Edit tour

Windows Analysis Report
Statement of Account PDF.bat.exe

Overview

General Information

Sample name:	Statement of Account PDF.bat.exe
Analysis ID:	1432040
MD5:	8db4915ba4e6bb27cb249554a18a9f4c
SHA1:	fd3e06212f9da365c2106dcd808caf291ccb3a2a
SHA256:	470e7bcb766a436b50d28e362621b59467b6e6aa4146b467f4175a8b5c9eaa04
Tags:	AgentTeslabatexeShipping
Infos:

Detection

AgentTesla, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Statement of Account PDF.bat.exe (PID: 6984 cmdline: "C:\Users\user\Desktop\Statement of Account PDF.bat.exe" MD5: 8DB4915BA4E6BB27CB249554A18A9F4C)

powershell.exe (PID: 7156 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Statement of Account PDF.bat.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3120 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gDdsxauPhk.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7532 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 7080 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp690.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Statement of Account PDF.bat.exe (PID: 7252 cmdline: "C:\Users\user\Desktop\Statement of Account PDF.bat.exe" MD5: 8DB4915BA4E6BB27CB249554A18A9F4C)

gDdsxauPhk.exe (PID: 7440 cmdline: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe MD5: 8DB4915BA4E6BB27CB249554A18A9F4C)

schtasks.exe (PID: 7668 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp216B.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

gDdsxauPhk.exe (PID: 7712 cmdline: "C:\Users\user\AppData\Roaming\gDdsxauPhk.exe" MD5: 8DB4915BA4E6BB27CB249554A18A9F4C)

gDdsxauPhk.exe (PID: 7720 cmdline: "C:\Users\user\AppData\Roaming\gDdsxauPhk.exe" MD5: 8DB4915BA4E6BB27CB249554A18A9F4C)

WerFault.exe (PID: 7796 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 1816 MD5: C31336C1EFC2CCB44B4326EA793040F2)

BjTxJte.exe (PID: 8032 cmdline: "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe" MD5: 8DB4915BA4E6BB27CB249554A18A9F4C)

schtasks.exe (PID: 7096 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp44D2.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

BjTxJte.exe (PID: 7220 cmdline: "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe" MD5: 8DB4915BA4E6BB27CB249554A18A9F4C)

WerFault.exe (PID: 7192 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 8032 -s 1828 MD5: C31336C1EFC2CCB44B4326EA793040F2)

BjTxJte.exe (PID: 7400 cmdline: "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe" MD5: 8DB4915BA4E6BB27CB249554A18A9F4C)

schtasks.exe (PID: 7708 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp6598.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

BjTxJte.exe (PID: 7752 cmdline: "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe" MD5: 8DB4915BA4E6BB27CB249554A18A9F4C)

WerFault.exe (PID: 7936 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7400 -s 1788 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.fascia-arch.com", "Username": "brian@fascia-arch.com", "Password": "HERbertstown1987"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000001E.00000002.4081952252.000000000294B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000002.4081952252.000000000294B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.4080192144.0000000003081000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.4080192144.0000000003081000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.4080192144.00000000030D3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000016.00000002.1916411729.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000002.1916411729.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1700653245.0000000003949000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000012.00000002.1856813364.0000000004928000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000002.1856813364.0000000004928000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000019.00000002.1945703172.0000000004798000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000002.1945703172.0000000004798000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.4080192144.00000000030CB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000016.00000002.1928490064.000000000356C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000016.00000002.1928490064.0000000003541000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000002.1928490064.0000000003541000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.4082420582.0000000002FAB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.4082420582.0000000002FAB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000016.00000002.1928490064.0000000003574000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1710196910.0000000007600000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1700653245.0000000004337000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1700653245.0000000004337000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Statement of Account PDF.bat.exe PID: 6984	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Statement of Account PDF.bat.exe PID: 6984	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Statement of Account PDF.bat.exe PID: 6984	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Statement of Account PDF.bat.exe PID: 7252	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Statement of Account PDF.bat.exe PID: 7252	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: gDdsxauPhk.exe PID: 7440	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: gDdsxauPhk.exe PID: 7720	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: gDdsxauPhk.exe PID: 7720	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: BjTxJte.exe PID: 8032	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BjTxJte.exe PID: 8032	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: BjTxJte.exe PID: 8032	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: BjTxJte.exe PID: 7220	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BjTxJte.exe PID: 7220	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: BjTxJte.exe PID: 7400	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BjTxJte.exe PID: 7400	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: BjTxJte.exe PID: 7400	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: BjTxJte.exe PID: 7752	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BjTxJte.exe PID: 7752	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 35 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Statement of Account PDF.bat.exe.7600000.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Statement of Account PDF.bat.exe.3949970.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Statement of Account PDF.bat.exe.3949970.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Statement of Account PDF.bat.exe.7600000.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
25.2.BjTxJte.exe.4798530.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
25.2.BjTxJte.exe.4798530.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
25.2.BjTxJte.exe.4798530.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31cfe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31d70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31dfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31e8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31ef6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31f68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31ffe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3208e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
22.2.BjTxJte.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
22.2.BjTxJte.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
18.2.BjTxJte.exe.4963d80.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
18.2.BjTxJte.exe.4963d80.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Statement of Account PDF.bat.exe.43bdcb0.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
18.2.BjTxJte.exe.4963d80.8.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31cfe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31d70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31dfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31e8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31ef6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31f68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31ffe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3208e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Statement of Account PDF.bat.exe.43bdcb0.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
22.2.BjTxJte.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33afe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33b70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33bfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33c8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33cf6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33d68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33dfe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33e8e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Statement of Account PDF.bat.exe.43bdcb0.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31cfe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31d70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31dfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31e8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31ef6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31f68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31ffe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3208e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Statement of Account PDF.bat.exe.43f8cd0.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Statement of Account PDF.bat.exe.43f8cd0.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Statement of Account PDF.bat.exe.43f8cd0.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31cfe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31d70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31dfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31e8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31ef6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31f68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31ffe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3208e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
18.2.BjTxJte.exe.4928d60.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
18.2.BjTxJte.exe.4928d60.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
18.2.BjTxJte.exe.4928d60.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31cfe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31d70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31dfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31e8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31ef6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31f68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31ffe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3208e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
25.2.BjTxJte.exe.47d3550.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
25.2.BjTxJte.exe.47d3550.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
25.2.BjTxJte.exe.47d3550.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31cfe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31d70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31dfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31e8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31ef6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31f68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31ffe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3208e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
25.2.BjTxJte.exe.47d3550.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
25.2.BjTxJte.exe.47d3550.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
25.2.BjTxJte.exe.47d3550.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33afe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6e91e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33b70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6e990:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33bfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ea1a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33c8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6eaac:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33cf6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6eb16:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33d68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6eb88:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33dfe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6ec1e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33e8e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6ecae:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
18.2.BjTxJte.exe.4928d60.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
18.2.BjTxJte.exe.4928d60.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
18.2.BjTxJte.exe.4928d60.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33afe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6eb1e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa993e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33b70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6eb90:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa99b0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33bfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ec1a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa9a3a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33c8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6ecac:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa9acc:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33cf6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6ed16:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa9b36:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33d68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6ed88:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa9ba8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33dfe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6ee1e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa9c3e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
25.2.BjTxJte.exe.4798530.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
25.2.BjTxJte.exe.4798530.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
25.2.BjTxJte.exe.4798530.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33afe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6eb1e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa993e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33b70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6eb90:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa99b0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33bfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ec1a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa9a3a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33c8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6ecac:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa9acc:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33cf6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6ed16:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa9b36:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33d68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6ed88:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa9ba8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33dfe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6ee1e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa9c3e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
18.2.BjTxJte.exe.4963d80.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
18.2.BjTxJte.exe.4963d80.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
18.2.BjTxJte.exe.4963d80.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33afe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6e91e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33b70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6e990:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33bfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ea1a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33c8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6eaac:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33cf6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6eb16:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33d68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6eb88:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33dfe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6ec1e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33e8e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6ecae:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Statement of Account PDF.bat.exe.43bdcb0.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Statement of Account PDF.bat.exe.43bdcb0.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Statement of Account PDF.bat.exe.43bdcb0.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33afe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6eb1e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa993e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33b70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6eb90:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa99b0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33bfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ec1a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa9a3a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33c8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6ecac:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa9acc:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33cf6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6ed16:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa9b36:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33d68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6ed88:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa9ba8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33dfe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6ee1e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa9c3e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.Statement of Account PDF.bat.exe.43f8cd0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Statement of Account PDF.bat.exe.43f8cd0.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Statement of Account PDF.bat.exe.43f8cd0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33afe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6e91e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33b70:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6e990:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33bfa:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ea1a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33c8c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6eaac:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33cf6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6eb16:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33d68:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6eb88:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33dfe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6ec1e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33e8e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6ecae:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 38 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Statement of Account PDF.bat.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Statement of Account PDF.bat.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Statement of Account PDF.bat.exe", ParentImage: C:\Users\user\Desktop\Statement of Account PDF.bat.exe, ParentProcessId: 6984, ParentProcessName: Statement of Account PDF.bat.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Statement of Account PDF.bat.exe", ProcessId: 7156, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Statement of Account PDF.bat.exe, ProcessId: 7252, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BjTxJte

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp216B.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp216B.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe, ParentImage: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe, ParentProcessId: 7440, ParentProcessName: gDdsxauPhk.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp216B.tmp", ProcessId: 7668, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 50.87.195.61, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\Statement of Account PDF.bat.exe, Initiated: true, ProcessId: 7252, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49736

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp690.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp690.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Statement of Account PDF.bat.exe", ParentImage: C:\Users\user\Desktop\Statement of Account PDF.bat.exe, ParentProcessId: 6984, ParentProcessName: Statement of Account PDF.bat.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp690.tmp", ProcessId: 7080, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Statement of Account PDF.bat.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Statement of Account PDF.bat.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Statement of Account PDF.bat.exe", ParentImage: C:\Users\user\Desktop\Statement of Account PDF.bat.exe, ParentProcessId: 6984, ParentProcessName: Statement of Account PDF.bat.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Statement of Account PDF.bat.exe", ProcessId: 7156, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp690.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp690.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Statement of Account PDF.bat.exe", ParentImage: C:\Users\user\Desktop\Statement of Account PDF.bat.exe, ParentProcessId: 6984, ParentProcessName: Statement of Account PDF.bat.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp690.tmp", ProcessId: 7080, ProcessName: schtasks.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 25.2.BjTxJte.exe.4798530.6.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.fascia-arch.com", "Username": "brian@fascia-arch.com", "Password": "HERbertstown1987"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Virustotal: Detection: 56%	Perma Link
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Virustotal: Detection: 56%	Perma Link

Multi AV Scanner detection for submitted file

Source: Statement of Account PDF.bat.exe	ReversingLabs: Detection: 47%
Source: Statement of Account PDF.bat.exe	Virustotal: Detection: 56%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Statement of Account PDF.bat.exe

Joe Sandbox ML: detected

Source: Statement of Account PDF.bat.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49755 version: TLS 1.2

Source: Statement of Account PDF.bat.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Data.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.Xml.ni.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: Accessibility.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.ni.pdbRSDS source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: Microsoft.VisualBasic.pdbu source: WERFDF5.tmp.dmp.17.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.Data.ni.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.Configuration.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: UbK.pdb source: Statement of Account PDF.bat.exe, gDdsxauPhk.exe.0.dr, BjTxJte.exe.8.dr, WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.pdbMZ source: WER211D.tmp.dmp.24.dr
Source:	Binary string: System.Core.pdbMZ@ source: WER211D.tmp.dmp.24.dr
Source:	Binary string: System.Xml.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.Core.ni.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.Drawing.pdbt source: WER4195.tmp.dmp.32.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: Microsoft.VisualBasic.pdbMZ source: WER211D.tmp.dmp.24.dr
Source:	Binary string: Accessibility.pdbSystem.ni.dllSystem.Core.dll4 source: WER211D.tmp.dmp.24.dr
Source:	Binary string: mscorlib.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.Drawing.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: mscorlib.ni.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.Data.ni.pdbRSDS source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: UbK.pdbSHA256 source: Statement of Account PDF.bat.exe, gDdsxauPhk.exe.0.dr, BjTxJte.exe.8.dr
Source:	Binary string: System.Core.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.pdb4 source: WERFDF5.tmp.dmp.17.dr
Source:	Binary string: Accessibility.pdbMZ source: WERFDF5.tmp.dmp.17.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.ni.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.Data.pdb, source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_BjTxJte.exe_f5c09dd75b90d612af8c658c8837992c387ee89_843aacda_4690c535-c6af-41e6-8128-f3000ded106c\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_gDdsxauPhk.exe_e2c8de6e9dfbc3bf198524a8a8bae3ea56c2edb2_cb724c00_6c828731-bc0c-4d10-93b3-5ed4934f0644\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 50.87.195.61:587

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 50.87.195.61 50.87.195.61

Source: Joe Sandbox View

ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 50.87.195.61:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: mail.fascia-arch.com

Source: Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003385000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.000000000306D000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003244000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003135000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.00000000032E6000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.00000000030EC000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.000000000342C000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.00000000030ED000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.0000000003136000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.0000000003227000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.00000000030CB000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000016.00000002.1928490064.000000000356C000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001E.00000002.4081952252.0000000002D9F000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001E.00000002.4081952252.0000000002A42000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001E.00000002.4081952252.0000000002CF8000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001E.00000002.4081952252.0000000002BC0000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001E.00000002.4081952252.0000000002B78000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001E.00000002.4081952252.0000000002C5F000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001E.00000002.4081952252.0000000002ADB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.fascia-arch.com
Source: Statement of Account PDF.bat.exe, 00000008.00000002.4121885551.0000000006729000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003385000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.000000000306D000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003244000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003135000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4121885551.0000000006707000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4123465356.0000000006762000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.00000000032E6000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4124030684.0000000006777000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.00000000030EC000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4123465356.000000000676E000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.000000000342C000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.000000000302F000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4073522473.00000000010CB000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000002FAB000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4151301532.0000000007DD8000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4121885551.000000000673F000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4150449840.0000000007DAB000.00000004.00000020.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.00000000030ED000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4121813503.00000000068ED000.00000004.00000020.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.0000000003136000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: Statement of Account PDF.bat.exe, 00000008.00000002.4121885551.0000000006729000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003385000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.000000000306D000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003244000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003135000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4121885551.0000000006707000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4123465356.0000000006762000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.00000000032E6000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4124030684.0000000006777000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.00000000030EC000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4123465356.000000000676E000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.000000000342C000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.000000000302F000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4073522473.00000000010CB000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000002FAB000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4121885551.000000000673F000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4150449840.0000000007DAB000.00000004.00000020.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.00000000030ED000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4121813503.00000000068ED000.00000004.00000020.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.0000000003136000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4074399117.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1699276440.00000000029BD000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000A.00000002.1763034515.00000000025BD000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.0000000003031000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000012.00000002.1853285183.0000000002E70000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000012.00000002.1853285183.0000000002C46000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000016.00000002.1928490064.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000019.00000002.1940766232.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000019.00000002.1940766232.0000000002CE0000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001E.00000002.4081952252.000000000290C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1707110996.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.htmlqX
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Statement of Account PDF.bat.exe, 00000008.00000002.4121885551.0000000006729000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4151590709.0000000007DE4000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003385000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.000000000306D000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003244000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003135000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4073522473.0000000001040000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.00000000032E6000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4073522473.000000000106A000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4124030684.0000000006777000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4120771933.00000000066C6000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.00000000030EC000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.000000000342C000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4073522473.00000000010CB000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4151301532.0000000007DD8000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4121885551.000000000673F000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4150449840.0000000007DAB000.00000004.00000020.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.00000000030ED000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4121813503.00000000068ED000.00000004.00000020.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.0000000003136000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4074399117.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Statement of Account PDF.bat.exe, 00000008.00000002.4121885551.0000000006729000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4151590709.0000000007DE4000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003385000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.000000000306D000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003244000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003135000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4073522473.0000000001040000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.00000000032E6000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4073522473.000000000106A000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4124030684.0000000006777000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4120771933.00000000066C6000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.00000000030EC000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.000000000342C000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4073522473.00000000010CB000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4151301532.0000000007DD8000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4121885551.000000000673F000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4150449840.0000000007DAB000.00000004.00000020.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.00000000030ED000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4121813503.00000000068ED000.00000004.00000020.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.0000000003136000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4074399117.000000000148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1700653245.0000000004337000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000012.00000002.1856813364.0000000004928000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000016.00000002.1916411729.0000000000402000.00000040.00000400.00020000.00000000.sdmp, BjTxJte.exe, 00000019.00000002.1945703172.0000000004798000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1700653245.0000000004337000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.0000000003031000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000012.00000002.1856813364.0000000004928000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000016.00000002.1916411729.0000000000402000.00000040.00000400.00020000.00000000.sdmp, BjTxJte.exe, 00000016.00000002.1928490064.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000019.00000002.1945703172.0000000004798000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001E.00000002.4081952252.000000000290C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: gDdsxauPhk.exe, 0000000F.00000002.4080192144.0000000003031000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000016.00000002.1928490064.00000000034F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: gDdsxauPhk.exe, 0000000F.00000002.4080192144.0000000003031000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000016.00000002.1928490064.00000000034F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443

Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49755 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.Statement of Account PDF.bat.exe.43bdcb0.5.raw.unpack, 8WWn.cs	.Net Code: UOFvW
Source: 0.2.Statement of Account PDF.bat.exe.43f8cd0.3.raw.unpack, 8WWn.cs	.Net Code: UOFvW

Installs a global keyboard hook

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\gDdsxauPhk.exe
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Window created: window name: CLIPBRDWNDCLASS

System Summary

Malicious sample detected (through community Yara rule)

Source: 25.2.BjTxJte.exe.4798530.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 18.2.BjTxJte.exe.4963d80.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 22.2.BjTxJte.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Statement of Account PDF.bat.exe.43bdcb0.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Statement of Account PDF.bat.exe.43f8cd0.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 18.2.BjTxJte.exe.4928d60.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 25.2.BjTxJte.exe.47d3550.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 25.2.BjTxJte.exe.47d3550.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 18.2.BjTxJte.exe.4928d60.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 25.2.BjTxJte.exe.4798530.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 18.2.BjTxJte.exe.4963d80.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Statement of Account PDF.bat.exe.43bdcb0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Statement of Account PDF.bat.exe.43f8cd0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_076A3910	0_2_076A3910
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_076A2C68	0_2_076A2C68
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_076A34D8	0_2_076A34D8
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_00F125D8	0_2_00F125D8
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_04EE1808	0_2_04EE1808
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_04EE17F8	0_2_04EE17F8
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_06CCC550	0_2_06CCC550
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_06CCE6F0	0_2_06CCE6F0
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_06CEA688	0_2_06CEA688
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_06CE9CC8	0_2_06CE9CC8
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_06CE6CD8	0_2_06CE6CD8
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_06CE39C0	0_2_06CE39C0
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_06CE7280	0_2_06CE7280
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_06CE7271	0_2_06CE7271
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_06CEA3E0	0_2_06CEA3E0
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_06CEA3F0	0_2_06CEA3F0
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_06CEC388	0_2_06CEC388
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_06CEC378	0_2_06CEC378
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_06CE9CB8	0_2_06CE9CB8
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_074A9BC0	0_2_074A9BC0
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_074A7A20	0_2_074A7A20
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_074AC900	0_2_074AC900
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_074AAA60	0_2_074AAA60
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_074ABED0	0_2_074ABED0
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_074AF148	0_2_074AF148
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_074A0040	0_2_074A0040
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_074A0006	0_2_074A0006
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_074ABC88	0_2_074ABC88
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_074AD8A8	0_2_074AD8A8
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 8_2_010141F8	8_2_010141F8
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 8_2_0101EB08	8_2_0101EB08
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 8_2_01014AC8	8_2_01014AC8
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 8_2_0101ADF8	8_2_0101ADF8
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 8_2_01013EB0	8_2_01013EB0
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 8_2_06952750	8_2_06952750
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 8_2_069565C8	8_2_069565C8
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 8_2_0695B1F8	8_2_0695B1F8
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 8_2_0695C138	8_2_0695C138
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 8_2_06957D48	8_2_06957D48
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 8_2_06955568	8_2_06955568
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 8_2_06957668	8_2_06957668
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 8_2_0695E360	8_2_0695E360
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 8_2_06955CC0	8_2_06955CC0
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 8_2_06950040	8_2_06950040
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_023F1CC4	10_2_023F1CC4
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_023F01A0	10_2_023F01A0
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_023F2B11	10_2_023F2B11
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_023F0B60	10_2_023F0B60
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_023F0B50	10_2_023F0B50
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_068FC550	10_2_068FC550
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_068FE6F0	10_2_068FE6F0
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06A1A688	10_2_06A1A688
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06A12368	10_2_06A12368
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06A19CC8	10_2_06A19CC8
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06A16CD8	10_2_06A16CD8
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06A17280	10_2_06A17280
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06A17271	10_2_06A17271
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06A1C380	10_2_06A1C380
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06A1C388	10_2_06A1C388
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06A1A3E0	10_2_06A1A3E0
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06A1A3F0	10_2_06A1A3F0
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06A19CB8	10_2_06A19CB8
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06A19C15	10_2_06A19C15
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06D37A20	10_2_06D37A20
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06D39BC0	10_2_06D39BC0
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06D3C900	10_2_06D3C900
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06D3BED0	10_2_06D3BED0
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06D3AA60	10_2_06D3AA60
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06D3BC88	10_2_06D3BC88
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06D3D8A8	10_2_06D3D8A8
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06D30040	10_2_06D30040
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06D30007	10_2_06D30007
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06D3F148	10_2_06D3F148
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06EDAE68	10_2_06EDAE68
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06ED34D8	10_2_06ED34D8
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06ED2C68	10_2_06ED2C68
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06ED5458	10_2_06ED5458
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06ED3091	10_2_06ED3091
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06ED7120	10_2_06ED7120
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06ED3910	10_2_06ED3910
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 15_2_014041F8	15_2_014041F8
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 15_2_0140EB08	15_2_0140EB08
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 15_2_01404AC8	15_2_01404AC8
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 15_2_01403EB0	15_2_01403EB0
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 15_2_0140ADF8	15_2_0140ADF8
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 15_2_06B43438	15_2_06B43438
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 15_2_06B465D0	15_2_06B465D0
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 15_2_06B45570	15_2_06B45570
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 15_2_06B47D50	15_2_06B47D50
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 15_2_06B4B1F0	15_2_06B4B1F0
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 15_2_06B4C140	15_2_06B4C140
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 15_2_06B47670	15_2_06B47670
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 15_2_06B45CB7	15_2_06B45CB7
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 15_2_06B4E368	15_2_06B4E368
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 15_2_06B40040	15_2_06B40040
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_051026B8	18_2_051026B8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_05101FB8	18_2_05101FB8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_051001A0	18_2_051001A0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_05100B50	18_2_05100B50
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_05100B60	18_2_05100B60
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_07408D10	18_2_07408D10
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_0740CC18	18_2_0740CC18
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_07409BC0	18_2_07409BC0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_07407A20	18_2_07407A20
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_0740C900	18_2_0740C900
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_07408770	18_2_07408770
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_07406F10	18_2_07406F10
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_0740BED0	18_2_0740BED0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_0740BC88	18_2_0740BC88
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_0740AA60	18_2_0740AA60
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_074082A8	18_2_074082A8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_0740F148	18_2_0740F148
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_0740B918	18_2_0740B918
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_07400040	18_2_07400040
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_07400006	18_2_07400006
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_0740D8A8	18_2_0740D8A8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_0764AD68	18_2_0764AD68
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_07642C68	18_2_07642C68
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_07645458	18_2_07645458
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_076434D8	18_2_076434D8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_07647120	18_2_07647120
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_07643910	18_2_07643910
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_07643091	18_2_07643091
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 22_2_0164E9E8	22_2_0164E9E8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 22_2_01644AC8	22_2_01644AC8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 22_2_0164ACC8	22_2_0164ACC8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 22_2_01643EB0	22_2_01643EB0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 22_2_016441F8	22_2_016441F8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 22_2_07041DC2	22_2_07041DC2
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 22_2_07041DC8	22_2_07041DC8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 22_2_07075568	22_2_07075568
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 22_2_070765C8	22_2_070765C8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 22_2_0707C138	22_2_0707C138
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 22_2_0707B1E8	22_2_0707B1E8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 22_2_07073030	22_2_07073030
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 22_2_07077D48	22_2_07077D48
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 22_2_07077668	22_2_07077668
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 22_2_0707E360	22_2_0707E360
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 22_2_07070040	22_2_07070040
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 22_2_07075CAF	22_2_07075CAF
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 22_2_07070006	22_2_07070006
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_04FC1808	25_2_04FC1808
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_04FC17F8	25_2_04FC17F8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06E8A688	25_2_06E8A688
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06E89CC8	25_2_06E89CC8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06E86CD8	25_2_06E86CD8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06E839C0	25_2_06E839C0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06E8A67C	25_2_06E8A67C
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06E87280	25_2_06E87280
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06E87271	25_2_06E87271
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06E8A3E0	25_2_06E8A3E0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06E8A3F0	25_2_06E8A3F0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06E8C388	25_2_06E8C388
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06E8C378	25_2_06E8C378
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06E89CB8	25_2_06E89CB8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06FF34D8	25_2_06FF34D8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06FF2C68	25_2_06FF2C68
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06FF5458	25_2_06FF5458
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06FFAD68	25_2_06FFAD68
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06FF3091	25_2_06FF3091
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06FF7120	25_2_06FF7120
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06FF3910	25_2_06FF3910
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_071AC900	25_2_071AC900
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_071A9BC0	25_2_071A9BC0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_071A7A20	25_2_071A7A20
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_071AF148	25_2_071AF148
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_071A0016	25_2_071A0016
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_071A0040	25_2_071A0040
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_071AAA60	25_2_071AAA60
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_071ABC88	25_2_071ABC88
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_071AD8A8	25_2_071AD8A8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_071ABED0	25_2_071ABED0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_0739C550	25_2_0739C550
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_0739E6F0	25_2_0739E6F0

Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 1816

Source: Statement of Account PDF.bat.exe	Binary or memory string: OriginalFilename vs Statement of Account PDF.bat.exe
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1700653245.000000000459D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Statement of Account PDF.bat.exe
Source: Statement of Account PDF.bat.exe, 00000000.00000000.1626756757.0000000000580000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameUbK.exe& vs Statement of Account PDF.bat.exe
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1709155218.0000000007288000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUbK.exe& vs Statement of Account PDF.bat.exe
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1700653245.0000000004337000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec0fe0520-5c7a-42ab-a1ed-336010ccc94a.exe4 vs Statement of Account PDF.bat.exe
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1710403251.0000000007620000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Statement of Account PDF.bat.exe
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1699276440.0000000002A5C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec0fe0520-5c7a-42ab-a1ed-336010ccc94a.exe4 vs Statement of Account PDF.bat.exe
Source: Statement of Account PDF.bat.exe, 00000000.00000002.1694061767.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Statement of Account PDF.bat.exe
Source: Statement of Account PDF.bat.exe, 00000008.00000002.4071828324.0000000000EF9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Statement of Account PDF.bat.exe
Source: Statement of Account PDF.bat.exe	Binary or memory string: OriginalFilenameUbK.exe& vs Statement of Account PDF.bat.exe

Source: Statement of Account PDF.bat.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 25.2.BjTxJte.exe.4798530.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 18.2.BjTxJte.exe.4963d80.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 22.2.BjTxJte.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Statement of Account PDF.bat.exe.43bdcb0.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Statement of Account PDF.bat.exe.43f8cd0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 18.2.BjTxJte.exe.4928d60.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 25.2.BjTxJte.exe.47d3550.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 25.2.BjTxJte.exe.47d3550.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 18.2.BjTxJte.exe.4928d60.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 25.2.BjTxJte.exe.4798530.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 18.2.BjTxJte.exe.4963d80.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Statement of Account PDF.bat.exe.43bdcb0.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Statement of Account PDF.bat.exe.43f8cd0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: Statement of Account PDF.bat.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: gDdsxauPhk.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Statement of Account PDF.bat.exe.43bdcb0.5.raw.unpack, G39cBQ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Statement of Account PDF.bat.exe.43bdcb0.5.raw.unpack, G39cBQ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Statement of Account PDF.bat.exe.43bdcb0.5.raw.unpack, sDtvQjPGfa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Statement of Account PDF.bat.exe.43bdcb0.5.raw.unpack, sDtvQjPGfa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Statement of Account PDF.bat.exe.43bdcb0.5.raw.unpack, sDtvQjPGfa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Statement of Account PDF.bat.exe.43bdcb0.5.raw.unpack, sDtvQjPGfa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Statement of Account PDF.bat.exe.43bdcb0.5.raw.unpack, b1PPCKov2KZ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Statement of Account PDF.bat.exe.43bdcb0.5.raw.unpack, b1PPCKov2KZ.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 0.2.Statement of Account PDF.bat.exe.45bb430.4.raw.unpack, Dr83W1h4x8JWr6EBI0.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Statement of Account PDF.bat.exe.45bb430.4.raw.unpack, Dr83W1h4x8JWr6EBI0.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Statement of Account PDF.bat.exe.45bb430.4.raw.unpack, Dr83W1h4x8JWr6EBI0.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Statement of Account PDF.bat.exe.45bb430.4.raw.unpack, rX6SQY6VW0eXSFLNTj.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@36/32@2/2

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe

File created: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8032
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2996:120:WilError_03
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6736:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7440
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Mutant created: \Sessions\1\BaseNamedObjects\JATJfqjfmxt
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7688:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7052:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7400
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3864:120:WilError_03

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe

File created: C:\Users\user\AppData\Local\Temp\tmp690.tmp

Jump to behavior

Source: Statement of Account PDF.bat.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Statement of Account PDF.bat.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Statement of Account PDF.bat.exe	ReversingLabs: Detection: 47%
Source: Statement of Account PDF.bat.exe	Virustotal: Detection: 56%

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe

File read: C:\Users\user\Desktop\Statement of Account PDF.bat.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Statement of Account PDF.bat.exe "C:\Users\user\Desktop\Statement of Account PDF.bat.exe"
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Statement of Account PDF.bat.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gDdsxauPhk.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp690.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process created: C:\Users\user\Desktop\Statement of Account PDF.bat.exe "C:\Users\user\Desktop\Statement of Account PDF.bat.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe C:\Users\user\AppData\Roaming\gDdsxauPhk.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp216B.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process created: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe "C:\Users\user\AppData\Roaming\gDdsxauPhk.exe"
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process created: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe "C:\Users\user\AppData\Roaming\gDdsxauPhk.exe"
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 1816
Source: unknown	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp44D2.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8032 -s 1828
Source: unknown	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp6598.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7400 -s 1788
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Statement of Account PDF.bat.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gDdsxauPhk.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp690.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process created: C:\Users\user\Desktop\Statement of Account PDF.bat.exe "C:\Users\user\Desktop\Statement of Account PDF.bat.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp216B.tmp"
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process created: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe "C:\Users\user\AppData\Roaming\gDdsxauPhk.exe"
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process created: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe "C:\Users\user\AppData\Roaming\gDdsxauPhk.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp44D2.tmp"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp6598.tmp"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Section loaded: windowscodecs.dll

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Statement of Account PDF.bat.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Statement of Account PDF.bat.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Statement of Account PDF.bat.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: System.Data.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.Xml.ni.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: Accessibility.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.ni.pdbRSDS source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: Microsoft.VisualBasic.pdbu source: WERFDF5.tmp.dmp.17.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.Data.ni.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.Configuration.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: UbK.pdb source: Statement of Account PDF.bat.exe, gDdsxauPhk.exe.0.dr, BjTxJte.exe.8.dr, WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.pdbMZ source: WER211D.tmp.dmp.24.dr
Source:	Binary string: System.Core.pdbMZ@ source: WER211D.tmp.dmp.24.dr
Source:	Binary string: System.Xml.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.Core.ni.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.Drawing.pdbt source: WER4195.tmp.dmp.32.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: Microsoft.VisualBasic.pdbMZ source: WER211D.tmp.dmp.24.dr
Source:	Binary string: Accessibility.pdbSystem.ni.dllSystem.Core.dll4 source: WER211D.tmp.dmp.24.dr
Source:	Binary string: mscorlib.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.Drawing.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: mscorlib.ni.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.Data.ni.pdbRSDS source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: UbK.pdbSHA256 source: Statement of Account PDF.bat.exe, gDdsxauPhk.exe.0.dr, BjTxJte.exe.8.dr
Source:	Binary string: System.Core.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.pdb4 source: WERFDF5.tmp.dmp.17.dr
Source:	Binary string: Accessibility.pdbMZ source: WERFDF5.tmp.dmp.17.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.ni.pdb source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.Data.pdb, source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER211D.tmp.dmp.24.dr, WERFDF5.tmp.dmp.17.dr, WER4195.tmp.dmp.32.dr

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.Statement of Account PDF.bat.exe.3949970.2.raw.unpack, V4uC3Iifq56IKQcfry.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.Statement of Account PDF.bat.exe.7600000.7.raw.unpack, V4uC3Iifq56IKQcfry.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: 0.2.Statement of Account PDF.bat.exe.45bb430.4.raw.unpack, Dr83W1h4x8JWr6EBI0.cs

.Net Code: O3Bxfh3Ehd System.Reflection.Assembly.Load(byte[])

Source: Statement of Account PDF.bat.exe

Static PE information: 0x9CBFCD6A [Fri May 2 16:20:58 2053 UTC]

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_07625534 pushfd ; retf	0_2_0762555F
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_06CC7E88 pushad ; iretd	0_2_06CC7E91
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_06CCFF58 push ebx; retf	0_2_06CCFF6A
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_06CE055C pushfd ; retf	0_2_06CE055D
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_06CE5ABB pushad ; retf	0_2_06CE5ACF
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_06CE8AB8 pushad ; retf	0_2_06CE8AC6
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 0_2_074A3E3A push ds; ret	0_2_074A3E3B
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 8_2_0101F04E push eax; retf 0594h	8_2_0101F085
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 8_2_01010C3D push edi; ret	8_2_01010CC2
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Code function: 8_2_01010C95 push edi; retf	8_2_01010C3A
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_068F7E88 pushad ; iretd	10_2_068F7E91
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06A16471 push es; ret	10_2_06A16480
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06A1BB71 pushad ; retn 0006h	10_2_06A1BB72
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06D33E3A push ds; ret	10_2_06D33E3B
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06ED7D50 push eax; ret	10_2_06ED7D51
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 10_2_06ED8998 pushad ; retf	10_2_06ED8999
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 15_2_01400C3D push edi; ret	15_2_01400CC2
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Code function: 15_2_01400C95 push edi; retf	15_2_01400C3A
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_07403E3A push ds; ret	18_2_07403E3B
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_07647E0A pushfd ; ret	18_2_07647E11
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_07647D50 push eax; ret	18_2_07647D51
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_076489E8 pushfd ; retf	18_2_076489F1
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 18_2_07648998 pushad ; retf	18_2_07648999
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 22_2_01640B4D push edi; ret	22_2_01640CC2
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 22_2_0164AA28 pushfd ; iretd	22_2_0164AA29
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 22_2_01640C95 push edi; retf	22_2_01640C3A
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 22_2_07041658 push cs; retf	22_2_0704165B
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 22_2_070474B8 push esp; iretd	22_2_070474C1
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06FF7E0B pushfd ; ret	25_2_06FF7E11
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06FF7D50 push eax; ret	25_2_06FF7D51
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Code function: 25_2_06FF89E8 pushfd ; retf	25_2_06FF89F1

Source: Statement of Account PDF.bat.exe	Static PE information: section name: .text entropy: 7.953860448849022
Source: gDdsxauPhk.exe.0.dr	Static PE information: section name: .text entropy: 7.953860448849022

