Edit tour

Windows Analysis Report
REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

Overview

General Information

Sample name:	REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe
Analysis ID:	1640795
MD5:	38f235d25e264d4c15c7596bb02d74fb
SHA1:	1b61618f9b4a052f6141d001c121dab951400ccd
SHA256:	19298835e138f870193c12029158ec18ce6d1d4c5ec12372d533eaf855c0e7f0
Tags:	exeuser-threatcat_ch
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected Snake Keylogger

.NET source code contains potential unpacker

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Sample uses string decryption to hide its real strings

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe (PID: 6536 cmdline: "C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe" MD5: 38F235D25E264D4C15C7596BB02D74FB)

REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe (PID: 6812 cmdline: "C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe" MD5: 38F235D25E264D4C15C7596BB02D74FB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot8001882214:AAFYbuE3sctUsMptRg6i8B28zD_AOK7mrvg/sendMessage?chat_id=6090860697", "Token": "8001882214:AAFYbuE3sctUsMptRg6i8B28zD_AOK7mrvg", "Chat_id": "6090860697", "Version": "5.1"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.3497274920.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3497274920.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.3497274920.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1485f:$a1: get_encryptedPassword 0x14b4b:$a2: get_encryptedUsername 0x1466b:$a3: get_timePasswordChanged 0x14766:$a4: get_passwordField 0x14875:$a5: set_encryptedPassword 0x15ee6:$a7: get_logins 0x15e49:$a10: KeyLoggerEventArgs 0x15ab4:$a11: KeyLoggerEventArgsEventHandler
00000002.00000002.3497274920.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x198a4:$x1: $%SMTPDV$ 0x18288:$x2: $#TheHashHere%& 0x1984c:$x3: %FTPDV$ 0x18228:$x4: $%TelegramDv$ 0x15ab4:$x5: KeyLoggerEventArgs 0x15e49:$x5: KeyLoggerEventArgs 0x19870:$m2: Clipboard Logs ID 0x19aae:$m2: Screenshot Logs ID 0x19bbe:$m2: keystroke Logs ID 0x19e98:$m3: SnakePW 0x19a86:$m4: \SnakeKeylogger\
00000002.00000002.3499265424.00000000034FB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1042942598.0000000003BE9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1042942598.0000000003BE9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1042942598.0000000003BE9000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x82727:$a1: get_encryptedPassword 0xa3147:$a1: get_encryptedPassword 0xc3967:$a1: get_encryptedPassword 0x82a13:$a2: get_encryptedUsername 0xa3433:$a2: get_encryptedUsername 0xc3c53:$a2: get_encryptedUsername 0x82533:$a3: get_timePasswordChanged 0xa2f53:$a3: get_timePasswordChanged 0xc3773:$a3: get_timePasswordChanged 0x8262e:$a4: get_passwordField 0xa304e:$a4: get_passwordField 0xc386e:$a4: get_passwordField 0x8273d:$a5: set_encryptedPassword 0xa315d:$a5: set_encryptedPassword 0xc397d:$a5: set_encryptedPassword 0x83dae:$a7: get_logins 0xa47ce:$a7: get_logins 0xc4fee:$a7: get_logins 0x83d11:$a10: KeyLoggerEventArgs 0xa4731:$a10: KeyLoggerEventArgs 0xc4f51:$a10: KeyLoggerEventArgs
00000000.00000002.1042942598.0000000003BE9000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x8776c:$x1: $%SMTPDV$ 0xa818c:$x1: $%SMTPDV$ 0xc89ac:$x1: $%SMTPDV$ 0x86150:$x2: $#TheHashHere%& 0xa6b70:$x2: $#TheHashHere%& 0xc7390:$x2: $#TheHashHere%& 0x87714:$x3: %FTPDV$ 0xa8134:$x3: %FTPDV$ 0xc8954:$x3: %FTPDV$ 0x860f0:$x4: $%TelegramDv$ 0xa6b10:$x4: $%TelegramDv$ 0xc7330:$x4: $%TelegramDv$ 0x8397c:$x5: KeyLoggerEventArgs 0x83d11:$x5: KeyLoggerEventArgs 0xa439c:$x5: KeyLoggerEventArgs 0xa4731:$x5: KeyLoggerEventArgs 0xc4bbc:$x5: KeyLoggerEventArgs 0xc4f51:$x5: KeyLoggerEventArgs 0x87738:$m2: Clipboard Logs ID 0x87976:$m2: Screenshot Logs ID 0x87a86:$m2: keystroke Logs ID
00000002.00000002.3499265424.0000000003331000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe PID: 6536	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe PID: 6536	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe PID: 6536	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe PID: 6536	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x61485:$a1: get_encryptedPassword 0x61767:$a2: get_encryptedUsername 0x6129b:$a3: get_timePasswordChanged 0x61396:$a4: get_passwordField 0x6149b:$a5: set_encryptedPassword 0x63974:$a7: get_logins 0x638d7:$a10: KeyLoggerEventArgs 0x63542:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe PID: 6536	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x63542:$x5: KeyLoggerEventArgs 0x638d7:$x5: KeyLoggerEventArgs 0x641de:$x5: KeyLoggerEventArgs 0x6453f:$x5: KeyLoggerEventArgs 0x65b02:$m2: Clipboard Logs ID 0x65c08:$m2: Screenshot Logs ID 0x65c5e:$m2: keystroke Logs ID 0x65d93:$m3: SnakePW 0x65bf4:$m4: \SnakeKeylogger\
Process Memory Space: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe PID: 6812	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe PID: 6812	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe PID: 6812	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14984:$a1: get_encryptedPassword 0x14c66:$a2: get_encryptedUsername 0x1479a:$a3: get_timePasswordChanged 0x14895:$a4: get_passwordField 0x1499a:$a5: set_encryptedPassword 0x16e73:$a7: get_logins 0x16dd6:$a10: KeyLoggerEventArgs 0x16a41:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe PID: 6812	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x16a41:$x5: KeyLoggerEventArgs 0x16dd6:$x5: KeyLoggerEventArgs 0x176dd:$x5: KeyLoggerEventArgs 0x17a3e:$x5: KeyLoggerEventArgs 0x19001:$m2: Clipboard Logs ID 0x19107:$m2: Screenshot Logs ID 0x1915d:$m2: keystroke Logs ID 0x19292:$m3: SnakePW 0x190f3:$m4: \SnakeKeylogger\
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12c5f:$a1: get_encryptedPassword 0x12f4b:$a2: get_encryptedUsername 0x12a6b:$a3: get_timePasswordChanged 0x12b66:$a4: get_passwordField 0x12c75:$a5: set_encryptedPassword 0x142e6:$a7: get_logins 0x14249:$a10: KeyLoggerEventArgs 0x13eb4:$a11: KeyLoggerEventArgsEventHandler
0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a65a:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1988c:$a3: \Google\Chrome\User Data\Default\Login Data 0x19cbf:$a4: \Orbitum\User Data\Default\Login Data 0x1acfe:$a5: \Kometa\User Data\Default\Login Data
0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x13842:$s1: UnHook 0x13849:$s2: SetHook 0x13851:$s3: CallNextHook 0x1385e:$s4: _hook
0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17ca4:$x1: $%SMTPDV$ 0x16688:$x2: $#TheHashHere%& 0x17c4c:$x3: %FTPDV$ 0x16628:$x4: $%TelegramDv$ 0x13eb4:$x5: KeyLoggerEventArgs 0x14249:$x5: KeyLoggerEventArgs 0x17c70:$m2: Clipboard Logs ID 0x17eae:$m2: Screenshot Logs ID 0x17fbe:$m2: keystroke Logs ID 0x18298:$m3: SnakePW 0x17e86:$m4: \SnakeKeylogger\
2.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
2.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a5f:$a1: get_encryptedPassword 0x14d4b:$a2: get_encryptedUsername 0x1486b:$a3: get_timePasswordChanged 0x14966:$a4: get_passwordField 0x14a75:$a5: set_encryptedPassword 0x160e6:$a7: get_logins 0x16049:$a10: KeyLoggerEventArgs 0x15cb4:$a11: KeyLoggerEventArgsEventHandler
2.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c45a:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b68c:$a3: \Google\Chrome\User Data\Default\Login Data 0x1babf:$a4: \Orbitum\User Data\Default\Login Data 0x1cafe:$a5: \Kometa\User Data\Default\Login Data
2.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15642:$s1: UnHook 0x15649:$s2: SetHook 0x15651:$s3: CallNextHook 0x1565e:$s4: _hook
2.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.400000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19aa4:$x1: $%SMTPDV$ 0x18488:$x2: $#TheHashHere%& 0x19a4c:$x3: %FTPDV$ 0x18428:$x4: $%TelegramDv$ 0x15cb4:$x5: KeyLoggerEventArgs 0x16049:$x5: KeyLoggerEventArgs 0x19a70:$m2: Clipboard Logs ID 0x19cae:$m2: Screenshot Logs ID 0x19dbe:$m2: keystroke Logs ID 0x1a098:$m3: SnakePW 0x19c86:$m4: \SnakeKeylogger\
0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12c5f:$a1: get_encryptedPassword 0x12f4b:$a2: get_encryptedUsername 0x12a6b:$a3: get_timePasswordChanged 0x12b66:$a4: get_passwordField 0x12c75:$a5: set_encryptedPassword 0x142e6:$a7: get_logins 0x14249:$a10: KeyLoggerEventArgs 0x13eb4:$a11: KeyLoggerEventArgsEventHandler
0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a65a:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1988c:$a3: \Google\Chrome\User Data\Default\Login Data 0x19cbf:$a4: \Orbitum\User Data\Default\Login Data 0x1acfe:$a5: \Kometa\User Data\Default\Login Data
0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x13842:$s1: UnHook 0x13849:$s2: SetHook 0x13851:$s3: CallNextHook 0x1385e:$s4: _hook
0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17ca4:$x1: $%SMTPDV$ 0x16688:$x2: $#TheHashHere%& 0x17c4c:$x3: %FTPDV$ 0x16628:$x4: $%TelegramDv$ 0x13eb4:$x5: KeyLoggerEventArgs 0x14249:$x5: KeyLoggerEventArgs 0x17c70:$m2: Clipboard Logs ID 0x17eae:$m2: Screenshot Logs ID 0x17fbe:$m2: keystroke Logs ID 0x18298:$m3: SnakePW 0x17e86:$m4: \SnakeKeylogger\
0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a5f:$a1: get_encryptedPassword 0x3527f:$a1: get_encryptedPassword 0x14d4b:$a2: get_encryptedUsername 0x3556b:$a2: get_encryptedUsername 0x1486b:$a3: get_timePasswordChanged 0x3508b:$a3: get_timePasswordChanged 0x14966:$a4: get_passwordField 0x35186:$a4: get_passwordField 0x14a75:$a5: set_encryptedPassword 0x35295:$a5: set_encryptedPassword 0x160e6:$a7: get_logins 0x36906:$a7: get_logins 0x16049:$a10: KeyLoggerEventArgs 0x36869:$a10: KeyLoggerEventArgs 0x15cb4:$a11: KeyLoggerEventArgsEventHandler 0x364d4:$a11: KeyLoggerEventArgsEventHandler
0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15642:$s1: UnHook 0x35e62:$s1: UnHook 0x15649:$s2: SetHook 0x35e69:$s2: SetHook 0x15651:$s3: CallNextHook 0x35e71:$s3: CallNextHook 0x1565e:$s4: _hook 0x35e7e:$s4: _hook
0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19aa4:$x1: $%SMTPDV$ 0x3a2c4:$x1: $%SMTPDV$ 0x18488:$x2: $#TheHashHere%& 0x38ca8:$x2: $#TheHashHere%& 0x19a4c:$x3: %FTPDV$ 0x3a26c:$x3: %FTPDV$ 0x18428:$x4: $%TelegramDv$ 0x38c48:$x4: $%TelegramDv$ 0x15cb4:$x5: KeyLoggerEventArgs 0x16049:$x5: KeyLoggerEventArgs 0x364d4:$x5: KeyLoggerEventArgs 0x36869:$x5: KeyLoggerEventArgs 0x19a70:$m2: Clipboard Logs ID 0x19cae:$m2: Screenshot Logs ID 0x19dbe:$m2: keystroke Logs ID 0x3a290:$m2: Clipboard Logs ID 0x3a4ce:$m2: Screenshot Logs ID 0x3a5de:$m2: keystroke Logs ID 0x1a098:$m3: SnakePW 0x3a8b8:$m3: SnakePW 0x19c86:$m4: \SnakeKeylogger\
0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a5f:$a1: get_encryptedPassword 0x3547f:$a1: get_encryptedPassword 0x55c9f:$a1: get_encryptedPassword 0x14d4b:$a2: get_encryptedUsername 0x3576b:$a2: get_encryptedUsername 0x55f8b:$a2: get_encryptedUsername 0x1486b:$a3: get_timePasswordChanged 0x3528b:$a3: get_timePasswordChanged 0x55aab:$a3: get_timePasswordChanged 0x14966:$a4: get_passwordField 0x35386:$a4: get_passwordField 0x55ba6:$a4: get_passwordField 0x14a75:$a5: set_encryptedPassword 0x35495:$a5: set_encryptedPassword 0x55cb5:$a5: set_encryptedPassword 0x160e6:$a7: get_logins 0x36b06:$a7: get_logins 0x57326:$a7: get_logins 0x16049:$a10: KeyLoggerEventArgs 0x36a69:$a10: KeyLoggerEventArgs 0x57289:$a10: KeyLoggerEventArgs
0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15642:$s1: UnHook 0x36062:$s1: UnHook 0x56882:$s1: UnHook 0x15649:$s2: SetHook 0x36069:$s2: SetHook 0x56889:$s2: SetHook 0x15651:$s3: CallNextHook 0x36071:$s3: CallNextHook 0x56891:$s3: CallNextHook 0x1565e:$s4: _hook 0x3607e:$s4: _hook 0x5689e:$s4: _hook
0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19aa4:$x1: $%SMTPDV$ 0x3a4c4:$x1: $%SMTPDV$ 0x5ace4:$x1: $%SMTPDV$ 0x18488:$x2: $#TheHashHere%& 0x38ea8:$x2: $#TheHashHere%& 0x596c8:$x2: $#TheHashHere%& 0x19a4c:$x3: %FTPDV$ 0x3a46c:$x3: %FTPDV$ 0x5ac8c:$x3: %FTPDV$ 0x18428:$x4: $%TelegramDv$ 0x38e48:$x4: $%TelegramDv$ 0x59668:$x4: $%TelegramDv$ 0x15cb4:$x5: KeyLoggerEventArgs 0x16049:$x5: KeyLoggerEventArgs 0x366d4:$x5: KeyLoggerEventArgs 0x36a69:$x5: KeyLoggerEventArgs 0x56ef4:$x5: KeyLoggerEventArgs 0x57289:$x5: KeyLoggerEventArgs 0x19a70:$m2: Clipboard Logs ID 0x19cae:$m2: Screenshot Logs ID 0x19dbe:$m2: keystroke Logs ID
Click to see the 23 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-17T18:31:14.161259+0100	2803305	3	Unknown Traffic	192.168.2.10	49683	104.21.48.1	443	TCP
2025-03-17T18:31:22.918075+0100	2803305	3	Unknown Traffic	192.168.2.10	49693	104.21.48.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-17T18:31:12.625523+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49681	132.226.8.169	80	TCP
2025-03-17T18:31:13.609884+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49681	132.226.8.169	80	TCP
2025-03-17T18:31:15.000544+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49684	132.226.8.169	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000002.00000002.3497274920.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot8001882214:AAFYbuE3sctUsMptRg6i8B28zD_AOK7mrvg/sendMessage?chat_id=6090860697", "Token": "8001882214:AAFYbuE3sctUsMptRg6i8B28zD_AOK7mrvg", "Chat_id": "6090860697", "Version": "5.1"}