Source: 0.2.Statement of Account PDF.bat.exe.45bb430.4.raw.unpack, Dr83W1h4x8JWr6EBI0.cs	High entropy of concatenated method names: 'SjpioJ9awJ', 'ea8iZ4gqug', 'MECi3HoQTF', 'UUHid4MrLo', 'WOCiBxwBPw', 'L4wiVOrOuJ', 'k9di7KbRoO', 'Ejbih30AsW', 'vJ6iLVQmpQ', 'Rpbiu8EQoF'
Source: 0.2.Statement of Account PDF.bat.exe.45bb430.4.raw.unpack, f9AEeM92i5mlZ4Aopi.cs	High entropy of concatenated method names: 'meFr6pyr5u', 'nHfrc9nAMw', 'lyWrssknHt', 'hH1rTnCNwj', 'DxUry1RSU1', 'Jqerb3RYy2', 'nBcrEnR9wl', 'UVorgZPqUS', 'Q4IrHKnd23', 'OnArUCyYnv'
Source: 0.2.Statement of Account PDF.bat.exe.45bb430.4.raw.unpack, XhKCd9dHf21VeCLFyn.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'wvXOmwRH8f', 'VwwOtZWtA0', 'BGCOzMrrx1', 'EwHi15WSlf', 'rx8i0akpVm', 'mF8iOqeqbQ', 'ySeiiBBgPv', 'PuCjFBPpf1uYIhfEx86'
Source: 0.2.Statement of Account PDF.bat.exe.45bb430.4.raw.unpack, rX6SQY6VW0eXSFLNTj.cs	High entropy of concatenated method names: 'dba3NyVIOh', 'kiY3PSBMu4', 'P6m3wY9Mhj', 'DPw32EjX88', 'M4W3vH9siM', 'Hg33JUdnOW', 'zlD3nwLFrY', 'qWJ35l50Xx', 'y0e3mosY2b', 'fIT3tg1x6r'
Source: 0.2.Statement of Account PDF.bat.exe.45bb430.4.raw.unpack, UtFFE8xFLtnRoEVa8X.cs	High entropy of concatenated method names: 'uiR07X6SQY', 'iW00heXSFL', 'wq90uMrTF4', 'rc70FTjdtm', 'tCm0GAKNXx', 'X2v0jjygSG', 'F7FIS9F3ktykQm0QfM', 'sf1PNNkxfOGfgslpEU', 'sUO00I1DK7', 'dFK0iI4nCn'
Source: 0.2.Statement of Account PDF.bat.exe.45bb430.4.raw.unpack, pdtmeyKGkFH3nSCmAK.cs	High entropy of concatenated method names: 'mjlBQWpSiX', 'LSkBpBUDRn', 'OkddkvB3lt', 'i61dyQIJrg', 'Bv3db0G7Xe', 'yO7dlG4HCZ', 'Ok9dEUNjxh', 'ClddgMT05Z', 'cNQd8G3GCV', 'x0UdHEfXvt'
Source: 0.2.Statement of Account PDF.bat.exe.45bb430.4.raw.unpack, Q0vt0hOSjo6HIj4Rq3.cs	High entropy of concatenated method names: 'wpaf5LLQ0', 'rxh4vk4J8', 'JJGIEh9jY', 'au8pi5SHf', 'jY0c0NTgk', 'QI3KLHWb7', 'fqD0V8SHmRenCUnAeq', 'BibAuLQfThhaKeeF73', 'jhhaiH8LJ', 'A0VSXwA2K'
Source: 0.2.Statement of Account PDF.bat.exe.45bb430.4.raw.unpack, xIbxFy8gOG4vjPPpTX.cs	High entropy of concatenated method names: 'Gto7DJUvE5', 'kyU7MG2yt4', 'ueO7fLuqhw', 'Boe74jeRuo', 'VLc7QVDYbq', 'K4u7I5buHj', 'GXk7pGLnWU', 'Lu576g7QMj', 'SwY7cWldwg', 'AnK7K6FSGv'
Source: 0.2.Statement of Account PDF.bat.exe.45bb430.4.raw.unpack, eZfufPmGb7N5B4W3Lm.cs	High entropy of concatenated method names: 'gr3asZTftr', 'SSMaTXr7In', 'NHgakd9eEU', 'xpFayH9wD2', 'tJjaNp49l4', 'fbrabuxhf7', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Statement of Account PDF.bat.exe.45bb430.4.raw.unpack, KisC0xzkcjhkuYQIwX.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'xCgRrVPMPl', 'xsDRGQ8Z3s', 'MoLRjGgEtM', 'oTwRq8BkKA', 'IN7RagxPns', 'mrIRRxq2Rw', 'AI4RSn3XqL'
Source: 0.2.Statement of Account PDF.bat.exe.45bb430.4.raw.unpack, g6ofiB57OeE53f5hFC.cs	High entropy of concatenated method names: 'Hr0aZ6pF48', 'vGga3CDhix', 'HGOad6QrhT', 'fqxaBkLrL9', 'M9MaVqctgg', 'h7ta7RpXFY', 'acjah2vvV9', 'v4YaLiL33q', 'inhauehEfJ', 'I0LaFHn3Ua'
Source: 0.2.Statement of Account PDF.bat.exe.45bb430.4.raw.unpack, RXxm2vsjygSGRy8oEp.cs	High entropy of concatenated method names: 'Hj0VoApRBd', 'EpXV3Is6y8', 'BX9VBTBBu1', 'Ps3V7KUEru', 'wf7VheH1aX', 'SANBveSRtM', 'x0nBJvCC2E', 'P3bBnFsEHh', 'usJB5ZqZbY', 'aheBmZjrRF'
Source: 0.2.Statement of Account PDF.bat.exe.45bb430.4.raw.unpack, WAm6g4lQKCsssNesbm.cs	High entropy of concatenated method names: 'G2SVwBKVmZ', 'FPAV25sjvh', 'YIJVvELQ20', 'ToString', 'zvcVJ011XC', 'g9hVnpffxq', 'kuKb8h1cDGGL8kkENXo', 'wTsqAw1i6GFNdUC3se7'
Source: 0.2.Statement of Account PDF.bat.exe.45bb430.4.raw.unpack, TbdHuRwIDNx36coOJj.cs	High entropy of concatenated method names: 'ToString', 'lstjUjAc0x', 'W3OjT3yVrG', 'Ohsjk9YJ4f', 'AF8jyv1cB5', 'TgLjbjODMF', 'GxKjl7KjOg', 'Kg9jENfd3j', 'o1AjgS7dF6', 'VqFj8ARHuM'
Source: 0.2.Statement of Account PDF.bat.exe.45bb430.4.raw.unpack, TQUTGR01T6mTBxIIcxc.cs	High entropy of concatenated method names: 'XK6RDu5MTi', 'V6IRMuKAU5', 'kVaRfPSMyQ', 'my3R4anKEs', 'DuPRQuvfoD', 'AjXRId9MqP', 'IwfRpFS6oN', 'uB6R6LdJEW', 'JbbRcsrFkT', 'feFRKAI8YS'
Source: 0.2.Statement of Account PDF.bat.exe.45bb430.4.raw.unpack, ENrO1Acq9MrTF4Rc7T.cs	High entropy of concatenated method names: 'Br1d4U2XNV', 'D7LdIiYElt', 'Pqad6dvGmT', 'cVudcxCHRi', 'qdDdGhKOXv', 'CQpdjAafLZ', 'l0jdqy1fFL', 'XK9daQCAto', 'aSRdRjfgZS', 'TDSdSgfZSC'
Source: 0.2.Statement of Account PDF.bat.exe.45bb430.4.raw.unpack, lG6NYlJTADKPBmgkWy.cs	High entropy of concatenated method names: 'wKZq5ZmjUG', 'cnUqtNQIAH', 'L2Wa1YIipr', 'gPea02c2kb', 'J6TqUnHsnP', 'SJBqCOEjKH', 'PmCq9nNn9W', 'GauqNG66D2', 'SeTqPGG8ZJ', 'qkQqwsd87W'
Source: 0.2.Statement of Account PDF.bat.exe.45bb430.4.raw.unpack, NBhtei0i2kd7O8CGNMg.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'KPgSN9EkJV', 'doRSPlPd0u', 'zN8Sw6ThTq', 'zPIS2BVR5X', 'wxlSvNJdsb', 'znhSJC20vq', 'GlpSnIyIFR'
Source: 0.2.Statement of Account PDF.bat.exe.45bb430.4.raw.unpack, k3txY0tGWeAPhqr1oN.cs	High entropy of concatenated method names: 'W33R05dTbP', 'oLhRiPXw7K', 'HGURx9iVLc', 'nhjRZRETq3', 'hHCR3w8nvn', 'pvLRBNxFie', 'uaERVPPIZ7', 'bG9anCyrQF', 'lj5a5OckWd', 'U7bamkHuow'
Source: 0.2.Statement of Account PDF.bat.exe.45bb430.4.raw.unpack, PuRLoy3ScatIm3wqH1.cs	High entropy of concatenated method names: 'Dispose', 'wDp0mZmijB', 'MRKOTudN99', 'crtHHIUsxe', 'cd60tofiB7', 'beE0z53f5h', 'ProcessDialogKey', 'mCoO1ZfufP', 'ob7O0N5B4W', 'fLmOOh3txY'
Source: 0.2.Statement of Account PDF.bat.exe.3949970.2.raw.unpack, V4uC3Iifq56IKQcfry.cs	High entropy of concatenated method names: 'JcqLcnHE8kRk7VHJhl', 'baAwnpSkPWAs4YMGxr', 'wTgrto4LNQ', 'imnL6GCB6AIFRqkhxN', 'RgtTUJcyZL', 'dHYrbjNADO', 'xiCr8b7Qs6', 'PT2rZj37UR', 'P1WruDgOtu', 'd71eKLY6YVFQv'
Source: 0.2.Statement of Account PDF.bat.exe.3949970.2.raw.unpack, vpednoN8EZgsJ4TDwx.cs	High entropy of concatenated method names: 'SvRTLtpnA', 'uJwWpedno', 'REZpgsJ4T', 'uwxys3A5Q', 'Tl3iTkB7U', 'EqRFtDP16', 'TW5lfqidm', 'wSKAUGlNW', 'LkrevaXpK', 'cwu0Op5AT'
Source: 0.2.Statement of Account PDF.bat.exe.7600000.7.raw.unpack, V4uC3Iifq56IKQcfry.cs	High entropy of concatenated method names: 'JcqLcnHE8kRk7VHJhl', 'baAwnpSkPWAs4YMGxr', 'wTgrto4LNQ', 'imnL6GCB6AIFRqkhxN', 'RgtTUJcyZL', 'dHYrbjNADO', 'xiCr8b7Qs6', 'PT2rZj37UR', 'P1WruDgOtu', 'd71eKLY6YVFQv'
Source: 0.2.Statement of Account PDF.bat.exe.7600000.7.raw.unpack, vpednoN8EZgsJ4TDwx.cs	High entropy of concatenated method names: 'SvRTLtpnA', 'uJwWpedno', 'REZpgsJ4T', 'uwxys3A5Q', 'Tl3iTkB7U', 'EqRFtDP16', 'TW5lfqidm', 'wSKAUGlNW', 'LkrevaXpK', 'cwu0Op5AT'

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	File created: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe			Jump to dropped file
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	File created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp690.tmp"

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BjTxJte			Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BjTxJte			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	File opened: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	File opened: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe:Zone.Identifier read attributes \| delete

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Statement of Account PDF.bat.exe PID: 6984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gDdsxauPhk.exe PID: 7440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 8032, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7400, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Memory allocated: EF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Memory allocated: 2940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Memory allocated: 26D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Memory allocated: 8F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Memory allocated: 78F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Memory allocated: 9F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Memory allocated: AF50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Memory allocated: B480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Memory allocated: 8F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Memory allocated: 1010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Memory allocated: 2F60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Memory allocated: 2CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Memory allocated: 7F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Memory allocated: 2540000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Memory allocated: 2260000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Memory allocated: 8160000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Memory allocated: 9160000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Memory allocated: 9350000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Memory allocated: A350000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Memory allocated: A940000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Memory allocated: 8160000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Memory allocated: 1400000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Memory allocated: 3030000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Memory allocated: 2E60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: FE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 2BD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 1270000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 89F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 99F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 9BE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: ABE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: B140000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: C140000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: D140000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 1640000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 34F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 1940000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: E80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 2A40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 27A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 8710000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 9710000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 9900000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: A900000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: AF80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: BF80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: CF80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 2610000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 2900000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory allocated: 4900000 memory reserve \| memory write watch

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1200000	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1199874	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1199765	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1199656	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1199546	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1199437	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1199328	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1199214	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1199109	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1198999	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1198890	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1198781	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1198671	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1198551	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1198421	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1198312	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1198192	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1198062	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1197952	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1197839	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1197733	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1197624	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1197514	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1200000
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1199887
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1199770
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1199637
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1199527
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1199418
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1199308
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1199199
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1199090
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1198980
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1198871
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1198746
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1198595
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1198465
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1198355
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1198245
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1198136
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1198027
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1197918
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1197808
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1197691
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1197558
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1197415
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1197257
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1197142
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1196894
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1196150
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1196023
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1195621
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1195511
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1195402
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1195292
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1195183
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1195072
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1194961
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199949
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199828
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199718
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199609
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199498
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199390
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199281
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199170
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199062
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198953
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198843
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198734
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198624
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198515
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198406
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198295
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198187
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198078
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197968
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197856
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197734
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197625
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197515
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197406
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199951
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199839
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199719
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199609
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199473
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199335
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199219
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199105
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198956
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198828
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198719
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198411
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198281
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198172
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198062
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197953
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197844
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197734
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197621
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197500
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197391
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197276
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197156
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197047
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1196936
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1196828
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1196719
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1196594
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1196484
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1196375

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4027	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6023	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Window / User API: threadDelayed 4363	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Window / User API: threadDelayed 5478	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Window / User API: threadDelayed 4252
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Window / User API: threadDelayed 5575
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Window / User API: threadDelayed 5084
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Window / User API: threadDelayed 4765
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Window / User API: threadDelayed 6549
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Window / User API: threadDelayed 3282

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7172	Thread sleep count: 4027 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7384	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7244	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7436	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -36893488147419080s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -99874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -99763s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -99546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -99316s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -99187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -99070s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -98953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -98841s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -98734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -98624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -98515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -98404s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -98296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -98184s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -98078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -97968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -97859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -97749s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -97640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -97531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -97421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -97312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -97203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -97087s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -96984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -1200000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -1199874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -1199765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -1199656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -1199546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -1199437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -1199328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -1199214s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -1199109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -1198999s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -1198890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -1198781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -1198671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -1198551s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -1198421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -1198312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -1198192s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -1198062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -1197952s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -1197839s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -1197733s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -1197624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe TID: 7524	Thread sleep time: -1197514s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -35048813740048126s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -99875s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -99766s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -99657s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -99423s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -99297s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -99188s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -99077s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -98936s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -98828s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -98308s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -98203s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -98094s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -97969s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -95957s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -95829s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1200000s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1199887s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1199770s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1199637s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1199527s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1199418s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1199308s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1199199s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1199090s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1198980s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1198871s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1198746s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1198595s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1198465s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1198355s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1198245s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1198136s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1198027s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1197918s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1197808s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1197691s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1197558s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1197415s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1197257s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1197142s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1196894s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1196150s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1196023s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1195621s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1195511s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1195402s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1195292s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1195183s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1195072s >= -30000s
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe TID: 7884	Thread sleep time: -1194961s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep count: 39 > 30
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -35971150943733603s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7236	Thread sleep count: 5084 > 30
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -99875s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7236	Thread sleep count: 4765 > 30
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -99762s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -99641s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -99531s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -99422s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -99313s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -99156s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -99046s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -98937s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -98828s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -98712s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -98594s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -98484s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -98375s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -98266s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -98141s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -98016s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -97906s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -97797s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -97687s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -97578s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -97469s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -97359s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -97250s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -97135s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -1199949s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -1199828s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -1199718s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -1199609s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -1199498s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -1199390s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -1199281s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -1199170s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -1199062s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -1198953s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -1198843s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -1198734s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -1198624s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -1198515s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -1198406s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -1198295s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -1198187s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -1198078s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -1197968s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -1197856s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -1197734s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -1197625s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -1197515s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7212	Thread sleep time: -1197406s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -33204139332677172s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -99875s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -99766s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -99637s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -99531s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -99422s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -99313s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -99188s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -99063s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -98953s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -98844s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -98719s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -98610s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -98485s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -98329s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -98154s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -98042s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -97723s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -97594s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -97485s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -97358s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -97163s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1199951s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1199839s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1199719s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1199609s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1199473s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1199335s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1199219s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1199105s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1198956s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1198828s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1198719s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1198411s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1198281s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1198172s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1198062s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1197953s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1197844s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1197734s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1197621s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1197500s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1197391s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1197276s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1197156s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1197047s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1196936s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1196828s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1196719s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1196594s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1196484s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7948	Thread sleep time: -1196375s >= -30000s

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 99874	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 99763	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 99546	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 99316	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 99187	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 99070	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 98953	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 98841	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 98734	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 98624	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 98515	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 98404	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 98296	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 98184	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 98078	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 97968	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 97859	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 97749	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 97640	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 97531	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 97421	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 97312	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 97203	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 97087	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 96984	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1200000	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1199874	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1199765	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1199656	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1199546	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1199437	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1199328	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1199214	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1199109	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1198999	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1198890	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1198781	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1198671	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1198551	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1198421	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1198312	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1198192	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1198062	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1197952	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1197839	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1197733	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1197624	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Thread delayed: delay time: 1197514	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 99875
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 99766
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 99657
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 99423
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 99297
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 99188
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 99077
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 98936
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 98828
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 98308
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 98203
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 98094
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 97969
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 95957
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 95829
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1200000
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1199887
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1199770
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1199637
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1199527
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1199418
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1199308
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1199199
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1199090
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1198980
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1198871
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1198746
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1198595
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1198465
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1198355
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1198245
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1198136
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1198027
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1197918
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1197808
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1197691
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1197558
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1197415
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1197257
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1197142
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1196894
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1196150
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1196023
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1195621
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1195511
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1195402
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1195292
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1195183
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1195072
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Thread delayed: delay time: 1194961
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99875
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99762
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99641
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99531
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99422
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99313
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99156
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99046
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98937
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98828
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98712
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98594
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98484
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98375
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98266
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98141
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98016
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97906
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97797
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97687
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97578
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97469
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97359
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97250
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97135
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199949
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199828
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199718
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199609
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199498
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199390
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199281
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199170
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199062
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198953
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198843
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198734
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198624
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198515
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198406
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198295
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198187
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198078
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197968
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197856
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197734
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197625
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197515
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197406
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99875
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99766
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99637
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99531
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99422
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99313
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99188
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 99063
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98953
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98844
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98719
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98610
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98485
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98329
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98154
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 98042
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97723
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97594
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97485
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97358
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 97163
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199951
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199839
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199719
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199609
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199473
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199335
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199219
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1199105
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198956
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198828
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198719
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198411
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198281
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198172
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1198062
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197953
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197844
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197734
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197621
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197500
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197391
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197276
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197156
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1197047
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1196936
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1196828
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1196719
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1196594
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1196484
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Thread delayed: delay time: 1196375

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_BjTxJte.exe_f5c09dd75b90d612af8c658c8837992c387ee89_843aacda_4690c535-c6af-41e6-8128-f3000ded106c\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_gDdsxauPhk.exe_e2c8de6e9dfbc3bf198524a8a8bae3ea56c2edb2_cb724c00_6c828731-bc0c-4d10-93b3-5ed4934f0644\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue

Source: BjTxJte.exe, 00000016.00000002.1923322227.0000000001709000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllv
Source: BjTxJte.exe, 00000012.00000002.1852257669.00000000010B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: Statement of Account PDF.bat.exe, 00000008.00000002.4073522473.00000000010CB000.00000004.00000020.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4074399117.00000000014AB000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 0000001E.00000002.4077118774.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Statement of Account PDF.bat.exe"
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gDdsxauPhk.exe"
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Statement of Account PDF.bat.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gDdsxauPhk.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Memory written: C:\Users\user\Desktop\Statement of Account PDF.bat.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Memory written: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory written: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Memory written: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Statement of Account PDF.bat.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gDdsxauPhk.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp690.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Process created: C:\Users\user\Desktop\Statement of Account PDF.bat.exe "C:\Users\user\Desktop\Statement of Account PDF.bat.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp216B.tmp"
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process created: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe "C:\Users\user\AppData\Roaming\gDdsxauPhk.exe"
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Process created: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe "C:\Users\user\AppData\Roaming\gDdsxauPhk.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp44D2.tmp"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp6598.tmp"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"

Source: Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000002FAB000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Users\user\Desktop\Statement of Account PDF.bat.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Users\user\Desktop\Statement of Account PDF.bat.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Queries volume information: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Queries volume information: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 25.2.BjTxJte.exe.4798530.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.BjTxJte.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.BjTxJte.exe.4963d80.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Statement of Account PDF.bat.exe.43bdcb0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Statement of Account PDF.bat.exe.43f8cd0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.BjTxJte.exe.4928d60.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.BjTxJte.exe.47d3550.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.BjTxJte.exe.47d3550.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.BjTxJte.exe.4928d60.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.BjTxJte.exe.4798530.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.BjTxJte.exe.4963d80.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Statement of Account PDF.bat.exe.43bdcb0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Statement of Account PDF.bat.exe.43f8cd0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.4081952252.000000000294B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.4080192144.0000000003081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.4080192144.00000000030D3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1916411729.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.1856813364.0000000004928000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1945703172.0000000004798000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.4080192144.00000000030CB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1928490064.000000000356C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1928490064.0000000003541000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4082420582.0000000002FAB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1928490064.0000000003574000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1700653245.0000000004337000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Statement of Account PDF.bat.exe PID: 6984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Statement of Account PDF.bat.exe PID: 7252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gDdsxauPhk.exe PID: 7720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 8032, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7220, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7752, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.Statement of Account PDF.bat.exe.7600000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Statement of Account PDF.bat.exe.3949970.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Statement of Account PDF.bat.exe.3949970.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Statement of Account PDF.bat.exe.7600000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1700653245.0000000003949000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1710196910.0000000007600000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account PDF.bat.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 25.2.BjTxJte.exe.4798530.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.BjTxJte.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.BjTxJte.exe.4963d80.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Statement of Account PDF.bat.exe.43bdcb0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Statement of Account PDF.bat.exe.43f8cd0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.BjTxJte.exe.4928d60.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.BjTxJte.exe.47d3550.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.BjTxJte.exe.47d3550.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.BjTxJte.exe.4928d60.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.BjTxJte.exe.4798530.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.BjTxJte.exe.4963d80.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Statement of Account PDF.bat.exe.43bdcb0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Statement of Account PDF.bat.exe.43f8cd0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.4081952252.000000000294B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.4080192144.0000000003081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1916411729.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.1856813364.0000000004928000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1945703172.0000000004798000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1928490064.0000000003541000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4082420582.0000000002FAB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1700653245.0000000004337000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Statement of Account PDF.bat.exe PID: 6984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Statement of Account PDF.bat.exe PID: 7252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gDdsxauPhk.exe PID: 7720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 8032, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7220, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7752, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 25.2.BjTxJte.exe.4798530.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.BjTxJte.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.BjTxJte.exe.4963d80.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Statement of Account PDF.bat.exe.43bdcb0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Statement of Account PDF.bat.exe.43f8cd0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.BjTxJte.exe.4928d60.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.BjTxJte.exe.47d3550.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.BjTxJte.exe.47d3550.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.BjTxJte.exe.4928d60.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.BjTxJte.exe.4798530.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.BjTxJte.exe.4963d80.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Statement of Account PDF.bat.exe.43bdcb0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Statement of Account PDF.bat.exe.43f8cd0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.4081952252.000000000294B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.4080192144.0000000003081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.4080192144.00000000030D3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1916411729.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.1856813364.0000000004928000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1945703172.0000000004798000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.4080192144.00000000030CB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1928490064.000000000356C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1928490064.0000000003541000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4082420582.0000000002FAB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1928490064.0000000003574000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1700653245.0000000004337000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Statement of Account PDF.bat.exe PID: 6984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Statement of Account PDF.bat.exe PID: 7252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gDdsxauPhk.exe PID: 7720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 8032, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7220, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BjTxJte.exe PID: 7752, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.Statement of Account PDF.bat.exe.7600000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Statement of Account PDF.bat.exe.3949970.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Statement of Account PDF.bat.exe.3949970.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Statement of Account PDF.bat.exe.7600000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1700653245.0000000003949000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1710196910.0000000007600000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	112 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	2 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	22 Software Packing	NTDS	221 Security Software Discovery	Distributed Component Object Model	21 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	2 Process Discovery	SSH	1 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	151 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	151 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Files and Directories	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Statement of Account PDF.bat.exe	47%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
Statement of Account PDF.bat.exe	57%	Virustotal		Browse
Statement of Account PDF.bat.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	47%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe	57%	Virustotal		Browse
C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	47%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Roaming\gDdsxauPhk.exe	57%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
mail.fascia-arch.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	Avira URL Cloud	safe
http://mail.fascia-arch.com	0%	Avira URL Cloud	safe
http://www.ascendercorp.com/typedesigners.htmlqX	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cn	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	Virustotal		Browse
http://www.zhongyicts.com.cn	1%	Virustotal		Browse
http://mail.fascia-arch.com	0%	Virustotal		Browse
http://www.founder.com.cn/cn/cThe	0%	Virustotal		Browse
http://www.founder.com.cn/cn	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.12.205	true	false		high
mail.fascia-arch.com	50.87.195.61	true	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.ascendercorp.com/typedesigners.htmlqX	Statement of Account PDF.bat.exe, 00000000.00000002.1707110996.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com	Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://account.dyn.com/	Statement of Account PDF.bat.exe, 00000000.00000002.1700653245.0000000004337000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000012.00000002.1856813364.0000000004928000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000016.00000002.1916411729.0000000000402000.00000040.00000400.00020000.00000000.sdmp, BjTxJte.exe, 00000019.00000002.1945703172.0000000004798000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.com	Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/t	gDdsxauPhk.exe, 0000000F.00000002.4080192144.0000000003031000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000016.00000002.1928490064.00000000034F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r3.i.lencr.org/0	Statement of Account PDF.bat.exe, 00000008.00000002.4121885551.0000000006729000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003385000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.000000000306D000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003244000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003135000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4121885551.0000000006707000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4123465356.0000000006762000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.00000000032E6000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4124030684.0000000006777000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.00000000030EC000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4123465356.000000000676E000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.000000000342C000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.000000000302F000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4073522473.00000000010CB000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000002FAB000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4151301532.0000000007DD8000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4121885551.000000000673F000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4150449840.0000000007DAB000.00000004.00000020.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.00000000030ED000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4121813503.00000000068ED000.00000004.00000020.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.0000000003136000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org	Statement of Account PDF.bat.exe, 00000000.00000002.1700653245.0000000004337000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.0000000003031000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000012.00000002.1856813364.0000000004928000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000016.00000002.1916411729.0000000000402000.00000040.00000400.00020000.00000000.sdmp, BjTxJte.exe, 00000016.00000002.1928490064.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000019.00000002.1945703172.0000000004798000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001E.00000002.4081952252.000000000290C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://mail.fascia-arch.com	Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003385000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.000000000306D000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003244000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003135000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.00000000032E6000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.00000000030EC000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.000000000342C000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.00000000030ED000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.0000000003136000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.0000000003227000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.00000000030CB000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000016.00000002.1928490064.000000000356C000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001E.00000002.4081952252.0000000002D9F000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001E.00000002.4081952252.0000000002A42000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001E.00000002.4081952252.0000000002CF8000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001E.00000002.4081952252.0000000002BC0000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001E.00000002.4081952252.0000000002B78000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001E.00000002.4081952252.0000000002C5F000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001E.00000002.4081952252.0000000002ADB000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	Statement of Account PDF.bat.exe, 00000008.00000002.4121885551.0000000006729000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4151590709.0000000007DE4000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003385000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.000000000306D000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003244000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003135000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4073522473.0000000001040000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.00000000032E6000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4073522473.000000000106A000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4124030684.0000000006777000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4120771933.00000000066C6000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.00000000030EC000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.000000000342C000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4073522473.00000000010CB000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4151301532.0000000007DD8000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4121885551.000000000673F000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4150449840.0000000007DAB000.00000004.00000020.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.00000000030ED000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4121813503.00000000068ED000.00000004.00000020.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.0000000003136000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4074399117.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	Statement of Account PDF.bat.exe, 00000008.00000002.4121885551.0000000006729000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4151590709.0000000007DE4000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003385000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.000000000306D000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003244000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003135000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4073522473.0000000001040000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.00000000032E6000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4073522473.000000000106A000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4124030684.0000000006777000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4120771933.00000000066C6000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.00000000030EC000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.000000000342C000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4073522473.00000000010CB000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4151301532.0000000007DD8000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4121885551.000000000673F000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4150449840.0000000007DAB000.00000004.00000020.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.00000000030ED000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4121813503.00000000068ED000.00000004.00000020.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.0000000003136000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4074399117.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r3.o.lencr.org0	Statement of Account PDF.bat.exe, 00000008.00000002.4121885551.0000000006729000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003385000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.000000000306D000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003244000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000003135000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4121885551.0000000006707000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4123465356.0000000006762000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.00000000032E6000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4124030684.0000000006777000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.00000000030EC000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4123465356.000000000676E000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.000000000342C000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.000000000302F000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4073522473.00000000010CB000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000002FAB000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4121885551.000000000673F000.00000004.00000020.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4150449840.0000000007DAB000.00000004.00000020.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.00000000030ED000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4121813503.00000000068ED000.00000004.00000020.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.0000000003136000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4074399117.000000000148A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Statement of Account PDF.bat.exe, 00000000.00000002.1699276440.00000000029BD000.00000004.00000800.00020000.00000000.sdmp, Statement of Account PDF.bat.exe, 00000008.00000002.4082420582.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000A.00000002.1763034515.00000000025BD000.00000004.00000800.00020000.00000000.sdmp, gDdsxauPhk.exe, 0000000F.00000002.4080192144.0000000003031000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000012.00000002.1853285183.0000000002E70000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000012.00000002.1853285183.0000000002C46000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000016.00000002.1928490064.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000019.00000002.1940766232.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000019.00000002.1940766232.0000000002CE0000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001E.00000002.4081952252.000000000290C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	Statement of Account PDF.bat.exe, 00000000.00000002.1707492672.0000000006D32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
50.87.195.61	mail.fascia-arch.com	United States		46606	UNIFIEDLAYER-AS-1US	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432040
Start date and time:	2024-04-26 10:32:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	34
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Statement of Account PDF.bat.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@36/32@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 462 Number of non-executed functions: 30
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92, 20.189.173.21
Excluded domains from analysis (whitelisted): fs.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:32:57	Task Scheduler	Run new task: gDdsxauPhk path: C:\Users\user\AppData\Roaming\gDdsxauPhk.exe
09:32:59	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run BjTxJte C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
09:33:08	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run BjTxJte C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
10:32:52	API Interceptor	5944805x Sleep call for process: Statement of Account PDF.bat.exe modified
10:32:56	API Interceptor	31x Sleep call for process: powershell.exe modified
10:33:00	API Interceptor	1374237x Sleep call for process: gDdsxauPhk.exe modified
10:33:09	API Interceptor	4809222x Sleep call for process: BjTxJte.exe modified
10:33:14	API Interceptor	3x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SecuriteInfo.com.Backdoor.Win32.Agent.myuuxz.13708.17224.exe	Get hash	malicious	Bunny Loader	Browse	api.ipify.org/
	lods.cmd	Get hash	malicious	Remcos	Browse	api.ipify.org/
50.87.195.61	vbc.exe	Get hash	malicious	FormBook	Browse	www.vegrebel.com/nnmd/?VRNp=wBZl4vkh1&MvdD=iedGY0/hYfrjbbwxufAPjCijJp09b4Pnd9RoleXu3W9ZUfsJsAn0SGbENHPecaFD81L2
50.87.195.61	SWIFT COPY_PDF.exe	Get hash	malicious	FormBook	Browse	www.smguidetowkw.com/m2be/?Et5pFP9=GRobwBHqsz/I/K6QMyhqlyyiibK6nxcxU5TpJro9yIpA+ftqAp39OLT0oN0WcJ2Wu53Xy7WDvg==&uDKLJ=D48t

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.fascia-arch.com	SOA FOR APR 2024 PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.195.61
	DHL STATEMENT OF ACCOUNT - 1003657363.exe	Get hash	malicious	AgentTesla	Browse	50.87.195.61
	PO.exe	Get hash	malicious	AgentTesla	Browse	50.87.195.61
	IOJMZilMeH.exe	Get hash	malicious	AgentTesla	Browse	50.87.195.61
	PO#7A68D20.exe	Get hash	malicious	AgentTesla	Browse	50.87.195.61
api.ipify.org	CHEMICAL SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Payment.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	SOA FOR APR 2024 PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	Payment Swift.doc	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://lide.alosalca.fun/highbox#joeblow@xyz.com	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	http://asana.wf	Get hash	malicious	Unknown	Browse	172.67.74.152
	o3KyzpE7F4.ps1	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	http://wsj.pm	Get hash	malicious	NetSupport RAT	Browse	104.26.12.205
	16770075581.zip	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	SecuriteInfo.com.Win32.PWSX-gen.18376.4403.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://powerpointmicrosoftoffice.top/	Get hash	malicious	Unknown	Browse	104.17.3.184
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:d35aec95-f365-414c-8371-68e6d7d2ec41	Get hash	malicious	Unknown	Browse	104.17.28.92
	150-425-2024.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	CHEMICAL SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Payment.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://usigroups-my.sharepoint.com/:o:/p/js/Es3HdUJZlbVJngCJE-Z7JCYBUTZvd1ZCMQwZhhlQoy_hDw?e=mT2aQm	Get hash	malicious	HTMLPhisher	Browse	172.67.144.70
	SOA FOR APR 2024 PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	http://householdshop.club/	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://xred.site50.net/syn/SSLLibrary.dll	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://tracking.theimpco.com/tracking/click?d=OrpweRVshItmHO3qVpYwg0JJ3qp4iuwmt5687ge2H9uFpmeuDd2X4dPYczAnrgigX6DFu-Km6YtBvUpjEWnC0qAPektAg_1gGuxaDYDl5nf8rOcHvuOtOBIWknNeVHzB3g2	Get hash	malicious	Unknown	Browse	1.1.1.1
UNIFIEDLAYER-AS-1US	Quotation Order.exe	Get hash	malicious	AgentTesla	Browse	192.254.225.166
	DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.253.239
	CHEMICAL SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse	192.254.225.136
	SOA FOR APR 2024 PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.195.61
	INQ No. HDPE-16-GM-00- PI-INQ-3001.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	162.240.81.18
	DOC-Zcns1G_.html	Get hash	malicious	HTMLPhisher	Browse	192.232.216.145
	DOC-Zcns1G_.html	Get hash	malicious	HTMLPhisher	Browse	192.232.216.145
	DOC-Zcns1G_.html	Get hash	malicious	HTMLPhisher	Browse	192.232.216.145
	https://www.bing.com/ck/a?!&&p=8c604c2d3901cb1eJmltdHM9MTcxMjc5MzYwMCZpZ3VpZD0wODdjNjgyYy00N2ZlLTYyOGQtMzA1ZC03YmVmNDY5NTYzNjUmaW5zaWQ9NTE2MQ&ptn=3&ver=2&hsh=3&fclid=087c682c-47fe-628d-305d-7bef46956365&u=a1aHR0cHM6Ly9rZWljb3NlY3VyaXR5LmNvbS5teC8&ntb=1	Get hash	malicious	Unknown	Browse	192.185.214.24
	https://web.lehighvalleychamber.org/cwt/external/wcpages/referral.aspx?ReferralType=W&ProfileID=5337&ListingID=4065&CategoryID=74&SubCategoryID=0&url=//sanemedia.ca/owaow/yjyo8q/bWFyaWEud29qY2llY2hvd3NraUBjby5tb25tb3V0aC5uai51cw==	Get hash	malicious	HTMLPhisher	Browse	162.241.120.242

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	CHEMICAL SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Payment.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	SOA FOR APR 2024 PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	DHL_ES567436735845755676678877988975877.vbs	Get hash	malicious	FormBook, GuLoader, Remcos	Browse	104.26.12.205
	PO-inv-CQV20(92315).exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	a.cmd	Get hash	malicious	Unknown	Browse	104.26.12.205
	http://papajoeschicago.com	Get hash	malicious	Unknown	Browse	104.26.12.205
	https://www.bing.com/ck/a?!&&p=8c604c2d3901cb1eJmltdHM9MTcxMjc5MzYwMCZpZ3VpZD0wODdjNjgyYy00N2ZlLTYyOGQtMzA1ZC03YmVmNDY5NTYzNjUmaW5zaWQ9NTE2MQ&ptn=3&ver=2&hsh=3&fclid=087c682c-47fe-628d-305d-7bef46956365&u=a1aHR0cHM6Ly9rZWljb3NlY3VyaXR5LmNvbS5teC8&ntb=1	Get hash	malicious	Unknown	Browse	104.26.12.205
	o3KyzpE7F4.ps1	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	https://web.lehighvalleychamber.org/cwt/external/wcpages/referral.aspx?ReferralType=W&ProfileID=5337&ListingID=4065&CategoryID=74&SubCategoryID=0&url=//sanemedia.ca/owaow/yjyo8q/bWFyaWEud29qY2llY2hvd3NraUBjby5tb25tb3V0aC5uai51cw==	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_BjTxJte.exe_f5c09dd75b90d612af8c658c8837992c387ee89_843aacda_4690c535-c6af-41e6-8128-f3000ded106c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2837376433510128
Encrypted:	false
SSDEEP:	192:A+lB/n9+0Wbk9aGOJo1ZrFmCozuiFxZ24IO87:RpnfWbk9ah1DzuiFxY4IO87
MD5:	22425F011EE5D1D2BDBD23A46D7FFC03
SHA1:	1B709DBFF1EFC0887DA605E47356819E8CA367E6
SHA-256:	A3EAF2A0F48042F92E3FBBF2DC0327F93CB453FC909DD15AC48F4C3374021DEE
SHA-512:	82CEA5F34241A5164978F36C70C96204B4C5A904F7D938E35CC92A5AB81838FB66B86A812D2900E5DB9B3EC813FAE7EE02C9ADA5570C61EC588BB4915DC71C5F
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.5.9.3.9.9.2.5.3.9.5.1.4.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.5.9.3.9.9.3.5.5.5.1.3.5.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.6.9.0.c.5.3.5.-.c.6.a.f.-.4.1.e.6.-.8.1.2.8.-.f.3.0.0.0.d.e.d.1.0.6.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.d.2.f.4.e.0.0.-.c.f.b.b.-.4.a.b.e.-.a.3.9.9.-.9.7.2.b.f.d.6.2.f.2.b.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.B.j.T.x.J.t.e...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.U.b.K...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.f.6.0.-.0.0.0.1.-.0.0.1.4.-.5.0.4.1.-.f.5.5.d.b.4.9.7.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.5.1.e.f.b.7.d.8.8.b.b.f.d.1.3.c.c.9.b.4.2.c.3.0.0.e.f.a.6.d.d.0.0.0.0.0.0.0.0.!.0.0.0.0.f.d.3.e.0.6.2.1.2.f.9.d.a.3.6.5.c.2.1.0.6.d.c.d.8.0.8.c.a.f.2.9.1.c.c.b.3.a.2.a.!.B.j.T.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_BjTxJte.exe_f5c09dd75b90d612af8c658c8837992c387ee89_843aacda_f7977af1-9a55-4b84-b1d5-dbe8f1aea04e\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2772764358652007
Encrypted:	false
SSDEEP:	192:kmGV/T9+0Wbk9ayU+myZr07ptzuiFgZ24IO87:pGFTfWbk9a7FjzuiFgY4IO87
MD5:	F44AC2F4A44A07012BAA8F3EC782F63C
SHA1:	C34CF51938DC53EDF48124A09AE0B60C502AD1D6
SHA-256:	5D7744177B4B5CF1CC0B0F5CDB4CEC5D788ABE70BEE58213318BF435A9E49614
SHA-512:	262F198AB0674C530553F65256871E26186C570C0C33AC126B532328B0CC0A0909495CF8867133471C0D8D0D96416DCBB6900288C16AD3CB6F48039F428B24F0
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.5.9.4.0.0.0.9.0.3.2.3.7.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.5.9.4.0.0.1.4.1.8.8.6.7.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.7.9.7.7.a.f.1.-.9.a.5.5.-.4.b.8.4.-.b.1.d.5.-.d.b.e.8.f.1.a.e.a.0.4.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.b.c.4.a.3.9.d.-.7.e.c.3.-.4.7.6.4.-.8.e.a.3.-.b.2.8.b.d.f.d.6.a.3.5.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.B.j.T.x.J.t.e...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.U.b.K...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.e.8.-.0.0.0.1.-.0.0.1.4.-.7.0.c.e.-.f.3.6.2.b.4.9.7.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.5.1.e.f.b.7.d.8.8.b.b.f.d.1.3.c.c.9.b.4.2.c.3.0.0.e.f.a.6.d.d.0.0.0.0.0.0.0.0.!.0.0.0.0.f.d.3.e.0.6.2.1.2.f.9.d.a.3.6.5.c.2.1.0.6.d.c.d.8.0.8.c.a.f.2.9.1.c.c.b.3.a.2.a.!.B.j.T.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_gDdsxauPhk.exe_e2c8de6e9dfbc3bf198524a8a8bae3ea56c2edb2_cb724c00_6c828731-bc0c-4d10-93b3-5ed4934f0644\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2882566430890479
Encrypted:	false
SSDEEP:	192:OrpvXMp+0WbkNauOJo1ZrFmCjkzuiFgZ24IO8kn:IvMrWbkNap1gkzuiFgY4IO8k
MD5:	3AD43F30EC2A54F891CB1CF16EF05701
SHA1:	CA106098A54EC28F039FAAF351716D8F14E1686D
SHA-256:	0B56D7AD9FD97ACD42B690E84594FBD4DF5E1E4BBCE645275AB1704D22EF6D05
SHA-512:	05044E1BB36F2C3A7BD87FB6F49395F8778A44F15985A5076467F87B8A6CF246964C575CE5A1FF565BD3A7D72A52DB26483A158D28A3BAD59A48DE8F2DDD845B
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.5.9.3.9.8.3.5.7.9.7.3.2.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.5.9.3.9.8.4.5.6.4.1.1.1.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.c.8.2.8.7.3.1.-.b.c.0.c.-.4.d.1.0.-.9.3.b.3.-.5.e.d.4.9.3.4.f.0.6.4.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.a.3.8.7.e.4.4.-.b.d.1.5.-.4.e.f.3.-.8.6.0.9.-.d.1.0.4.f.e.5.c.5.7.b.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.g.D.d.s.x.a.u.P.h.k...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.U.b.K...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.1.0.-.0.0.0.1.-.0.0.1.4.-.6.6.e.5.-.f.d.5.6.b.4.9.7.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.5.1.e.f.b.7.d.8.8.b.b.f.d.1.3.c.c.9.b.4.2.c.3.0.0.e.f.a.6.d.d.0.0.0.0.0.0.0.0.!.0.0.0.0.f.d.3.e.0.6.2.1.2.f.9.d.a.3.6.5.c.2.1.0.6.d.c.d.8.0.8.c.a.f.2.9.1.c.c.b.3.a.2.a.!.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER123.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4736
Entropy (8bit):	4.459056297565655
Encrypted:	false
SSDEEP:	48:cvIwWl8zs1Jg77aI9t6WpW8VYkYm8M4JdS2yFD++q8vqS29/NNPLSDd:uIjfPI7L77VsJxKs//zSDd
MD5:	FAAFD1345CE621FE7FE244DDC4652D11
SHA1:	18170FC6E098EDA119CCA1407AC3DA462C951B47
SHA-256:	945A3AE7BF519B317A686FE782124D145881A7EB4C3708AE161348E0BA5D45A4
SHA-512:	E1BB8616D25A65981AFDAFEC1692975E454E119A88534D35AD23527DAFD7A5591ACB98DFB64729C6B1F56EDC492F2882A7CE03104C9BF77640BE1E2BE2E1BDE0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="296615" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER211D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Apr 26 08:33:13 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	242199
Entropy (8bit):	4.534388695167162
Encrypted:	false
SSDEEP:	3072:ClR+U4uEqMQPbEDLTguhWy8E4OBqqWxYTqP:ClIU4lQPbsTgucy8LXYo
MD5:	080662EE6631655199D65F68221C6D94
SHA1:	0B4BBA1A5F9B1F96DA49646B5EC1762068D1E461
SHA-256:	9EA784CEEC5BE4531E3D0CF3941C13509FC2004E90E2DDB7DB3B3153E1ABBED6
SHA-512:	5DB37387AF8F29AAC7C97D93B5EB2C9DC6668B21D35F451923DB7FEF17D6FBFE8A2AB29A31C443F5E864641A09864168F034661A4A489289702E583E1AE8E3A7
Malicious:	false
Preview:	MDMP..a..... ........f+f............d...........t#..x.......$....*......4&...@..........`.......8...........T...........8F...k...........+...........,..............................................................................eJ.......-......GenuineIntel............T.......`....f+f............................. ..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2312.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8400
Entropy (8bit):	3.684054244990612
Encrypted:	false
SSDEEP:	192:R6l7wVeJns69rUG6Y91SU9S3ongmfZivprc89bM5sfTEm:R6lXJs69rV6YvSU9S3AgmfY7MSfV
MD5:	CE15E1E6FB4A96EA97EEB3B524CD757F
SHA1:	572D2F9B9AFFA4626ACD540FC407078648F99605
SHA-256:	6CB860F036EF7FB60332AA5F4701A9D75C94104C8F6D5E8B0E3568F25D2C2F35
SHA-512:	EFF4845D78F316FF557FC5617DBC010AB788A56C574B7E35E9CDDA5C695E1069200415494841394FCABC269B66E55BE463091DCBFE56A2B347FE2F6C5BFCF878
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.8.0.3.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2351.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4721
Entropy (8bit):	4.456323326510158
Encrypted:	false
SSDEEP:	48:cvIwWl8zs1Jg77aI9t6WpW8VYqYm8M4JjegS2yFvVP+q8v5gS280NNPiSfSXd:uIjfPI7L77VqJjepPK5a/KSfSXd
MD5:	375DB68D7B1CC703F2F0502DF0142728
SHA1:	EDDA5F9F7F21E22EAC086EAEEF8D2B7AEE12AD5B
SHA-256:	07314E2787F612BE31A782C1EB97D36D887B7EA101FE71B344B9F19E14642D8A
SHA-512:	3FD5D502F8B9EC0C2DFF70FB9C832CDC6F2A2B382B8A0822DEE6925DA2AD7B5D0FD1308C0891C3B901FC61D36C66CFB557D72DEDB90222D9930871E666871FEB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="296615" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4195.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Apr 26 08:33:21 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	241565
Entropy (8bit):	4.52679090454485
Encrypted:	false
SSDEEP:	1536:JYaDO7KNuBojRwpN4uE2aOFdE7BLTgOoprZy59SVXNekxAcNtWdWCD4VBtT/LvLN:Jrm4uEq/EFLTgPrQzy9dA4dvjfvQQTj
MD5:	7740E6B901C4694A63A280BB49964454
SHA1:	B75D32A1A908290432BE7AEA7CDA778B3D93C880
SHA-256:	4B286F48A92715C79E5D8A0B9B516E2B392E78C291A9C1D4ABA8C4D8EF02CC74
SHA-512:	E4457D2574271EBA3092867B0F2DFE8CE793D1AB5B36143FACDA6D7F05D3FE8F96B0F85D36229DE3F9D820F9EE2966D21CFC8A543D02F72196DC1AB4CFC48F7A
Malicious:	false
Preview:	MDMP..a..... ........f+f............d............#..x.......$..........D&..8@..........`.......8...........T............D...j......................,..............................................................................eJ......(-......GenuineIntel............T............f+f............................. ..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4281.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8400
Entropy (8bit):	3.683470550398823
Encrypted:	false
SSDEEP:	192:R6l7wVeJdn6qle6Y9vSU9N3MgmfZivprg89b9WsfScfm:R6lXJN6qle6YFSU9N3MgmfYP91fSZ
MD5:	283742E8C860E5EFFCB9D7DCAF60B47C
SHA1:	9BE7D371B03F81BAB383622933A865EBD30D84A4
SHA-256:	4025B984AC9D176678D53D1BED21BDA6970D02BAC5D075E8EBD9561538586FA3
SHA-512:	CC795158676A45E01858AA8B350F1E096C4961E64BBEF5E587E20578AAE786EC5E698D4A3E6911B481A93AE2125B92F19BC41BF036575EBAFBDFA33D390D5B05
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.0.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER42A1.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4721
Entropy (8bit):	4.45504601655123
Encrypted:	false
SSDEEP:	48:cvIwWl8zskJg77aI9t6WpW8VYtvYm8M4JjegS2yFTY6E5j+q8v5gS2cSNNPiSfSS:uIjfiI7L77V9JjeI6E5jK5PS/KSfSsd
MD5:	7E9EEAED225228C9F2553FC90A5B00AD
SHA1:	E8F8B332BAE0433E06FB210265B5F9F1F0C2E226
SHA-256:	4AA5DC1EC1881B4D446BE3C5BEFBF90491FA52DDF205F8403512136743B2CF0C
SHA-512:	9D6D3962118EE9EDEB0BB252F1F953D7B438F21F3D5E1BADA918272BCFB0AAF05ECCB793B55763ADCDD64BA3B99B3601EB9FF8516DD549C2DBFBB3672625E4EF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="296616" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC5.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6386
Entropy (8bit):	3.6994495792577573
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetb1r61YZ+Vn7EgaM4Un89byFsf22HGm:R6l7wVeJ1r61YZ+vprn89byFsfvmm
MD5:	8CDC796D862160F853DF372A1F31B94B
SHA1:	908D9D031B799570ED8605E8EA69BC92E5283A34
SHA-256:	A2854D3EFB5B7A24B3CC59BC1BFE207070808B11F13CC82D5580C43F616EB37B
SHA-512:	77BE2F2AE2AC71CF9DD7E5706EB4B755466D09D809196F421A53855F84BADC7BF3B9B2E98383801DE8A42C6FEC65ED72A8C40AC5631A11429947DC5FB148D5D7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFDF5.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Apr 26 08:33:04 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	242961
Entropy (8bit):	4.5052908898061155
Encrypted:	false
SSDEEP:	3072:nLLU4uEqoEoLTgHsbQpyAwiLesovQ436DKR:nLLU4zLTgMbQpyrvvD32K
MD5:	0E31274DABC416C3C4FC90269CEFBE2C
SHA1:	B7C41643B2DE9CBD55C6B9C460ADF6D1658F682E
SHA-256:	5EDD73084ED5A40639CAE3E1376E9C225BAC2F7DF9CE55B80F6D3401CF368F0E
SHA-512:	B291E9088F833DE41D61CE1B9E478FB3CFA715EF943FCF77E99C25D036E86A52C27454F41CA761B88824E01F590798FC6F46BAADC043EA1E211830AE04D0004C
Malicious:	false
Preview:	MDMP..a..... ........f+f............d............#..x.......<...X+.......%..zA..........`.......8...........T...........`F...n...........+...........-..............................................................................eJ..............GenuineIntel............T............f+f............................. ..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BjTxJte.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Statement of Account PDF.bat.exe.log

Download File

Process:	C:\Users\user\Desktop\Statement of Account PDF.bat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\gDdsxauPhk.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\gDdsxauPhk.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380192968514367
Encrypted:	false
SSDEEP:	48:+WSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//ZeUyus:+LHyIFKL3IZ2KRH9Ougos
MD5:	DFB938AC479D63575631BF9D1D7CEC60
SHA1:	F42EBC6B0B4823B8600DC05237BDBCBA940C3CF1
SHA-256:	38298BB292A779EA5009599691C03E780306D6E52CDA6A26AFA339F31FB2870D
SHA-512:	F58116AE16C58A04775F0EB7992F7187805FA279461781311E018379C5AC383B75B72AE768CAB888919125D6EBFB83FAAD8811CE72867852A90832F82A79C7DE
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_22v4wkjd.x43.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bw4kxm1v.dz4.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fvzfr0w2.3zk.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gof1kgrj.hnd.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hpi3oywo.nkt.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hv0x0w2p.gdl.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_netipabd.v3k.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rqliqtw1.olg.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp216B.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\gDdsxauPhk.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1576
Entropy (8bit):	5.107376380597849
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtasxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTxv
MD5:	9D7F39C8E0667388818F45A197737E62
SHA1:	53D78BAF1CB57A444E85767F3641A792A62B3295
SHA-256:	972C48F606DF7A57676FD06674BDE849337270E4FC65AFECA873504C712B336C
SHA-512:	D1B65497DFADAA90A14B2C4D5E87E9941AC41718B9A6AACEA23BA73319F47C90AAEDE32B2323A36B69498ABCE1E4F7A1EF2BD87F3D5AF3BC5DFF3F2757CB2EE2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmp44D2.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1576
Entropy (8bit):	5.107376380597849
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtasxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTxv
MD5:	9D7F39C8E0667388818F45A197737E62
SHA1:	53D78BAF1CB57A444E85767F3641A792A62B3295
SHA-256:	972C48F606DF7A57676FD06674BDE849337270E4FC65AFECA873504C712B336C
SHA-512:	D1B65497DFADAA90A14B2C4D5E87E9941AC41718B9A6AACEA23BA73319F47C90AAEDE32B2323A36B69498ABCE1E4F7A1EF2BD87F3D5AF3BC5DFF3F2757CB2EE2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmp6598.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
File Type:	XML 1.0 document, ASCII text
Category:	modified
Size (bytes):	1576
Entropy (8bit):	5.107376380597849
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtasxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTxv
MD5:	9D7F39C8E0667388818F45A197737E62
SHA1:	53D78BAF1CB57A444E85767F3641A792A62B3295
SHA-256:	972C48F606DF7A57676FD06674BDE849337270E4FC65AFECA873504C712B336C
SHA-512:	D1B65497DFADAA90A14B2C4D5E87E9941AC41718B9A6AACEA23BA73319F47C90AAEDE32B2323A36B69498ABCE1E4F7A1EF2BD87F3D5AF3BC5DFF3F2757CB2EE2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmp690.tmp

Download File

Process:	C:\Users\user\Desktop\Statement of Account PDF.bat.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1576
Entropy (8bit):	5.107376380597849
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtasxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTxv
MD5:	9D7F39C8E0667388818F45A197737E62
SHA1:	53D78BAF1CB57A444E85767F3641A792A62B3295
SHA-256:	972C48F606DF7A57676FD06674BDE849337270E4FC65AFECA873504C712B336C
SHA-512:	D1B65497DFADAA90A14B2C4D5E87E9941AC41718B9A6AACEA23BA73319F47C90AAEDE32B2323A36B69498ABCE1E4F7A1EF2BD87F3D5AF3BC5DFF3F2757CB2EE2
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe

Download File

Process:	C:\Users\user\Desktop\Statement of Account PDF.bat.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	709632
Entropy (8bit):	7.947855789155266
Encrypted:	false
SSDEEP:	12288:lYIPXj/PqfEKyBVaLXKfjJUKJepONj9BtjWVpFZt/DAjB4Bd:lYIPesVaLXKnJeAj9BtqzFHiWX
MD5:	8DB4915BA4E6BB27CB249554A18A9F4C
SHA1:	FD3E06212F9DA365C2106DCD808CAF291CCB3A2A
SHA-256:	470E7BCB766A436B50D28E362621B59467B6E6AA4146B467F4175A8B5C9EAA04
SHA-512:	EC42A9DE73E4E79911CF870FD3D41392B1DC5726CEB4660BA8D7BC4BBEDEE9A3E111CB5426B3D3797C8517CEBB2BDBB4E7D3A96590EE14F2BB89B4A3E286B50C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47% Antivirus: Virustotal, Detection: 57%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j................0.............".... ........@.. .......................@............@.....................................O.......\|.................... ..........p............................................ ............... ..H............text...H.... ...................... ..`.rsrc...\|...........................@..@.reloc....... ......................@..B........................H............N......+....................................................0...........sq...}.....st...}.....st...}.....sX...}.....s....}.....sj...}.....s....}.....sj...}.....sl...}.....sR...}.....s....}.....s....}.....s]...}......}.....(.......()........{....(.......{&...(......(......(.........0............{.....{....o~.....{.....{....ox.....{.....{....ov.....{.....{....o\|.....{.....{....oz.....{.....o......{.....o......{.....o......{.....o......{.....o......{#...r...p.{...

C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Statement of Account PDF.bat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\gDdsxauPhk.exe

Download File

Process:	C:\Users\user\Desktop\Statement of Account PDF.bat.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	709632
Entropy (8bit):	7.947855789155266
Encrypted:	false
SSDEEP:	12288:lYIPXj/PqfEKyBVaLXKfjJUKJepONj9BtjWVpFZt/DAjB4Bd:lYIPesVaLXKnJeAj9BtqzFHiWX
MD5:	8DB4915BA4E6BB27CB249554A18A9F4C
SHA1:	FD3E06212F9DA365C2106DCD808CAF291CCB3A2A
SHA-256:	470E7BCB766A436B50D28E362621B59467B6E6AA4146B467F4175A8B5C9EAA04
SHA-512:	EC42A9DE73E4E79911CF870FD3D41392B1DC5726CEB4660BA8D7BC4BBEDEE9A3E111CB5426B3D3797C8517CEBB2BDBB4E7D3A96590EE14F2BB89B4A3E286B50C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47% Antivirus: Virustotal, Detection: 57%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j................0.............".... ........@.. .......................@............@.....................................O.......\|.................... ..........p............................................ ............... ..H............text...H.... ...................... ..`.rsrc...\|...........................@..@.reloc....... ......................@..B........................H............N......+....................................................0...........sq...}.....st...}.....st...}.....sX...}.....s....}.....sj...}.....s....}.....sj...}.....sl...}.....sR...}.....s....}.....s....}.....s]...}......}.....(.......()........{....(.......{&...(......(......(.........0............{.....{....o~.....{.....{....ox.....{.....{....ov.....{.....{....o\|.....{.....{....oz.....{.....o......{.....o......{.....o......{.....o......{.....o......{#...r...p.{...