Multi AV Scanner detection for submitted file

Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Virustotal: Detection: 42%			Perma Link
Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	ReversingLabs: Detection: 58%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 2.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.400000.0.unpack	String decryptor:
Source: 2.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.400000.0.unpack	String decryptor: 8001882214:AAFYbuE3sctUsMptRg6i8B28zD_AOK7mrvg
Source: 2.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.400000.0.unpack	String decryptor: 6090860697

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.10:49682 version: TLS 1.0

Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: STRy.pdb source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe
Source:	Binary string: STRy.pdbSHA256 source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 4x nop then jmp 0167F1F6h	2_2_0167F007
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 4x nop then jmp 0167FB80h	2_2_0167F007
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_0167E528
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 4x nop then jmp 06EF8945h	2_2_06EF8608
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 4x nop then jmp 06EF65C9h	2_2_06EF6320
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_06EF36CE
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 4x nop then jmp 06EF6171h	2_2_06EF5EC8
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 4x nop then jmp 06EF58C1h	2_2_06EF5618
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 4x nop then jmp 06EF6A21h	2_2_06EF6778
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 4x nop then jmp 06EF7751h	2_2_06EF74A8
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 4x nop then jmp 06EF0741h	2_2_06EF0498
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 4x nop then jmp 06EF0FF1h	2_2_06EF0D48
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 4x nop then jmp 06EF8001h	2_2_06EF7D58
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 4x nop then jmp 06EF5D19h	2_2_06EF5A70
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 4x nop then jmp 06EF6E79h	2_2_06EF6BD0
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_06EF33A8
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_06EF33B8
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 4x nop then jmp 06EF0B99h	2_2_06EF08F0
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 4x nop then jmp 06EF02E9h	2_2_06EF0040
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 4x nop then jmp 06EF72FAh	2_2_06EF7050
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 4x nop then jmp 06EF8459h	2_2_06EF81B0
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 4x nop then jmp 06EF5441h	2_2_06EF5198
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 4x nop then jmp 06EF7BA9h	2_2_06EF7900