C:\Users\user\AppData\Roaming\gDdsxauPhk.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Statement of Account PDF.bat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.947855789155266
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Statement of Account PDF.bat.exe
File size:	709'632 bytes
MD5:	8db4915ba4e6bb27cb249554a18a9f4c
SHA1:	fd3e06212f9da365c2106dcd808caf291ccb3a2a
SHA256:	470e7bcb766a436b50d28e362621b59467b6e6aa4146b467f4175a8b5c9eaa04
SHA512:	ec42a9de73e4e79911cf870fd3d41392b1dc5726ceb4660ba8d7bc4bbedee9a3e111cb5426b3d3797c8517cebb2bdbb4e7d3a96590ee14f2bb89b4a3e286b50c
SSDEEP:	12288:lYIPXj/PqfEKyBVaLXKfjJUKJepONj9BtjWVpFZt/DAjB4Bd:lYIPesVaLXKnJeAj9BtqzFHiWX
TLSH:	3CE412402AF85B67F97D73F80520255843F02A296A63FB4C2FD0A2E3257B7954B50B7B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j.................0.............".... ........@.. .......................@............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4ae922
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x9CBFCD6A [Fri May 2 16:20:58 2053 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
xor eax, 35455354h
xor dword ptr [edi+eax*2], esi
dec eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx+4Ah], dl
push ebx
cmp byte ptr [eax+edi+34h], al
inc ebx
inc ebx
xor al, 37h
xor eax, 00000035h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xae8cf	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb0000	0x57c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xacaec	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xac948	0xaca00	cc6f8d495a151764c88415effb41004d	False	0.9525550438993483	data	7.953860448849022	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb0000	0x57c	0x600	1f75e371351229bd6b94315dca34c3bf	False	0.4108072916666667	data	4.003547176750001	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb2000	0xc	0x200	aa8be37c15602334eb6c67566044895a	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xb0090	0x2ec	data			0.43983957219251335
RT_MANIFEST	0xb038c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 10:32:57.959342957 CEST	49734	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:32:57.959407091 CEST	443	49734	104.26.12.205	192.168.2.4
Apr 26, 2024 10:32:57.959517002 CEST	49734	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:32:57.990559101 CEST	49734	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:32:57.990588903 CEST	443	49734	104.26.12.205	192.168.2.4
Apr 26, 2024 10:32:58.258552074 CEST	443	49734	104.26.12.205	192.168.2.4
Apr 26, 2024 10:32:58.258658886 CEST	49734	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:32:58.278544903 CEST	49734	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:32:58.278615952 CEST	443	49734	104.26.12.205	192.168.2.4
Apr 26, 2024 10:32:58.279619932 CEST	443	49734	104.26.12.205	192.168.2.4
Apr 26, 2024 10:32:58.323865891 CEST	49734	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:32:58.380043983 CEST	49734	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:32:58.420130968 CEST	443	49734	104.26.12.205	192.168.2.4
Apr 26, 2024 10:32:58.577439070 CEST	443	49734	104.26.12.205	192.168.2.4
Apr 26, 2024 10:32:58.577573061 CEST	443	49734	104.26.12.205	192.168.2.4
Apr 26, 2024 10:32:58.577667952 CEST	49734	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:32:58.584738970 CEST	49734	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:32:59.556538105 CEST	49736	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:32:59.753226042 CEST	587	49736	50.87.195.61	192.168.2.4
Apr 26, 2024 10:32:59.753345013 CEST	49736	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:00.070991039 CEST	587	49736	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:00.074568987 CEST	49736	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:00.271383047 CEST	587	49736	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:00.271923065 CEST	49736	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:00.470662117 CEST	587	49736	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:00.472225904 CEST	49736	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:00.680167913 CEST	587	49736	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:00.680197001 CEST	587	49736	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:00.680213928 CEST	587	49736	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:00.680294991 CEST	49736	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:00.715018034 CEST	49736	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:00.911931992 CEST	587	49736	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:00.914824963 CEST	49736	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:01.111970901 CEST	587	49736	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:01.113197088 CEST	49736	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:01.312346935 CEST	587	49736	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:01.312803030 CEST	49736	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:01.551106930 CEST	587	49736	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:01.620796919 CEST	587	49736	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:01.624671936 CEST	49736	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:01.822881937 CEST	587	49736	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:01.823427916 CEST	587	49736	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:01.823704004 CEST	49736	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:02.062201977 CEST	587	49736	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:02.074182034 CEST	587	49736	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:02.074415922 CEST	49736	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:02.271310091 CEST	587	49736	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:02.271348000 CEST	587	49736	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:02.271990061 CEST	49736	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:02.272042990 CEST	49736	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:02.272079945 CEST	49736	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:02.272104979 CEST	49736	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:02.469218016 CEST	587	49736	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:02.469372988 CEST	587	49736	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:02.469969988 CEST	587	49736	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:02.511368036 CEST	49736	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:04.312026024 CEST	49737	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:33:04.312068939 CEST	443	49737	104.26.12.205	192.168.2.4
Apr 26, 2024 10:33:04.312144041 CEST	49737	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:33:04.316140890 CEST	49737	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:33:04.316154957 CEST	443	49737	104.26.12.205	192.168.2.4
Apr 26, 2024 10:33:04.575211048 CEST	443	49737	104.26.12.205	192.168.2.4
Apr 26, 2024 10:33:04.575318098 CEST	49737	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:33:04.576860905 CEST	49737	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:33:04.576869011 CEST	443	49737	104.26.12.205	192.168.2.4
Apr 26, 2024 10:33:04.577203989 CEST	443	49737	104.26.12.205	192.168.2.4
Apr 26, 2024 10:33:04.620735884 CEST	49737	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:33:04.670937061 CEST	49737	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:33:04.712132931 CEST	443	49737	104.26.12.205	192.168.2.4
Apr 26, 2024 10:33:04.904771090 CEST	443	49737	104.26.12.205	192.168.2.4
Apr 26, 2024 10:33:04.904844999 CEST	443	49737	104.26.12.205	192.168.2.4
Apr 26, 2024 10:33:04.904920101 CEST	49737	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:33:04.907715082 CEST	49737	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:33:05.642848015 CEST	49739	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:05.839730978 CEST	587	49739	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:05.839852095 CEST	49739	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:06.113437891 CEST	587	49739	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:06.117778063 CEST	49739	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:06.314546108 CEST	587	49739	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:06.317152977 CEST	49739	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:06.515319109 CEST	587	49739	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:06.515831947 CEST	49739	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:06.732532978 CEST	587	49739	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:06.732641935 CEST	587	49739	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:06.732681990 CEST	587	49739	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:06.732770920 CEST	49739	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:06.737844944 CEST	49739	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:06.935890913 CEST	587	49739	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:06.980132103 CEST	49739	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:07.030622005 CEST	49739	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:07.227381945 CEST	587	49739	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:07.291393042 CEST	49739	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:07.315216064 CEST	49739	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:07.512069941 CEST	587	49739	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:07.512523890 CEST	49739	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:07.711711884 CEST	587	49739	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:07.712497950 CEST	49739	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:07.914414883 CEST	587	49739	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:07.964488029 CEST	49739	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:09.198209047 CEST	49739	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:09.435003042 CEST	587	49739	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:09.449403048 CEST	587	49739	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:09.460222006 CEST	49739	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:09.656719923 CEST	587	49739	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:09.656784058 CEST	587	49739	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:09.676700115 CEST	49739	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:09.677305937 CEST	49739	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:09.677371025 CEST	49739	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:09.677439928 CEST	49739	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:09.878810883 CEST	587	49739	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:09.879008055 CEST	587	49739	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:09.879045010 CEST	587	49739	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:09.879077911 CEST	587	49739	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:09.882457018 CEST	587	49739	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:09.933244944 CEST	49739	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:13.664582968 CEST	49750	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:33:13.664630890 CEST	443	49750	104.26.12.205	192.168.2.4
Apr 26, 2024 10:33:13.664823055 CEST	49750	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:33:13.674757004 CEST	49750	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:33:13.674768925 CEST	443	49750	104.26.12.205	192.168.2.4
Apr 26, 2024 10:33:13.934699059 CEST	443	49750	104.26.12.205	192.168.2.4
Apr 26, 2024 10:33:13.934775114 CEST	49750	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:33:13.938417912 CEST	49750	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:33:13.938425064 CEST	443	49750	104.26.12.205	192.168.2.4
Apr 26, 2024 10:33:13.938688993 CEST	443	49750	104.26.12.205	192.168.2.4
Apr 26, 2024 10:33:13.980173111 CEST	49750	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:33:14.207614899 CEST	49750	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:33:14.252116919 CEST	443	49750	104.26.12.205	192.168.2.4
Apr 26, 2024 10:33:14.376785994 CEST	443	49750	104.26.12.205	192.168.2.4
Apr 26, 2024 10:33:14.376890898 CEST	443	49750	104.26.12.205	192.168.2.4
Apr 26, 2024 10:33:14.376965046 CEST	49750	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:33:14.379509926 CEST	49750	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:33:14.897726059 CEST	49753	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:15.100383043 CEST	587	49753	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:15.100506067 CEST	49753	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:15.554121971 CEST	587	49753	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:15.554326057 CEST	49753	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:15.751154900 CEST	587	49753	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:15.751425982 CEST	49753	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:15.950134993 CEST	587	49753	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:15.950587034 CEST	49753	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:16.160096884 CEST	587	49753	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:16.160130978 CEST	587	49753	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:16.160144091 CEST	587	49753	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:16.160258055 CEST	49753	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:16.161843061 CEST	49753	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:16.358247042 CEST	587	49753	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:16.363389015 CEST	49753	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:16.559710979 CEST	587	49753	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:16.560132980 CEST	49753	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:16.756644964 CEST	587	49753	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:16.757729053 CEST	49753	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:16.956267118 CEST	587	49753	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:16.956595898 CEST	49753	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:17.152975082 CEST	587	49753	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:17.153228045 CEST	49753	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:17.391088009 CEST	587	49753	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:17.405121088 CEST	587	49753	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:17.405399084 CEST	49753	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:17.602688074 CEST	587	49753	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:17.602720976 CEST	587	49753	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:17.603652000 CEST	49753	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:17.603754044 CEST	49753	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:17.603820086 CEST	49753	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:17.603836060 CEST	49753	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:17.801412106 CEST	587	49753	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:17.801445007 CEST	587	49753	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:17.801462889 CEST	587	49753	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:17.801959991 CEST	587	49753	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:17.856628895 CEST	49753	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:21.585676908 CEST	49755	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:33:21.585772038 CEST	443	49755	104.26.12.205	192.168.2.4
Apr 26, 2024 10:33:21.585871935 CEST	49755	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:33:21.588932037 CEST	49755	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:33:21.588968992 CEST	443	49755	104.26.12.205	192.168.2.4
Apr 26, 2024 10:33:21.880594969 CEST	443	49755	104.26.12.205	192.168.2.4
Apr 26, 2024 10:33:21.880698919 CEST	49755	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:33:21.882520914 CEST	49755	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:33:21.882546902 CEST	443	49755	104.26.12.205	192.168.2.4
Apr 26, 2024 10:33:21.882896900 CEST	443	49755	104.26.12.205	192.168.2.4
Apr 26, 2024 10:33:21.933233976 CEST	49755	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:33:21.941553116 CEST	49755	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:33:21.988127947 CEST	443	49755	104.26.12.205	192.168.2.4
Apr 26, 2024 10:33:22.210608006 CEST	443	49755	104.26.12.205	192.168.2.4
Apr 26, 2024 10:33:22.210691929 CEST	443	49755	104.26.12.205	192.168.2.4
Apr 26, 2024 10:33:22.210783005 CEST	49755	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:33:22.213233948 CEST	49755	443	192.168.2.4	104.26.12.205
Apr 26, 2024 10:33:22.817615986 CEST	49757	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:23.014687061 CEST	587	49757	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:23.014792919 CEST	49757	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:23.243947983 CEST	587	49757	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:23.244153023 CEST	49757	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:23.457655907 CEST	587	49757	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:23.457859993 CEST	49757	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:23.656215906 CEST	587	49757	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:23.657335043 CEST	49757	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:23.727190018 CEST	49753	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:23.865221977 CEST	587	49757	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:23.865246058 CEST	587	49757	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:23.865261078 CEST	587	49757	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:23.865322113 CEST	49757	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:23.868221045 CEST	49757	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:24.065463066 CEST	587	49757	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:24.070982933 CEST	49757	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:24.268199921 CEST	587	49757	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:24.268518925 CEST	49757	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:24.466063023 CEST	587	49757	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:24.476833105 CEST	49757	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:24.675434113 CEST	587	49757	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:24.675767899 CEST	49757	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:24.889815092 CEST	587	49757	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:24.933245897 CEST	49757	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:25.084201097 CEST	49757	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:25.322104931 CEST	587	49757	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:25.329432964 CEST	587	49757	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:25.329612017 CEST	49757	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:25.526571035 CEST	587	49757	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:25.526633978 CEST	587	49757	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:25.527801991 CEST	49757	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:25.527976036 CEST	49757	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:25.528012991 CEST	49757	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:25.528089046 CEST	49757	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:33:25.763251066 CEST	587	49757	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:25.763304949 CEST	587	49757	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:25.763341904 CEST	587	49757	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:25.763377905 CEST	587	49757	50.87.195.61	192.168.2.4
Apr 26, 2024 10:33:25.808232069 CEST	49757	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:39.386992931 CEST	49736	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:39.583981037 CEST	587	49736	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:39.584615946 CEST	49736	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:39.725550890 CEST	49759	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:39.790819883 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:39.922826052 CEST	587	49759	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:39.922935009 CEST	49759	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:39.987035990 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:39.987171888 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:40.195323944 CEST	587	49759	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:40.195552111 CEST	49759	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:40.255414963 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:40.255625010 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:40.393052101 CEST	587	49759	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:40.393222094 CEST	49759	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:40.452086926 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:40.452255964 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:40.591851950 CEST	587	49759	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:40.592477083 CEST	49759	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:40.650135040 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:40.650526047 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:40.803736925 CEST	587	49759	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:40.803762913 CEST	587	49759	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:40.803805113 CEST	587	49759	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:40.803833961 CEST	49759	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:40.807967901 CEST	49759	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:40.867259979 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:40.867280006 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:40.867310047 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:40.867333889 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:40.869452953 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:41.006061077 CEST	587	49759	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:41.010915041 CEST	49759	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:41.066097975 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:41.072647095 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:41.211308002 CEST	587	49759	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:41.215195894 CEST	49759	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:41.273686886 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:41.275799036 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:41.412359953 CEST	587	49759	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:41.412651062 CEST	49759	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:41.472537041 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:41.472846031 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:41.649976969 CEST	587	49759	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:41.700824022 CEST	587	49759	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:41.702986002 CEST	49759	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:41.709588051 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:41.738744974 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:41.764420033 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:41.899353027 CEST	587	49759	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:41.899457932 CEST	587	49759	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:41.902923107 CEST	49759	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:41.960613966 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:41.960774899 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:41.963764906 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:42.140093088 CEST	587	49759	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:42.172355890 CEST	587	49759	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:42.172632933 CEST	49759	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:42.201687098 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:42.213757992 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:42.213927031 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:42.369090080 CEST	587	49759	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:42.369231939 CEST	587	49759	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:42.369678974 CEST	49759	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:42.369777918 CEST	49759	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:42.369777918 CEST	49759	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:42.369815111 CEST	49759	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:42.410022020 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:42.410271883 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:42.413043022 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:42.413151979 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:42.413223982 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:42.413281918 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:42.415564060 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:42.566164970 CEST	587	49759	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:42.566298962 CEST	587	49759	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:42.566855907 CEST	587	49759	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:42.609710932 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:42.609824896 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:42.611656904 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:42.611716032 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:42.611743927 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:42.611768007 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:42.611809969 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:42.611861944 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:42.611886024 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:42.611953020 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:42.683289051 CEST	49759	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:42.806088924 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:42.806176901 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:42.808110952 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:42.808183908 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:42.808325052 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:42.808428049 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:42.808475018 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:42.808527946 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:42.808706999 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:42.808753967 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:42.809293032 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:42.809365988 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:43.002381086 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.002398968 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.002589941 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:43.004329920 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.004723072 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.004749060 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.005177021 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.005398989 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.005584002 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.005716085 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.005760908 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.005780935 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.005803108 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.005933046 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.006038904 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.006093025 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.006151915 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.006217957 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.006263971 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.006335974 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.006388903 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.006408930 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.006500959 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.006552935 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.006792068 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.006835938 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.007010937 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.007061005 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.007100105 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.007121086 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.198684931 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.198695898 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.198976040 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.199678898 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:43.386639118 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:45.692389965 CEST	49739	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:45.889195919 CEST	587	49739	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:45.891134977 CEST	49739	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:45.911602020 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:46.107984066 CEST	587	49760	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:46.108489037 CEST	49760	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:46.108659983 CEST	49759	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:46.305089951 CEST	587	49759	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:46.305605888 CEST	49759	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:46.306514978 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:46.351301908 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:46.503355026 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:46.503452063 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:46.547133923 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:46.547213078 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:46.772742987 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:46.773036957 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:46.794117928 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:46.794332981 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:46.969957113 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:46.970149040 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:46.990200996 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:46.990319014 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:47.171823025 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:47.174638987 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:47.189968109 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:47.190285921 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:47.381608963 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:47.381625891 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:47.381721020 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:47.381767035 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:47.384594917 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:47.396090031 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:47.396110058 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:47.396121025 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:47.396225929 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:47.397902966 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:47.581764936 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:47.583473921 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:47.594011068 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:47.594860077 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:47.780463934 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:47.780807972 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:47.791074991 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:47.791455984 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:47.987689972 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:47.987832069 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:47.988152027 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:47.988205910 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:48.188227892 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:48.188426018 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:48.189769030 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:48.189909935 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:48.384812117 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:48.385072947 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:48.386811018 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:48.387001991 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:48.621576071 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:48.624047041 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:48.633852959 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:48.634032011 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:48.635127068 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:48.635226965 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:48.829838991 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:48.829950094 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:48.830333948 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:48.830334902 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:48.830334902 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:48.831551075 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:48.831551075 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:48.832123041 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:48.832159996 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:48.832381010 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:48.832431078 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:48.832477093 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:48.832526922 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:48.833676100 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:49.026801109 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.026827097 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.027014971 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.027699947 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.027745962 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.027857065 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:49.028086901 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.028187037 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.028500080 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.028635979 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:49.029557943 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.029606104 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.029736996 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.029788971 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:49.029798985 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:49.030771971 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.030824900 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:49.030921936 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.031136036 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.031506062 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.036654949 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:49.069596052 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.071990013 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.072772980 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:49.072777987 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:49.224467993 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.224517107 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.224987984 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.225006104 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.225070000 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:49.225481033 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.225553989 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.225568056 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:49.227524042 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.227616072 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:49.231622934 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:49.233644962 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.234220982 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.234302044 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.234368086 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.234396935 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:49.234438896 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:49.234766960 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:49.235063076 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.243623972 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:49.266592026 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.268567085 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.268649101 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:49.269686937 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.269922018 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:49.269931078 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:49.422147036 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.422251940 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.422323942 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:49.422384024 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.422557116 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.422573090 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.422970057 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.422977924 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.423091888 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.423407078 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.423413992 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.423422098 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.423553944 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.424686909 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.424700975 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.424709082 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.424818039 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.424940109 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.424954891 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.424961090 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.425091028 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.429570913 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.429708958 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.429759026 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:49.432290077 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.432415009 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.432543993 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.432930946 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.433060884 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.433206081 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.433341026 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.433347940 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.433475018 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.433482885 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.433610916 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.433618069 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.433634043 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.433640957 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.433739901 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.433747053 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.433861971 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.441656113 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.441667080 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.441674948 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.441692114 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.464406013 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.464418888 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.465979099 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.466191053 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.466197968 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.466259003 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.466681957 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.466721058 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.466835022 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.466907978 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.618244886 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.618257046 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.618282080 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.618392944 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.619159937 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.626542091 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.626586914 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.626641035 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.626997948 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.627770901 CEST	587	49761	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:49.745759964 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:49.745762110 CEST	49761	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:49.876617908 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:50.073231936 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:50.073316097 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:50.323384047 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:50.323631048 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:50.520364046 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:50.520539045 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:50.719587088 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:50.720114946 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:50.906233072 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:50.932005882 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:50.932106018 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:50.932145119 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:50.932214975 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:50.934075117 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:51.104283094 CEST	587	49762	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:51.109734058 CEST	49762	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:51.109877110 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:51.132996082 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:51.140610933 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:51.306130886 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:51.308767080 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:51.337445021 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:51.337734938 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:51.537487984 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:51.537873983 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:51.540391922 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:51.541019917 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:51.736835957 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:51.737155914 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:51.737519026 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:51.738224030 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:51.933857918 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:51.935138941 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:51.935959101 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:51.936431885 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:52.143102884 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.143126965 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.143177032 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:52.143193960 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.145210028 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:52.171890974 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.198870897 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.199515104 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:52.341758013 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.359441996 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:52.396434069 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.396471024 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.400770903 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:52.400877953 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:52.400906086 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:52.401062965 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:52.403296947 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:52.555916071 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.556164026 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:52.597063065 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.597095966 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.597126007 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:52.597300053 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.597352982 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:52.599603891 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.599636078 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.599653959 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.599683046 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:52.599746943 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:52.599987030 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.600052118 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:52.753403902 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.753796101 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:52.793713093 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.793834925 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:52.796420097 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.796497107 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:52.796597958 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.796618938 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.796670914 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.796675920 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:52.796740055 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:52.796740055 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:52.796766996 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.796824932 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:52.796916962 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.796982050 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:52.797394037 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.797454119 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:52.951827049 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.951988935 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:52.990294933 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.990318060 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.990403891 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:52.994760990 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.994788885 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.994838953 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.994853973 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.994884014 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.994966030 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.994981050 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.995009899 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.995033979 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.995095015 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.995179892 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:52.995204926 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:53.149370909 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:53.186839104 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:53.186882973 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:53.186924934 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:53.186981916 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:53.187890053 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:53.318937063 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:53.386794090 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:53.555948973 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:53.569659948 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:53.570746899 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:53.766844988 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:53.766912937 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:53.952713966 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:54.941355944 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:54.941395044 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:54.941426039 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:54.941478014 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:54.942742109 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:55.137474060 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.137526035 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.137537003 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:55.137542963 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.137558937 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.137602091 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:55.139050961 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.139091969 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.139106989 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.139115095 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:55.139133930 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:55.139161110 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:55.139173985 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.139213085 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:55.139283895 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.139331102 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:55.139365911 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.139408112 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:55.139430046 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.139473915 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:55.139497042 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.139513016 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.139533997 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:55.139554024 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:55.333652973 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.333710909 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:55.333818913 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.333864927 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:55.335164070 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.335205078 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:55.335736990 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.335752010 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.335805893 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:55.335829973 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:55.335860014 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.335912943 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:55.335913897 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.335957050 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:55.336024046 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.336059093 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:55.336070061 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:55.336482048 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.336524963 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:55.529860020 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.529896975 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.529952049 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:55.529985905 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:55.531232119 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.532202005 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.532866001 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.532949924 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.534971952 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.726102114 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.726156950 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.726171017 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.726234913 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.726340055 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.726397038 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.726473093 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.727474928 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:55.948952913 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:57.303608894 CEST	49757	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:57.501532078 CEST	587	49757	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:57.502006054 CEST	49757	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:57.504589081 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:57.707258940 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:57.707411051 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:57.977706909 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:57.977869987 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:58.174664021 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:58.174841881 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:58.372922897 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:58.373442888 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:58.581653118 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:58.581685066 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:58.581734896 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:58.581732988 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:58.583762884 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:58.780288935 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:58.782110929 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:58.978476048 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:58.978687048 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:59.175367117 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:59.182782888 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:59.381133080 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:59.381405115 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:59.577820063 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:59.578385115 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:34:59.814644098 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:59.835129023 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:34:59.840712070 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:00.036633015 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.036732912 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.041230917 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:00.041230917 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:00.041232109 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:00.041232109 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:00.042752981 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:00.237327099 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.237341881 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.237353086 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.237401009 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:00.237493038 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:00.238948107 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.239005089 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:00.239054918 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.239104033 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:00.239201069 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.239262104 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:00.239314079 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.239361048 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:00.279484987 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.279544115 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:00.433593988 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.433675051 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:00.435141087 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.435205936 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:00.435719013 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.435761929 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.435812950 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:00.435874939 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:00.435884953 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.435945034 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:00.436034918 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.436094046 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:00.476304054 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.476381063 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:00.516680956 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.516733885 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:00.629667044 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.629760981 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:00.629784107 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.631221056 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.631318092 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.631822109 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.632241011 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.632322073 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.632484913 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.632500887 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.632566929 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.632612944 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.632683992 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.632745981 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.632791996 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.632898092 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.632971048 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.632987022 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.633054018 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.633094072 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.633161068 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.633193016 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.672468901 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.672952890 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.712727070 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.712734938 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.825942039 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.825974941 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.826010942 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.826284885 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.827023029 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:00.995779991 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:02.690403938 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:02.887190104 CEST	587	49763	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:02.887780905 CEST	49763	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:02.888904095 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:03.085175037 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:03.088718891 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:03.317862034 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:03.324615002 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:03.521177053 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:03.521544933 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:03.719501972 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:03.720961094 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:03.941710949 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:03.941787958 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:03.941795111 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:03.942003012 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:03.946929932 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:04.143438101 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:04.144525051 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:04.340759039 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:04.341048002 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:04.539257050 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:04.539625883 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:04.737953901 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:04.738143921 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:04.934513092 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:04.934803009 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:05.171174049 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.180502892 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.182801962 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:05.378938913 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.378947020 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.379419088 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:05.379477978 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:05.379477978 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:05.379606009 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:05.380789995 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:05.575484037 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.575521946 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.575834990 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.575972080 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:05.576814890 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.576837063 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.576881886 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.576970100 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:05.577112913 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:05.617928028 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.618809938 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:05.690660000 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:05.774331093 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.774861097 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:05.774902105 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.775034904 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:05.775753021 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.775759935 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.775888920 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.775895119 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.775908947 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:05.775990009 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:05.776576042 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.779162884 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:05.828222990 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.830709934 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:05.887500048 CEST	587	49764	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.890945911 CEST	49764	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:05.894659042 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:05.972784996 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.972794056 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.972800970 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.972825050 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.972831964 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.972836018 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.972846985 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.972851992 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.972862005 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.972896099 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:05.976130009 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.976136923 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:05.976140976 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:06.029361010 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:06.029369116 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:06.029380083 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:06.092066050 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:06.092127085 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:06.170527935 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:06.170547009 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:06.170574903 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:06.171619892 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:06.292619944 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:06.320000887 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:06.320156097 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:06.518642902 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:06.522763014 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:06.721072912 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:06.721478939 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:06.938420057 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:06.938452005 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:06.938476086 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:06.938492060 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:06.940793991 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:07.138875008 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:07.144742966 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:07.341989994 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:07.344538927 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:07.542618990 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:07.543106079 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:07.741990089 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:07.744796991 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:07.941704035 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:07.948601961 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:08.201236010 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:08.213551998 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:08.213727951 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:08.410415888 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:08.410434961 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:08.410783052 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:08.410818100 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:08.410907030 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:08.410991907 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:08.412508011 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:08.608021975 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:08.608041048 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:08.608072996 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:08.608407021 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:08.608454943 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:08.608957052 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:08.609004974 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:08.609131098 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:08.609147072 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:08.609195948 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:08.649950027 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:08.649995089 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:08.805111885 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:08.805202007 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:08.805784941 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:08.805843115 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:08.806791067 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:08.806806087 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:08.806842089 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:08.806870937 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:08.806905031 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:08.806952953 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:08.806984901 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:08.807032108 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:08.807065010 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:08.807107925 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:08.808465958 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:08.808532953 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:08.859549046 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:08.859601974 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:09.001655102 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:09.001719952 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:09.002337933 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:09.002353907 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:09.005367041 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:09.005445957 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:09.005461931 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:09.005481005 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:09.005531073 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:09.005546093 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:09.005589962 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:09.005654097 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:09.005669117 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:09.005683899 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:09.055908918 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:09.055989027 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:09.056003094 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:09.198473930 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:09.198563099 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:09.198579073 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:09.198827028 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:09.199496984 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:09.339495897 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:14.199307919 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:14.395703077 CEST	587	49765	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:14.396951914 CEST	49765	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:14.397902966 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:14.594646931 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:14.594758034 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:14.867494106 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:14.867705107 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:15.064642906 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:15.068703890 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:15.266855001 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:15.268580914 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:15.477293968 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:15.477412939 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:15.477425098 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:15.477575064 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:15.479268074 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:15.676305056 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:15.685247898 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:15.882158995 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:15.882509947 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:16.094708920 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:16.094924927 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:16.331892014 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:16.391362906 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:16.391582966 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:16.588115931 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:16.588331938 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:16.588557005 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:16.825923920 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:16.837764978 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:16.837968111 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:17.034550905 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.034744978 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.035032988 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:17.035082102 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:17.035116911 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:17.035176039 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:17.036478043 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:17.232321024 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.232637882 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:17.233515978 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.233560085 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.233660936 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.233803034 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:17.234380960 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.240586042 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:17.274455070 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.280581951 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:17.432068110 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.432687998 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:17.433872938 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.433881044 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.434075117 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:17.441318035 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.441325903 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.441720963 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:17.489619970 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.492789030 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:17.633225918 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.633236885 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.633558035 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:17.635230064 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.635363102 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.636413097 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.636420965 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.636428118 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.636451960 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.663439035 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.663445950 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.663451910 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.663621902 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.664530039 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.664685965 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.696726084 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.696733952 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.696747065 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.830092907 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.830347061 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.830353975 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.831016064 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:17.996587038 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:27.400604010 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:27.597395897 CEST	587	49768	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:27.598958969 CEST	49768	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:27.604614973 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:27.802479029 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:27.802731991 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:28.051446915 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:28.054642916 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:28.252288103 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:28.252629042 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:28.452194929 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:28.452874899 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:28.661847115 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:28.661863089 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:28.661874056 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:28.661952019 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:28.803941011 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:29.010545015 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:29.012972116 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:29.449091911 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:29.645136118 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:29.677957058 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:29.746630907 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:30.397058964 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:30.593038082 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:30.593481064 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:30.593821049 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:30.791584969 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:30.791806936 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:30.950797081 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:30.988018990 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:30.988308907 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:31.147969007 CEST	587	49767	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:31.148382902 CEST	49767	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:31.149075985 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:31.228888035 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:31.270093918 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:31.270276070 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:31.345438004 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:31.347317934 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:31.585346937 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:31.606662989 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:31.606829882 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:31.781454086 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:31.803644896 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:31.803786039 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:31.893004894 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:31.895040035 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:31.895040035 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:31.895101070 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:31.895119905 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:31.896315098 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:32.002747059 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.008923054 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:32.091214895 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.091298103 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:32.091402054 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.091418028 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.091481924 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.091536045 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:32.093019962 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.093043089 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.093056917 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.093095064 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.093096972 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:32.093096972 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:32.093149900 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:32.093332052 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.093370914 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.093393087 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:32.093425989 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:32.093503952 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.093539000 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.093605995 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:32.093683004 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.093755960 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:32.218426943 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.218780994 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.218822956 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.218931913 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:32.224412918 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:32.291744947 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.291800022 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.292010069 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:32.294315100 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.294322968 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.294392109 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.294473886 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:32.294543982 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:32.295886040 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.295933008 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.296000004 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:32.296113968 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.296155930 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.296297073 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:32.436279058 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.438261986 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:32.488075018 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.488089085 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.488281012 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:32.490710974 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.490770102 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.490883112 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.491293907 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.491441965 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.491579056 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.491635084 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.491816044 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.492010117 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.492054939 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.492146015 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.492270947 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.492280006 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.492302895 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.492434978 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.492443085 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.492501974 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.492568970 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.492693901 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.492769957 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.492815018 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.493140936 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.493149042 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.493211031 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.636457920 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.637017965 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:32.692557096 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.692567110 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.692583084 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.692589998 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.692739010 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.745798111 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:32.833936930 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:32.834462881 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:33.032841921 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:33.033315897 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:33.230062008 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:33.230350971 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:33.467984915 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:33.496480942 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:33.496690035 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:33.703944921 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:33.703949928 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:33.704353094 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:33.704430103 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:33.704452038 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:33.704627991 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:33.706811905 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:33.908536911 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:33.908560038 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:33.908580065 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:33.908590078 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:33.908592939 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:33.908600092 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:33.908680916 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:33.908721924 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:34.108733892 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.108792067 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:34.109019995 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.109074116 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:34.109905005 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.110001087 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:34.110048056 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.110064030 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.110110044 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:34.110842943 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.110902071 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:34.305860043 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.305871964 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.305879116 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.305973053 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.306031942 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:34.306495905 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.308296919 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.308304071 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.308310032 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.308315992 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.308321953 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.308329105 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.308342934 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.308350086 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.308602095 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.309521914 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.309531927 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.309540033 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.309541941 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.309549093 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.309556007 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.309561968 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.309568882 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.309576035 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.309593916 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.309601068 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.309607983 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.509658098 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.509680986 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.509689093 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.509742022 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.509808064 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.511421919 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:34.636466026 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:35.113938093 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:35.311219931 CEST	587	49766	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:35.311728954 CEST	49766	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:35.312736988 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:35.519520044 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:35.519596100 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:35.768610001 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:35.768754959 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:35.944410086 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:35.964926004 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:35.965078115 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:36.140839100 CEST	587	49769	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:36.142952919 CEST	49769	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:36.148602962 CEST	49772	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:36.163014889 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:36.167115927 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:36.356232882 CEST	587	49772	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:36.359175920 CEST	49772	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:36.373279095 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:36.373303890 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:36.373347998 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:36.373456001 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:36.375133038 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:36.571151018 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:36.616919994 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:36.647352934 CEST	587	49772	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:36.647501945 CEST	49772	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:36.812895060 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:36.814580917 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:36.843811035 CEST	587	49772	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:36.847058058 CEST	49772	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:37.010858059 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:37.025211096 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:37.045042038 CEST	587	49772	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:37.045644999 CEST	49772	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:37.206680059 CEST	49772	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:37.223012924 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:37.223284006 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:37.258111954 CEST	587	49772	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:37.258192062 CEST	49772	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:37.258259058 CEST	587	49772	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:37.258315086 CEST	49772	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:37.258315086 CEST	587	49772	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:37.258363008 CEST	49772	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:37.291604996 CEST	49773	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:37.405316114 CEST	587	49772	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:37.405402899 CEST	49772	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:37.419078112 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:37.419291019 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:37.489341021 CEST	587	49773	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:37.489490986 CEST	49773	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:37.662327051 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:37.754841089 CEST	587	49773	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:37.754966021 CEST	49773	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:37.951975107 CEST	587	49773	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:37.952109098 CEST	49773	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:38.125530958 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.125855923 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:38.150494099 CEST	587	49773	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.150898933 CEST	49773	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:38.321688890 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.321702003 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.322192907 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:38.322246075 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:38.322314024 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:38.322735071 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:38.328196049 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:38.357945919 CEST	587	49773	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.357980013 CEST	587	49773	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.357990026 CEST	587	49773	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.358097076 CEST	49773	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:38.360565901 CEST	49773	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:38.518416882 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.518454075 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.518520117 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.518527031 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.518559933 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:38.518637896 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:38.523833036 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.523888111 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.523895979 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.524049997 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.524058104 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.524059057 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:38.524123907 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.524162054 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.524169922 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:38.524210930 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.524264097 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.524313927 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:38.524471998 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:38.558726072 CEST	587	49773	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.560404062 CEST	49773	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:38.719614029 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.721873999 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.721997976 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:38.722304106 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.722321987 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.722337961 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.722346067 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.722570896 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:38.722726107 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.722852945 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:38.757950068 CEST	587	49773	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.760734081 CEST	49773	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:38.905450106 CEST	49773	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:38.926877975 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.926897049 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.926918983 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.926933050 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.926942110 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.926960945 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.926969051 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.926984072 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.926991940 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.926995039 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:38.927006006 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.927014112 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.927020073 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.927026987 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.927045107 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.927052021 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.927064896 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.927076101 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.927083969 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.959897041 CEST	587	49773	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:38.963143110 CEST	49773	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:38.968682051 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:39.122840881 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:39.122869015 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:39.123003006 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:39.123292923 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:39.123895884 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:39.142895937 CEST	587	49773	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:39.142988920 CEST	49773	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:39.165015936 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:39.165091991 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:39.183255911 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:39.393001080 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:39.393163919 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:39.589946985 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:39.590140104 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:39.820218086 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:39.820637941 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:40.029680014 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:40.029705048 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:40.029721975 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:40.029748917 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:40.031831026 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:40.232286930 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:40.238869905 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:40.450337887 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:40.450737953 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:40.690000057 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:44.652144909 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:44.652568102 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:44.850174904 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:44.947060108 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:44.952944040 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:45.149225950 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:45.149313927 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:45.149534941 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:45.386025906 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:45.396380901 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:45.396605968 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:45.592891932 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:45.592941999 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:45.593398094 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:45.593467951 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:45.593508959 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:45.593602896 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:45.595663071 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:45.792726994 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:45.792783022 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:45.792840004 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:45.792921066 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:45.792937040 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:45.792973995 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:45.794608116 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:45.794625998 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:45.794662952 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:45.794682026 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:45.794811010 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:45.794853926 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:45.794991970 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:45.795032978 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:45.795039892 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:45.795061111 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:45.795100927 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:45.837733984 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:45.837788105 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:46.001951933 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.002038956 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:46.004265070 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.004435062 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:46.004636049 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.004709005 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.004712105 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:46.004725933 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.004744053 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:46.004760981 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:46.006974936 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.007039070 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:46.034272909 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.034450054 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:46.208564997 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.208579063 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.209518909 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.209619999 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.209867001 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.209911108 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.209935904 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.209958076 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.209969997 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.210004091 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.210011005 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.210012913 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:46.210025072 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.210031986 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.230793953 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.230808973 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.230825901 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.230859041 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.234076023 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:46.234076023 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:46.234076023 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:46.406218052 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.406238079 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.406255007 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.430458069 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.430505991 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.430543900 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.431328058 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:46.495861053 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:54.865942001 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:55.062917948 CEST	587	49770	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:55.063641071 CEST	49770	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:55.065262079 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:55.261646986 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:55.268579006 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:55.542357922 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:55.543216944 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:55.740255117 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:55.740693092 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:55.956368923 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:55.959007978 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:56.167197943 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:56.167208910 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:56.167227983 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:56.167375088 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:56.169116974 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:56.366034985 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:56.368371010 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:56.565037966 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:56.565300941 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:56.763585091 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:56.763827085 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:56.976355076 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:56.976571083 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:57.173203945 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:57.176723957 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:57.413552999 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:57.441447973 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:57.442768097 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:57.640151978 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:57.640161991 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:57.640604019 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:57.640604019 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:57.640659094 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:57.640706062 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:57.641968012 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:57.836919069 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:57.836930037 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:57.836997032 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:57.837114096 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:57.837171078 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:57.838788033 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:57.838937998 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:57.839179993 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:57.839185953 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:57.839292049 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:57.839792013 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:57.839907885 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:57.884880066 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:57.885010004 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:58.039232016 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:58.039336920 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:58.046418905 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:58.046425104 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:58.047897100 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:58.049484968 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:58.052685022 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:58.101665974 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:58.104767084 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:58.236793041 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:58.236871958 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:35:58.245141029 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:58.245521069 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:58.245532990 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:58.245575905 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:58.257122040 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:58.301050901 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:58.301063061 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:58.301100969 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:58.301115990 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:58.433329105 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:58.433341026 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:58.433379889 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:58.433388948 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:58.433444023 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:58.433765888 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:58.434420109 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:35:58.517854929 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:00.788184881 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:00.987520933 CEST	587	49775	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:00.988112926 CEST	49775	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:00.989192963 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:01.185596943 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:01.186860085 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:01.454304934 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:01.459032059 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:01.656028986 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:01.656389952 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:01.870546103 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:01.871478081 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:02.091419935 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:02.091437101 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:02.091532946 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:02.091672897 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:02.094723940 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:02.295578003 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:02.297785044 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:02.494513988 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:02.494693995 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:02.693917990 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:02.694212914 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:02.892291069 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:02.892559052 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:03.089446068 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:03.090181112 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:03.327949047 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:03.345091105 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:03.352567911 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:03.551995993 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:03.552079916 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:03.652452946 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:03.759197950 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:03.759253025 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:03.759253025 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:03.759466887 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:03.761038065 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:03.955372095 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:03.955380917 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:03.955614090 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:03.955636024 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:03.955734968 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:03.957257032 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:03.957339048 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:03.957381964 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:03.957441092 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:03.957612038 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:03.997503996 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:03.998018026 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:04.152163029 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.153892994 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.154568911 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.154763937 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:04.194519043 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.194597960 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:04.244530916 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.244632959 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:04.351362944 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.351377010 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.351478100 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:04.351502895 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.351630926 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.351737022 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.352648020 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.352679014 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.352729082 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.352766991 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.352816105 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.353123903 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.353138924 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.353193998 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.391302109 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.391366005 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.391381025 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.391406059 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.441176891 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.441194057 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.553577900 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.553590059 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.553637028 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.553647041 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.553657055 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.553667068 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:04.553751945 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:05.407226086 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:05.407305002 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:05.604202032 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:05.604310036 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:05.604352951 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:05.682749033 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:10.047013998 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:10.243654966 CEST	587	49776	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:10.244096041 CEST	49776	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:10.246634007 CEST	49777	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:10.442708969 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:10.442790985 CEST	49777	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:10.710277081 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:10.710474968 CEST	49777	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:10.906841040 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:10.907222033 CEST	49777	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:11.106486082 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:11.106904984 CEST	49777	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:11.313878059 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:11.313900948 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:11.313939095 CEST	49777	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:11.313956022 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:11.316067934 CEST	49777	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:11.512546062 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:11.514585972 CEST	49777	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:11.712162971 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:11.712408066 CEST	49777	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:11.911595106 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:11.911904097 CEST	49777	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:12.109457970 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:12.109644890 CEST	49777	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:12.306219101 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:12.312576056 CEST	49777	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:12.550548077 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:12.557642937 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:12.560853004 CEST	49777	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:12.776063919 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:12.776071072 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:12.776457071 CEST	49777	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:12.776458025 CEST	49777	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:12.776458025 CEST	49777	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:12.776582956 CEST	49777	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:12.777582884 CEST	49777	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:12.972459078 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:12.972470999 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:12.972656965 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:12.972698927 CEST	49777	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:12.973402977 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:12.973638058 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:12.976610899 CEST	49777	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:13.172575951 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.172584057 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.173187971 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.174696922 CEST	49777	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:13.370757103 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.370806932 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.370815039 CEST	49777	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:13.370865107 CEST	49777	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:13.371016979 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.371076107 CEST	49777	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:13.371098042 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.371275902 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.371643066 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.371761084 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.371901035 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.371993065 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.372096062 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.372128010 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.372185946 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.372247934 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.372293949 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.372355938 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.372436047 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.372456074 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.372581959 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.372605085 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.566803932 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.566814899 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.567063093 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.567106009 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.567178965 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.567301035 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.567342043 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.567356110 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.567370892 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.567403078 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.567466021 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.567666054 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.568331957 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:13.683248997 CEST	49777	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:16.518667936 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:16.715440035 CEST	587	49774	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:16.715980053 CEST	49774	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:16.720563889 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:16.920628071 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:16.920897961 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:17.150849104 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:17.151319981 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:17.348068953 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:17.348181963 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:17.546612978 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:17.547106028 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:17.775544882 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:17.775571108 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:17.775583029 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:17.775604010 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:17.777760983 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:17.975775003 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:17.977418900 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:18.174046993 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:18.174278021 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:18.371315956 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:18.371948957 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:18.609695911 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:18.678085089 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:18.684621096 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:18.890383959 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:18.890392065 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:18.894606113 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:19.132575989 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.141494036 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.143753052 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:19.340066910 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.340130091 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.341347933 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:19.341423988 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:19.341451883 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:19.341535091 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:19.343324900 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:19.537954092 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.538013935 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:19.539740086 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.539781094 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:19.539869070 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.539908886 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:19.540227890 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.540267944 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:19.540329933 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.540371895 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:19.581964016 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.582015991 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:19.734352112 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.734405041 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:19.736093998 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.736139059 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:19.736541986 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.736603022 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:19.736700058 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.736743927 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:19.736877918 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.736915112 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:19.737121105 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.737160921 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:19.737559080 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.737601995 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:19.779169083 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.779216051 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:19.947228909 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.947243929 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.947292089 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:19.948457003 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.948477983 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.948510885 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.949598074 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.949651003 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.949728966 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.949740887 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.949786901 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.949796915 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.949805975 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.949815989 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.977113008 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.977154016 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:19.977164030 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:20.144448042 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:20.144464016 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:20.144479990 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:20.144489050 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:20.145400047 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:20.294795036 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:29.902225018 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:30.099729061 CEST	587	49771	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:30.100233078 CEST	49771	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:31.435964108 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:31.632623911 CEST	587	49778	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:31.633058071 CEST	49778	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:31.634094954 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:31.831778049 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:31.831845999 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:32.112770081 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:32.113012075 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:32.320796967 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:32.320986986 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:32.519685984 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:32.520127058 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:32.726995945 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:32.727004051 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:32.727016926 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:32.727277994 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:32.728550911 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:32.925267935 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:32.928551912 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:33.138199091 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:33.138837099 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:33.349740028 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:33.349976063 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:33.561310053 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:33.561506987 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:33.757901907 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:33.758057117 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:33.994925976 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:34.024416924 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:34.024631023 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:34.221374035 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:34.221438885 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:34.221858025 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:34.221924067 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:34.221983910 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:34.222038031 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:34.223454952 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:34.420799017 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:34.420806885 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:34.420875072 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:34.421387911 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:34.421540022 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:34.422990084 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:34.423002958 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:34.423007965 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:34.423080921 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:34.423135042 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:34.618824005 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:34.618992090 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:34.620027065 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:34.620033026 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:34.620189905 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:34.815443039 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:34.815552950 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:34.815597057 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:34.815685034 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:34.816618919 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:34.816654921 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:34.816668034 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:34.816737890 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:34.817106009 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:34.817146063 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:34.817229986 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:34.817235947 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:35.012016058 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:35.012025118 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:35.012072086 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:35.012109041 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:35.012119055 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:35.012226105 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:35.012269974 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:35.012305975 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:35.012979984 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:35.012989044 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:35.013338089 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:35.013906956 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:35.154660940 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:35.470997095 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:35.667428017 CEST	587	49779	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:35.685668945 CEST	49779	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:35.686703920 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:35.883090973 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:35.883184910 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:36.132191896 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:36.183393002 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:36.306034088 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:36.504277945 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:36.504723072 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:36.702572107 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:36.808394909 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:38.024568081 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:38.239907980 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:38.239974022 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:38.240077972 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:38.240175962 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:38.242964983 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:38.456501961 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:38.458395004 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:38.654870987 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:38.655105114 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:38.852329016 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:38.852652073 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:39.051183939 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:39.051407099 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:39.258624077 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:39.266587019 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:39.502785921 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:39.522840977 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:39.523397923 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:39.719574928 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:39.719664097 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:39.724800110 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:39.724881887 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:39.724881887 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:39.724920988 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:39.726679087 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:39.921262026 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:39.921274900 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:39.921291113 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:39.921297073 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:39.921406984 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:39.923165083 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:39.923249960 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:39.923255920 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:39.923285007 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:39.923381090 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:39.923383951 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:39.926786900 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:39.964004993 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:39.964157104 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:40.117871046 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.118228912 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:40.119627953 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.119909048 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.120220900 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:40.122956991 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.123210907 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:40.160492897 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.160928011 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:40.221453905 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.221613884 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:40.314605951 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.314682007 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:40.314783096 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.314836025 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:40.316575050 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.316586018 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.317373991 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.317383051 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.320086956 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.320101976 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.320149899 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.320161104 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.320169926 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.320184946 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.367672920 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.367683887 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.367845058 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.367856026 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.417928934 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.417939901 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.515553951 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.515611887 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.515628099 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.515638113 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.515661001 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.515671015 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.515686989 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:40.698898077 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:46.780500889 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:46.977000952 CEST	587	49780	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:46.977422953 CEST	49780	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:46.978301048 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:47.175215960 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:47.175307035 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:47.447623968 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:47.447979927 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:47.644378901 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:47.644668102 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:47.842349052 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:47.842880964 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:48.054575920 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:48.054675102 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:48.054814100 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:48.054894924 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:48.056557894 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:48.253226995 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:48.255985975 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:48.462980032 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:48.463155985 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:48.659902096 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:48.661622047 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:48.899764061 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:48.949425936 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:48.949729919 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:49.146066904 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:49.146351099 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:49.146528959 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:49.383501053 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:49.397277117 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:49.397505045 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:49.593498945 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:49.593549013 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:49.593890905 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:49.593890905 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:49.593944073 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:49.594583035 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:49.597666979 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:49.789902925 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:49.790494919 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:49.790622950 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:49.793716908 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:49.793746948 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:49.793884039 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:49.794534922 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:49.794749022 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:49.988926888 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:49.992640018 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:49.992887020 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:49.993021011 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:49.993422985 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:49.993432045 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:49.993596077 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:49.994277000 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:49.994436026 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:50.188854933 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.188992023 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:50.189004898 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.189074993 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.189189911 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:50.189224958 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.190427065 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.190891981 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.190965891 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.191028118 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.191112995 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.191162109 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.191313028 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.191371918 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.191761017 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.191781998 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.191802979 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.191860914 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.191925049 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.191968918 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.192024946 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.192568064 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.192580938 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.192632914 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.192677975 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.192732096 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.192745924 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.192765951 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.192809105 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.385075092 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.385274887 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.385303974 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.385320902 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.385329962 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.385616064 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.386251926 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:50.448916912 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:50.931499958 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:51.068711996 CEST	49777	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:51.127595901 CEST	587	49781	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:51.128029108 CEST	49781	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:51.129076958 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:51.264890909 CEST	587	49777	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:51.265340090 CEST	49777	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:51.266341925 CEST	49783	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:51.329189062 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:51.334577084 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:51.464175940 CEST	587	49783	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:51.464627028 CEST	49783	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:51.603967905 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:51.604675055 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:51.712610006 CEST	587	49783	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:51.714802980 CEST	49783	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:51.800863981 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:51.802799940 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:51.911451101 CEST	587	49783	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:51.911760092 CEST	49783	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:52.000360966 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:52.000869036 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:52.109939098 CEST	587	49783	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:52.110620022 CEST	49783	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:52.214148045 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:52.214175940 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:52.214195013 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:52.214428902 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:52.219887972 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:52.325287104 CEST	587	49783	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:52.325584888 CEST	587	49783	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:52.325628042 CEST	587	49783	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:52.325654030 CEST	49783	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:52.328391075 CEST	49783	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:52.423707962 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:52.430407047 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:52.532083988 CEST	587	49783	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:52.534200907 CEST	49783	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:52.626669884 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:52.627070904 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:52.699553967 CEST	49783	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:52.731260061 CEST	587	49783	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:52.731336117 CEST	49783	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:52.787659883 CEST	49784	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:52.823601961 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:52.823879004 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:52.896142006 CEST	587	49783	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:52.896193027 CEST	49783	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:52.898459911 CEST	587	49783	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:52.898500919 CEST	49783	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:52.984177113 CEST	587	49784	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:52.984246969 CEST	49784	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:53.021745920 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:53.022043943 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:53.210360050 CEST	587	49784	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:53.210480928 CEST	49784	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:53.214745998 CEST	49784	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:53.218025923 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:53.218214989 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:53.276520014 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:53.410368919 CEST	587	49784	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:53.412219048 CEST	587	49784	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:53.412369013 CEST	49784	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:53.412369013 CEST	49784	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:53.412926912 CEST	587	49784	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:53.416618109 CEST	49784	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:53.461055040 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:53.470890999 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:53.474169970 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:53.477387905 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:53.480663061 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:53.670061111 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:53.670147896 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:53.670810938 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:53.670876980 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:53.670877934 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:53.671061993 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:53.672607899 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:53.708465099 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:53.708642006 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:53.872225046 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:53.872236013 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:53.872251987 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:53.872330904 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:53.872366905 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:53.872478962 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:53.904931068 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:53.905142069 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:54.068154097 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.068268061 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:54.068305969 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.068397999 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:54.069108009 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.072704077 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:54.102890968 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.103477955 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:54.264677048 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.264703035 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.264723063 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.264842033 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.264919043 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:54.265065908 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:54.269814968 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.269833088 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.270190954 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.270323038 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.270356894 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.270693064 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.270709991 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.270725965 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.270740986 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.270773888 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.270792007 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.270853043 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.271147966 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.310610056 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.310636044 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.310657024 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.310683012 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:54.312654018 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:54.493275881 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.493299961 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.493331909 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.493361950 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.493380070 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.493395090 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.493424892 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.493465900 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.493482113 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.493855953 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.494354963 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.494386911 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.494445086 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.494836092 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.543030977 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.545636892 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:54.652028084 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:54.743968964 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.744157076 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:54.942292929 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:54.942625999 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:55.140851021 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:55.141107082 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:55.338593960 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:55.342082024 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:55.579330921 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:55.596251011 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:55.596463919 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:55.792727947 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:55.792983055 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:55.793493032 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:55.793493032 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:55.793557882 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:55.793646097 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:55.794806957 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:55.990876913 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:55.990997076 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:55.991076946 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:55.991354942 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:55.991617918 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:55.992790937 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:55.992810011 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:55.992835045 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:55.992868900 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:55.992943048 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:55.992970943 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:55.996623993 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:56.031796932 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.031902075 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:56.187915087 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.189121962 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.189189911 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:56.189817905 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.189886093 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.189991951 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.190098047 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.190176010 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:56.190207958 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:56.193263054 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.193603039 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.199022055 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:56.228240967 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.228689909 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:56.385457039 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.385469913 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.385524988 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:36:56.386250973 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.386261940 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.386307955 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.386832952 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.394967079 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.394977093 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.395025969 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.395087004 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.395219088 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.395231962 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.424770117 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.424937010 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.424987078 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.581650019 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.581666946 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.581680059 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.582015038 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.582766056 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:36:56.683263063 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:37:04.998109102 CEST	49786	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:37:05.135195971 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:37:05.155577898 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:37:05.197303057 CEST	587	49786	50.87.195.61	192.168.2.4
Apr 26, 2024 10:37:05.200620890 CEST	49786	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:37:05.331267118 CEST	587	49785	50.87.195.61	192.168.2.4
Apr 26, 2024 10:37:05.331664085 CEST	49785	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:37:05.331890106 CEST	49787	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:37:05.351583958 CEST	587	49782	50.87.195.61	192.168.2.4
Apr 26, 2024 10:37:05.351917982 CEST	49782	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:37:05.352181911 CEST	49788	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:37:05.498631001 CEST	587	49786	50.87.195.61	192.168.2.4
Apr 26, 2024 10:37:05.498776913 CEST	49786	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:37:05.537266016 CEST	587	49787	50.87.195.61	192.168.2.4
Apr 26, 2024 10:37:05.537331104 CEST	49787	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:37:05.565598011 CEST	587	49788	50.87.195.61	192.168.2.4
Apr 26, 2024 10:37:05.565696955 CEST	49788	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:37:05.695743084 CEST	587	49786	50.87.195.61	192.168.2.4
Apr 26, 2024 10:37:05.695940971 CEST	49786	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:37:05.783169985 CEST	587	49787	50.87.195.61	192.168.2.4
Apr 26, 2024 10:37:05.783319950 CEST	49787	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:37:05.833647013 CEST	587	49788	50.87.195.61	192.168.2.4
Apr 26, 2024 10:37:05.833780050 CEST	49788	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:37:05.894460917 CEST	587	49786	50.87.195.61	192.168.2.4
Apr 26, 2024 10:37:05.894826889 CEST	49786	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:37:05.979835987 CEST	587	49787	50.87.195.61	192.168.2.4
Apr 26, 2024 10:37:05.979962111 CEST	49787	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:37:06.030572891 CEST	587	49788	50.87.195.61	192.168.2.4
Apr 26, 2024 10:37:06.030741930 CEST	49788	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:37:06.102528095 CEST	587	49786	50.87.195.61	192.168.2.4
Apr 26, 2024 10:37:06.102638006 CEST	587	49786	50.87.195.61	192.168.2.4
Apr 26, 2024 10:37:06.102650881 CEST	587	49786	50.87.195.61	192.168.2.4
Apr 26, 2024 10:37:06.102732897 CEST	49786	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:37:06.103991985 CEST	49786	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:37:06.193125010 CEST	587	49787	50.87.195.61	192.168.2.4
Apr 26, 2024 10:37:06.193464994 CEST	49787	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:37:06.230432034 CEST	587	49788	50.87.195.61	192.168.2.4
Apr 26, 2024 10:37:06.230784893 CEST	49788	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:37:06.401124001 CEST	587	49787	50.87.195.61	192.168.2.4
Apr 26, 2024 10:37:06.401143074 CEST	587	49787	50.87.195.61	192.168.2.4
Apr 26, 2024 10:37:06.401154995 CEST	587	49787	50.87.195.61	192.168.2.4
Apr 26, 2024 10:37:06.401201010 CEST	49787	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:37:06.454029083 CEST	587	49788	50.87.195.61	192.168.2.4
Apr 26, 2024 10:37:06.454097986 CEST	587	49788	50.87.195.61	192.168.2.4
Apr 26, 2024 10:37:06.454111099 CEST	587	49788	50.87.195.61	192.168.2.4
Apr 26, 2024 10:37:06.454163074 CEST	49788	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:37:06.480158091 CEST	49786	587	192.168.2.4	50.87.195.61
Apr 26, 2024 10:37:06.679934978 CEST	587	49786	50.87.195.61	192.168.2.4
Apr 26, 2024 10:37:06.798178911 CEST	587	49786	50.87.195.61	192.168.2.4
Apr 26, 2024 10:37:06.839524031 CEST	49786	587	192.168.2.4	50.87.195.61

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 10:32:57.790539980 CEST	54701	53	192.168.2.4	1.1.1.1
Apr 26, 2024 10:32:57.915714979 CEST	53	54701	1.1.1.1	192.168.2.4
Apr 26, 2024 10:32:59.370839119 CEST	49777	53	192.168.2.4	1.1.1.1
Apr 26, 2024 10:32:59.545531034 CEST	53	49777	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 26, 2024 10:32:57.790539980 CEST	192.168.2.4	1.1.1.1	0xbd3d	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Apr 26, 2024 10:32:59.370839119 CEST	192.168.2.4	1.1.1.1	0xdd75	Standard query (0)	mail.fascia-arch.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 26, 2024 10:32:57.915714979 CEST	1.1.1.1	192.168.2.4	0xbd3d	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Apr 26, 2024 10:32:57.915714979 CEST	1.1.1.1	192.168.2.4	0xbd3d	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Apr 26, 2024 10:32:57.915714979 CEST	1.1.1.1	192.168.2.4	0xbd3d	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Apr 26, 2024 10:32:59.545531034 CEST	1.1.1.1	192.168.2.4	0xdd75	No error (0)	mail.fascia-arch.com	50.87.195.61	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	104.26.12.205	443	7252	C:\Users\user\Desktop\Statement of Account PDF.bat.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 08:32:58 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-26 08:32:58 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 08:32:58 GMT Content-Type: text/plain Content-Length: 15 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87a539ad7b724974-MIA
2024-04-26 08:32:58 UTC	15	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 32 30 Data Ascii: 102.129.152.220

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	104.26.12.205	443	7720	C:\Users\user\AppData\Roaming\gDdsxauPhk.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 08:33:04 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-26 08:33:04 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 08:33:04 GMT Content-Type: text/plain Content-Length: 15 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87a539d4fa3109d2-MIA
2024-04-26 08:33:04 UTC	15	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 32 30 Data Ascii: 102.129.152.220

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49750	104.26.12.205	443	7220	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 08:33:14 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-26 08:33:14 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 08:33:14 GMT Content-Type: text/plain Content-Length: 15 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87a53a102f23a4c1-MIA
2024-04-26 08:33:14 UTC	15	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 32 30 Data Ascii: 102.129.152.220

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49755	104.26.12.205	443	7752	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 08:33:21 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-26 08:33:22 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 08:33:22 GMT Content-Type: text/plain Content-Length: 15 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87a53a412cd77436-MIA
2024-04-26 08:33:22 UTC	15	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 32 30 Data Ascii: 102.129.152.220

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 26, 2024 10:33:00.070991039 CEST	587	49736	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:32:59 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:33:00.074568987 CEST	49736	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:33:00.271383047 CEST	587	49736	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:33:00.271923065 CEST	49736	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:33:00.470662117 CEST	587	49736	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:33:06.113437891 CEST	587	49739	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:33:06 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:33:06.117778063 CEST	49739	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:33:06.314546108 CEST	587	49739	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:33:06.317152977 CEST	49739	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:33:06.515319109 CEST	587	49739	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:33:15.554121971 CEST	587	49753	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:33:15 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:33:15.554326057 CEST	49753	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:33:15.751154900 CEST	587	49753	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:33:15.751425982 CEST	49753	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:33:15.950134993 CEST	587	49753	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:33:23.243947983 CEST	587	49757	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:33:23 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:33:23.244153023 CEST	49757	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:33:23.457655907 CEST	587	49757	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:33:23.457859993 CEST	49757	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:33:23.656215906 CEST	587	49757	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:34:40.195323944 CEST	587	49759	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:34:40 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:34:40.195552111 CEST	49759	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:34:40.255414963 CEST	587	49760	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:34:40 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:34:40.255625010 CEST	49760	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:34:40.393052101 CEST	587	49759	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:34:40.393222094 CEST	49759	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:34:40.452086926 CEST	587	49760	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:34:40.452255964 CEST	49760	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:34:40.591851950 CEST	587	49759	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:34:40.650135040 CEST	587	49760	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:34:46.772742987 CEST	587	49761	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:34:46 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:34:46.773036957 CEST	49761	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:34:46.794117928 CEST	587	49762	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:34:46 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:34:46.794332981 CEST	49762	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:34:46.969957113 CEST	587	49761	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:34:46.970149040 CEST	49761	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:34:46.990200996 CEST	587	49762	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:34:46.990319014 CEST	49762	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:34:47.171823025 CEST	587	49761	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:34:47.189968109 CEST	587	49762	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:34:50.323384047 CEST	587	49763	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:34:50 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:34:50.323631048 CEST	49763	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:34:50.520364046 CEST	587	49763	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:34:50.520539045 CEST	49763	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:34:50.719587088 CEST	587	49763	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:34:51.540391922 CEST	587	49764	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:34:51 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:34:51.541019917 CEST	49764	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:34:51.737519026 CEST	587	49764	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:34:51.738224030 CEST	49764	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:34:51.935959101 CEST	587	49764	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:34:57.977706909 CEST	587	49765	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:34:57 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:34:57.977869987 CEST	49765	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:34:58.174664021 CEST	587	49765	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:34:58.174841881 CEST	49765	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:34:58.372922897 CEST	587	49765	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:35:03.317862034 CEST	587	49766	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:35:03 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:35:03.324615002 CEST	49766	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:35:03.521177053 CEST	587	49766	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:35:03.521544933 CEST	49766	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:35:03.719501972 CEST	587	49766	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:35:06.320000887 CEST	587	49767	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:35:06 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:35:06.320156097 CEST	49767	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:35:06.518642902 CEST	587	49767	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:35:06.522763014 CEST	49767	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:35:06.721072912 CEST	587	49767	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:35:14.867494106 CEST	587	49768	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:35:14 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:35:14.867705107 CEST	49768	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:35:15.064642906 CEST	587	49768	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:35:15.068703890 CEST	49768	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:35:15.266855001 CEST	587	49768	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:35:28.051446915 CEST	587	49769	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:35:27 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:35:28.054642916 CEST	49769	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:35:28.252288103 CEST	587	49769	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:35:28.252629042 CEST	49769	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:35:28.452194929 CEST	587	49769	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:35:31.606662989 CEST	587	49770	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:35:31 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:35:31.606829882 CEST	49770	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:35:31.803644896 CEST	587	49770	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:35:31.803786039 CEST	49770	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:35:32.002747059 CEST	587	49770	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:35:35.768610001 CEST	587	49771	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:35:35 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:35:35.768754959 CEST	49771	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:35:35.964926004 CEST	587	49771	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:35:35.965078115 CEST	49771	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:35:36.163014889 CEST	587	49771	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:35:36.647352934 CEST	587	49772	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:35:36 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:35:36.647501945 CEST	49772	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:35:36.843811035 CEST	587	49772	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:35:36.847058058 CEST	49772	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:35:37.045042038 CEST	587	49772	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:35:37.754841089 CEST	587	49773	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:35:37 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:35:37.754966021 CEST	49773	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:35:37.951975107 CEST	587	49773	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:35:37.952109098 CEST	49773	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:35:38.150494099 CEST	587	49773	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:35:39.393001080 CEST	587	49774	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:35:39 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:35:39.393163919 CEST	49774	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:35:39.589946985 CEST	587	49774	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:35:39.590140104 CEST	49774	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:35:39.820218086 CEST	587	49774	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:35:55.542357922 CEST	587	49775	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:35:55 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:35:55.543216944 CEST	49775	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:35:55.740255117 CEST	587	49775	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:35:55.740693092 CEST	49775	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:35:55.956368923 CEST	587	49775	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:36:01.454304934 CEST	587	49776	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:36:01 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:36:01.459032059 CEST	49776	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:36:01.656028986 CEST	587	49776	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:36:01.656389952 CEST	49776	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:36:01.870546103 CEST	587	49776	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:36:10.710277081 CEST	587	49777	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:36:10 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:36:10.710474968 CEST	49777	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:36:10.906841040 CEST	587	49777	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:36:10.907222033 CEST	49777	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:36:11.106486082 CEST	587	49777	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:36:17.150849104 CEST	587	49778	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:36:17 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:36:17.151319981 CEST	49778	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:36:17.348068953 CEST	587	49778	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:36:17.348181963 CEST	49778	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:36:17.546612978 CEST	587	49778	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:36:32.112770081 CEST	587	49779	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:36:32 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:36:32.113012075 CEST	49779	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:36:32.320796967 CEST	587	49779	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:36:32.320986986 CEST	49779	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:36:32.519685984 CEST	587	49779	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:36:36.132191896 CEST	587	49780	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:36:36 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:36:36.306034088 CEST	49780	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:36:36.504277945 CEST	587	49780	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:36:36.504723072 CEST	49780	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:36:36.702572107 CEST	587	49780	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:36:47.447623968 CEST	587	49781	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:36:47 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:36:47.447979927 CEST	49781	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:36:47.644378901 CEST	587	49781	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:36:47.644668102 CEST	49781	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:36:47.842349052 CEST	587	49781	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:36:51.603967905 CEST	587	49782	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:36:51 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:36:51.604675055 CEST	49782	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:36:51.712610006 CEST	587	49783	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:36:51 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:36:51.714802980 CEST	49783	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:36:51.800863981 CEST	587	49782	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:36:51.802799940 CEST	49782	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:36:51.911451101 CEST	587	49783	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:36:51.911760092 CEST	49783	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:36:52.000360966 CEST	587	49782	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:36:52.109939098 CEST	587	49783	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:36:52.896142006 CEST	587	49783	50.87.195.61	192.168.2.4	421 box2344.bluehost.com lost input connection
Apr 26, 2024 10:36:53.210360050 CEST	587	49784	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:36:53 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:36:53.210480928 CEST	49784	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:36:53.410368919 CEST	587	49784	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:36:53.412219048 CEST	587	49784	50.87.195.61	192.168.2.4	421 box2344.bluehost.com lost input connection
Apr 26, 2024 10:36:53.708465099 CEST	587	49785	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:36:53 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:36:53.708642006 CEST	49785	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:36:53.904931068 CEST	587	49785	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:36:53.905142069 CEST	49785	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:36:54.102890968 CEST	587	49785	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:37:05.498631001 CEST	587	49786	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:37:05 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:37:05.498776913 CEST	49786	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:37:05.695743084 CEST	587	49786	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:37:05.695940971 CEST	49786	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:37:05.783169985 CEST	587	49787	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:37:05 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:37:05.783319950 CEST	49787	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:37:05.833647013 CEST	587	49788	50.87.195.61	192.168.2.4	220-box2344.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 02:37:05 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 10:37:05.833780050 CEST	49788	587	192.168.2.4	50.87.195.61	EHLO 965543
Apr 26, 2024 10:37:05.894460917 CEST	587	49786	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:37:05.979835987 CEST	587	49787	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:37:05.979962111 CEST	49787	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:37:06.030572891 CEST	587	49788	50.87.195.61	192.168.2.4	250-box2344.bluehost.com Hello 965543 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 10:37:06.030741930 CEST	49788	587	192.168.2.4	50.87.195.61	STARTTLS
Apr 26, 2024 10:37:06.193125010 CEST	587	49787	50.87.195.61	192.168.2.4	220 TLS go ahead
Apr 26, 2024 10:37:06.230432034 CEST	587	49788	50.87.195.61	192.168.2.4	220 TLS go ahead

Target ID:	0
Start time:	10:32:51
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\Statement of Account PDF.bat.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Statement of Account PDF.bat.exe"
Imagebase:	0x4d0000
File size:	709'632 bytes
MD5 hash:	8DB4915BA4E6BB27CB249554A18A9F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1700653245.0000000003949000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1710196910.0000000007600000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1700653245.0000000004337000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1700653245.0000000004337000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:32:55
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Statement of Account PDF.bat.exe"
Imagebase:	0xfb0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:32:55
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:32:55
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gDdsxauPhk.exe"
Imagebase:	0xfb0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:32:55
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:32:55
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp690.tmp"
Imagebase:	0xbe0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:32:55
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:32:56
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\Statement of Account PDF.bat.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Statement of Account PDF.bat.exe"
Imagebase:	0x9f0000
File size:	709'632 bytes
MD5 hash:	8DB4915BA4E6BB27CB249554A18A9F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.4082420582.0000000002FAB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.4082420582.0000000002FAB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	10:32:57
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Roaming\gDdsxauPhk.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\gDdsxauPhk.exe
Imagebase:	0x20000
File size:	709'632 bytes
MD5 hash:	8DB4915BA4E6BB27CB249554A18A9F4C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs Detection: 57%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:32:58
Start date:	26/04/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:33:02
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp216B.tmp"
Imagebase:	0xbe0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:33:02
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:33:03
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Roaming\gDdsxauPhk.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\gDdsxauPhk.exe"
Imagebase:	0xb0000
File size:	709'632 bytes
MD5 hash:	8DB4915BA4E6BB27CB249554A18A9F4C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:33:03
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Roaming\gDdsxauPhk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\gDdsxauPhk.exe"
Imagebase:	0xbe0000
File size:	709'632 bytes
MD5 hash:	8DB4915BA4E6BB27CB249554A18A9F4C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.4080192144.0000000003081000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.4080192144.0000000003081000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.4080192144.00000000030D3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.4080192144.00000000030CB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	10:33:03
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 1816
Imagebase:	0x830000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:33:08
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Imagebase:	0x7d0000
File size:	709'632 bytes
MD5 hash:	8DB4915BA4E6BB27CB249554A18A9F4C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000012.00000002.1856813364.0000000004928000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000012.00000002.1856813364.0000000004928000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs Detection: 57%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:33:11
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp44D2.tmp"
Imagebase:	0xbe0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	10:33:11
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:33:12
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Imagebase:	0xfd0000
File size:	709'632 bytes
MD5 hash:	8DB4915BA4E6BB27CB249554A18A9F4C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000002.1916411729.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000016.00000002.1916411729.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000016.00000002.1928490064.000000000356C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000002.1928490064.0000000003541000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000016.00000002.1928490064.0000000003541000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000016.00000002.1928490064.0000000003574000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	10:33:12
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 8032 -s 1828
Imagebase:	0x830000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	10:33:17
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Imagebase:	0x4a0000
File size:	709'632 bytes
MD5 hash:	8DB4915BA4E6BB27CB249554A18A9F4C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000019.00000002.1945703172.0000000004798000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000019.00000002.1945703172.0000000004798000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	10:33:20
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gDdsxauPhk" /XML "C:\Users\user\AppData\Local\Temp\tmp6598.tmp"
Imagebase:	0xbe0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	10:33:20
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	10:33:20
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Imagebase:	0x520000
File size:	709'632 bytes
MD5 hash:	8DB4915BA4E6BB27CB249554A18A9F4C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000002.4081952252.000000000294B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000001E.00000002.4081952252.000000000294B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	10:33:20
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7400 -s 1788
Imagebase:	0x830000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	47
Total number of Limit Nodes:	2

Executed Functions

Function 06CE39C0 Relevance: 11.0, Strings: 8, Instructions: 977
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 06CE4254
Hbq, xrefs: 06CE4472
Hbq, xrefs: 06CE3E91
Hbq, xrefs: 06CE42B3
Hbq, xrefs: 06CE3E32
(bq, xrefs: 06CE3B8D
Hbq, xrefs: 06CE4050
PH^q, xrefs: 06CE3B61

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: (bq$Hbq$Hbq$Hbq$Hbq$Hbq$Hbq$PH^q
API String ID: 0-3076519024
Opcode ID: c5081897fb8c8056105cf34b08c1bcac3a2298f1975ee95d619b686c22a5c25a
Instruction ID: 3c209c813bc34938581cf3f1663a9976832f611b30b5d9b74ba7d7afcacd1b33
Opcode Fuzzy Hash: c5081897fb8c8056105cf34b08c1bcac3a2298f1975ee95d619b686c22a5c25a
Instruction Fuzzy Hash: 17729D31B002548FDB58AB79C85466E7BB6FFC8310F248669D40ADB3A5CE34ED46C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 06CEA688 Relevance: 8.5, Strings: 6, Instructions: 1042
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 06CEB289
TJcq, xrefs: 06CEA82D
&IH3, xrefs: 06CEAA80
xbaq, xrefs: 06CEA7B8
Te^q, xrefs: 06CEAEE2
pbq, xrefs: 06CEB361

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: &IH3$4'^q$TJcq$Te^q$pbq$xbaq
API String ID: 0-1216527603
Opcode ID: cb68446657f5d2564efb297c69cd23db5718d07ec4f48b275f27a97429af9b94
Instruction ID: af2dc99779ab733d066c1192cccb42e3acc6dcd45c90727c8fd22a2b614e27a1
Opcode Fuzzy Hash: cb68446657f5d2564efb297c69cd23db5718d07ec4f48b275f27a97429af9b94
Instruction Fuzzy Hash: 10B2A375A00628CFDB65CF69C984AD9BBB2BF89304F1581E9D509AB325DB319E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 074A7A20 Relevance: 4.0, Strings: 3, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 074A7C4E
)", xrefs: 074A7ACA
Te^q, xrefs: 074A7A89

Memory Dump Source

Source File: 00000000.00000002.1709983632.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74a0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: Te^q$Te^q$)"
API String ID: 0-4031938444
Opcode ID: 783d9b125779a37d24f1c0bd0bd36affec7fa430ab445e3fb69deb88babf9797
Instruction ID: bdf63e30a901ad65acb992da6833eac6fed2065a424240eaacc98964a2a53ddc
Opcode Fuzzy Hash: 783d9b125779a37d24f1c0bd0bd36affec7fa430ab445e3fb69deb88babf9797
Instruction Fuzzy Hash: D581C3B4E002099FDB08CFEAC9846EEBBB2FF89310F24942AD415AB354D7349946CF54

Uniqueness

Uniqueness Score: -1.00%

Function 074A9BC0 Relevance: 1.6, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

tIh, xrefs: 074A9F75

Memory Dump Source

Source File: 00000000.00000002.1709983632.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74a0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: tIh
API String ID: 0-443931868
Opcode ID: 6c3cd37dbbc21670a6792e7005c27377856d3f71375e4e3845d0ed84f00e8acc
Instruction ID: 756da5a5b20ebfac758b38e483b28fe9ad4210f4122b68d8bd7ddd3306f6f200
Opcode Fuzzy Hash: 6c3cd37dbbc21670a6792e7005c27377856d3f71375e4e3845d0ed84f00e8acc
Instruction Fuzzy Hash: 48D115B0D1421AEBCB04CF99D5848EEFBB2FF99300F14D55AD512AB254D734AA82CF94

Uniqueness

Uniqueness Score: -1.00%

Function 06CE6CD8 Relevance: .8, Instructions: 805COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a42b12b0bd18798e4d4335ea0e350c96b72d2022d75e8a5dd379489696d33c5
Instruction ID: fcea9d3011fe1c4bda68c0b788badb0c52621dfd536ca4454933f44d7c1111e8
Opcode Fuzzy Hash: 6a42b12b0bd18798e4d4335ea0e350c96b72d2022d75e8a5dd379489696d33c5
Instruction Fuzzy Hash: 00721B70A00219CFDB54DF68C884AEDB7B2FF89310F1586A9D459AB351DB34AE85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06CCC550 Relevance: .7, Instructions: 668COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707322732.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d08dcb20eecec395334e2aa8589c4d55e6fc3aa146ac48969ffdd3abc086044d
Instruction ID: 551cfa895803d223f7546486cc15161b80cb649088dde9f78bdfd4c49fe016f5
Opcode Fuzzy Hash: d08dcb20eecec395334e2aa8589c4d55e6fc3aa146ac48969ffdd3abc086044d
Instruction Fuzzy Hash: AC52E534A006048FCB54DF68C588A6DB7F2FF89315F2585ACD40A9B765DB30ED86CB80

Uniqueness

Uniqueness Score: -1.00%

Function 04EE1808 Relevance: .6, Instructions: 588COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0f393b3102f18bd9db8c73256a2632071484746d9eb04d91fe286c4e1241c06
Instruction ID: e0fcb9020bc6248586221f6741891783a30433839bf0dfa70e0746c51d16761e
Opcode Fuzzy Hash: f0f393b3102f18bd9db8c73256a2632071484746d9eb04d91fe286c4e1241c06
Instruction Fuzzy Hash: D1525B34A003458FDB14DF28C844B99B7B2FF89314F2586A9D5586F3A2DB71AD86CF81

Uniqueness

Uniqueness Score: -1.00%

Function 04EE17F8 Relevance: .6, Instructions: 577COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edc95510e5b5c47ce0447ff60f23e72f209086928ccdf78fc9daf8f5d9dfd758
Instruction ID: 15c5cc945cd5801fb7528519e9df1ad82ecbdac90b7014aa510ca6aeb2b4dec6
Opcode Fuzzy Hash: edc95510e5b5c47ce0447ff60f23e72f209086928ccdf78fc9daf8f5d9dfd758
Instruction Fuzzy Hash: 0B524B34A003458FDB14DF28C844B99B7B2FF89314F2586A9D5586F3A2DB71A986CF81

Uniqueness

Uniqueness Score: -1.00%

Function 074AC900 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709983632.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74a0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 214d12495148c75c7de29a73a4d351e06ec09273a11c8e253b2e2a46308e5ef2
Instruction ID: 95fac4909dc26f43358ab3c48b5ccd7459a0294c255d5e0bc3f9bf883eba1084
Opcode Fuzzy Hash: 214d12495148c75c7de29a73a4d351e06ec09273a11c8e253b2e2a46308e5ef2
Instruction Fuzzy Hash: 8B8112B4E1421ADFCB44CFA9D8809EEFBB6FB9E200F10991AD415B7214D7349906CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06CE9CB8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 625ca9bfe781f18bffde463c1c02d9b5c72ee1f5fea4b65698decc6267b42e1e
Instruction ID: dd731879ee3a53235b557ac69fa6b24202b6e4d66cd21e201125b5b3210abe8f
Opcode Fuzzy Hash: 625ca9bfe781f18bffde463c1c02d9b5c72ee1f5fea4b65698decc6267b42e1e
Instruction Fuzzy Hash: DE2108B1E056588BEB58DFABD8046DEBAF7AFC8300F14C07AD4196B258DB3409428F51

Uniqueness

Uniqueness Score: -1.00%

Function 06CE9CC8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f7480c14b3f6ff30357ace4356bbd9685da64fcbc505a43e9ba2363a211851d
Instruction ID: cda56c45b80c707434acb068113570865a96ce7e412b8f0262ba6bf087fc8f44
Opcode Fuzzy Hash: 2f7480c14b3f6ff30357ace4356bbd9685da64fcbc505a43e9ba2363a211851d
Instruction Fuzzy Hash: DD11E9B1E056588BEB58DFABD9042DEBAF7AFC8300F04D07AD519AA258DB7409458F50

Uniqueness

Uniqueness Score: -1.00%

Function 06CE9D5F Relevance: 5.1, Strings: 4, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06CE9E18
$^q, xrefs: 06CEA093
$^q, xrefs: 06CE9E02
$^q, xrefs: 06CEA0A9

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: ec2d63fc1aa53c2e5a5a7e232df09b82e73b709d2fd7f6e939f17b5762fb6f2f
Instruction ID: 8f869f66464461c20a88cfbf7d80b89bc17d9ed4eab24e94c8a4f294ca684d31
Opcode Fuzzy Hash: ec2d63fc1aa53c2e5a5a7e232df09b82e73b709d2fd7f6e939f17b5762fb6f2f
Instruction Fuzzy Hash: 1541D474E00218CFEB64DF65D844B99B7B2FB49300F1080D9E54AA7355CB305E85CF52

Uniqueness

Uniqueness Score: -1.00%

Function 06CE2768 Relevance: 2.8, Strings: 2, Instructions: 314
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 06CE28E6
PH^q, xrefs: 06CE2A54

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 3ecb98ad695cff41fc5451f37d030c8e7622abf51fcb84030cb8762ed2a9c02e
Instruction ID: 531f3dd3d2863a3474b6bfe3d62635d59276f7e29f8c478cc32557923469e739
Opcode Fuzzy Hash: 3ecb98ad695cff41fc5451f37d030c8e7622abf51fcb84030cb8762ed2a9c02e
Instruction Fuzzy Hash: 8CC13835A002048FCB64DF78C958A9DBBF6FF89310B2545A9E416EB3A1CB34ED45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04EE9BD8 Relevance: 2.8, Strings: 2, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 04EE9E49
Hbq, xrefs: 04EE9E7B

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: e671a94c45f42b512eae84a7611f7e90f985a9d7b6310c5fc6eeb146f12575c8
Instruction ID: bd616236a10be4ba64d0044f3fb181f3cb64e1ef39fb80fc071a18ec20beacb7
Opcode Fuzzy Hash: e671a94c45f42b512eae84a7611f7e90f985a9d7b6310c5fc6eeb146f12575c8
Instruction Fuzzy Hash: 22A17C74A002188FDB04EF69C5549AEBBF6FF89314F2044A9D405AB3A2CB35EC41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04EEB814 Relevance: 2.7, Strings: 2, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 04EEB8F0
Hbq, xrefs: 04EEB956

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: abc88107505f9db39ae936aa88355bceec8a4b221bba47e341b04b4fe7f85f18
Instruction ID: cd232b5109d5e2cc6636461991562f8b08d3b7531a1397e42ac3409a0c9903e7
Opcode Fuzzy Hash: abc88107505f9db39ae936aa88355bceec8a4b221bba47e341b04b4fe7f85f18
Instruction Fuzzy Hash: 13817C74E003598FDB04DFA9C8946EEBBF2FF88310F14812AD409AB351DB749946CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04EE4AD0 Relevance: 2.7, Strings: 2, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 04EE69C2
Hbq, xrefs: 04EE6AE0

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: (bq$Hbq
API String ID: 0-4081012451
Opcode ID: 03bd2fb0a4194c59396652479c970dc03d7cc689bb1727020de73d22ff739750
Instruction ID: 1282dd62381ec2ce541f852e506ca4b201e98315fa3269900e9f752c9341c32e
Opcode Fuzzy Hash: 03bd2fb0a4194c59396652479c970dc03d7cc689bb1727020de73d22ff739750
Instruction Fuzzy Hash: C8513031B041408FD718EF79C0406BABBA2FFC4344B1885BAE4499B762DE35BC86DB91

Uniqueness

Uniqueness Score: -1.00%

Function 06CE9F41 Relevance: 2.7, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 06CE9FB2
Te^q, xrefs: 06CEA169

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: bf8428315e1f7ae0a4d81d386377f50a2d3711815d11849522dc6ff7f6a006c7
Instruction ID: cf6984d3b049e067e84aeea613d675983f5be8a6fc394434a5150298667597cf
Opcode Fuzzy Hash: bf8428315e1f7ae0a4d81d386377f50a2d3711815d11849522dc6ff7f6a006c7
Instruction Fuzzy Hash: 5851D774E09218CFDB54DFA9D844BEDBBB6FB49300F206129E50AA7385DB349A44CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06CE9D48 Relevance: 2.6, Strings: 2, Instructions: 150
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 06CE9FB2
Te^q, xrefs: 06CEA169

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: 0392d2ecb07072db1bb981ff5f505f716d597ce93891f479dc1548dbd2c35014
Instruction ID: 5fdfa7ad9a619adb954ab35d2399af987f9efc5be51d1d97f551bd70a8fc64a3
Opcode Fuzzy Hash: 0392d2ecb07072db1bb981ff5f505f716d597ce93891f479dc1548dbd2c35014
Instruction Fuzzy Hash: 5C51D674E09208CFDB54DFA9D844BEDBBB6FB49300F206159E54AA7385DB349A44CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F1BCB8 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F1BF1E

Memory Dump Source

Source File: 00000000.00000002.1697899463.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Statement of Account PDF.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 441563b5fb676b2b7b079125278fcbf0c5f2b771fa97f1f585bc1b4cfad0f32e
Instruction ID: 44ea33b5307de3728111786c6a176446bfb121c05dbf0c189077e22502d1ac35
Opcode Fuzzy Hash: 441563b5fb676b2b7b079125278fcbf0c5f2b771fa97f1f585bc1b4cfad0f32e
Instruction Fuzzy Hash: 78812370A00B05CFD728DF29D45579ABBF1BF88314F008A2DD486DBA50DB35E985DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F14538 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00F15DC9

Memory Dump Source

Source File: 00000000.00000002.1697899463.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Statement of Account PDF.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d856111a8fbc8a897b07719a8676da92783b88bf160a3a15965e68dc75811357
Instruction ID: 11d28b16160d636c0b04cc3ca6400898d76894a3b1299de8ee8d98386e360d2e
Opcode Fuzzy Hash: d856111a8fbc8a897b07719a8676da92783b88bf160a3a15965e68dc75811357
Instruction Fuzzy Hash: 9D41D1B0C00719CBDB24CFA9C844BDEBBF5BF88704F24806AD408AB255DB756985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00F15D0D Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00F15DC9

Memory Dump Source

Source File: 00000000.00000002.1697899463.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Statement of Account PDF.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ca0dce40dd70432b276ddb573b456f38c4a3d8ad45ad4ac64a474c862ebffe3b
Instruction ID: 990253a494a7f95846a0c619aa2cc9a6a365270818b047e1b952e411c01ad0e1
Opcode Fuzzy Hash: ca0dce40dd70432b276ddb573b456f38c4a3d8ad45ad4ac64a474c862ebffe3b
Instruction Fuzzy Hash: 1741CCB0C00619CFDB24CFA9C9846DDBBB6BF88704F24816AD408AB255DB756986CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06CC9ED8 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 06CC9F77

Memory Dump Source

Source File: 00000000.00000002.1707322732.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_Statement of Account PDF.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 13cc90e52ba94fdac1b28e366674fd3f80e13a570da28d50b9e302434282cbb2
Instruction ID: 465deca57d2e3f23604afc088afd5b5ccf9d987ffd7d0ce94626777537101e33
Opcode Fuzzy Hash: 13cc90e52ba94fdac1b28e366674fd3f80e13a570da28d50b9e302434282cbb2
Instruction Fuzzy Hash: BF31E0B5D002099FDB10CF9AD880ADEBBF5FB48324F14842EE819A7210D775AA45CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06CC9EE0 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 06CC9F77

Memory Dump Source

Source File: 00000000.00000002.1707322732.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_Statement of Account PDF.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: bae1f91370fc02edc92f5c0474328c1a595cb1b283a8dc1141ad1b8287af353e
Instruction ID: 833bc8dc625dd975c94777f52987b05eb0683ef504916b9e39bcbfa5f0a09dcc
Opcode Fuzzy Hash: bae1f91370fc02edc92f5c0474328c1a595cb1b283a8dc1141ad1b8287af353e
Instruction Fuzzy Hash: 9E21CEB5D002499FDB10CF9AD884A9EBBF4BB48320F14842EE819A7210D775A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00F1DAF0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00F1E16E,?,?,?,?,?), ref: 00F1E22F

Memory Dump Source

Source File: 00000000.00000002.1697899463.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Statement of Account PDF.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9a13237f5c6c62721d81d45a105d724543e8bcf3a19ce5a3c2994f9d107a5451
Instruction ID: a426fe2f64a71d1c4c4e0ffcdc1aa54eedca1278f3a2a7f962e7b09074eb1261
Opcode Fuzzy Hash: 9a13237f5c6c62721d81d45a105d724543e8bcf3a19ce5a3c2994f9d107a5451
Instruction Fuzzy Hash: F021D2B5D00248AFDB10CF9AD584AEEBBF8EB48320F14841AE958A7310D375A944DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00F1E1A0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00F1E16E,?,?,?,?,?), ref: 00F1E22F

Memory Dump Source

Source File: 00000000.00000002.1697899463.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Statement of Account PDF.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cd76be804cb80cc515e351bcd571bd7f7e1f5adf3a17176eda3dedce3c21b485
Instruction ID: c2f525d2c4eed8ed96db3349f08143398ad2caab3f6543ba6f904f1e733a8ca0
Opcode Fuzzy Hash: cd76be804cb80cc515e351bcd571bd7f7e1f5adf3a17176eda3dedce3c21b485
Instruction Fuzzy Hash: B721E4B5D00248DFDB10CF99D584ADEBBF9FB48320F14841AE958A7260C774A954DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00F1B6C8 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00F1BF99,00000800,00000000,00000000), ref: 00F1C1AA

Memory Dump Source

Source File: 00000000.00000002.1697899463.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Statement of Account PDF.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5a5339d67f89cf2a13ea0322474c5fa811d7943719abd4d47ece497854c563cd
Instruction ID: 318721faef43b827095ec68b68a4125b7a6eba1cbe7ca6424229968c73aa5750
Opcode Fuzzy Hash: 5a5339d67f89cf2a13ea0322474c5fa811d7943719abd4d47ece497854c563cd
Instruction Fuzzy Hash: 481114B6D003499FDB10CF9AD444ADEFBF4EB48320F10842AE519B7211C375A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00F1C138 Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00F1BF99,00000800,00000000,00000000), ref: 00F1C1AA

Memory Dump Source

Source File: 00000000.00000002.1697899463.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Statement of Account PDF.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9ba323716c97c5f84637095127c52754b59b413acbccef7d955912a52f4a1532
Instruction ID: d1f14ba8e312d35c453cadc6c8d6f697835d488ab6e8535bb377f30382e1476d
Opcode Fuzzy Hash: 9ba323716c97c5f84637095127c52754b59b413acbccef7d955912a52f4a1532
Instruction Fuzzy Hash: F71142B6D00309DFDB14CF9AC584ADEFBF4AB48320F10842AD419B7210C775A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 04EEC990 Relevance: 1.5, Strings: 1, Instructions: 299COMMON

Download Yara Rule

Strings

(bq, xrefs: 04EECB82

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 6a9a6f376efce1e2ad299c42cdf01c37e52f58e283821ec77571b069d76a0d07
Instruction ID: 2720ee54810469cecd17b5b766f79f020db6d19513b1d162b0147639b6412f3c
Opcode Fuzzy Hash: 6a9a6f376efce1e2ad299c42cdf01c37e52f58e283821ec77571b069d76a0d07
Instruction Fuzzy Hash: D191F070A01248DFDB14DFBAE4446EEBFF2FF89314F20846AE455A7251DB34A842CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F1BEB8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F1BF1E

Memory Dump Source

Source File: 00000000.00000002.1697899463.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Statement of Account PDF.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 84a39345508385bb1bf3555139114ae23fa41a322766f7f29bb935b9ef39062f
Instruction ID: 876cd1d46be3430ec996f1782ef80a51cae4108bf2f622148b612a0d24e4bdf1
Opcode Fuzzy Hash: 84a39345508385bb1bf3555139114ae23fa41a322766f7f29bb935b9ef39062f
Instruction Fuzzy Hash: 3111E0B6D00349CFCB10CF9AD844ADEFBF5AF88324F14846AD459A7210C375A585CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06CE2F10 Relevance: 1.4, Strings: 1, Instructions: 193COMMON

Download Yara Rule

Strings

Hbq, xrefs: 06CE30AA

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 76da77d8ae1ba1a79250f8b186a570b67d19ab9230b539c68694f313bcce50f3
Instruction ID: dac426b8443721f25230b6a5a46d0965295b5076ad151a262c77c10a500a0463
Opcode Fuzzy Hash: 76da77d8ae1ba1a79250f8b186a570b67d19ab9230b539c68694f313bcce50f3
Instruction Fuzzy Hash: E461CF30B002489FCB58EB78C45466E7BBAEFC5311B2485ADD409DB391CE39EE46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04EE4B48 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

Hbq, xrefs: 04EE4C67

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 5cacdfb5705894614a60ef9a956bcf78a1d45b54ca699c95d6e6ea65467f13a9
Instruction ID: d79f87c3450f305b3b35a4e16f5faa2291b2ae7c37d668735703e075cccce768
Opcode Fuzzy Hash: 5cacdfb5705894614a60ef9a956bcf78a1d45b54ca699c95d6e6ea65467f13a9
Instruction Fuzzy Hash: 954152367001149BD705AFBA98906BF7B9BEBC5351B118425E906CB3D5EE38DC42C3E1

Uniqueness

Uniqueness Score: -1.00%

Function 06CE39B0 Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06CE3B61

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: fbbd5a30c49a4454b071afe16218ee65b8792f2011c133c451935084ca107555
Instruction ID: 489059f98a014acdb7e0579d000fcbada1f4b6658a6406b62f4399d0309f275a
Opcode Fuzzy Hash: fbbd5a30c49a4454b071afe16218ee65b8792f2011c133c451935084ca107555
Instruction Fuzzy Hash: EE516730B405458FDB58DF69C998BAAB7F1FF88700F1481A9E40ADB260DB71ED85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06CE3991 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06CE3B61

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 84ae90d70e2070281b8c599f817a074cb47053ca05f73f75ef0fe62a9b522b9c
Instruction ID: 915c68337a9fa312dbe1aea42d7cd355f92872926cde5da86af14f9c93a84c6d
Opcode Fuzzy Hash: 84ae90d70e2070281b8c599f817a074cb47053ca05f73f75ef0fe62a9b522b9c
Instruction Fuzzy Hash: 9B516830B405458FDB58CF69C998BA9B7F1BF88704F1581A9E40ADB261CB71ED85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04EEAED8 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

Hbq, xrefs: 04EEAEE9

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: f67efb9b0c9abdd0909efc47066be76b6fea46972eee637b1211da479ba4f6df
Instruction ID: 82e188a0daeeb9205957ce8a53c06c413afdfb6720c3ab962ff83871efba5850
Opcode Fuzzy Hash: f67efb9b0c9abdd0909efc47066be76b6fea46972eee637b1211da479ba4f6df
Instruction Fuzzy Hash: F6311634A00209AFDB04EFA5D8549DEBBB6FFC9304B108529E502AB395DF74AD46CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06CE3B8C Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

(bq, xrefs: 06CE3B8D

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 0751db26892e54626f6f1a0986f238095a62340543758d2c169d3fc9eb0f6fbe
Instruction ID: 1687b7acf88abf5a8b42458ef06146f4f1b105ce4e697487388b1cc2523d3d31
Opcode Fuzzy Hash: 0751db26892e54626f6f1a0986f238095a62340543758d2c169d3fc9eb0f6fbe
Instruction Fuzzy Hash: 334191307006508FC7A4AB38C848B567BB1BF85314F1586ADE45ECB3A1CF74E98ACB41

Uniqueness

Uniqueness Score: -1.00%

Function 074AC350 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

O};5, xrefs: 074AC388

Memory Dump Source

Source File: 00000000.00000002.1709983632.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74a0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: O};5
API String ID: 0-3558557551
Opcode ID: 1375168a7ecf720d0081fad4ac9ad0dc6101a3c0cfcfc663c60ab131599f1b1c
Instruction ID: 66b4cc7e3b0928240042b6d79b02d2a5c389a49153297e9e68c5a2e4b81434c6
Opcode Fuzzy Hash: 1375168a7ecf720d0081fad4ac9ad0dc6101a3c0cfcfc663c60ab131599f1b1c
Instruction Fuzzy Hash: 28411DB0E15609EFCB84CF99D5849AEBBF2FF89300F609896D456A7314D730EA11CB25

Uniqueness

Uniqueness Score: -1.00%

Function 06CEF208 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06CEF380

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: e91531cee8839502cc3fca620e7f059d209ebe2497ccdaeb9eea55ca86367001
Instruction ID: 1b78a04022deff786402e170df217a2ff95d7f01b2fa2d8015eb5152edc815f2
Opcode Fuzzy Hash: e91531cee8839502cc3fca620e7f059d209ebe2497ccdaeb9eea55ca86367001
Instruction Fuzzy Hash: BF312DB4E042888FDB54CFA6C4546EEBFB6BF89300F14802ED415AB365DB745945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04EE69A9 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

(bq, xrefs: 04EE69C2

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 8ff11a84f07d08eec1b9cfbcb34ca106e689a040dc1feea730e1b881b3c6cf5c
Instruction ID: cd8d6abfe1628eb9b4caebc5d1d9572fe7244084787eb55b94c65039268b279a
Opcode Fuzzy Hash: 8ff11a84f07d08eec1b9cfbcb34ca106e689a040dc1feea730e1b881b3c6cf5c
Instruction Fuzzy Hash: EE217B71D0A691AFD329DF39C0001B9BFB0FF91344B44816BC4988BA93DA34B996D7D2

Uniqueness

Uniqueness Score: -1.00%

Function 06CEF218 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06CEF380

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 5419e00b85cfc409d85c166033f331a774ac5f5f74424f31edee50805ee9bb8b
Instruction ID: 849af1ec251f128d5f8c28bc7826ca0c283e4752f2f8aa4f4df2ab2cf270fd90
Opcode Fuzzy Hash: 5419e00b85cfc409d85c166033f331a774ac5f5f74424f31edee50805ee9bb8b
Instruction Fuzzy Hash: 4931F6B4E042488FDB58CFAAC5546EEBBB6AF89300F108029D419AB358DB745906CF80

Uniqueness

Uniqueness Score: -1.00%

Function 074ADDE0 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

8bq, xrefs: 074ADE5B

Memory Dump Source

Source File: 00000000.00000002.1709983632.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74a0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: 8bq
API String ID: 0-187764589
Opcode ID: 7d2ce76ec6b95cbf4fc965e30d5f0f35937119f726ab72f87c487a67eac7100b
Instruction ID: 6ea3e4238fab066f6a9abab825d488d065002409edff5167ef458c94b07c3ec6
Opcode Fuzzy Hash: 7d2ce76ec6b95cbf4fc965e30d5f0f35937119f726ab72f87c487a67eac7100b
Instruction Fuzzy Hash: D1312DB4E04109DFCB48DFA9D9406EFBBB6FBA9300F10952AD516A7395DB345A01CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06CEB982 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

8bq, xrefs: 06CEB9FC

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: 8bq
API String ID: 0-187764589
Opcode ID: 17c581ca48762266f91a6c9d2a1f834d9dcffa085cb582d1488cdaba8d7b44c1
Instruction ID: ed93b59973868b6bddd95c9d7a3ab6e6374cef48a94e6421657ee872169390f3
Opcode Fuzzy Hash: 17c581ca48762266f91a6c9d2a1f834d9dcffa085cb582d1488cdaba8d7b44c1
Instruction Fuzzy Hash: F8211A78E0924E8FCB00DFA8D5408EEBBF1FB49310F105566D515AB295D7345E01CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 074AE0D8 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

Te^q, xrefs: 074AE143

Memory Dump Source

Source File: 00000000.00000002.1709983632.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74a0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 55f93c9582628792d29e1ee9e00d35b32f5e7f13eccf5da627213b1a93788105
Instruction ID: c068626a911b38dc6d9ed19fc842571160912ebdd84435649b84c96dc9473bde
Opcode Fuzzy Hash: 55f93c9582628792d29e1ee9e00d35b32f5e7f13eccf5da627213b1a93788105
Instruction Fuzzy Hash: A2115171F0022A9BCB14EBB9D9115EFB7F2AF95210F10006AC415E7344EB358E06CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 06CE8B9F Relevance: 1.3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

(bq, xrefs: 06CE8BE7

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: e599348e641e633300c97b2460ea2890b58b265f27ae87e93d0f567fc74be18f
Instruction ID: 9e9045b536c91bf5e7918e971d93f23d213210b392f00c24f8ed10e11af20883
Opcode Fuzzy Hash: e599348e641e633300c97b2460ea2890b58b265f27ae87e93d0f567fc74be18f
Instruction Fuzzy Hash: AA019E71E0525A8FCF44EFB9D8051EEBBB2EF86312F20456AD215F7240EB305A468B91

Uniqueness

Uniqueness Score: -1.00%

Function 06CEF2E4 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06CEF2F4

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: af970e50916eb770558bcd315e4aade41a3f762af026368e0b29f8507c2afd73
Instruction ID: bb8bb597d7735c818b58e9c9ee00dfc988b1d35c0e9fdcc69cd1e40eee09aab1
Opcode Fuzzy Hash: af970e50916eb770558bcd315e4aade41a3f762af026368e0b29f8507c2afd73
Instruction Fuzzy Hash: 31117F75E002199FCF08DFE8D8849ADBBB2FB88310F10812AE919AB365C7356945DF50

Uniqueness

Uniqueness Score: -1.00%

Function 04EE5228 Relevance: .8, Instructions: 755COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 612a3b1957c0f6652fc46315043190ee2ec287ea2ebe781294334e08e9ec4dca
Instruction ID: 10c6084254ed491bc2d06bde65568db619bca133ef8503578d48ec9fb9aa7731
Opcode Fuzzy Hash: 612a3b1957c0f6652fc46315043190ee2ec287ea2ebe781294334e08e9ec4dca
Instruction Fuzzy Hash: 66621E74D00B45DADB319BB6D58C3BEB6E2AB41308F516D1FC4BACE390DB35A4818B45

Uniqueness

Uniqueness Score: -1.00%

Function 04EE51C9 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e23b605c43c216784164ef278a1be9a7d40c418132d2ed8bf8a2b1e7ed7217f
Instruction ID: d9ea76a61c77b8706d49d7521b5f96249b081dd12421c500433037d905411cc0
Opcode Fuzzy Hash: 1e23b605c43c216784164ef278a1be9a7d40c418132d2ed8bf8a2b1e7ed7217f
Instruction Fuzzy Hash: 5F228EB4905B86DADB719BA5D48C2AF76E0AB0130CF216D1BC4FACE351D734E086CB45

Uniqueness

Uniqueness Score: -1.00%

Function 06CE084B Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2720c8b2c2bd9d90f605da33c01ecbce4ec13d7784e5a343827c073706ca9ed
Instruction ID: 467f73dbb6ba244e8695daba79dde6b5e2ba4eca7c6b6238283310354420f828
Opcode Fuzzy Hash: a2720c8b2c2bd9d90f605da33c01ecbce4ec13d7784e5a343827c073706ca9ed
Instruction Fuzzy Hash: CB02E534B401089FDB54DF68D498A6DBBF2FF88314F1585A8E4099B366CB71ED85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04EEA128 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5abd77dd9b28e2e09e9d62bfd2ce39127f6a2ba01da35e803757376d10fa1470
Instruction ID: 056b947c33767962e58d4a433f5c6321fcab62069b700737fe3c0478ef8c026f
Opcode Fuzzy Hash: 5abd77dd9b28e2e09e9d62bfd2ce39127f6a2ba01da35e803757376d10fa1470
Instruction Fuzzy Hash: 4781D038710600CFCB14EF69D49896A7BF6BF89B05B1541A9E516CB3B6DB71EC41CB80