Source: global traffic

TCP traffic: 192.168.2.10:63182 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.10:49684 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.10:49681 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49683 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49693 -> 104.21.48.1:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.10:49682 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa

Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.0000000003487000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000034A3000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.0000000003495000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000033F4000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000034ED000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000034DE000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000034B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000034BF000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.0000000003487000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000034A3000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.0000000003495000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.0000000003437000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000033F4000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000034ED000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.0000000003331000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000034DE000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000034B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.0000000003331000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000000.00000002.1042942598.0000000003BE9000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3497274920.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.0000000003487000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000034A3000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.0000000003495000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000034ED000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000034DE000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000034B1000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.000000000340D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.0000000003331000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.0000000003487000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000034A3000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.0000000003495000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.0000000003437000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000033F4000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000034ED000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000034DE000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000034B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000000.00000002.1042942598.0000000003BE9000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3497274920.0000000000402000.00000040.00000400.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000033F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000034B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.0000000003487000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000034A3000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.0000000003495000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.0000000003437000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000034ED000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000034DE000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000034B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49689
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49682
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 2.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000002.00000002.3497274920.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000002.00000002.3497274920.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.1042942598.0000000003BE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1042942598.0000000003BE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe PID: 6536, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe PID: 6536, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe PID: 6812, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe PID: 6812, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 0_2_00EB3E40	0_2_00EB3E40
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 0_2_00EB6F92	0_2_00EB6F92
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 0_2_00EBD87C	0_2_00EBD87C
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 0_2_074D9550	0_2_074D9550
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 0_2_074D5078	0_2_074D5078
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 0_2_074D2FA8	0_2_074D2FA8
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 0_2_074D4C40	0_2_074D4C40
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 0_2_074DAC70	0_2_074DAC70
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 0_2_074D4C31	0_2_074D4C31
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 0_2_074D5A18	0_2_074D5A18
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 0_2_074D5A28	0_2_074D5A28
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 0_2_074D4808	0_2_074D4808
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_01676108	2_2_01676108
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_0167C190	2_2_0167C190
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_0167F007	2_2_0167F007
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_0167C473	2_2_0167C473
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_0167B4F7	2_2_0167B4F7
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_0167C752	2_2_0167C752
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_01676730	2_2_01676730
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_01679858	2_2_01679858
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_0167BBD2	2_2_0167BBD2
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_0167CA32	2_2_0167CA32
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_01674AD9	2_2_01674AD9
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_0167BEB3	2_2_0167BEB3
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_0167E528	2_2_0167E528
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_0167E517	2_2_0167E517
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EFB6E8	2_2_06EFB6E8
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EFD670	2_2_06EFD670
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF8608	2_2_06EF8608
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF8C51	2_2_06EF8C51
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EFA408	2_2_06EFA408
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EFBD38	2_2_06EFBD38
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EFAA58	2_2_06EFAA58
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EFC388	2_2_06EFC388
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF6320	2_2_06EF6320
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EFB0A0	2_2_06EFB0A0
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EFD028	2_2_06EFD028
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EFC9D8	2_2_06EFC9D8
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF11A0	2_2_06EF11A0
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF5EC8	2_2_06EF5EC8
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EFB6D9	2_2_06EFB6D9
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF5EB8	2_2_06EF5EB8
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EFD661	2_2_06EFD661
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF5609	2_2_06EF5609
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF5618	2_2_06EF5618
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF676B	2_2_06EF676B
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF6778	2_2_06EF6778
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF3730	2_2_06EF3730
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF74A8	2_2_06EF74A8
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF0488	2_2_06EF0488
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF0498	2_2_06EF0498
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF7497	2_2_06EF7497
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF4430	2_2_06EF4430
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF85FC	2_2_06EF85FC
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF0D48	2_2_06EF0D48
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF7D48	2_2_06EF7D48
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF7D58	2_2_06EF7D58
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EFBD28	2_2_06EFBD28
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF0D39	2_2_06EF0D39
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF5A60	2_2_06EF5A60
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF5A70	2_2_06EF5A70
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EFAA48	2_2_06EFAA48
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EFA3F8	2_2_06EFA3F8
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF6BC1	2_2_06EF6BC1
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF6BD0	2_2_06EF6BD0
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF33A8	2_2_06EF33A8
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF33B8	2_2_06EF33B8
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EFC378	2_2_06EFC378
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF6311	2_2_06EF6311
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF08E0	2_2_06EF08E0
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF08F0	2_2_06EF08F0
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF78F0	2_2_06EF78F0
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EFB090	2_2_06EFB090
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF0040	2_2_06EF0040
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF7040	2_2_06EF7040
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF7050	2_2_06EF7050
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF2807	2_2_06EF2807
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF0006	2_2_06EF0006
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF2818	2_2_06EF2818
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EFD018	2_2_06EFD018
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EFC9C8	2_2_06EFC9C8
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF81A0	2_2_06EF81A0
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF81B0	2_2_06EF81B0
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF518B	2_2_06EF518B
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF5198	2_2_06EF5198
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF1191	2_2_06EF1191
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 2_2_06EF7900	2_2_06EF7900

Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000000.00000002.1041996028.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe
Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000000.00000002.1045917582.0000000008FE0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTL.dll" vs REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe
Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000000.00000002.1041996028.0000000002BF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTL.dll" vs REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe
Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000000.00000002.1041996028.0000000002CE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTL.dll" vs REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe
Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000000.00000002.1042942598.0000000003BE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe
Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000000.00000002.1042942598.0000000003BE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe
Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000000.00000002.1041400084.00000000010FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe
Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000000.00000002.1045566433.0000000007440000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe
Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000000.00000000.1030191777.000000000089E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSTRy.exe> vs REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe
Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3497274920.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe
Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3497477158.00000000012F7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe
Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Binary or memory string: OriginalFilenameSTRy.exe> vs REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 2.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000002.00000002.3497274920.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000002.00000002.3497274920.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.1042942598.0000000003BE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1042942598.0000000003BE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe PID: 6536, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe PID: 6536, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe PID: 6812, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe PID: 6812, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.raw.unpack, .cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.raw.unpack, .cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.raw.unpack, .cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.raw.unpack, .cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, WK8t8iecWiTpGCIL5F.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, WK8t8iecWiTpGCIL5F.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, O8qvj20SamKbffkoW1.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, O8qvj20SamKbffkoW1.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, O8qvj20SamKbffkoW1.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, O8qvj20SamKbffkoW1.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, O8qvj20SamKbffkoW1.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, O8qvj20SamKbffkoW1.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, WK8t8iecWiTpGCIL5F.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, WK8t8iecWiTpGCIL5F.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@3/2

Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

Mutant created: NULL

Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.0000000003577000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.0000000003585000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.0000000003567000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000035AD000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3500733126.00000000043BB000.00000004.00000800.00020000.00000000.sdmp, REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3499265424.00000000035B9000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Virustotal: Detection: 42%
Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	ReversingLabs: Detection: 58%

Source: unknown	Process created: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe "C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe"
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process created: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe "C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe"
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process created: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe "C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe"	Jump to behavior

Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: STRy.pdb source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe
Source:	Binary string: STRy.pdbSHA256 source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, O8qvj20SamKbffkoW1.cs	.Net Code: u3FCNX2qOf System.Reflection.Assembly.Load(byte[])
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, O8qvj20SamKbffkoW1.cs	.Net Code: u3FCNX2qOf System.Reflection.Assembly.Load(byte[])

Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

Static PE information: 0xC8463929 [Mon Jun 22 09:55:53 2076 UTC]

Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 0_2_00EBEE80 pushfd ; iretd	0_2_00EBEE81
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 0_2_074D6CAF push eax; iretd	0_2_074D6CB0
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Code function: 0_2_074D6A2D push eax; iretd	0_2_074D6A2E

Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

Static PE information: section name: .text entropy: 7.677667064692474

Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, S8laZe75M6pbhbTc5V.cs	High entropy of concatenated method names: 'W3DNOVwLb', 'ufwkHygXx', 'DhMOmxYvq', 'LAE4AM7FN', 'FtWInm39M', 'lwLl1KmV4', 'Ck8woAC8aHYZxU9LH1', 'Hh6phbryTkwML6L0Tc', 'b6JTUhTWn', 'QYbyxOshr'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, WK8t8iecWiTpGCIL5F.cs	High entropy of concatenated method names: 'zrfr1e3gcl', 'EEcriP3Paq', 'QA0rtj5D1V', 'KjrrnNcDcH', 'trOrK8Iwml', 'hAxrp2pfM0', 'USGr8EOWKw', 'GSfrsDRYGO', 'zO1rLCk9US', 'yDkrafRvw7'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, EDyCjepJdEqkXORlXe.cs	High entropy of concatenated method names: 'KZBVsLVHPB', 'Ks3VabKFvj', 'tk9Tq5XAfo', 'b21TjDTfHN', 'lYIVuxBsqf', 'NbkVECipCT', 'yTrVwXeqm7', 'JUmV19flvl', 'T55Vixl88P', 'FxHVtaOiNc'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, Hsb4rQac10rJV6LpXK.cs	High entropy of concatenated method names: 'AFOy38yiBC', 'HeKyvqiwGQ', 'WIiy9fNLJq', 'qXHyJd8BU9', 'vrLyYcZm7j', 'wS1y0gL6VF', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, i0W9csICRh0gyWZVmb.cs	High entropy of concatenated method names: 'a6c3kjt58F', 'QKA3O3xlm4', 'SuF3eL4llm', 'VGs3I4VRKY', 'vmL3fPvioo', 'eti3heW3FZ', 'aoa3V5tYcW', 'JK43TsqOhA', 'dsA3YG1UUq', 'Yfr3y2ei9x'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, yiBCZKjjZZNwwaXTTsg.cs	High entropy of concatenated method names: 'o65yasK5nG', 'jtdyz3TIHj', 'euhZqk6yII', 'QiIZjKIWCu', 'tkPZ7ABFIT', 'EnGZGR7Yht', 'xKWZCQxvJr', 'BZUZ2JvSI7', 'XmsZ5edW06', 'CltZrZGypn'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, G0xQalCNJfWMwpGsLh.cs	High entropy of concatenated method names: 'B7sjJK8t8i', 'BWij0TpGCI', 'WCRjmh0gyW', 'tVmjXbATdF', 'EeJjffnbjW', 'nJSjhJT4XV', 'x92PN7qUlVmY8hWdtU', 'XqZL3vdBKL6nh7u9Wf', 'NHEjjuyiO8', 'M4bjGWF500'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, O8qvj20SamKbffkoW1.cs	High entropy of concatenated method names: 'OTLG2sVkMu', 'QsOG5VUtI1', 'JlfGrdeJVR', 'EqlG3byG2E', 'ygWGvvhZGK', 'sU7G9bI9wZ', 'totGJ5Wq61', 'hrBG0SKRmR', 'bYpGB177B4', 'Y1NGmWB3va'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, GG6TqDFhSwsFVH2XSy.cs	High entropy of concatenated method names: 'OTNJ6MOFdr', 'mmTJHFWSXA', 'NrsJN5VPpi', 'lkuJkIjuag', 'S6PJcMKQKY', 'EQEJO8UVYc', 'O87J4mBCje', 'YouJewoGvp', 'xZ7JIui5a8', 'iAQJlfyBv8'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, py5Fy5rM4rve1Vmswf.cs	High entropy of concatenated method names: 'Dispose', 'JD0jLPuJuq', 'sRf7Pd5bEm', 'p5VHepTaxO', 'Kg0jakpfFT', 'X2AjzSAqkH', 'ProcessDialogKey', 'hBe7qhRlEH', 'js97jArXUg', 'txn77Psb4r'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, IjWQJSRJT4XVYUBJcp.cs	High entropy of concatenated method names: 'uRu92pdLlC', 'Fe19rR66eq', 'ayj9v1rUe6', 'Bxa9JaCwiW', 'YAo90GCHKm', 'TaEvKYH8hR', 'gE5vpC8Tv1', 'YGkv8aEO1s', 'QQ7vs5I1wR', 'FsIvLdr6TB'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, aucDfujqZrFMRMH5EOk.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'tvDyuGi0X0', 'nwyyETh3eb', 'fclywfmHKq', 'QeEy15siZ3', 'l7ZyivcKEg', 'soeyt1EIRr', 'bnrynx1I64'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, sgP6LojCcj8eGv1dsoY.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'smcSYHc2U4', 'HeRSyyM3uj', 'Yd2SZlWHwT', 'rv6SS9B7fE', 'RaBSAJsKG0', 'BRZSdZYmxm', 'uwPSW8AsXS'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, vTdF79laQh5v2IeJfn.cs	High entropy of concatenated method names: 'EttvceHnTX', 'Dxfv4T8Lld', 'K2Z3D5Lkx5', 'NSd3baFhHd', 'VuA3gKSaf7', 'bUb3ojk86r', 'p4D3xlVFAu', 'nCH3UO1TJ1', 'rhb3F5ItsK', 'hdY3MEl7rP'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, HmPFQdnfOnDbtKtfJu.cs	High entropy of concatenated method names: 'ilbVm4xNtU', 'lH9VX7Y1In', 'ToString', 'd8gV5sMsN5', 'oYjVrNm1AW', 'vhNV3ShYZ3', 'z6eVvPQj2q', 'OjPV98ReBe', 'Y7IVJYL4Ww', 'eBgV0jde34'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, DhRlEHL9s9ArXUgZxn.cs	High entropy of concatenated method names: 'jJaYRxNtZW', 'kojYPCrtQB', 'sheYDeoCQF', 'YUbYbAT1pt', 'cQOYgpY0p9', 'PPoYoLFVp7', 'lfxYxAYqOu', 'grJYU40t59', 'xH2YFhwPmB', 'B5CYMBYrhv'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, fEGAZQ8WogD0PuJuqo.cs	High entropy of concatenated method names: 'Mb3Yf4tJe5', 'BrCYVETU8O', 'ytQYYGhtY8', 'VN0YZ4rif7', 'DZCYAFwUSA', 'u8FYWbMcxb', 'Dispose', 'PnXT5Cla2f', 'Q2ETridlwO', 'ViBT3hno1H'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, dVbFYTwJMEauvmsqo7.cs	High entropy of concatenated method names: 'qXpQefq1jN', 'KHpQIiD5dY', 'YL3QRaa9o5', 'yQSQPXxBPc', 'LOhQbAJUNt', 'pxuQgM4jw5', 'swIQxY3oJN', 'S1PQUnIPoF', 'GcfQMAtQhB', 'DfbQuV1pka'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, TdeGQKPCEdmRV8JXTl.cs	High entropy of concatenated method names: 'g2xIdfvotwhEZehBNKG', 'Syjn3SvJHtcY4J6Yq7P', 'HXkA6xv3SDjcsichTL6', 'aaq9TogYZc', 'XQn9Y0JSqA', 'iLk9yG0Lu7', 'g3TrsHvpau2oVxV8ai9', 'OF4MGZvaNyngvtkcgrP'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, VXC2JLtetPnvrru80l.cs	High entropy of concatenated method names: 'ToString', 'E60hutwY48', 'nN9hPiuFRy', 'mpUhD4VsUN', 'C3OhbYVMdD', 'BUghgC4Wq5', 'SeAhoEIdob', 'TmehxsCL2K', 'zd7hUnIh7k', 'B2hhFLOdLm'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, wgEB4lxsF7s4gpcyoP.cs	High entropy of concatenated method names: 'ettJ57oSkt', 'ihLJ3dXEjr', 'Yh0J9S8Nk4', 'KqG9aTKBOt', 'Srj9z5IOX6', 'qe1JqasQCu', 'GA5JjIdBXm', 'QlWJ7CVsVi', 'evaJGEhcIw', 'dXrJCHakBE'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, toPHuNbNJiEJtj3TqB.cs	High entropy of concatenated method names: 'FWr9WBJTtj', 'fGc96pp43x', 'ROI9NeA9Km', 'cVL9kSv45e', 'AoV9OgvxHl', 'Mip94bBQYH', 'Hgk9Ig7GJj', 'bF79lSE0mN', 'qp0lUsv6eEIZUDDVpt5', 'u5KlMpvyIYDw3PFTJ8x'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, dyMFK21g9rMBGWRYlD.cs	High entropy of concatenated method names: 'cytfMtll10', 'SsRfEneMUd', 'OrPf1ChCBs', 'V4jfimOTDu', 'IP6fPLZpr0', 'gWwfD7sOQ6', 'mkZfbU5n8s', 'DPEfgqr0MR', 'FicfobO9bB', 'uSLfxQIX40'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.7440000.4.raw.unpack, lkMS59z7idQugP9T7e.cs	High entropy of concatenated method names: 'howyOU68IB', 'FWLyeCrKY1', 'rKsyIU8Rv9', 'fO0yR12guG', 'QeDyPXdb24', 'fDxybJlOil', 