Uniqueness

Uniqueness Score: -1.00%

Function 074AF6F8 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709983632.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74a0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e7ac1a0e199c4b29091b9b61e9fa9dc0d279b8737f8dcba9064c9f0b49e7cd7
Instruction ID: a7dd9ab19906c8329717dc8ce4d8ed2f7ed1907747a58367a200ae43be142516
Opcode Fuzzy Hash: 7e7ac1a0e199c4b29091b9b61e9fa9dc0d279b8737f8dcba9064c9f0b49e7cd7
Instruction Fuzzy Hash: 5D613BB4D19209EFCB14CFE9D4446EEBBBAFF9A300F10942AE419A7255D7309946CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04EE8F30 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0ac697cb3d71c18e1258feb90e3c87fb06df5078b722db165525f093414b922
Instruction ID: fb6d9cd19fde4d178a58115384bda30af1e5a52bdd802da81e04a65498d3399f
Opcode Fuzzy Hash: c0ac697cb3d71c18e1258feb90e3c87fb06df5078b722db165525f093414b922
Instruction Fuzzy Hash: 01717C74A01208EFCB15DFA9D894DAEBBB6FF48724B514498F901AB361DB31EC81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04EEDB48 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 341c1a6fb7eb9fcf28221bbb01f5302a2faeed2d695e2782d72ec7e3f1685b91
Instruction ID: c363a50562c2a838cf4c47743054977c5333308592d20c285ef506fabc7ca149
Opcode Fuzzy Hash: 341c1a6fb7eb9fcf28221bbb01f5302a2faeed2d695e2782d72ec7e3f1685b91
Instruction Fuzzy Hash: C7519032A0050A9FDF10CFA6DC40AFEB3B6EF85754F0984A6E904EB261D775E906CB40

Uniqueness

Uniqueness Score: -1.00%

Function 04EEBB20 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0650b7977a66f1276f872e6e7c18b7dea390d6fb59912bf8c8390cde211a1aa0
Instruction ID: a2e7e3654c54faf8e3bb978d54a7d259bcdef0d469e9cfd38c03433364ec4565
Opcode Fuzzy Hash: 0650b7977a66f1276f872e6e7c18b7dea390d6fb59912bf8c8390cde211a1aa0
Instruction Fuzzy Hash: CC518E71E002499FDB14DFAAD844ABFBBF9EFC8310F10846AD455E7250DB34A945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04EE8B60 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 920dc6a023720a175a48c9f667a6820aa44315c2c0b519826e8b6a76a415a6ef
Instruction ID: bab387bf393558111e6540477f6f42147db0fe4c86e95fe68af4055b53692407
Opcode Fuzzy Hash: 920dc6a023720a175a48c9f667a6820aa44315c2c0b519826e8b6a76a415a6ef
Instruction Fuzzy Hash: CA51B0317002008FD714AF69D494AEE7BF6EF89304F1449A9D10ADB362DB75EC45DB91

Uniqueness

Uniqueness Score: -1.00%

Function 06CEFA10 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaf43fde2719f514430f0c3c87d6f271f62ae7eec1e6de0c543cad1134a6224a
Instruction ID: b4048506a326832f55836405a82a1aacc533ff92a66326fed57c2a8b0d0950f3
Opcode Fuzzy Hash: aaf43fde2719f514430f0c3c87d6f271f62ae7eec1e6de0c543cad1134a6224a
Instruction Fuzzy Hash: 6E418E74E092188FDB44CFAAD8446EEBBF6EF8D301F14D02DE419A7251D7344A40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04EE8F21 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7a1caee21e2321cc6e0b1505321c38315e2ad6a0fd40b3967f9a6021fc65c6c
Instruction ID: f1a75613562221b0c17a58f0d8bfc5152e06362590e83730f8ee08cc994d2fc5
Opcode Fuzzy Hash: b7a1caee21e2321cc6e0b1505321c38315e2ad6a0fd40b3967f9a6021fc65c6c
Instruction Fuzzy Hash: 6B51B278A11208AFCB14DF69D894DADBBB2FF49724B114498F901AB361DB31EC81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04EEAA78 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a30f908ca0bbabfbced8adfa43c25fed5d328895402b4065974350248ec4c2e
Instruction ID: c02e2daaa343bee939136e613eda25606b3155f6f5cda714791090342432ab4a
Opcode Fuzzy Hash: 2a30f908ca0bbabfbced8adfa43c25fed5d328895402b4065974350248ec4c2e
Instruction Fuzzy Hash: 11418175E002088FEB14EFB6D0506BDBAB2EFC8618F14547DD501AB284DB38A981CB95

Uniqueness

Uniqueness Score: -1.00%

Function 06CE1351 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b41d9e7f48e938e257ed63e37789171e3111a5e5228db82f9be1e0fca679506d
Instruction ID: 08de39e9c4cf0581a7f6b3c7c0321568ad00bbfdaa3b589831ee2bd336171f26
Opcode Fuzzy Hash: b41d9e7f48e938e257ed63e37789171e3111a5e5228db82f9be1e0fca679506d
Instruction Fuzzy Hash: CF41D4307006018FD7A59F25C894B7EB3F2BF85324F14856ED0158BBA1CB71AD56CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04EEE548 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5b4fa052703c99b5c9d16e23c69252e5374d01863bb712fc3719d845b5164ce
Instruction ID: 13729e6126bc4ca4ce9f299d0dd5fc19e0863f9fca82295e1c9e0f548a06c734
Opcode Fuzzy Hash: a5b4fa052703c99b5c9d16e23c69252e5374d01863bb712fc3719d845b5164ce
Instruction Fuzzy Hash: 8F410734A002198FDB14EFA9C855BEDB7B1BF89314F114068E505BB3A1DB79E845CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06CE1360 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 164f6b5286f0f1b8196bc6da0145581a262cdd1d6cc4a17f7099a43a779b59cc
Instruction ID: 5b0effd946b423b327994f590aa086c748103fe5c18fbc042df84c77657eefab
Opcode Fuzzy Hash: 164f6b5286f0f1b8196bc6da0145581a262cdd1d6cc4a17f7099a43a779b59cc
Instruction Fuzzy Hash: E5417E307006019FD7A9AF25C894B6EB3B2BF85324F14862DD1168B7A0CB71ED46DB91

Uniqueness

Uniqueness Score: -1.00%

Function 04EE4948 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 830b6744617cbd93dd86b7a78a1b7fcad3a620f2cfac0bf7b65da0eb1630b024
Instruction ID: cd11b35d1748ff68660173d3192d9c8c1422a83cfc3677249e2bbb881d7ee6ef
Opcode Fuzzy Hash: 830b6744617cbd93dd86b7a78a1b7fcad3a620f2cfac0bf7b65da0eb1630b024
Instruction Fuzzy Hash: B04104B1D00359CFDB10DFAAC584ADEBBB1BF48304F24802AD408AB251D775AA4ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 06CE8C28 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 934b718e558af25d204acef514f419dd63a58fbc65dbcc2ed9e47e009c4e04a1
Instruction ID: 180b2683937144b8843e6866d05e5d28ac3df7fc52410982b9a3b097e135c5d3
Opcode Fuzzy Hash: 934b718e558af25d204acef514f419dd63a58fbc65dbcc2ed9e47e009c4e04a1
Instruction Fuzzy Hash: 4F413E34E111098BDB54DBA9D994BAEBBF2BF88700F24856AE511B7350DB719D01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04EEAA53 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04730bef0997442d5b447129dd7bd6800e2d868f3e399d9ba236f46313eb899d
Instruction ID: 39585fe1f8c53b3451f727135eada7fe694cc1c7cdd5d4e33dfb7de7cb4483e8
Opcode Fuzzy Hash: 04730bef0997442d5b447129dd7bd6800e2d868f3e399d9ba236f46313eb899d
Instruction Fuzzy Hash: 7331B475E002058BEB14EB76C0546FE7BB2EF84208F10547DC502AB280DB79A982CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 04EE497C Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75de8b869ab167abfaca5f5c7d4884f42abf956cbd90f4ad3d67c9763aea5231
Instruction ID: 07a95caed4fb5843efe63ec338f8d20120b01b86932caa366fb433853e3df07d
Opcode Fuzzy Hash: 75de8b869ab167abfaca5f5c7d4884f42abf956cbd90f4ad3d67c9763aea5231
Instruction Fuzzy Hash: 8531D231A04659DBCF00CFA9E8904BE7BB5FF85708F14856AE804DB256F636DC46C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 04EE4E94 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca2cb7edf2e5dd55141cbf0ae7789ada28005222d220ecc07777f9731f933f95
Instruction ID: ea483ffe182fbf278bea9c87a99fa1456491c63d6fb905775e8cad05599db668
Opcode Fuzzy Hash: ca2cb7edf2e5dd55141cbf0ae7789ada28005222d220ecc07777f9731f933f95
Instruction Fuzzy Hash: 9441D1B1D0020DDFDB10CFAAC984ADEBBB5BF48304F248029D418BB254D775AA4ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 074AF9F8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709983632.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74a0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed4a5b069dd53ea12635b16a9cabf762f6f1189ba655270cc9643a517f8d0ee
Instruction ID: 63a6eb37a58182921dd99097b0bf6e37df711b4131716489561840437cc8f5a3
Opcode Fuzzy Hash: 0ed4a5b069dd53ea12635b16a9cabf762f6f1189ba655270cc9643a517f8d0ee
Instruction Fuzzy Hash: 3131C2B1A09389AFCB05DF74D8554EE7FF8EF5621072484BBD845C7252EA309D06C761

Uniqueness

Uniqueness Score: -1.00%

Function 06CE4B11 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cc8bc466a3ae1a4db1b84636dd269183b149bb3ecd25c7943e8698c1b65a1fc
Instruction ID: bc9d58deccd078e6616aae8b032a05b29809b6c0bf54c2735a3b6b0df7e074f9
Opcode Fuzzy Hash: 8cc8bc466a3ae1a4db1b84636dd269183b149bb3ecd25c7943e8698c1b65a1fc
Instruction Fuzzy Hash: 79316D35B002149FCB18DF68D884AAEBBB6FF88220F118299E5258B3B1D771DD41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04EE4964 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d62393d02207341d4254506b246886b108cbfbf5f69c085cac66a3f2512fd3f
Instruction ID: bdb72312b14446756837143867e4ac2b3a12ad662c40971fd28ca4925fc7e8fd
Opcode Fuzzy Hash: 4d62393d02207341d4254506b246886b108cbfbf5f69c085cac66a3f2512fd3f
Instruction Fuzzy Hash: 7041BFB1D0020DDFDB24DFAAC584ADEBBB5AF48704F649029D408BB254D775AA4ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 04EEE410 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9b50c1a03631e4b7200f4027034dc4d26892c5e8ba8a80e09003536e32be504
Instruction ID: eb05ec2d49ead8b2917b3a9853494669b81f6e0f12284f4c6c425bd13185b6a7
Opcode Fuzzy Hash: c9b50c1a03631e4b7200f4027034dc4d26892c5e8ba8a80e09003536e32be504
Instruction Fuzzy Hash: 7B31DF31B042848FCB19EB7DD81456E7BB6FFC5310B1485BAD049DB3A5DE34AC4A8B91

Uniqueness

Uniqueness Score: -1.00%

Function 074AFCF0 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709983632.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74a0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e453d4316a4455fd9708f2482c5ceb685ef42b2b2765d26527d0a302b7a5b80
Instruction ID: 71866abc2c01981bb563a74d2b5fa1d370b2bdda4001713e506c215960639331
Opcode Fuzzy Hash: 2e453d4316a4455fd9708f2482c5ceb685ef42b2b2765d26527d0a302b7a5b80
Instruction Fuzzy Hash: B8210571B001659FCB55ABBE98146AFBBEBFFE4250720453AD506D7380DE34CE0683A2

Uniqueness

Uniqueness Score: -1.00%

Function 06CE20C8 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a241d8ebcccddd70d7e86dbd80ea7c7de7281dd3286f7ac2f936ff70ee6c4c0a
Instruction ID: 8b982f55422a30e2d2fcf289aa91d3eba684c4a6e29796abb6daa54851f1c290
Opcode Fuzzy Hash: a241d8ebcccddd70d7e86dbd80ea7c7de7281dd3286f7ac2f936ff70ee6c4c0a
Instruction Fuzzy Hash: E1311A347006008FDB98DB69C894B6973FAEF89614F1580ADE51ACB361DB39EE41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06CE20B8 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21c5fb2617899c07f3d4c0e7f09d9ea04b76b04d809437a1493f3cddb5a89b09
Instruction ID: 20082bce5403ebacac1b3cb85c7079a851aa8a07f3c81448ca7249e49d1db4ca
Opcode Fuzzy Hash: 21c5fb2617899c07f3d4c0e7f09d9ea04b76b04d809437a1493f3cddb5a89b09
Instruction Fuzzy Hash: 14315D307002008FDB58DB69C884B5977B9EF85614F1580ADE546CB371DB35EE45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04EEC770 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbf88d122ce068c64b390d3b543d38c7be93a26ed44cb5fa153f4e7089317438
Instruction ID: 922d81d8c3831185ba796a5fc2a9d6f47a6f3838874785c3789b8d5e41a97850
Opcode Fuzzy Hash: cbf88d122ce068c64b390d3b543d38c7be93a26ed44cb5fa153f4e7089317438
Instruction Fuzzy Hash: B031AEB1E043489FDB10CFAAC844AAEFFF4EF89320F14846AD458E7251D734A945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06CE4B20 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1b07866e58c2666b1d3e7e777b701984f45afed0c1db7bc89c30cbc6159504a
Instruction ID: c2037d148170b372f071bb4823708346aee714e5f6f0295caba03b8213138e3c
Opcode Fuzzy Hash: e1b07866e58c2666b1d3e7e777b701984f45afed0c1db7bc89c30cbc6159504a
Instruction Fuzzy Hash: 96315A34B006149FCB58DF68D884A6EB7B6FF88720F1082A9E5259B3B1CB71DD41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04EEB9A0 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96962c4279966ec690599f840ab65e2db91266dbb4479fd50cb5919334944d61
Instruction ID: afece7f017d08f267dfbad55dd8b6253fa1980620ac78fe40e90825c2269991c
Opcode Fuzzy Hash: 96962c4279966ec690599f840ab65e2db91266dbb4479fd50cb5919334944d61
Instruction Fuzzy Hash: 5441BDB0D00358DFDB14CFAAC984A9EFBB1BF48714F24812AE418BB250D7706845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04EEA101 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2d41d6d5c8b7e3b16c2cca9e638965338df68a6ac7371a50a39d81b8c6adf7f
Instruction ID: b343955c75b3727f585ed0bd2f68745462562eb8e10e6565482fe8695d609a02
Opcode Fuzzy Hash: d2d41d6d5c8b7e3b16c2cca9e638965338df68a6ac7371a50a39d81b8c6adf7f
Instruction Fuzzy Hash: E8318974B006008FCB05DB38D4999AD7BF6EF8970470541AAE902CB372EB75EC06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04EE4970 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ee49fb33e64b60c6a66e02fda8704c843e6fad7c06ab809ca290c321c8f470
Instruction ID: 3e5b85d239a2ab11881eb26e4c97fba244f72b95f84c858ecb1bb3fdfd3542b9
Opcode Fuzzy Hash: 33ee49fb33e64b60c6a66e02fda8704c843e6fad7c06ab809ca290c321c8f470
Instruction Fuzzy Hash: 88310471900616DBDF00DF69D8804BFBBF5EF85319B04846AEC18EB256E234D905C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 074A6D14 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709983632.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74a0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03c9c600e8be6558b88230f5891796e04a88ae47f0959f1ee92c0a9972ebc41f
Instruction ID: c93b8d058efa9a42455131be21f9fce6ccdec1ba48c492c7d4249825c7894fef
Opcode Fuzzy Hash: 03c9c600e8be6558b88230f5891796e04a88ae47f0959f1ee92c0a9972ebc41f
Instruction Fuzzy Hash: 4121FEB0B003599FCB05AB79AC584BF7BB6EFC4260714482AE426D7381EE348C018361

Uniqueness

Uniqueness Score: -1.00%

Function 06CEC7F8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5624739d841475557c04bcd565fc70fc0cec5528fd71514cff67265abf429394
Instruction ID: 1e5d4fadcd573eaf78460f54957e3c2ccfd090db34821f884c7630c234c8af01
Opcode Fuzzy Hash: 5624739d841475557c04bcd565fc70fc0cec5528fd71514cff67265abf429394
Instruction Fuzzy Hash: E1314B74E04108DFDB58DFAAD544AEEBBF6FB88300F10A06AD425A7351DB309A44CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06CE25D4 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64e5fc8b2c9fd25e87e6a9e94d89537c8bec7356918511b6c948245fa27f7b32
Instruction ID: 78a6f826f5f76b814c040dd422ff392f030b751eccb759cbead9355691fba790
Opcode Fuzzy Hash: 64e5fc8b2c9fd25e87e6a9e94d89537c8bec7356918511b6c948245fa27f7b32
Instruction Fuzzy Hash: 70314D307406108FD7A4AB29C848B6677B5FF84324F50866DE55E8B2B1CF71F98ACB40

Uniqueness

Uniqueness Score: -1.00%

Function 06CE2DA0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f998e5fdfe5e7f285699ff656b81c1842b7324b75644f73ffcb664bff024ab9d
Instruction ID: be3f91771c76fd7c91c0d074b7d5a62f21c3d6dc7758169377102a378ac643cc
Opcode Fuzzy Hash: f998e5fdfe5e7f285699ff656b81c1842b7324b75644f73ffcb664bff024ab9d
Instruction Fuzzy Hash: 7121B334B409148B9BA96A79991477E36EBAFC8652709402DD403C7398EE6CCE03D7E6

Uniqueness

Uniqueness Score: -1.00%

Function 04EE4D98 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91e489b75e7378d8d0ca8bc2ab359002c5440a3b66a8a4b3b1a128e8825cacb4
Instruction ID: 252602a0817bf8bbccc830acffd437db0e0a3fb7f8b4d0c5f4034e211d82f5d7
Opcode Fuzzy Hash: 91e489b75e7378d8d0ca8bc2ab359002c5440a3b66a8a4b3b1a128e8825cacb4
Instruction Fuzzy Hash: F8213571B002458FC710DF79D4488EABBE6EFC430471588A9D10AEB361EF79EC0A8B90

Uniqueness

Uniqueness Score: -1.00%

Function 04EEBB10 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 181799afc1ea392f979875b5addf4c025adaee481e236eb9e77f60970ec80b54
Instruction ID: da518f90bcf3b879e2afb04f84155f5e43d049b71373e5c4880162341677bffb
Opcode Fuzzy Hash: 181799afc1ea392f979875b5addf4c025adaee481e236eb9e77f60970ec80b54
Instruction Fuzzy Hash: 9D218D71E001459FDB10EFAAD8109BFBBFAEFC4204F10806AE554E3254EB34AA058BA0

Uniqueness

Uniqueness Score: -1.00%

Function 06CEC7F7 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d5f3117d820fded7d192f3be6eb630ccbe65014c4a2f471f3f0da11730671f0
Instruction ID: 2f000b37ccbd8394a8d5d8e650d183c5176d3d0e75d6474ed845a70d89444875
Opcode Fuzzy Hash: 7d5f3117d820fded7d192f3be6eb630ccbe65014c4a2f471f3f0da11730671f0
Instruction Fuzzy Hash: 52316D74E04108DFDB54DFAAD544AEEBBF6FB88300F10A02AD425A7341DB309A40CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04EE0697 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93cec6e9b8c017ae0622c013cee1aa398254a10890e335d077639609666c1538
Instruction ID: 2c5abcf4e5a23ded40f8c865fa10ee3d288f3250c32810d0abbcfb5482b222b0
Opcode Fuzzy Hash: 93cec6e9b8c017ae0622c013cee1aa398254a10890e335d077639609666c1538
Instruction Fuzzy Hash: 71310232904B09DFCB01EF78C854499F771FF55310B118B9AE5996B222FB30E695CB81

Uniqueness

Uniqueness Score: -1.00%

Function 04EEE817 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7370467588b8accac70176eaec5bff84d85bd33a21b05839ae5c51133fa11813
Instruction ID: ceb0216b476d16944b52be3ecc1828f1b50665f0afaff249aade15323bfae003
Opcode Fuzzy Hash: 7370467588b8accac70176eaec5bff84d85bd33a21b05839ae5c51133fa11813
Instruction Fuzzy Hash: 9A215C347002008FDB19AB3DD854A6977E6EF8571871494AEE406CB3B5DB76EC83CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04EE4B38 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35ea52d80ea3a4cb3f007b564a25e40b272500ece06bf5c102a6e4c77d37c96d
Instruction ID: e5fbfd4b0d1ea3f2e6aa7c7d957cfe0cd3c584f0c2da600ba7b7d07454ef3c00
Opcode Fuzzy Hash: 35ea52d80ea3a4cb3f007b564a25e40b272500ece06bf5c102a6e4c77d37c96d
Instruction Fuzzy Hash: 772178367005149BE7109F9ADC44BBFBBABEB84315B114415E901D72E5DB38EC42C3E1

Uniqueness

Uniqueness Score: -1.00%

Function 06CE2A6D Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cebe9333b3d79aae693b47ecfffc082599c18489aa27f749f1950db4cf2280a5
Instruction ID: 6e1c4e6066dce9879f5bd18a4bb0eb55b316e493ce87763322ac03aed00528ce
Opcode Fuzzy Hash: cebe9333b3d79aae693b47ecfffc082599c18489aa27f749f1950db4cf2280a5
Instruction Fuzzy Hash: BB314C31B002088FCBA5DFA5D544ADDB7F6EF88311F155468D802AB3A4CB35DE85CB60

Uniqueness

Uniqueness Score: -1.00%

Function 06CE2258 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6445820c7f01067ce9ba5723881c522cd0b726be493fa588f48f54013b2141c
Instruction ID: 772bbfc2244da4aef710aa1929c3a3a684980a1b1b21e016cc09dfe0f6282432
Opcode Fuzzy Hash: f6445820c7f01067ce9ba5723881c522cd0b726be493fa588f48f54013b2141c
Instruction Fuzzy Hash: FD312A302106008FC7A5DB28D848BA677F6FF85314F5585A9E09ECB361DF74AD8ACB41

Uniqueness

Uniqueness Score: -1.00%

Function 06CE5CAF Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecbf277f9a7c53afb6c34215c8966b9af1302d4b8a3f8d8fe03af201d6742cd7
Instruction ID: 536257cce2abcecfb78f3bc3e846c412a8c5f2b18a2f2f38f40310292663217b
Opcode Fuzzy Hash: ecbf277f9a7c53afb6c34215c8966b9af1302d4b8a3f8d8fe03af201d6742cd7
Instruction Fuzzy Hash: CF212B34200348CFC764DF31C89096A77F9FF82308790467DE4664B290DB36DA95DB50

Uniqueness

Uniqueness Score: -1.00%

Function 06CE2D90 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80415eb3660a5199e7413e20cac3836a7a66cfd68f106079f89931bc2706b45e
Instruction ID: cef9e0fb5b8e7d03d3e69a0a5103ed6e29666b961c9bdc89c1f76fe050f0b805
Opcode Fuzzy Hash: 80415eb3660a5199e7413e20cac3836a7a66cfd68f106079f89931bc2706b45e
Instruction Fuzzy Hash: 8111AF35B009104B9B992A35995467E3BAAAFC9652709006ED802CB394DE6CCF02D7E6

Uniqueness

Uniqueness Score: -1.00%

Function 04EE06A8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ba5af63e6da541a4c293581d88d401d1e56d4e0e83c28ad004bf4c3f560bc2
Instruction ID: c1c67ebebf06a640ed8705aca9884472e1fa39e12176604b853b8ddb021a5ef2
Opcode Fuzzy Hash: e0ba5af63e6da541a4c293581d88d401d1e56d4e0e83c28ad004bf4c3f560bc2
Instruction Fuzzy Hash: 5131F132910B09DACB01EFB8C854899F771FF95350B118B5AE95967221FB30E6D5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 04EE6CC4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64ce3ec57f5729d3934ee9ce4910edeba5da60442c2288b021728009644a022a
Instruction ID: 5533cbcba1c7456bdc3889f609aa6df5fef29b0e0af11c71d89f9fd50ef1edc6
Opcode Fuzzy Hash: 64ce3ec57f5729d3934ee9ce4910edeba5da60442c2288b021728009644a022a
Instruction Fuzzy Hash: 1B214D357006149FCB24AF1AD980A7BB7A6FB84724B14942EE60687761DB71FC41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00C5D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1696515478.0000000000C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c5d000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be80cb8b231155486104bc70c9261a1b4bb131a08fa6f97296d5202375dee0b7
Instruction ID: 6f37369cd632af81fa66c4cfb70e347d2703e23a154d79bbeb49ee12ec3d7002
Opcode Fuzzy Hash: be80cb8b231155486104bc70c9261a1b4bb131a08fa6f97296d5202375dee0b7
Instruction Fuzzy Hash: 42210479504300EFDB25DF14D9C0B26BBA5FB84315F20C6ADEC0A4B296C376DC8ACA65

Uniqueness

Uniqueness Score: -1.00%

Function 00C5D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1696515478.0000000000C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c5d000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25b0d7488cd6e25d31ea518c1b5a3f26de43e609dacb837fce0380589facf572
Instruction ID: a051aae96bde311411131f7d5ec1abe8c6dc53faa1d43ca87d8bc43a80e8e6eb
Opcode Fuzzy Hash: 25b0d7488cd6e25d31ea518c1b5a3f26de43e609dacb837fce0380589facf572
Instruction Fuzzy Hash: A221F279604300DFDB24DF14D9C4B26BBA5EBC4315F20C569EC0A4B296C33AD88BCA66

Uniqueness

Uniqueness Score: -1.00%

Function 04EE5091 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fa0db0be84948fb23650895360b1fc59af6c30a9376310686206419d0da8548
Instruction ID: 8b1cc6de857b787a5c8a24d2e33de03647a41ff528786cab38011f8efa1ac7f6
Opcode Fuzzy Hash: 6fa0db0be84948fb23650895360b1fc59af6c30a9376310686206419d0da8548
Instruction Fuzzy Hash: AE217975A00A1A9BCF00DF9AD8804BFB7B5FF88309B049526EC08EB251E635E941C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 06CE2268 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd573cc4d4b915814031712a7fb0b22db58bc406c5972da78565fdaa5574c100
Instruction ID: c14e49c187c0945f0a8f70cfd2e95675bd733ab5f341c0eb3c3e6a5660ed3ca5
Opcode Fuzzy Hash: cd573cc4d4b915814031712a7fb0b22db58bc406c5972da78565fdaa5574c100
Instruction Fuzzy Hash: 913137302106008FC7A4DB28D848BA6B7F6FF85321F5585A9E15ECB361DF74AD8ACB40

Uniqueness

Uniqueness Score: -1.00%

Function 04EEA0D0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 137f47d9118bd7271fb52f19fcf19aea4ea7ee5ed54acf0dff22b0ba040fed2b
Instruction ID: 2e6b08c40d422fbc1c7d7d3e32101c8fe5fd9078bdf8b891b25b7be0a1fc7d4f
Opcode Fuzzy Hash: 137f47d9118bd7271fb52f19fcf19aea4ea7ee5ed54acf0dff22b0ba040fed2b
Instruction Fuzzy Hash: 9921E278B506008FCB04DF68E9998AC7BF5EF49B0531581AAE512CB372DB31EC01CB80

Uniqueness

Uniqueness Score: -1.00%

Function 04EE6B98 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cd62e4b32a04c83c7ad21d54c854960a97c49126a143046479e3c4102d8fab7
Instruction ID: 8de71dd9702a9d7ded7904c0a8076bb1781c13c1bb3d3e82d228386f4d7c773b
Opcode Fuzzy Hash: 4cd62e4b32a04c83c7ad21d54c854960a97c49126a143046479e3c4102d8fab7
Instruction Fuzzy Hash: F71127347042004FE729DA76C891BBA73A6EFC4318F94C469E9068B285DB79E8478790

Uniqueness

Uniqueness Score: -1.00%

Function 04EE0508 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a214fdb61be19da9cee1f2a474aa3a190dd559240602c89089577c868810376
Instruction ID: 30c8357bef49845ae6d8737aa2c50ff621cb6e21523429d38a154311e74f16f7
Opcode Fuzzy Hash: 1a214fdb61be19da9cee1f2a474aa3a190dd559240602c89089577c868810376
Instruction Fuzzy Hash: D91194383047105BE7047B69D81279F76EBEBC5B08F044029E14AEB7D6CDB9EC9157A1

Uniqueness

Uniqueness Score: -1.00%

Function 04EE0507 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0bdd0150600343788f79f1befbafcafdc5dbd96d4d4d67cabf6564bdb7a8719
Instruction ID: 01196e10aece9bc2ed8623834ad2cd5c628e406d86f46b158a4d39cfee5200c3
Opcode Fuzzy Hash: d0bdd0150600343788f79f1befbafcafdc5dbd96d4d4d67cabf6564bdb7a8719
Instruction Fuzzy Hash: E01182383046105BE7047B69D81279F76E7EBC5B08F044029E14AEB7D6CDB9AC9157A1

Uniqueness

Uniqueness Score: -1.00%

Function 04EE9780 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3f4c9c2f041bbb9ab0b3498555da304edc44dffd42da06b59694f235d4b3c1f
Instruction ID: 7e6fa49f23294426e93a7e9df1eabfa56f966d53820523574d7f0d679f83528d
Opcode Fuzzy Hash: b3f4c9c2f041bbb9ab0b3498555da304edc44dffd42da06b59694f235d4b3c1f
Instruction Fuzzy Hash: 6E214D75E0020A9FCB05DFA9C9848EEFBF9FF98300B11C55AE414E7215E774A942CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04EE4D88 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b1303cebde3baeb72737b66e4347d8a2dc7a5ca14c77a2c9f8bb9597405b5c4
Instruction ID: 3e95a1417b8d7942077fad5a47d53fda526a9b1659cf6c80a5b794660606747e
Opcode Fuzzy Hash: 0b1303cebde3baeb72737b66e4347d8a2dc7a5ca14c77a2c9f8bb9597405b5c4
Instruction Fuzzy Hash: AF11E475A002058FD710DB69C5458EBBBF6EFC0304B0089A9E616EB391EF75ED098F90

Uniqueness

Uniqueness Score: -1.00%

Function 04EEE0F8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 902be0f4b1c44cbe457662227eea7e06eceaa77581a201564054a0600a650f78
Instruction ID: cb177730f2ed1343819cf591a2656ab284dbcdaa81d3370bb70e122ff651ecd7
Opcode Fuzzy Hash: 902be0f4b1c44cbe457662227eea7e06eceaa77581a201564054a0600a650f78
Instruction Fuzzy Hash: D11108317041689FDB18ABBD94142BF7BDAEBC5390B108179D509DB385DE399DC283D0

Uniqueness

Uniqueness Score: -1.00%

Function 074AE770 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709983632.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74a0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 249da06c80cd6f93bccb200b6a0094493e8a165ba68d16d338f59d17b3b93bb6
Instruction ID: 0231c2b62415692f805613fa347b2561ec858a1c6771b8240e08962b87e62dcd
Opcode Fuzzy Hash: 249da06c80cd6f93bccb200b6a0094493e8a165ba68d16d338f59d17b3b93bb6
Instruction Fuzzy Hash: E421D2B4D01268EFDB20DF99C585BCEBFF4AB08314F24841AE418BB250C7B55885CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04EE6D18 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40d5b14abb61fd3f9c00858e0570840f0af08824200c931751fb47242a8ed8d0
Instruction ID: 71e89c7ca97608f38192f6f45df881f252e1fc11f0bb7273ffa56a2690318af0
Opcode Fuzzy Hash: 40d5b14abb61fd3f9c00858e0570840f0af08824200c931751fb47242a8ed8d0
Instruction Fuzzy Hash: CA210B75E0020A9F8B04DFADC8848AFFBF9FF98300B10851AE518E7215E770A946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04EE8E60 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd0b4d90056bcacc1081473fb08a43cec0ad7cd0cd14b672a38e228e6c0a6767
Instruction ID: 3ef2aa4167b74d686516c63651ac40fb4303b1cd357eb04d9ddad8b6af70284a
Opcode Fuzzy Hash: fd0b4d90056bcacc1081473fb08a43cec0ad7cd0cd14b672a38e228e6c0a6767
Instruction Fuzzy Hash: 7C21AC75B006008FCB20EF1AC980EAA77B6BF88724B10442EEA0687762D735FC41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 074AC278 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709983632.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74a0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cff9e57e455f5ac5cc7ad1f6e891b5a200d51904a400265ae4fb21780277737
Instruction ID: 537d66ead622ab084f993134d12c1c2346f1031e5a49f4b9db15b8df56ae4f86
Opcode Fuzzy Hash: 0cff9e57e455f5ac5cc7ad1f6e891b5a200d51904a400265ae4fb21780277737
Instruction Fuzzy Hash: D92190B4A00A08DFC748DF5AE084A99BFF1FF88310F5290D5D5499B365EB31E995CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00C5D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1696515478.0000000000C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c5d000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69df75d156841aad38b4140d112eec7c058b1eaea1251345d5177e783103d13b
Instruction ID: d581f1ba92d002a1d22bcde0165bfbd5f7aafa8e6d48bf1f2b1748010fafff59
Opcode Fuzzy Hash: 69df75d156841aad38b4140d112eec7c058b1eaea1251345d5177e783103d13b
Instruction Fuzzy Hash: 70218E755093808FDB12CF24D994715BF71EB86314F28C5EAD8498F2A7C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 06CEFB80 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c26d634d31fcbafef66c7337848d6e4648852fd404a80ae8ce9a16b11c0d3ef
Instruction ID: 9d0ffff2121626888d1d3f7b8cf418ede2e313e73c9154e5aa0cba8f3d5e4b3b
Opcode Fuzzy Hash: 9c26d634d31fcbafef66c7337848d6e4648852fd404a80ae8ce9a16b11c0d3ef
Instruction Fuzzy Hash: A921C9B4E04209DFCB80DFA9D1919AEBBF5EF49301F60A099D819A7711D7309E41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06CE0700 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3c46e1f08a94a05fbe3043d7a22e41a8e5689e1c975854426f731ade53f52f4
Instruction ID: e7ae0eaca5418ca42a38a21e548e37dc9d76d86bd8d89c4348fe82527df76349
Opcode Fuzzy Hash: c3c46e1f08a94a05fbe3043d7a22e41a8e5689e1c975854426f731ade53f52f4
Instruction Fuzzy Hash: 1A115970B006009FC794DF68D89096AB7F2FFC8224B20896DD066DB3A1DB71EC0ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 06CE2010 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7a23200d34a7f495e708482c2e7e7b46bf3f94a4cad54ecc212a6ee9af11cfb
Instruction ID: e7a196b4f2ca0a6423bed61f6fe5b0a8ee5c72ce3f64881869450e9ddeb61849
Opcode Fuzzy Hash: e7a23200d34a7f495e708482c2e7e7b46bf3f94a4cad54ecc212a6ee9af11cfb
Instruction Fuzzy Hash: 8111C131700644CFC764EF39C8A091ABBFAEF8621171005AEE056CB3B0DA36EE85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 06CE2001 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35fac2a2dcb98c66a9f3e69b490a9a325c517856639de6615a26e2993fdb7534
Instruction ID: 489c3bb26a56eb5119e4f774884e794f4f4fadd5e5eb56ac35574d47b32c4a81
Opcode Fuzzy Hash: 35fac2a2dcb98c66a9f3e69b490a9a325c517856639de6615a26e2993fdb7534
Instruction Fuzzy Hash: CC112B327042408FCB649F39D8609697BF5EF9625030901AFE055CB372DA36DE42C751

Uniqueness

Uniqueness Score: -1.00%

Function 04EE6BA8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 895c02edeb8a0b461f41bdecd9a145a074f1706e30f12a65b022f493a6001293
Instruction ID: 9fddf9507358304ecd9fe7c0aeb3a8aaf621c076ca291d87a0a3fc76f35cd0a1
Opcode Fuzzy Hash: 895c02edeb8a0b461f41bdecd9a145a074f1706e30f12a65b022f493a6001293
Instruction Fuzzy Hash: FB11E1343043004FD729DA77C851B7AB3AAEBC4318F94C579E90A8B294CBB5F8468B94

Uniqueness

Uniqueness Score: -1.00%

Function 06CEFC70 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8da2ce1011c230cf913d2912a9b011a2baa37e27f2c606fcb50875387a7987ec
Instruction ID: c33b406db95761d8e7f5490d2333e869a024275768fbe65489913fbc0b059523
Opcode Fuzzy Hash: 8da2ce1011c230cf913d2912a9b011a2baa37e27f2c606fcb50875387a7987ec
Instruction Fuzzy Hash: 3A115B74E08209EFDB54EFAAC5405ADBBF5FF49310F20959AD81897312D7309A40CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06CE7EC7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5da2431c2b51e10b8a0b8e04a0fb9382ed444ea6af00f8789335d92c427cba38
Instruction ID: 67543a2e25e82ffe47638f1555bb1f0e6b5567b93a27bd06367cc83aafa038ba
Opcode Fuzzy Hash: 5da2431c2b51e10b8a0b8e04a0fb9382ed444ea6af00f8789335d92c427cba38
Instruction Fuzzy Hash: 41117C30A451889FCB08DF78D8504AE7FB2AF81305B2042B9D0188F7E2DE319E55DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06CEFB90 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17a25a2f7373ebbcb5fcd45c369ec84b5d94c762553d0c1a38040938c7a07fbd
Instruction ID: 8df02f23130091f2fe723a2feadcdfa0bc3077b6b43cebf34cbd5092a74cfd67
Opcode Fuzzy Hash: 17a25a2f7373ebbcb5fcd45c369ec84b5d94c762553d0c1a38040938c7a07fbd
Instruction Fuzzy Hash: 6C21EAB4E04109DFCB80DFA9D1809AEBBF5FB48300F60A099D819A7711D730AE41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 074AE474 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709983632.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74a0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f74a92304e966539cbea3db08789b5fe371d8c3c81ce68c549aedcebf827fcfe
Instruction ID: 31e4eb4a4bb6d622c11bd914b21962a031996215bd81fcca300abd8ff6301b65
Opcode Fuzzy Hash: f74a92304e966539cbea3db08789b5fe371d8c3c81ce68c549aedcebf827fcfe
Instruction Fuzzy Hash: 842100B5900349EFCB10CF9AD884ADEBBF4FB48320F10842AE919A7211C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06CE2D01 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 334fe3e4c6439481215586d665b949abd0d582e54ccdbce69fed7cccd82635f2
Instruction ID: 1b44ed706f8d5d8617300898a4ab62219f56fc96176926a6f9a04462ef4bc8b4
Opcode Fuzzy Hash: 334fe3e4c6439481215586d665b949abd0d582e54ccdbce69fed7cccd82635f2
Instruction Fuzzy Hash: 9201D6256053844FCB975A38C8507663FBDDFC7150B1700DED182CB262D95C9F06D762

Uniqueness

Uniqueness Score: -1.00%

Function 04EEDB21 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a3b385525d9235fb968adb1c73cdaeeca355e8c59d7fcc7dbd2df10b9088637
Instruction ID: 7fe505154e243504449a3c9a355b444f9094c01212d622853c80e8362a0a742f
Opcode Fuzzy Hash: 5a3b385525d9235fb968adb1c73cdaeeca355e8c59d7fcc7dbd2df10b9088637
Instruction Fuzzy Hash: 651126B2E092479FDF029FA0DC405DEBBBAEF46714F4004A6E000FB086E6782947C751

Uniqueness

Uniqueness Score: -1.00%

Function 04EED511 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8ec14c5f6c0ef3eb482ab5c7b486b986e4f6aea14d2011925e28d298cfbd8ac
Instruction ID: f6bce9aa7805adced4156d746080959f24e33071d437537cd3aceb0548a64eda
Opcode Fuzzy Hash: b8ec14c5f6c0ef3eb482ab5c7b486b986e4f6aea14d2011925e28d298cfbd8ac
Instruction Fuzzy Hash: DC116AB4C08389CFCB11CF9AD844ADEBFF0EF49324F14845AD458A7251C378A949CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04EEC780 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fd8429a1c031a3813096169a1eaabc54506c9a4840b99d5938b1145c9230a7e
Instruction ID: 55fa37da7050026884a73968fbda1689d4a5e5ba3117f68a1be107ceaf4b30a7
Opcode Fuzzy Hash: 1fd8429a1c031a3813096169a1eaabc54506c9a4840b99d5938b1145c9230a7e
Instruction Fuzzy Hash: 0B012631B483581FEB04DBBAA8548FD7FEADB86664B1484BBD808C7252ED699D424381

Uniqueness

Uniqueness Score: -1.00%

Function 04EEA3E0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a967de738053127843f08f40df36f6c6cd86c03c02968e005a7cf7df2de8a606
Instruction ID: 95fe3f69eab0a3da9a67210fb131ced890a4a3265fb15d8947aa4410171161c2
Opcode Fuzzy Hash: a967de738053127843f08f40df36f6c6cd86c03c02968e005a7cf7df2de8a606
Instruction Fuzzy Hash: 7201B5B194D3498FDB429B65AC651E57FB4DF52314F0540EFC044CB893E638994BC352

Uniqueness

Uniqueness Score: -1.00%

Function 00C5D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1696515478.0000000000C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c5d000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: f7ee97f249341c6d146d562eea93dfbbaff600db747b9eefef6e657a7a9ebdcc
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: F4118B79504380DFDB16CF14D9C4B15BBA1FB84314F24C6AEDC4A4B696C33AD98ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 04EEBE30 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f2fe5ebfc02aea25e4db0f401f709cbfc8b186f358f98356f7a2673e81038a0
Instruction ID: 6dde5cf649364a486f792070da8fe6e052b38ab2f321b0bdfca5e3054bdcff8f
Opcode Fuzzy Hash: 3f2fe5ebfc02aea25e4db0f401f709cbfc8b186f358f98356f7a2673e81038a0
Instruction Fuzzy Hash: B71104B5D002489FCB10DF9AD544ADEFBF8EB48320F14841AD859A7210D778A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04EEA948 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd1ec3d8f9184b6aae81033bc8de59dd5b743d819c835105f3b780eeff321445
Instruction ID: 6fad4b5cff50f969be7e24a2a8bd110a8a4d8cdf90bac1d920e36a149fd8c2f2
Opcode Fuzzy Hash: bd1ec3d8f9184b6aae81033bc8de59dd5b743d819c835105f3b780eeff321445
Instruction Fuzzy Hash: AD1104B5D006489FDB10DF9AC448ADEFBF4EB88320F14842AE459B7310D374A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04EEFAC2 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4fefcd00cedd5f4339a7b5f5134b98c3d50a3aabbcd61877206c981fae31284
Instruction ID: 20bdef2bd1302e1124307ffeda4aa3cce7921819a2b740b94324eae4827c9d2f
Opcode Fuzzy Hash: e4fefcd00cedd5f4339a7b5f5134b98c3d50a3aabbcd61877206c981fae31284
Instruction Fuzzy Hash: 9811CA31200B404FD725DF2AD554647BBF2FBC9325F108B6DD0968BBA9DB74A8068B91

Uniqueness

Uniqueness Score: -1.00%

Function 06CEB87A Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3caae1c810bed22e6fa8a8247079fc86b842f9ccadfb3d11096562d93ca4936
Instruction ID: be01a40a9ddcec7676bd91b10d3c3c9dec12efdccbe4313a3c0731c14a9d2758
Opcode Fuzzy Hash: b3caae1c810bed22e6fa8a8247079fc86b842f9ccadfb3d11096562d93ca4936
Instruction Fuzzy Hash: BC11FE74D05209DFDB94DFAAD6446BE7BF6FB48300F109569D519A7344D7304E00DB91

Uniqueness

Uniqueness Score: -1.00%

Function 06CEB880 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14d14fa1fcdfe5da0a77381b84d697aa5ef4b5c72d855d8ae64858cbb393cd8c
Instruction ID: 22aa44a8379e3450d32487cca5ae24c1b14ec3a19502a425a290fc49fd1347e1
Opcode Fuzzy Hash: 14d14fa1fcdfe5da0a77381b84d697aa5ef4b5c72d855d8ae64858cbb393cd8c
Instruction Fuzzy Hash: DF11FAB4D09209DFDB94EFAAD6446BEBBFAFB48300F1095A9D519A3344DB305E00DB91

Uniqueness

Uniqueness Score: -1.00%

Function 074AE464 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709983632.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74a0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa96a45ca75d220b95f002502f47c3c900bc4c5328202d9b830aab528575760a
Instruction ID: ca7a254a264ef9561a3c249bcf4b294bd1766809ba072f5e314bef2baa6c92e6
Opcode Fuzzy Hash: aa96a45ca75d220b95f002502f47c3c900bc4c5328202d9b830aab528575760a
Instruction Fuzzy Hash: 84F0FFB2640209BFCF08DFB8E8458EEBFEAEB94210B10C87BE805D7210EA30D8458754

Uniqueness

Uniqueness Score: -1.00%

Function 04EEC369 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48efe75ebef7a1bebc6ca9761397b55df3107ccdf35b25343dff190953a6a57b
Instruction ID: 5681c7891883db9121c4f2567596054e179b837a8e2cded5ae314f2de8dee08e
Opcode Fuzzy Hash: 48efe75ebef7a1bebc6ca9761397b55df3107ccdf35b25343dff190953a6a57b
Instruction Fuzzy Hash: E8014470B002555FEB01BBB969904FE7FB6EB88158B00003DE248A7381DE355E039395

Uniqueness

Uniqueness Score: -1.00%

Function 04EEAB02 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daf59872ed721c7a811738ecf60ed20555c737450907dd7e742db0c4a8c534ae
Instruction ID: 2a714372aeb117d6e51046fa483503a314068e688cb6d694b84f9c403e994d2d
Opcode Fuzzy Hash: daf59872ed721c7a811738ecf60ed20555c737450907dd7e742db0c4a8c534ae
Instruction Fuzzy Hash: 4B116D74A00209CFEB14EFA6D0547BE7AB2EF84319F14A47DD101AB284DBB85985CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 04EED0A4 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 925d81c3aaba9badd9df89e04c76364d6ff68d6ab1dad6dcc9a0c24d7074af84
Instruction ID: e3cd411dba8e48119eaa88666aaae40a5c10ec5a18541d9bea0baded117d3384
Opcode Fuzzy Hash: 925d81c3aaba9badd9df89e04c76364d6ff68d6ab1dad6dcc9a0c24d7074af84
Instruction Fuzzy Hash: 191125B5D00249CFDB20DF9AD544BDEBBF4EB48324F10845AD559A7210C374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04EED050 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02baa8f768ae1caabc6bf78afd793c57c16696cb4cd015364a7f6bab7d799345
Instruction ID: c0ec502b7e17f508a3af70712ab1ef31913511324a2464a956ca3a7b2833e2d6
Opcode Fuzzy Hash: 02baa8f768ae1caabc6bf78afd793c57c16696cb4cd015364a7f6bab7d799345
Instruction Fuzzy Hash: AD1122B5D00249CFDB20DF9AD584BEEBBF4EB48324F20841AD559A7210C374AA44CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04EE6A08 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fb909324b0cc2873ceea94d173ea5940115a80b2ec30f22773de7088d9474c2
Instruction ID: a7425fea7e6647c67f1c14bae90cf389a3ba46ebd62170f7a81371d657ccc26a
Opcode Fuzzy Hash: 5fb909324b0cc2873ceea94d173ea5940115a80b2ec30f22773de7088d9474c2
Instruction Fuzzy Hash: 6601D432D02A21BBC7349F2AD100275FBA4BF54758B49A22AE49C57A51D730F8F0E7E1

Uniqueness

Uniqueness Score: -1.00%

Function 06CE83F0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3f9e01a0cebf623851361944cc3559b21f35ef308d6bd11a8217d44d5ac1941
Instruction ID: 60b4f33cf3d54dd47cddb95f33c30f163b95a8777e44f16ef3ffbefffddf822f
Opcode Fuzzy Hash: b3f9e01a0cebf623851361944cc3559b21f35ef308d6bd11a8217d44d5ac1941
Instruction Fuzzy Hash: 5701443260A3048FDBA9C715D4607A6BBF9EF44224F10446FD00ACB2A2D631E946C791

Uniqueness

Uniqueness Score: -1.00%

Function 04EEE7A8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 794314ffaa97f6d23cc86af80c40d2371107ba41727fbdeae81199f261282c4f
Instruction ID: ffc6aba64706ecffe78da65ca1ae846516cbf156dee261d5586b75ae2f70843c
Opcode Fuzzy Hash: 794314ffaa97f6d23cc86af80c40d2371107ba41727fbdeae81199f261282c4f
Instruction Fuzzy Hash: 90F0B43674021417FB28627FAC41BBE328A9BC5B14F08803AE609DB2C0CDB9B8428384

Uniqueness

Uniqueness Score: -1.00%

Function 04EEFAD0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b393c5b80795fe3e8c4c336fe38046ad988bda88b865c60f0ffdd1152e6c48c5
Instruction ID: e69ec1e193bd0bc18dab4fe925bc4b279531fdc55aed70de86b213a19d2581e6
Opcode Fuzzy Hash: b393c5b80795fe3e8c4c336fe38046ad988bda88b865c60f0ffdd1152e6c48c5
Instruction Fuzzy Hash: B9014C31200B504FD724DF2AD544607B7F5FBC4725F108B2DD166477A8DB74A8058F91

Uniqueness

Uniqueness Score: -1.00%

Function 04EEE090 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f920b32db4f70e6813edead176a9a439efcba017380bc588eead37b9ed31dab
Instruction ID: 718af6f485cd89e7698f6b12e1a9b05dd0a176cb5db35bcfeed7e1c7646e4e42
Opcode Fuzzy Hash: 2f920b32db4f70e6813edead176a9a439efcba017380bc588eead37b9ed31dab
Instruction Fuzzy Hash: BDF08275ADD6C54FE30696B498A5CE93FE6DAA729030600D7E440CB2B3D9599C83C392

Uniqueness

Uniqueness Score: -1.00%

Function 06CE8400 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e09ae5b94cb1d612480fe8c78582350f7a08abca1a83691c372316ad0c988790
Instruction ID: 1802a8c34f1c17d137b347716024eb5cd6475b60bc9cc008ccd29725668ab9fe
Opcode Fuzzy Hash: e09ae5b94cb1d612480fe8c78582350f7a08abca1a83691c372316ad0c988790
Instruction Fuzzy Hash: 8AF0C232605704DFEB64CB16D55076AB7F8EF44314F40493ED50A8B7A4DB71E986C790

Uniqueness

Uniqueness Score: -1.00%

Function 06CE70B7 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f9ed05a67a8dfe546675010d5a784b42d8b7fa60bec9752c831f7dc5973610a
Instruction ID: b7ba936067f85b1d58dc713d567f4d6f8a18eede024f098eeadbd0da3c90899c
Opcode Fuzzy Hash: 0f9ed05a67a8dfe546675010d5a784b42d8b7fa60bec9752c831f7dc5973610a
Instruction Fuzzy Hash: A2F0247391024CAB8F519E948C000E83B70EF06234F008662E9A9DA141D239D620D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 06CEF2B8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e7e57447da9a03af0a7173aad9bfc61ca87308854895f91bab12682a065fd0d
Instruction ID: 7779d0a9f025d089f1cb24fb68d70403cc742489126ba214d318ffe2f3bcfeca
Opcode Fuzzy Hash: 6e7e57447da9a03af0a7173aad9bfc61ca87308854895f91bab12682a065fd0d
Instruction Fuzzy Hash: EA01E838E08248CFDB54CFA5D594AADBBB6BF4A301F119059D42AAB366D734AC06CF01

Uniqueness

Uniqueness Score: -1.00%

Function 074A6808 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709983632.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74a0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d390cbbc7c3dd14a55b953f9bef14e1df82e7bf3e03896dd6af8249ea39749a
Instruction ID: 889daf354da9e354ddd9fdeb4fe883054c6c322442f2a7b134d17b3f93604395
Opcode Fuzzy Hash: 0d390cbbc7c3dd14a55b953f9bef14e1df82e7bf3e03896dd6af8249ea39749a
Instruction Fuzzy Hash: 8EF04FB4D1A209EFCB40DFA9D4406EEBBB9FB49300F04A5AAD42993305D7305A01CF41

Uniqueness

Uniqueness Score: -1.00%

Function 06CE8A4F Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17574d59cd7ac4011ed4bf10a1efd99e8321485b04745be5d77efb180a8de9d3
Instruction ID: e4005aadcb0dcc02457f8a39360fd4cd1568b6460acd6d14e69483d540b10b2e
Opcode Fuzzy Hash: 17574d59cd7ac4011ed4bf10a1efd99e8321485b04745be5d77efb180a8de9d3
Instruction Fuzzy Hash: 840119B4D09249DFCB44DFA9E9046AEBFB5FF49300F0482AAA415E3291D7300B12CB52

Uniqueness

Uniqueness Score: -1.00%

Function 074AAE20 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709983632.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74a0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48e67ef72e40fcad73aa4d12190bb17e2e16cf2f5208aff864586e8396a0b22b
Instruction ID: a793849fda97f0e51830ce5336da25c1fe4a58139421a0deed5e670c664224ac
Opcode Fuzzy Hash: 48e67ef72e40fcad73aa4d12190bb17e2e16cf2f5208aff864586e8396a0b22b
Instruction Fuzzy Hash: DA01C8B4D00259AFCB44DFA8D4856AEBFF5FB18310F1085AAE954E3341D734AA80CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06CE2D28 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14772c83823bcc0efaec5768e68148491db3fad52a4d0c361bdd74686cea574b
Instruction ID: c34752dc4f8179ce30c26ba1e20501f9baa7a00fba95cf174e1fc6419b21fe71
Opcode Fuzzy Hash: 14772c83823bcc0efaec5768e68148491db3fad52a4d0c361bdd74686cea574b
Instruction Fuzzy Hash: 31F0B4347503044FDAA59639C84076A33EEEFC5650F04446DC255CB364DEB8EE42D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 074AA2F8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709983632.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74a0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdefeaafe175fa2695b36629f004503bc9fafcb45f1da7fac441e7658d1adc0e
Instruction ID: df8ba2570e27eff88f3c96a11941eff1ff11ad1f414633d4362a16b3b76d9cd0
Opcode Fuzzy Hash: fdefeaafe175fa2695b36629f004503bc9fafcb45f1da7fac441e7658d1adc0e
Instruction Fuzzy Hash: 13016674E00208AFCB44DFA9D588A9DBFF2EF48310F15C0A5A5099B365DA34EA40DF41

Uniqueness

Uniqueness Score: -1.00%

Function 06CE8468 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8ec8a44cd408147c688e5a754e6523b65c5a24c393658cf06e1f864ffbbafdb
Instruction ID: 20c6d6aa7bf21a235fe766ac225b70c2021ddf9a9df6b3de0ae9ab254421173c
Opcode Fuzzy Hash: f8ec8a44cd408147c688e5a754e6523b65c5a24c393658cf06e1f864ffbbafdb
Instruction Fuzzy Hash: 93E092623451406B8799626E9C50C7A7FEDEBCB56071680BBF109C7312D9114C0693B2

Uniqueness

Uniqueness Score: -1.00%

Function 06CEBB20 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ddc0f9e0e05ad6c1bb3719191c2b8cc1800f149031a67419874b1cb5aa2f1e0
Instruction ID: ba42e79234082a9bb70a29867be8444e9f9cda3cb91e4b4d479c0bc4b167de3f
Opcode Fuzzy Hash: 5ddc0f9e0e05ad6c1bb3719191c2b8cc1800f149031a67419874b1cb5aa2f1e0
Instruction Fuzzy Hash: 8AF05870D0A2089FCB85CFA8C5406ACBFF1EB49310F1082EA8829D3352D6318A02DB41

Uniqueness

Uniqueness Score: -1.00%

Function 04EEA610 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 625020210eb0c586cac9fc3daae334d5c69093762658e08d44326e1c11bb39b4
Instruction ID: 08cceac7176bdd46bbc999df7070434e904944ace77a75c3a8e9949cce23b130
Opcode Fuzzy Hash: 625020210eb0c586cac9fc3daae334d5c69093762658e08d44326e1c11bb39b4
Instruction Fuzzy Hash: 33E06DB6A4C3978FDB52AE75DD950D47BA0EA7329430500A6C040CF05BE65CA88B8B52

Uniqueness

Uniqueness Score: -1.00%

Function 04EECE29 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbb7badac0181ed6d232d080287205b76563b0840bd6792dfcae033680d1a11d
Instruction ID: 007fd8f4917792ed7a3335e51d346b3ca3c7488604184a9489de10289b10365c
Opcode Fuzzy Hash: bbb7badac0181ed6d232d080287205b76563b0840bd6792dfcae033680d1a11d
Instruction Fuzzy Hash: BEE0D876B086046FE705DFAA98404EEBFFADF85564B14C0AAD40CC7206FA356D428351

Uniqueness

Uniqueness Score: -1.00%

Function 04EEF938 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40666ff8660d67674ce92d5e81b1e088e58c05a4a441992f6e10fe595421db2b
Instruction ID: 129f64ebea1a3e8605b36a6e54d141d319c5fe11ea3ce7efd030155d8cf41ae4
Opcode Fuzzy Hash: 40666ff8660d67674ce92d5e81b1e088e58c05a4a441992f6e10fe595421db2b
Instruction Fuzzy Hash: 53E0D8727982446BD701366B64641DE7F9FDBC66767440066E006C3756DDD94C4343A2

Uniqueness

Uniqueness Score: -1.00%

Function 04EEAB5D Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd2c628f48125507974f5daf44351a4f9edb7597848860ffe0719541eb051aee
Instruction ID: 4be1049e2a26ed9da1a11f0e923273e5b03b01b73692a23501ad7d31747f4dc7
Opcode Fuzzy Hash: cd2c628f48125507974f5daf44351a4f9edb7597848860ffe0719541eb051aee
Instruction Fuzzy Hash: D7F03A74A00609CBDB18AFB6D4547AE7AB2EFC4304F05947DC1059B280DFB859818FA1

Uniqueness

Uniqueness Score: -1.00%

Function 06CE8A60 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ab1a8fb48d50249ed58d84ae82ede6495709400caa30f2a365da0156dbf067d
Instruction ID: c4fda72027db8d8ac44b1a38daf656c11b91c7f43f05b7432729f1d819bd5fc7
Opcode Fuzzy Hash: 9ab1a8fb48d50249ed58d84ae82ede6495709400caa30f2a365da0156dbf067d
Instruction Fuzzy Hash: F5F0B7B4D05209DFCB44DFAAE9446AEFBF5FB48300F1091AA9819A3350EB345B41CF95

Uniqueness

Uniqueness Score: -1.00%

Function 04EE8E11 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c311054e216acca135b802cceff97f03cc1161bc9864e728771a6d87f7d1ef6c
Instruction ID: 8dda6d22bd3192c39d74a293144a9d5239c698be7dc93dbe116446cd4cae998b
Opcode Fuzzy Hash: c311054e216acca135b802cceff97f03cc1161bc9864e728771a6d87f7d1ef6c
Instruction Fuzzy Hash: B4E09B715493C59FD7039F619C106A43F31EF5235470800DAD7444F1A3D21A591BC745

Uniqueness

Uniqueness Score: -1.00%

Function 06CE70C8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2e7b67d91a4c145bc4d7f458831a1e65e61951c8e3ec7bb3ca7936cbb8b1780
Instruction ID: 498506de25be5254427d05a297a51cd5828d58b296221c8d7a36f64378ae9c32
Opcode Fuzzy Hash: f2e7b67d91a4c145bc4d7f458831a1e65e61951c8e3ec7bb3ca7936cbb8b1780
Instruction Fuzzy Hash: 3EF0653291021DEB9F50DE988C055DD3774EF09234F148526F9A9E6140D375E660DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06CEC940 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 219026265748283d4589fe1d81b0bf1aa0c23a19d09c106a91a26ece529b9b2a
Instruction ID: 479c97eec2116cb0a2271886db06be6e63e5dd5815e6c46337e9e27f209186d0
Opcode Fuzzy Hash: 219026265748283d4589fe1d81b0bf1aa0c23a19d09c106a91a26ece529b9b2a
Instruction Fuzzy Hash: 00F05874E09249DFCB81CFA8D4402ACBBF0EF4A200F1081EAC8A8D3341D6354A42CF41

Uniqueness

Uniqueness Score: -1.00%

Function 04EE5180 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71855164f6962894066a5ad6c2853be1515afad80a1ed713eb678ffce6379666
Instruction ID: 730570909ca610d0eb5879479ae412613d4301b62b8f6bcf862d28c10e4c7147
Opcode Fuzzy Hash: 71855164f6962894066a5ad6c2853be1515afad80a1ed713eb678ffce6379666
Instruction Fuzzy Hash: 20E0ED36640928D7C610DF99F9814B5B3ADE78866D3188556E90CCA691F227D862C780

Uniqueness

Uniqueness Score: -1.00%

Function 04EE4D31 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47a42875a3f4aa48a10bd145be0d6db8e4b6616bdfdf5ef7adf66c8d3fa5e106
Instruction ID: 3c8aa2e5ce0d32f96b1c50025e3409ace09fb3065fbee22790c6c18ea8d43b51
Opcode Fuzzy Hash: 47a42875a3f4aa48a10bd145be0d6db8e4b6616bdfdf5ef7adf66c8d3fa5e106
Instruction Fuzzy Hash: DAF065F4E482859FD701FFA0E5414DDBFB1EB4221071042A5D805DB219EB365F06D751

Uniqueness

Uniqueness Score: -1.00%

Function 06CEBAD8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f4e973663fd2598fdb59e2f1c9fbfd1e3d1e82320c9a07af4696721e40515ca
Instruction ID: 0736c13a22588223ee3cc7004610522df2628638095874a1de969267945d5758
Opcode Fuzzy Hash: 0f4e973663fd2598fdb59e2f1c9fbfd1e3d1e82320c9a07af4696721e40515ca
Instruction Fuzzy Hash: 8CE0D8B194B108DFDB81DBB695005F93BF9DF47200F1556F6C001C3161D9320E05D712

Uniqueness

Uniqueness Score: -1.00%

Function 06CE5AA0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89d2adcd182f5ec9659f86547ffd17ee24aed8d62833240e19cedc750cc51ab5
Instruction ID: 22792a56d63a1b3c791e817f2ad0caaa59e26eb463eb8b7fd7b9f83463786380
Opcode Fuzzy Hash: 89d2adcd182f5ec9659f86547ffd17ee24aed8d62833240e19cedc750cc51ab5
Instruction Fuzzy Hash: E1E086313940105B9758665E98D48BEB7DEEBC9620755847AF20DD7326CD21DC0553A4

Uniqueness

Uniqueness Score: -1.00%

Function 04EE5058 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba8d4c89ffff666c00d760dd55d38834d39f506761679291311c6270a0b92011
Instruction ID: 0fc83b60dd1cc62c44dd73074792ec4997def2f630900e8efb5d620cb20cd4d1
Opcode Fuzzy Hash: ba8d4c89ffff666c00d760dd55d38834d39f506761679291311c6270a0b92011
Instruction Fuzzy Hash: 7AE0207B009744BFCB1347859C54CD5BFA9FF0E224309C087F24947533D1529510E791

Uniqueness

Uniqueness Score: -1.00%

Function 04EEE4F0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71e1280e14c3a7c3a2570ba688e7a3495ef4d44bbae73c15a4d2d828b18d8849
Instruction ID: 27524f73337df2d7d92d83f44a42510d1e6732f76ca3a8a29587db282cce1b36
Opcode Fuzzy Hash: 71e1280e14c3a7c3a2570ba688e7a3495ef4d44bbae73c15a4d2d828b18d8849
Instruction Fuzzy Hash: C2E0DF32B487810FD302AA28F8510CAF7E2EEC12903049A7AD0818B32BDA24AC874785

Uniqueness

Uniqueness Score: -1.00%

Function 06CEE997 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 149b2f84428775f69694bc4be3bd06337c859cd3d2c1d28b7f5fdfc9e5e53b64
Instruction ID: a837fd3d70bc8e95a11a1320d2c5a41ca371d19204df7c21443bc9e5c2df5989
Opcode Fuzzy Hash: 149b2f84428775f69694bc4be3bd06337c859cd3d2c1d28b7f5fdfc9e5e53b64
Instruction Fuzzy Hash: 57E01234E09715CFDB94CF56D9905EDB7BAAB8C281F00AD69C00AA7269CB305E48CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04EE4AEC Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88a3ee34f1b6aedff11c4c345bd7f946cfc209b9d5c1efaeac07e7767abca2be
Instruction ID: 8fde441e10d5c792b99f51d7a1de95271705c51a228c8ecc437a947db05584a9
Opcode Fuzzy Hash: 88a3ee34f1b6aedff11c4c345bd7f946cfc209b9d5c1efaeac07e7767abca2be
Instruction Fuzzy Hash: B0E04F352440008BCB11EB6DC489BE973E9EB4E358F5955B3F559EB325C276B8818B40

Uniqueness

Uniqueness Score: -1.00%

Function 04EECAC6 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64146225a07d6c9c1edbb975e88f5cfa5db59257ddd68adcd4bc125261f2bb3e
Instruction ID: eeba19293f09fdf0c8c4d105a4caadd133c415e96ae72e99e290651b24fec618
Opcode Fuzzy Hash: 64146225a07d6c9c1edbb975e88f5cfa5db59257ddd68adcd4bc125261f2bb3e
Instruction Fuzzy Hash: B5E09272A4024DDBCB109F92E6087FDBBB0FB8420AF301022E09AB2940C7711980EA90

Uniqueness

Uniqueness Score: -1.00%

Function 074A6688 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709983632.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74a0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dee5a8e4f005cfe9312b6bac17ebc72fae502bdfaa7395bee12fbec09c622b1c
Instruction ID: 0b049283cc0c09b1ad66479d1b28885c002c780f29800f0ba3cf6954ce8e90d8
Opcode Fuzzy Hash: dee5a8e4f005cfe9312b6bac17ebc72fae502bdfaa7395bee12fbec09c622b1c
Instruction Fuzzy Hash: F5F0C9B4905208FFCF44DF99D840AADBBB5EB58310F14C1AAED1857350D6329A61DF41

Uniqueness

Uniqueness Score: -1.00%

Function 04EE4938 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ee6c9c37433fea6109f0c755d635d16a4d5375d6fbd3610d4c7c802db45285f
Instruction ID: dfef6629bd0d6ba77a4194126c4a8f3f8d44f2d789992fd6745edd851c32627d
Opcode Fuzzy Hash: 8ee6c9c37433fea6109f0c755d635d16a4d5375d6fbd3610d4c7c802db45285f
Instruction Fuzzy Hash: B6E08C36285214AF8B029B8A9844CA6BF99EB09260708C452F20A47132C652E910EB94

Uniqueness

Uniqueness Score: -1.00%

Function 06CEEB84 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5687620d5fc4f11b51403264980e212decae71f31ca1d01778fbdd9013c13d62
Instruction ID: 8dc1edae82a17792de286bd3e7e3e411fff2e4182dbe37d0ed2291e6e9c46b24
Opcode Fuzzy Hash: 5687620d5fc4f11b51403264980e212decae71f31ca1d01778fbdd9013c13d62
Instruction Fuzzy Hash: D4E09230E0A719CFDB90CF95C994AACBB7AAF4C241F0049E9D00A9726DCB304E48CF52

Uniqueness

Uniqueness Score: -1.00%

Function 06CEBB30 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94614a3ba3976b8bddeadd068796eef55b927702ef939b96f6a91db629566044
Instruction ID: 1a7643b32ba78b253a9075377bad38442e4e0c0a87c8a534d098c838dc2a0fee
Opcode Fuzzy Hash: 94614a3ba3976b8bddeadd068796eef55b927702ef939b96f6a91db629566044
Instruction Fuzzy Hash: 5CE0E574E05208EFCB84DFA9D5816ACFBF5EB48300F10C1A9982893340D631AE01CF81

Uniqueness

Uniqueness Score: -1.00%

Function 04EEE929 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635da228d97735b1bf5e3c37f0037a338ae83862e80178e4d762e03f5fa6c57
Instruction ID: c3bf8a8f2f07bb1c17b822c759df6af1f073dcf8daac916c1dadbb58f42fa0ac
Opcode Fuzzy Hash: a635da228d97735b1bf5e3c37f0037a338ae83862e80178e4d762e03f5fa6c57
Instruction Fuzzy Hash: 83E0C2E2B4C2C10FDB1AE27568889D83FC29BBB16870890E9C2408A147E45E54C7C352

Uniqueness

Uniqueness Score: -1.00%

Function 06CEA3A7 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01d09c71e1e8700e2a489d761416735179ae67fad9cd5c48264632070717ca9f
Instruction ID: 9ea5d72ebab511a3d0d264662acbb3b1fe8cdbb6cb2045488d865a79cd1ac877
Opcode Fuzzy Hash: 01d09c71e1e8700e2a489d761416735179ae67fad9cd5c48264632070717ca9f
Instruction Fuzzy Hash: DBE0C270946108EFCB80DFF5D904ADE7BFEEB09300F00A4A5A10693110EE318E00DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04EEF948 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07edfbd560fdd9544eba45ffc92a09aad56469e9f5c83f28ff7254d27dabef3f
Instruction ID: d89eb67e6dfb692be55599077a1f157824b29a0acd3a78eca04f19e329915049
Opcode Fuzzy Hash: 07edfbd560fdd9544eba45ffc92a09aad56469e9f5c83f28ff7254d27dabef3f
Instruction Fuzzy Hash: 8DD05B31744114979604365FB01859F769FDBC4672B040026E50BC3354CD994C4247E5

Uniqueness

Uniqueness Score: -1.00%

Function 06CEA3A8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ebe16e658df4579d80bdd2080420b7ba9a86c1874492d650a78a0cbff063004
Instruction ID: 08f803bfb7c9a536d1eb2b7776b081904c6540d53e79da4baa64eb3de29ebc1f
Opcode Fuzzy Hash: 9ebe16e658df4579d80bdd2080420b7ba9a86c1874492d650a78a0cbff063004
Instruction Fuzzy Hash: ADE0C270946108EFCB80DFE5D50469E7BFEEB09300F00A4A5910693110EA318E00DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06CEBAE8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3ba6e818d150a538554c0ab0ef2a7a01ae9ab910c228a6ea968906ee00e6d9b
Instruction ID: 3af76e528ce007aea3803ba12b6eafd79edf2f6b03ab01d4d9436eb3c60d542d
Opcode Fuzzy Hash: e3ba6e818d150a538554c0ab0ef2a7a01ae9ab910c228a6ea968906ee00e6d9b
Instruction Fuzzy Hash: 80E08CB0946108EACB80EFA99500AAA77BDDB0A200F0054A5900583110E9325E009B91

Uniqueness

Uniqueness Score: -1.00%

Function 06CEB83F Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9462fb8c583567f73eeae16f5bcccdd25f58a03fcc141d8c7550b4501e081071
Instruction ID: 81ef8875f9742b28f182202798f67c02d4358c3ae4e4d3bf6bf2b79f5ed3765c
Opcode Fuzzy Hash: 9462fb8c583567f73eeae16f5bcccdd25f58a03fcc141d8c7550b4501e081071
Instruction Fuzzy Hash: FBE08C34D0A108EBCB54DBA4EA419ADBBB8EB45304F10D1ADD81823340CA326E42DB91

Uniqueness

Uniqueness Score: -1.00%

Function 04EE4D40 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fb91d91f3f904882fcb7a9c2dfc5d7e1d9c606f182fa55c29570dc9e05b4e04
Instruction ID: 8a5e79a75a148fe10b91737404b293ea39b17ab257dbbfdf1cedf978775213ab
Opcode Fuzzy Hash: 1fb91d91f3f904882fcb7a9c2dfc5d7e1d9c606f182fa55c29570dc9e05b4e04
Instruction Fuzzy Hash: AEE0E6B4A04208EFCB00FFA4E54185DBBB5FB853047108655E80597318DB326F04DB51

Uniqueness

Uniqueness Score: -1.00%

Function 06CE2F01 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a6cb31027e83b35191af11cf43ea2fcf96d367f1292e1bc4ecee191b2db8e0c
Instruction ID: ce0013f5622591f4bd08e448043273177773fac033fea801a052c49a67cd5911
Opcode Fuzzy Hash: 8a6cb31027e83b35191af11cf43ea2fcf96d367f1292e1bc4ecee191b2db8e0c
Instruction Fuzzy Hash: 5EE04F7040A2408FC7558F2498195503F34DB02215B2A42DAE8548F2B3D239CA57CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 06CE9F10 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fc8dec30cd997f912a647b27396318f1d90162e585ec4eb6b088241d7927bfb
Instruction ID: d2f23aaa2ff3ac42e46cbe93971b6e028532749ba3ecc037201eb1acdb072631
Opcode Fuzzy Hash: 2fc8dec30cd997f912a647b27396318f1d90162e585ec4eb6b088241d7927bfb
Instruction Fuzzy Hash: AED01276605148CFD710AFE5E404ADDB779EB89312F0090A6E20ADB504CB3599158F60

Uniqueness

Uniqueness Score: -1.00%

Function 04EE1418 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69ffb05af9b253eba234417b3c8625d5ec74c65496b21876af285a2ab41e5291
Instruction ID: 6a27b7fc5a84d4405ba3ece710ede155025b99a951860ae5d6a6acd3946a8f49
Opcode Fuzzy Hash: 69ffb05af9b253eba234417b3c8625d5ec74c65496b21876af285a2ab41e5291
Instruction Fuzzy Hash: 6CD0A9322400147BCA01339A5C009BABA2DFB85B58B58A099F3089E156D593EC038385

Uniqueness

Uniqueness Score: -1.00%

Function 06CEE818 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fd37df4fd4cf3aefb8622378768b0f27672363a08f3eec4179de058e7971bc1
Instruction ID: 13542890df4d0201d5c4459a4e0c6a52ef81e69c95941eb8e6ee97082e5e298f
Opcode Fuzzy Hash: 2fd37df4fd4cf3aefb8622378768b0f27672363a08f3eec4179de058e7971bc1
Instruction Fuzzy Hash: 70D05E300453808FC3426BB8A41A3A53BB89F06222F064496E4C8C6471DF780D95CB96

Uniqueness

Uniqueness Score: -1.00%

Function 04EEE0C0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e7c721a99f3ad2206bbb736198ac74b70d0867df894bd4183cb3ec4910bb2a1
Instruction ID: cc32d16db0062b260590286ed699664ed3d3677ebd0dc804c0938e63f6f6b0e5
Opcode Fuzzy Hash: 9e7c721a99f3ad2206bbb736198ac74b70d0867df894bd4183cb3ec4910bb2a1
Instruction Fuzzy Hash: 26D0C9363501289F8704AB58E404CA97BAEEB9D6613014067FD05C7331DA72DC51CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 04EEE180 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4e0896747cf8500099fdcb4a87dc9fc241536a2c7061ec120819094f09df735
Instruction ID: b6adf761c5afb35855b97af64acd9259c1fa66160c3ebc636ff70a3e80d33696
Opcode Fuzzy Hash: f4e0896747cf8500099fdcb4a87dc9fc241536a2c7061ec120819094f09df735
Instruction Fuzzy Hash: 91D01231310138D7DB192A5AA8187BF77DCEBC4795F444169E509D6280CB79ADC0C7D5

Uniqueness

Uniqueness Score: -1.00%

Function 04EEABD0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8acd6542addf648b0205099ca2f037d85b22198151620942ee6c803c4645ff9b
Instruction ID: 81b25aa163b6255945945f4020e322c5a1ffff3a3b4678455be36af669cf0eb5
Opcode Fuzzy Hash: 8acd6542addf648b0205099ca2f037d85b22198151620942ee6c803c4645ff9b
Instruction Fuzzy Hash: 98E0E278A40109CFC700DF69E499AADBBB1FB0C310F259429E502A7260CB346884CF50

Uniqueness

Uniqueness Score: -1.00%

Function 074A6ED8 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709983632.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74a0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a99bb343aeac580e8eeccf1752d7b3184b4a28b4b4710483bdce31ce5d2ae460
Instruction ID: 90ad409aa854ea71ac03f8489a08a75f1e3cdce38b567810b2c9606e51c6b425
Opcode Fuzzy Hash: a99bb343aeac580e8eeccf1752d7b3184b4a28b4b4710483bdce31ce5d2ae460
Instruction Fuzzy Hash: BEC080B0501208ABC344EFF9E40875B77ADDF05221F005055F50AC3140DF72A540C666

Uniqueness

Uniqueness Score: -1.00%

Function 06CE9F74 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc87782bc4c6e34c1f54a3d455182100e461559dc670eaaadaa00494fd55fcd4
Instruction ID: 67a37a389bd7b74e9975cd3660a6d9ec2af676946be143c7f9491d5d1a7a8d5f
Opcode Fuzzy Hash: dc87782bc4c6e34c1f54a3d455182100e461559dc670eaaadaa00494fd55fcd4
Instruction Fuzzy Hash: A4E01778E0421ACFCB60DF68D840BADBBB2FB48300F1014A8D41AA7746E7306E81CF80

Uniqueness

Uniqueness Score: -1.00%

Function 04EED388 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 102760eed34fbfb923646dc5aca0699261429daab08c9728f65bddd9e95fd850
Instruction ID: 7e917c8ad0603a7377a3bad8c9c0d908e5f952cc36ba38ddedaf9edb3b86d8f0
Opcode Fuzzy Hash: 102760eed34fbfb923646dc5aca0699261429daab08c9728f65bddd9e95fd850
Instruction Fuzzy Hash: 52B09B2231423513D618319D64105BD738D47C9569F500067950D97751CCC59C4103DF

Uniqueness

Uniqueness Score: -1.00%

Function 06CEA105 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8feaae62c2e221f59643fa2d0dd23c399b399a67d81f8694433894967a83aad2
Instruction ID: d42ce03cf3b570ecf51801ad6c7a501b17d236adfe1a7b935fb283efd9ce0541
Opcode Fuzzy Hash: 8feaae62c2e221f59643fa2d0dd23c399b399a67d81f8694433894967a83aad2
Instruction Fuzzy Hash: D7E04278905259CFEB94CF64DD44B9DB7B2FB48300F109195D90EAB385DA715984CF60

Uniqueness

Uniqueness Score: -1.00%

Function 06CE9E33 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 530fb005edd1945a335c39b2059cec46709acec13b921d9368d45b3444f4eb45
Instruction ID: 5eda3195e22c7db7110240014249fba157abd4cd65649bd8e42161edb5d0feaf
Opcode Fuzzy Hash: 530fb005edd1945a335c39b2059cec46709acec13b921d9368d45b3444f4eb45
Instruction Fuzzy Hash: FDD09234908288CFCB80DF91D8986ACBBB5FB49301F10A4A6950FB6245CA361D84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06CEE828 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8b7a2ef148052de94dc6fc36d38b23c2c0a6819460b0d7b06b7c4f1442faf86
Instruction ID: 7799aed04ae0da2f70235657ee5f13deb31193db65b7c92e14b1d852dc531c79
Opcode Fuzzy Hash: e8b7a2ef148052de94dc6fc36d38b23c2c0a6819460b0d7b06b7c4f1442faf86
Instruction Fuzzy Hash: 97C02B300402048BC2506BECF80D3B93B7CD704323F001015F10C814608F741880CF65