'q8UygF9jX3', 'NLeyWRV7KL', 'zjJy6YHwJ9', 'lZRyHHykxj'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, S8laZe75M6pbhbTc5V.cs	High entropy of concatenated method names: 'W3DNOVwLb', 'ufwkHygXx', 'DhMOmxYvq', 'LAE4AM7FN', 'FtWInm39M', 'lwLl1KmV4', 'Ck8woAC8aHYZxU9LH1', 'Hh6phbryTkwML6L0Tc', 'b6JTUhTWn', 'QYbyxOshr'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, WK8t8iecWiTpGCIL5F.cs	High entropy of concatenated method names: 'zrfr1e3gcl', 'EEcriP3Paq', 'QA0rtj5D1V', 'KjrrnNcDcH', 'trOrK8Iwml', 'hAxrp2pfM0', 'USGr8EOWKw', 'GSfrsDRYGO', 'zO1rLCk9US', 'yDkrafRvw7'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, EDyCjepJdEqkXORlXe.cs	High entropy of concatenated method names: 'KZBVsLVHPB', 'Ks3VabKFvj', 'tk9Tq5XAfo', 'b21TjDTfHN', 'lYIVuxBsqf', 'NbkVECipCT', 'yTrVwXeqm7', 'JUmV19flvl', 'T55Vixl88P', 'FxHVtaOiNc'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, Hsb4rQac10rJV6LpXK.cs	High entropy of concatenated method names: 'AFOy38yiBC', 'HeKyvqiwGQ', 'WIiy9fNLJq', 'qXHyJd8BU9', 'vrLyYcZm7j', 'wS1y0gL6VF', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, i0W9csICRh0gyWZVmb.cs	High entropy of concatenated method names: 'a6c3kjt58F', 'QKA3O3xlm4', 'SuF3eL4llm', 'VGs3I4VRKY', 'vmL3fPvioo', 'eti3heW3FZ', 'aoa3V5tYcW', 'JK43TsqOhA', 'dsA3YG1UUq', 'Yfr3y2ei9x'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, yiBCZKjjZZNwwaXTTsg.cs	High entropy of concatenated method names: 'o65yasK5nG', 'jtdyz3TIHj', 'euhZqk6yII', 'QiIZjKIWCu', 'tkPZ7ABFIT', 'EnGZGR7Yht', 'xKWZCQxvJr', 'BZUZ2JvSI7', 'XmsZ5edW06', 'CltZrZGypn'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, G0xQalCNJfWMwpGsLh.cs	High entropy of concatenated method names: 'B7sjJK8t8i', 'BWij0TpGCI', 'WCRjmh0gyW', 'tVmjXbATdF', 'EeJjffnbjW', 'nJSjhJT4XV', 'x92PN7qUlVmY8hWdtU', 'XqZL3vdBKL6nh7u9Wf', 'NHEjjuyiO8', 'M4bjGWF500'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, O8qvj20SamKbffkoW1.cs	High entropy of concatenated method names: 'OTLG2sVkMu', 'QsOG5VUtI1', 'JlfGrdeJVR', 'EqlG3byG2E', 'ygWGvvhZGK', 'sU7G9bI9wZ', 'totGJ5Wq61', 'hrBG0SKRmR', 'bYpGB177B4', 'Y1NGmWB3va'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, GG6TqDFhSwsFVH2XSy.cs	High entropy of concatenated method names: 'OTNJ6MOFdr', 'mmTJHFWSXA', 'NrsJN5VPpi', 'lkuJkIjuag', 'S6PJcMKQKY', 'EQEJO8UVYc', 'O87J4mBCje', 'YouJewoGvp', 'xZ7JIui5a8', 'iAQJlfyBv8'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, py5Fy5rM4rve1Vmswf.cs	High entropy of concatenated method names: 'Dispose', 'JD0jLPuJuq', 'sRf7Pd5bEm', 'p5VHepTaxO', 'Kg0jakpfFT', 'X2AjzSAqkH', 'ProcessDialogKey', 'hBe7qhRlEH', 'js97jArXUg', 'txn77Psb4r'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, IjWQJSRJT4XVYUBJcp.cs	High entropy of concatenated method names: 'uRu92pdLlC', 'Fe19rR66eq', 'ayj9v1rUe6', 'Bxa9JaCwiW', 'YAo90GCHKm', 'TaEvKYH8hR', 'gE5vpC8Tv1', 'YGkv8aEO1s', 'QQ7vs5I1wR', 'FsIvLdr6TB'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, aucDfujqZrFMRMH5EOk.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'tvDyuGi0X0', 'nwyyETh3eb', 'fclywfmHKq', 'QeEy15siZ3', 'l7ZyivcKEg', 'soeyt1EIRr', 'bnrynx1I64'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, sgP6LojCcj8eGv1dsoY.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'smcSYHc2U4', 'HeRSyyM3uj', 'Yd2SZlWHwT', 'rv6SS9B7fE', 'RaBSAJsKG0', 'BRZSdZYmxm', 'uwPSW8AsXS'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, vTdF79laQh5v2IeJfn.cs	High entropy of concatenated method names: 'EttvceHnTX', 'Dxfv4T8Lld', 'K2Z3D5Lkx5', 'NSd3baFhHd', 'VuA3gKSaf7', 'bUb3ojk86r', 'p4D3xlVFAu', 'nCH3UO1TJ1', 'rhb3F5ItsK', 'hdY3MEl7rP'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, HmPFQdnfOnDbtKtfJu.cs	High entropy of concatenated method names: 'ilbVm4xNtU', 'lH9VX7Y1In', 'ToString', 'd8gV5sMsN5', 'oYjVrNm1AW', 'vhNV3ShYZ3', 'z6eVvPQj2q', 'OjPV98ReBe', 'Y7IVJYL4Ww', 'eBgV0jde34'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, DhRlEHL9s9ArXUgZxn.cs	High entropy of concatenated method names: 'jJaYRxNtZW', 'kojYPCrtQB', 'sheYDeoCQF', 'YUbYbAT1pt', 'cQOYgpY0p9', 'PPoYoLFVp7', 'lfxYxAYqOu', 'grJYU40t59', 'xH2YFhwPmB', 'B5CYMBYrhv'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, fEGAZQ8WogD0PuJuqo.cs	High entropy of concatenated method names: 'Mb3Yf4tJe5', 'BrCYVETU8O', 'ytQYYGhtY8', 'VN0YZ4rif7', 'DZCYAFwUSA', 'u8FYWbMcxb', 'Dispose', 'PnXT5Cla2f', 'Q2ETridlwO', 'ViBT3hno1H'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, dVbFYTwJMEauvmsqo7.cs	High entropy of concatenated method names: 'qXpQefq1jN', 'KHpQIiD5dY', 'YL3QRaa9o5', 'yQSQPXxBPc', 'LOhQbAJUNt', 'pxuQgM4jw5', 'swIQxY3oJN', 'S1PQUnIPoF', 'GcfQMAtQhB', 'DfbQuV1pka'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, TdeGQKPCEdmRV8JXTl.cs	High entropy of concatenated method names: 'g2xIdfvotwhEZehBNKG', 'Syjn3SvJHtcY4J6Yq7P', 'HXkA6xv3SDjcsichTL6', 'aaq9TogYZc', 'XQn9Y0JSqA', 'iLk9yG0Lu7', 'g3TrsHvpau2oVxV8ai9', 'OF4MGZvaNyngvtkcgrP'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, VXC2JLtetPnvrru80l.cs	High entropy of concatenated method names: 'ToString', 'E60hutwY48', 'nN9hPiuFRy', 'mpUhD4VsUN', 'C3OhbYVMdD', 'BUghgC4Wq5', 'SeAhoEIdob', 'TmehxsCL2K', 'zd7hUnIh7k', 'B2hhFLOdLm'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, wgEB4lxsF7s4gpcyoP.cs	High entropy of concatenated method names: 'ettJ57oSkt', 'ihLJ3dXEjr', 'Yh0J9S8Nk4', 'KqG9aTKBOt', 'Srj9z5IOX6', 'qe1JqasQCu', 'GA5JjIdBXm', 'QlWJ7CVsVi', 'evaJGEhcIw', 'dXrJCHakBE'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, toPHuNbNJiEJtj3TqB.cs	High entropy of concatenated method names: 'FWr9WBJTtj', 'fGc96pp43x', 'ROI9NeA9Km', 'cVL9kSv45e', 'AoV9OgvxHl', 'Mip94bBQYH', 'Hgk9Ig7GJj', 'bF79lSE0mN', 'qp0lUsv6eEIZUDDVpt5', 'u5KlMpvyIYDw3PFTJ8x'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, dyMFK21g9rMBGWRYlD.cs	High entropy of concatenated method names: 'cytfMtll10', 'SsRfEneMUd', 'OrPf1ChCBs', 'V4jfimOTDu', 'IP6fPLZpr0', 'gWwfD7sOQ6', 'mkZfbU5n8s', 'DPEfgqr0MR', 'FicfobO9bB', 'uSLfxQIX40'
Source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3d8e270.2.raw.unpack, lkMS59z7idQugP9T7e.cs	High entropy of concatenated method names: 'howyOU68IB', 'FWLyeCrKY1', 'rKsyIU8Rv9', 'fO0yR12guG', 'QeDyPXdb24', 'fDxybJlOil', 'q8UygF9jX3', 'NLeyWRV7KL', 'zjJy6YHwJ9', 'lZRyHHykxj'

Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe PID: 6536, type: MEMORYSTR

Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Memory allocated: EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Memory allocated: 2BE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Memory allocated: 4BE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Memory allocated: 9040000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Memory allocated: A040000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Memory allocated: A250000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Memory allocated: B250000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Memory allocated: 1670000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Memory allocated: 3330000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Memory allocated: 3150000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 599516	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 599406	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 599187	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 598859	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 598750	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 598641	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 598516	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 598391	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 598281	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 598172	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 598062	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 597953	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 597844	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 597734	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 597625	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 597516	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 597391	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 597266	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 596938	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 596688	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 596425	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 595844	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 595716	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 595608	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 595487	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 595339	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 595109	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 594858	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 594666	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 594563	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 594438	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 594313	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 594203	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 594094	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 593969	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 593859	Jump to behavior

Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Window / User API: threadDelayed 2534			Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Window / User API: threadDelayed 7309			Jump to behavior

Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 6528	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 6632	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7064	Thread sleep count: 2534 > 30	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7064	Thread sleep count: 7309 > 30	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -599641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -599516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -599406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -599297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -599187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -599078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -598969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -598859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -598750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -598641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -598516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -598391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -598281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -598172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -598062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -597953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -597844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -597734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -597625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -597516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -597391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -597266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -597156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -597047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -596938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -596813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -596688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -596578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -596425s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -596297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -596187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -596078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -595969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -595844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -595716s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -595608s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -595487s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -595339s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -595109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -594858s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -594666s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -594563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -594438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -594313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -594203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -594094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -593969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe TID: 7068	Thread sleep time: -593859s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 599516	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 599406	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 599187	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 598859	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 598750	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 598641	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 598516	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 598391	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 598281	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 598172	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 598062	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 597953	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 597844	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 597734	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 597625	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 597516	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 597391	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 597266	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 596938	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 596688	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 596425	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 595844	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 595716	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 595608	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 595487	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 595339	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 595109	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 594858	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 594666	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 594563	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 594438	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 594313	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 594203	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 594094	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 593969	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Thread delayed: delay time: 593859	Jump to behavior

Source: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe, 00000002.00000002.3498379562.00000000016EF000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllR

Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

Memory written: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

Process created: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe "C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe"

Jump to behavior

Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Queries volume information: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Queries volume information: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3497274920.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3499265424.00000000034FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1042942598.0000000003BE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3499265424.0000000003331000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe PID: 6536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe PID: 6812, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3497274920.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1042942598.0000000003BE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe PID: 6536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe PID: 6812, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c776e8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe.3c56cc8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3497274920.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3499265424.00000000034FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1042942598.0000000003BE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3499265424.0000000003331000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe PID: 6536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe PID: 6812, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.exe