Uniqueness

Uniqueness Score: -1.00%

Function 074AE41C Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709983632.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74a0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e7af69d7576065d79f7fb7c321566d01144edff6bfeb6dd78dc1897cbd31232
Instruction ID: 39b8f3beef874d3829c3605c0c7411b30facc49372256750e1c6fcd82f40b678
Opcode Fuzzy Hash: 5e7af69d7576065d79f7fb7c321566d01144edff6bfeb6dd78dc1897cbd31232
Instruction Fuzzy Hash: 1AB012E51E4200F2AA0063744941DABE641FBF6700F40DC17730550069D8B0C46AE62F

Uniqueness

Uniqueness Score: -1.00%

Function 06CE7F60 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a395fa17e5ccc614d9133f09f2df3dfc1f53e91879dbc6656f804608b570d0fb
Instruction ID: 3b7de6b061446d60b7f8c9282ec3a45da301db3083e440000166a89c328ecda9
Opcode Fuzzy Hash: a395fa17e5ccc614d9133f09f2df3dfc1f53e91879dbc6656f804608b570d0fb
Instruction Fuzzy Hash: D1B09230190209CFC2009B58E448E6137E8AB08A04F0100F0E1088B632D621F8008A91

Uniqueness

Uniqueness Score: -1.00%

Function 04EE13C0 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706038482.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eed30aeb26fed969a7b9c8c952719105a2d80951b4a79c61f2500f0516919df
Instruction ID: 8716e1286d74a2f59af1b1c736dab8c0011cd205ea3fd4cbcd33e9c6264f2c16
Opcode Fuzzy Hash: 6eed30aeb26fed969a7b9c8c952719105a2d80951b4a79c61f2500f0516919df
Instruction Fuzzy Hash: FAA002942DA05642F81533BF55A50B99408FB95B1DBC1BC56929AD0069F808F649A11F

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06CEC388 Relevance: 5.3, Strings: 4, Instructions: 259COMMON

Download Yara Rule

Strings

[V~*, xrefs: 06CEC4F4
[V~*, xrefs: 06CEC4ED
]\`, xrefs: 06CEC60A
T+-q, xrefs: 06CEC6C2

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: T+-q$[V~*$[V~*$]\`
API String ID: 0-1849991408
Opcode ID: 22fc0fe0056cc59416bdedb2bc098cd2186c88b4d96edbfe44465d41d48de7d5
Instruction ID: c73db61d9a09d25f768b928b901ccfabc7202edcebf72c61092217950d85224c
Opcode Fuzzy Hash: 22fc0fe0056cc59416bdedb2bc098cd2186c88b4d96edbfe44465d41d48de7d5
Instruction Fuzzy Hash: B2B1D6B0E15619DFDB44CFAAD5809AEFBB2BF89300F54D92AE425AB214D7309901CF54

Uniqueness

Uniqueness Score: -1.00%

Function 06CEC378 Relevance: 4.0, Strings: 3, Instructions: 260COMMON

Download Yara Rule

Strings

[V~*, xrefs: 06CEC4F4
]\`, xrefs: 06CEC60A
T+-q, xrefs: 06CEC6C2

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: T+-q$[V~*$]\`
API String ID: 0-3978741314
Opcode ID: d1bd9f183f4f48c4336be9e75d7163dd7d2f8fc5cfcb6454c72327f281389c51
Instruction ID: 17e5e43806b0eb0fe51b3801783d8e51da9a3f14770cf752a56af0b061cf9818
Opcode Fuzzy Hash: d1bd9f183f4f48c4336be9e75d7163dd7d2f8fc5cfcb6454c72327f281389c51
Instruction Fuzzy Hash: 5FB1E8B4E15219DFDB44CFAAD9808AEFBF2BF89300B54D92AE425BB214D7309941CF54

Uniqueness

Uniqueness Score: -1.00%

Function 06CEA3E0 Relevance: 1.4, Strings: 1, Instructions: 166COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06CEA4C1

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 74c78b01176ef2d06cc61e2b594a62fb263241ec2333f58023cbe6d2e49e9842
Instruction ID: 64c5027dbf59a03feb67ce4faa9f11f96f829f8d297d021ea92a58efdbd511cf
Opcode Fuzzy Hash: 74c78b01176ef2d06cc61e2b594a62fb263241ec2333f58023cbe6d2e49e9842
Instruction Fuzzy Hash: 59612C70A002498FDB08EFAAE980B9EBBF3FBC4304F14D529D1149B369EB7459058B90

Uniqueness

Uniqueness Score: -1.00%

Function 06CEA3F0 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06CEA4C1

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: cd48ff33f02790da231445506a0910577c859d0ffa365b8b4f8a17a8316ff4bb
Instruction ID: dce872ce782ceaa082fc89b4b21e3d93b016a753841e2f52d0849ce73c557f56
Opcode Fuzzy Hash: cd48ff33f02790da231445506a0910577c859d0ffa365b8b4f8a17a8316ff4bb
Instruction Fuzzy Hash: 20610C70E042498FD748EFAAE980B9EBBF3FBC8304F14D529D1149B369EB7459059B90

Uniqueness

Uniqueness Score: -1.00%

Function 06CE7271 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbdeba49acf182e2d4348a2758fcc65f92efdfd000080adbdccb650366d3a161
Instruction ID: d07a495121e13177f59d7da8bfdec062dc8ecc81a81e9847158fbfcf890ed89a
Opcode Fuzzy Hash: cbdeba49acf182e2d4348a2758fcc65f92efdfd000080adbdccb650366d3a161
Instruction Fuzzy Hash: E912CA75D1071A8FCB55DF68C880AE9F7B1FF49300F1586AAD458AB211EB70AAC5CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06CE7280 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 669dc06fccc5dfcaed7854601d0207cc24b0c6ad22ec2cff461c65c41348ebf4
Instruction ID: af5d5076dcac36210d5beb287e8ab15b33958d28dc13030763df829f7f02a0e8
Opcode Fuzzy Hash: 669dc06fccc5dfcaed7854601d0207cc24b0c6ad22ec2cff461c65c41348ebf4
Instruction Fuzzy Hash: 1012C975D1061A8FCB55DF68C880AD9F7B1FF49300F15C6AAD458AB211EB70AAC5CF90

Uniqueness

Uniqueness Score: -1.00%

Function 076A2C68 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1710680268.00000000076A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07620000, based on PE: true

Associated: 00000000.00000002.1710403251.0000000007620000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7620000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da5781af7d09cc46d20fbc1f4a2ce7a3a9788f0e257576b940acde0fe35648cf
Instruction ID: 9c4f8a3f8ad98c09ffce7d620f3b28cd8e4585cc1375013299aa394dc94bdac6
Opcode Fuzzy Hash: da5781af7d09cc46d20fbc1f4a2ce7a3a9788f0e257576b940acde0fe35648cf
Instruction Fuzzy Hash: CFE11AB4E042199FCB14DFA9C5909AEFBB2FF89304F248169E415AB356D731AD41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 076A3910 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1710680268.00000000076A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07620000, based on PE: true

Associated: 00000000.00000002.1710403251.0000000007620000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7620000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11b4956ff584c91c070f89735dbc203401465daf1637874cd25101ebfafa1d5a
Instruction ID: cbf4f028488b3bdf1f4f9099104ebb9e3f64125d258814f4abc218a518ec6500
Opcode Fuzzy Hash: 11b4956ff584c91c070f89735dbc203401465daf1637874cd25101ebfafa1d5a
Instruction Fuzzy Hash: AFE1EAB4E042199FCB14DFA9C5809AEFBF2BF89304F248169D415AB356D731AD41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 076A34D8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1710680268.00000000076A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07620000, based on PE: true

Associated: 00000000.00000002.1710403251.0000000007620000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7620000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93d64f390bd1bdc34a26077d7c5faed4305b25e9e0bc3d3dfbd68441a1bca60e
Instruction ID: 09cf2d58430c4ceb902126214268338d7973aa6645ccbc65afa4c3507ccdf3c5
Opcode Fuzzy Hash: 93d64f390bd1bdc34a26077d7c5faed4305b25e9e0bc3d3dfbd68441a1bca60e
Instruction Fuzzy Hash: 22E1E9B4E042199FCB14DFA9C5809AEFBB2FF89304F248169E415AB356D731AD41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06CCE6F0 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707322732.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e17624fe91fe577c0ddb56891db3da962316e0f0e95cc8d955e17d82f347021
Instruction ID: c31e07358c473475b34b8426aed00b25facd42eb2a453614b200e39ab5f74d7b
Opcode Fuzzy Hash: 1e17624fe91fe577c0ddb56891db3da962316e0f0e95cc8d955e17d82f347021
Instruction Fuzzy Hash: 84A17270B002549FDB58ABBC841436F2AABAFC8354F14857C9049EB798DE389D4787A6

Uniqueness

Uniqueness Score: -1.00%

Function 074AF148 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709983632.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74a0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dc81984731bf48be11eabd74e3883061bc73e938ee7a001a98d48e28555e6f2
Instruction ID: 8cda630ca8788d8f917c5420a90e0d97b6ab9baba685e1a9949bf87dc991af2a
Opcode Fuzzy Hash: 6dc81984731bf48be11eabd74e3883061bc73e938ee7a001a98d48e28555e6f2
Instruction Fuzzy Hash: CFD10435D20B5A8ACB10EF64D990A9DB7B1FFD5300F10D79AE1093B225EB706AC5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 074AAA60 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709983632.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74a0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3016c724987823d47b78175fe07621ce818145efd5230e424f47fe483c1ca78e
Instruction ID: 654fe7eb238df7c889d89b2b62aae55c2bc4d8a44225c5e38fe11ca3ccb85bf2
Opcode Fuzzy Hash: 3016c724987823d47b78175fe07621ce818145efd5230e424f47fe483c1ca78e
Instruction Fuzzy Hash: 8381B0B4E15219DFCB44CFA9C68499EFBF2FF89210F14955AD415AB320D334AA42CF94

Uniqueness

Uniqueness Score: -1.00%

Function 074ABED0 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709983632.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74a0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9bb6a96043514b56a2a3ae33af0627eb8a920c56af15855e84c3d945de29d51
Instruction ID: bf4344e2bf329454942476188b735496ac4692962f6e87d7d2cd4dfbab9d505e
Opcode Fuzzy Hash: e9bb6a96043514b56a2a3ae33af0627eb8a920c56af15855e84c3d945de29d51
Instruction Fuzzy Hash: 1B61F1F0916A0AFBD744CF91E1C5299BFB2FB89300F20AC96C18AD7168E7349665CB14

Uniqueness

Uniqueness Score: -1.00%

Function 074AD8A8 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709983632.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74a0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d33b4b6b29e520638c25a6c45e1b5946b9d5e4b8f13ee9e9c4a0846dc9b933af
Instruction ID: 44ddc0eebdb766a4e63cb7539bcd14d8efa4f1bcb4fdd9d2102b120c16823318
Opcode Fuzzy Hash: d33b4b6b29e520638c25a6c45e1b5946b9d5e4b8f13ee9e9c4a0846dc9b933af
Instruction Fuzzy Hash: AC5118B0E1520ADFCB08CFAAE4855EEFBF2EF89210F10942AD516B7754D7345A428F94

Uniqueness

Uniqueness Score: -1.00%

Function 074A0006 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709983632.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74a0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81589702d7334d7f22c3354636921a0ca5105677997e60e82a4f154074c20b8f
Instruction ID: b04f294f6528b85d0333bd1cc0292f3e123f7c130e83a02922cfc5c7da16611e
Opcode Fuzzy Hash: 81589702d7334d7f22c3354636921a0ca5105677997e60e82a4f154074c20b8f
Instruction Fuzzy Hash: D54191B1D056588FEB1DCF6B8C4069AFBF3AFC5310F19C1BAC458AA225EA3505468F50

Uniqueness

Uniqueness Score: -1.00%

Function 074A0040 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709983632.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74a0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 268bfa56d5f2cf327d5c8555af14f89ab39bf698adb4c7c9651da89cf605e5f8
Instruction ID: e24c2635fc7ec1366616e9fb78e77fe98084a5c2bb6e9e8b19273e56ce95314e
Opcode Fuzzy Hash: 268bfa56d5f2cf327d5c8555af14f89ab39bf698adb4c7c9651da89cf605e5f8
Instruction Fuzzy Hash: E04153B1D016198BEB1CCF6B8D406DEFAF3AFC9301F18C1BA841CAA254EB7505968F50

Uniqueness

Uniqueness Score: -1.00%

Function 074ABC88 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709983632.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74a0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 035cdeb1ea07da5b500d61188999c2b45741f7b408c6c66e4859048e6e8522af
Instruction ID: 3b5daebe1b2148ad155bb05c8eaaf91ae179af9634a056b8c894951dde8bf791
Opcode Fuzzy Hash: 035cdeb1ea07da5b500d61188999c2b45741f7b408c6c66e4859048e6e8522af
Instruction Fuzzy Hash: EF41B2B0E0120AEBDB48CFAAC9815EEFBB2FB89300F24D52AD415A7214D7349A51CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00F125D8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1697899463.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43c93872bbef534c664faab4aadd14bbcfcf57daca15de1f5bca8ec841a996d6
Instruction ID: c1870ab8cb6d648fb72928f3315648827ea575f0704974b23bbc7d8de695a042
Opcode Fuzzy Hash: 43c93872bbef534c664faab4aadd14bbcfcf57daca15de1f5bca8ec841a996d6
Instruction Fuzzy Hash: 8E317C7500C641CBC7922EAA88746957F60FF1336D7660B9AC1A48CCEBD762C0F2E394

Uniqueness

Uniqueness Score: -1.00%

Function 06CE5570 Relevance: 6.4, Strings: 5, Instructions: 140COMMON

Download Yara Rule

Strings

@, xrefs: 06CE5591
@, xrefs: 06CE563E
B, xrefs: 06CE5596
Hbq, xrefs: 06CE568D
B, xrefs: 06CE5643

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: @$@$B$B$Hbq
API String ID: 0-1093311442
Opcode ID: 26a665f24f1d6753a84d09ceb85a314657a6bde77e70eb32d279aca981f7010e
Instruction ID: 3b16b221301b67600f421d9f8ddde5cf63f494b9536f8f81adfd3d3a58761f83
Opcode Fuzzy Hash: 26a665f24f1d6753a84d09ceb85a314657a6bde77e70eb32d279aca981f7010e
Instruction Fuzzy Hash: 8241EF71B002058FDB98CB7DC88446EBBBAFFC9214764456AE019CB3A1DB31DE06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06CE84C0 Relevance: 5.3, Strings: 4, Instructions: 315COMMON

Download Yara Rule

Strings

$^q, xrefs: 06CE859A
Hbq, xrefs: 06CE8773
$^q, xrefs: 06CE8544
$^q, xrefs: 06CE85A6

Memory Dump Source

Source File: 00000000.00000002.1707419050.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce0000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: Hbq$$^q$$^q$$^q
API String ID: 0-314989797
Opcode ID: 5140a36ce36ce111bf787a838c64fd42def42cf2d5c7ab369358a1c0353046fd
Instruction ID: 39ef19fc54279bc5bee500a7eda09aa1db02e86c7a330040d77f3f4bbce41ba2
Opcode Fuzzy Hash: 5140a36ce36ce111bf787a838c64fd42def42cf2d5c7ab369358a1c0353046fd
Instruction Fuzzy Hash: 42B1DF30B112048FDBA4DF65C840AAEB7F6BF89310F10856EE416DB395DB74DA86CB91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Statement of Account PDF.bat.exePID: 7252, Parent PID: 6984COMMON

Execution Graph

Execution Coverage:	12.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	55
Total number of Limit Nodes:	5

Executed Functions

Function 06952750 Relevance: 9.0, Strings: 6, Instructions: 1476COMMON

Download Yara Rule

Strings

$^q, xrefs: 06953B7C
$^q, xrefs: 06953B58
$^q, xrefs: 06953B64
$^q, xrefs: 06953B88
$^q, xrefs: 06953B2F
$^q, xrefs: 06953B3B

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 51f107fd8d80e7fd6baf7d75af0f7c1381370b1fa7ba0d8a2ba90cec17ad17c4
Instruction ID: 3a233b670639ef4df57febf89f11dc189f13b3073bdd723c730c47c46113c13c
Opcode Fuzzy Hash: 51f107fd8d80e7fd6baf7d75af0f7c1381370b1fa7ba0d8a2ba90cec17ad17c4
Instruction Fuzzy Hash: 4FD27B30E006098FCB64DF68C594A9DB7B6FF85300F6585A9D849AB764EB34ED85CF80

Uniqueness

Uniqueness Score: -1.00%

Function 0695B1F8 Relevance: 8.3, Strings: 6, Instructions: 762COMMON

Download Yara Rule

Strings

$^q, xrefs: 0695BBB9
$^q, xrefs: 0695BB91
$^q, xrefs: 0695BBC5
$^q, xrefs: 0695BB5D
$^q, xrefs: 0695BB51
$^q, xrefs: 0695BB85

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 958b53ef18e4624487396350c93e56f8459dd90d63fa4c2ca8c897a94accbf4b
Instruction ID: d618ace1ad98ba35e1886a5e6a333af73406cace007422aaa6f9410f5316b790
Opcode Fuzzy Hash: 958b53ef18e4624487396350c93e56f8459dd90d63fa4c2ca8c897a94accbf4b
Instruction Fuzzy Hash: 7A528030E102098FDF64DF68D5A07ADB7B6FB45310F218925E805EBB99DB35EC818B91

Uniqueness

Uniqueness Score: -1.00%

Function 06957D48 Relevance: 3.0, Strings: 2, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 069582E3
$^q, xrefs: 069582EF

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: ca790eacdb5e0ddde326d621d8b06d5c5910ab6a53930da66575e78808c4a1fb
Instruction ID: d3cd7c24f973b59c8cbef2cf7c897f642c2d5f294a18a74beebc32882ec9170f
Opcode Fuzzy Hash: ca790eacdb5e0ddde326d621d8b06d5c5910ab6a53930da66575e78808c4a1fb
Instruction Fuzzy Hash: D9029D30B002198FDB54DB64D594AAEB7F6FF84304F218929D809DB795DB31ED86CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06955568 Relevance: 1.8, Strings: 1, Instructions: 593
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06955C5E

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: ebe7870b9e5fbfccdaa6538800bbe413c1ed14865491494c1849015338eee354
Instruction ID: e5b43b1277ee6b06286fa03a6f96c7d49f31f721ea8d22cf3e79f2e8ca8c28bb
Opcode Fuzzy Hash: ebe7870b9e5fbfccdaa6538800bbe413c1ed14865491494c1849015338eee354
Instruction Fuzzy Hash: B122E135E002198FDF64DFA4C5846AEB7B6EF84310F228469D809EB786DB35DD42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 069565C8 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe4aae2cef25beac88411af971d85e278c81e243e0abe4365944e57a38c3aa64
Instruction ID: 1712fd17949bafad151a0d3e1b102940a09886d1de70a9c146fb7a7aae8cdf0e
Opcode Fuzzy Hash: fe4aae2cef25beac88411af971d85e278c81e243e0abe4365944e57a38c3aa64
Instruction Fuzzy Hash: ED62C134B002088FDF54DB68D594AADB7F6EF84314F658829E805EB764DB35ED86CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0695C138 Relevance: .6, Instructions: 636COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9df7d2c366d3df30d15c16b54450496768a007e1fad257f70226fd1f254133e
Instruction ID: 3bfa469ba0165ccb996e249019e509312f51b9ff2d0c14fe748c270250fa7b6a
Opcode Fuzzy Hash: e9df7d2c366d3df30d15c16b54450496768a007e1fad257f70226fd1f254133e
Instruction Fuzzy Hash: 5E328034B10209DFDF54DB68D990AAEB7B6FB88314F218529E805EB754DB34EC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0695AC90 Relevance: 10.4, Strings: 8, Instructions: 389
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0695AE5C
$^q, xrefs: 0695AE68
$^q, xrefs: 0695AE33
$^q, xrefs: 0695AE04
$^q, xrefs: 0695AE3F
$^q, xrefs: 0695ADB1
$^q, xrefs: 0695ADBD
$^q, xrefs: 0695AE10

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 19a687485baf88fea4baf7d152b640d9eab0c7fd0d641a011d2813e21ae59cf6
Instruction ID: 728e5915f3195fe03bd6fb04befb00a0b2495c42209a7e8c3f424e2fa85b03e5
Opcode Fuzzy Hash: 19a687485baf88fea4baf7d152b640d9eab0c7fd0d641a011d2813e21ae59cf6
Instruction Fuzzy Hash: 4DE17030E1020A8FDF65DF64D5946AEB7B6FF84304F218A29E8059B758DB34EC46CB85

Uniqueness

Uniqueness Score: -1.00%

Function 06959118 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 069591CF
$^q, xrefs: 06959194
$^q, xrefs: 069591C3
$^q, xrefs: 06959188

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: d973a0eec89b09c939ee98dde12261856449cfcf04ee5cd7d65c9fe800a9f99e
Instruction ID: 76e35bb303bb17525b84874cf5ab18e6812791a139bc1cf0a13deb4433b15ca0
Opcode Fuzzy Hash: d973a0eec89b09c939ee98dde12261856449cfcf04ee5cd7d65c9fe800a9f99e
Instruction Fuzzy Hash: 96913330F1021A9FDF54DF65D9507AEB3F6BFC8204F108565C809EB784EA70AD468B91

Uniqueness

Uniqueness Score: -1.00%

Function 0695CF00 Relevance: 4.5, Strings: 3, Instructions: 799
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0695D2FF
$^q, xrefs: 0695D2F7
$^q, xrefs: 0695D30B

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q
API String ID: 0-831282457
Opcode ID: 1d7e344b2c225d2c0a6c3ee35ffce38d3eefe365f90f373d7470714c06411b4a
Instruction ID: 98b79435e62a786ec1c59d9c041b35a668a624b5323724a360c07278d0ecb4f6
Opcode Fuzzy Hash: 1d7e344b2c225d2c0a6c3ee35ffce38d3eefe365f90f373d7470714c06411b4a
Instruction Fuzzy Hash: 53628430B0020A9FCB15EB68D5A0A5EB7F2FF84304F218929D4159F759DB71ED8ACB84

Uniqueness

Uniqueness Score: -1.00%

Function 013007A8 Relevance: 4.1, Strings: 3, Instructions: 347
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 01300ADF
(bq, xrefs: 01300922
(bq, xrefs: 0130094D

Memory Dump Source

Source File: 00000008.00000002.4078327794.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1300000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: (bq$(bq$(bq
API String ID: 0-2716923250
Opcode ID: 9f80f65ae2b7a6ffc564207080d5d5e01b8ea10f598138a5bcbd08c6b99b544b
Instruction ID: a3e9818c41687095141bb9e35416036bc5521ac109275f97c90f17b048112dbf
Opcode Fuzzy Hash: 9f80f65ae2b7a6ffc564207080d5d5e01b8ea10f598138a5bcbd08c6b99b544b
Instruction Fuzzy Hash: 69D1AC30E002098FDB19DFB9C86469EBBF2FF89354F148569E445AB391DB34AD81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06954B38 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fcq, xrefs: 06955245
XPcq, xrefs: 06954C65
\Ocq, xrefs: 06954CEF

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: fcq$XPcq$\Ocq
API String ID: 0-3575482020
Opcode ID: 87ec04517d9cf0f6632f16417dac6fad96604083288a3ffc1feaee1e77f0d244
Instruction ID: e50ba71309610c4bb2b5b670f972175095df425e06432ee3c8a38ba5f73b558c
Opcode Fuzzy Hash: 87ec04517d9cf0f6632f16417dac6fad96604083288a3ffc1feaee1e77f0d244
Instruction Fuzzy Hash: 52617030E002089FEF54DFA5C854BAEBAF6EF88700F20842AE509AB395DF755D459F91

Uniqueness

Uniqueness Score: -1.00%

Function 06959108 Relevance: 2.7, Strings: 2, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 069591C3
$^q, xrefs: 06959188

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: cc93dc6c6f5958c976d48a8cbd20d45d57f4e263e4bf3573e5d15a55bbb06420
Instruction ID: 0f60c431f3e63cdb218a7f53354abfb20147c70a7982e123e99d175578e8fc39
Opcode Fuzzy Hash: cc93dc6c6f5958c976d48a8cbd20d45d57f4e263e4bf3573e5d15a55bbb06420
Instruction Fuzzy Hash: 23514470B101199FDF54EB65DA60B6E73FAEF88244F148469C909DB788DA30EC42CB95

Uniqueness

Uniqueness Score: -1.00%

Function 01017800 Relevance: 1.6, APIs: 1, Instructions: 59
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 010181E0

Memory Dump Source

Source File: 00000008.00000002.4073010284.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1010000_Statement of Account PDF.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: de48f63dd1de2ec36bcb688b880b91511f3ec439a3b2a05e3f5d4a8a72dd7174
Instruction ID: e9e23f0036f0f97227f06d7ac266fbee80906fb9fd9eacf8a27c94ee621dc22f
Opcode Fuzzy Hash: de48f63dd1de2ec36bcb688b880b91511f3ec439a3b2a05e3f5d4a8a72dd7174
Instruction Fuzzy Hash: 152127B2C006599BCB14CF9AC5447DEFBF4FB48320F10856AE958A7244D738AA44CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01018168 Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 010181E0

Memory Dump Source

Source File: 00000008.00000002.4073010284.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1010000_Statement of Account PDF.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 2417569666f447bfddf8384c105029756de40efb189997a83f56d96da66bc001
Instruction ID: ef12bedd9b3d696eaacdabe44400ca949ecfe1ca14ce2f70c40e1b3b2bec7c12
Opcode Fuzzy Hash: 2417569666f447bfddf8384c105029756de40efb189997a83f56d96da66bc001
Instruction Fuzzy Hash: DF2136B2C0065A9FDB14CFAAC5447DEFBF4BF08320F14856AD958A7254D338AA44CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0101F088 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0101F0EF

Memory Dump Source

Source File: 00000008.00000002.4073010284.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1010000_Statement of Account PDF.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 619d54ade1b902852175368fb3809c89e86af242f141336a573a6ae06f159b8a
Instruction ID: dce7d6364ed8897eefd85ee84badf53a36bfcef1ad25470584d7e3936373f8c9
Opcode Fuzzy Hash: 619d54ade1b902852175368fb3809c89e86af242f141336a573a6ae06f159b8a
Instruction Fuzzy Hash: B71123B1C0025A9BCB10CF9AC544BDEFBF4AF48320F10816AE818A7244D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06954B29 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

XPcq, xrefs: 06954C65

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: XPcq
API String ID: 0-714321711
Opcode ID: d48aa812503366016363de3660d984c8209ef1c74a13b0ec1304ce86cc105bb6
Instruction ID: 567bd5e85fdc40f1cc4a69ebd6ded2f4b945a2996ef458df5d68138bedbee2f0
Opcode Fuzzy Hash: d48aa812503366016363de3660d984c8209ef1c74a13b0ec1304ce86cc105bb6
Instruction Fuzzy Hash: C4418C30B002089FDB55DFA5C854BAEBBF6BF88700F20852AE109AB395DB749C419F91

Uniqueness

Uniqueness Score: -1.00%

Function 0695DA88 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0695DBD1

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 8ff9725ffd7ef2afdcaec675ef5846f576eb2218533545434fab45da3ea02878
Instruction ID: 746f9c2b868674f572fe7089647510ef74a0816386bc07c3c00f92d4b2471cf3
Opcode Fuzzy Hash: 8ff9725ffd7ef2afdcaec675ef5846f576eb2218533545434fab45da3ea02878
Instruction Fuzzy Hash: EC418030E002099FDF55EFA5C85469EBBB6FF85300F214529D806EB740DB71E94ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 0695DA75 Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0695DBD1

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 9b9248386405d1c4d6e9fbe88ec09eef105c8d360d276fc267d91f2aebe3d975
Instruction ID: 422e67df3f2841b5eb661f6225a66606215e57b5d7f95846a14161cffc2e5187
Opcode Fuzzy Hash: 9b9248386405d1c4d6e9fbe88ec09eef105c8d360d276fc267d91f2aebe3d975
Instruction Fuzzy Hash: D1419130E002099FDB65EF75C89469EBBB6FF85300F21492AD851EB740EB71D94ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 069521B5 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06952303

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: e9760700a0e1a5640480c9f04f9a4f1ff89510d615d7fea00de6e8e3c0299de0
Instruction ID: aba0bd4c2ab574562506ced4b088ccdc6bacc3f51006dab1acc0e9214bdea24e
Opcode Fuzzy Hash: e9760700a0e1a5640480c9f04f9a4f1ff89510d615d7fea00de6e8e3c0299de0
Instruction Fuzzy Hash: 9B314630B002059FCB49EB74C91836E7BA7AF89204F258929C406DB394EF35DE46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 069521C8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06952303

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 0d673b75f806f5d1a1582a315d1a1e50a54755d7c8f2cb97832c8cde7deaa8c1
Instruction ID: ebcd601771cd993d2e1ca8bf78a7309a7aaed11f18f6e461806501b33ee4913c
Opcode Fuzzy Hash: 0d673b75f806f5d1a1582a315d1a1e50a54755d7c8f2cb97832c8cde7deaa8c1
Instruction Fuzzy Hash: 8E310530B002059FDB49EB74C91876F7BE7AF88200F208429D806DB394EE35DE46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06958298 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

$^q, xrefs: 069582E3

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: ab6413ebff45a522c385d954da5e987690b1b6fa6aae8cbf1d3160d0abdc8a33
Instruction ID: 81554cb08aa267a6d4c6f2c26cfe56a6a3200d57be69798c160972537c185c6c
Opcode Fuzzy Hash: ab6413ebff45a522c385d954da5e987690b1b6fa6aae8cbf1d3160d0abdc8a33
Instruction Fuzzy Hash: 79F02230B04229DFDF68EA59EB912B877B9FB40340F220826CD05CBA04D731ED06CB80

Uniqueness

Uniqueness Score: -1.00%

Function 01300554 Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4078327794.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1300000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc72123dddbd5e2adb6bf50ef06d46b980e3d3a9fd388e2a3721adb04d11682b
Instruction ID: e6cdd36c2c552265ed23ed1820624940099c5b720cc8e62def1e4fb1bbd9d970
Opcode Fuzzy Hash: bc72123dddbd5e2adb6bf50ef06d46b980e3d3a9fd388e2a3721adb04d11682b
Instruction Fuzzy Hash: BB418B30E00709DFDB19DF69C85469DBBF2FF89314F148659E5497B260EB70A981CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0695B1E8 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2816d1df523e11d38b8f1baf76b89f001e6179e6e87d0917be81d54ad9a654b9
Instruction ID: 13197bdee2dd9d2272a2d14bb70100b34c6ed32682df54dee999e15b5a718d1f
Opcode Fuzzy Hash: 2816d1df523e11d38b8f1baf76b89f001e6179e6e87d0917be81d54ad9a654b9
Instruction Fuzzy Hash: 17A1C834F101099FDF64DFACC9A07AE77AAEB85310F314825E809E7799CA35DC828B51

Uniqueness

Uniqueness Score: -1.00%

Function 069561C0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 982337e7249e12e5bded693408f148341e735d7b9a76306da2897aea165beb71
Instruction ID: b5056a97c287051878445e586c9e702cd701013fe51ca3f02c8a6e7a39c6290c
Opcode Fuzzy Hash: 982337e7249e12e5bded693408f148341e735d7b9a76306da2897aea165beb71
Instruction Fuzzy Hash: 2961C171F001214FCF509A7EC89466FBADBAFC4624B66443AD80EDB364DE66DD0287C2

Uniqueness

Uniqueness Score: -1.00%

Function 06954268 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 642dad5dc3ba15d54af314e2f1eb8752d6ad0e9b86b2a2209ed4da80f3990d0e
Instruction ID: a28eeb849d438dee2669fa5f064ee72e88ff10c699c83e50b153946d654d5c36
Opcode Fuzzy Hash: 642dad5dc3ba15d54af314e2f1eb8752d6ad0e9b86b2a2209ed4da80f3990d0e
Instruction Fuzzy Hash: 53816234B102099FDF94DFA4D59479EB7F6AF84704F218529D80ADB794EB34EC828B81

Uniqueness

Uniqueness Score: -1.00%

Function 0695458C Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2942dfa99720f9f7a4a7a8fd994d3dba5682c0579d7fffc813b18a4d22f39788
Instruction ID: b7afe19deaf6483175b3b39261db4f9eda1681efb1a1165342555dab63808ac3
Opcode Fuzzy Hash: 2942dfa99720f9f7a4a7a8fd994d3dba5682c0579d7fffc813b18a4d22f39788
Instruction Fuzzy Hash: 1E913F30E106198FDF60DF68C890B9DB7B1FF85700F208695D549BB295EB70AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06954278 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e12ae364185d70aa3cd358427d6e6793137f7fa7d3c96ac63f41ece6ce38cda5
Instruction ID: 8babb1faf172409f07135f70e95f73012663bdc8e015fef3f17f4b2c807c1786
Opcode Fuzzy Hash: e12ae364185d70aa3cd358427d6e6793137f7fa7d3c96ac63f41ece6ce38cda5
Instruction Fuzzy Hash: BB816134B102099FDF84DFA9D55475EB7F6AF88704F218429D80ADB794EB34EC828B81

Uniqueness

Uniqueness Score: -1.00%

Function 069545A0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: addce84e774c5ce5ce32eda213c49e3804f7906932a44fe8116557f01c5cc849
Instruction ID: dd3b1f4728fab967631b8474ff8fd34b3a0dd3079eded2bfbc5c2b3dac2ba3ac
Opcode Fuzzy Hash: addce84e774c5ce5ce32eda213c49e3804f7906932a44fe8116557f01c5cc849
Instruction Fuzzy Hash: 44913E30E106198BDF60DF68C890B9DB7B1FF89700F208595D549BB395EB70AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0695EED8 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d580352fc8e488e84bf8c9692de8247877704fe19e311d4fa4b2d6d27331d6
Instruction ID: cf878491c86d26e4ccf5981aa0542967e91629478c69b343a52efeed49bd2d8c
Opcode Fuzzy Hash: e8d580352fc8e488e84bf8c9692de8247877704fe19e311d4fa4b2d6d27331d6
Instruction Fuzzy Hash: ED717B70A002099FCB54DFA9D990A9DBBF6FF84310F258429E849EB758DB31ED46CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0695EEE8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40ef4032cc508338b29c4f19d19ad4a7601ba284175f4ef43386055788b1fc03
Instruction ID: dbefb6fc8e79e97bb696a98625843cb5a61575e057b13840c421171d866b92c1
Opcode Fuzzy Hash: 40ef4032cc508338b29c4f19d19ad4a7601ba284175f4ef43386055788b1fc03
Instruction Fuzzy Hash: 44716C70A002099FCB44DFA9D990A9EBBF6FF84314F258429E805EB758DB30ED46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0695FC41 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 780af3566622db3a6b0395e637d8c66bdb3e5e1923ddbd1db7f3c824c64078d7
Instruction ID: 856c987411f7b5ca229a375aacdae9f476ecb32760412266e0c7b0dc14ec192f
Opcode Fuzzy Hash: 780af3566622db3a6b0395e637d8c66bdb3e5e1923ddbd1db7f3c824c64078d7
Instruction Fuzzy Hash: 2E51C031E00209DFCF14EB78E4946AEB7B6EF84325F21887AE50AD7650DB319945CF81

Uniqueness

Uniqueness Score: -1.00%

Function 0695F9EF Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 623eaa1f0a23253fa3213e23cc003eb7df953c42e0c47297ca79ba476bc05809
Instruction ID: ae4fe0dabd2e8a421442d3f4e365795f2e44f61ed8262253d6923a52a1e5a5ea
Opcode Fuzzy Hash: 623eaa1f0a23253fa3213e23cc003eb7df953c42e0c47297ca79ba476bc05809
Instruction Fuzzy Hash: 0351B930B102049FEF64A66CD96476F365ED789320F21483AE80AD7799DA7ACC454BA3

Uniqueness

Uniqueness Score: -1.00%

Function 0695FA00 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65515c569f5ecdc42f333125e4796fe65438364053a4e50b707c553352b58e79
Instruction ID: 93363f22d052b08eaf88e06c133f766066d6ee8641c5bebf1793fd93187893f7
Opcode Fuzzy Hash: 65515c569f5ecdc42f333125e4796fe65438364053a4e50b707c553352b58e79
Instruction Fuzzy Hash: 3B51B930B10204DFEF64A66CD96476F365ED789320F314826E81ED7798DA7ACC454BA3

Uniqueness

Uniqueness Score: -1.00%

Function 069553F0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9722e1a0a04453ccc69bdbf390934f4101fd40408630520b240fac8fc00d09d
Instruction ID: e037297a41f77ec8b37f97c88d107c4c611b28bd18bcd228d52864ab94740cf1
Opcode Fuzzy Hash: d9722e1a0a04453ccc69bdbf390934f4101fd40408630520b240fac8fc00d09d
Instruction Fuzzy Hash: B0416F71E006098FDF70CE99D880AAFF7B6EB84310F22492AE516D7A51D330E8558B91

Uniqueness

Uniqueness Score: -1.00%

Function 0695D928 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e072b5c462b139cc1e1e1e6b3edc3ca4d8df4ecbfca9e5f7a892249cdf26ffd
Instruction ID: 304c9ca01f9ea6f20e8b0ce97185c615515cfe1a94d001bbf92d03717603349c
Opcode Fuzzy Hash: 2e072b5c462b139cc1e1e1e6b3edc3ca4d8df4ecbfca9e5f7a892249cdf26ffd
Instruction Fuzzy Hash: 2531C430E1030A9FCF25DF65C9A069EB7B5EF85304F254929E805EB714EB70E94ACB80

Uniqueness

Uniqueness Score: -1.00%

Function 01300FF1 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4078327794.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1300000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b50d31c80c279e696f1c3e5d27312d5146d9cf0c8be1e2c9bad8ed44b68f5a4a
Instruction ID: 4a48cb2c21cf9fc1b3fa79436c0e1e12af9a5c6630ef60ed8ca5ca26a6714108
Opcode Fuzzy Hash: b50d31c80c279e696f1c3e5d27312d5146d9cf0c8be1e2c9bad8ed44b68f5a4a
Instruction Fuzzy Hash: 0B319C30A002098FCB52EB78D8A0AAEB7F5EF89314F104529D00ADB355DB75EC06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06952078 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a0016c1d8747fc80be1859b8518edac41f57f2bb57710199e13ce2e74dfca36
Instruction ID: 0f0022790fa363ef0c52d853d62ebca879add0421ee15613303f1e75e6cdbc6f
Opcode Fuzzy Hash: 5a0016c1d8747fc80be1859b8518edac41f57f2bb57710199e13ce2e74dfca36
Instruction Fuzzy Hash: 8231AF34E146099FCB15CF75D894A9EBBB2FF89300F248929E806E7750DB71AD86CB40

Uniqueness

Uniqueness Score: -1.00%

Function 01301000 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4078327794.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1300000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6487d790ee5cc3cca17cfffd14fe57fe111b0105804d51460af7f216c1fe29c0
Instruction ID: 4952e84c6acd03490e9b6e463a7cf44e94c6bd236d05d5b1a11c2ff6df65e44f
Opcode Fuzzy Hash: 6487d790ee5cc3cca17cfffd14fe57fe111b0105804d51460af7f216c1fe29c0
Instruction Fuzzy Hash: 04318D30B002099FCF51EB68D990AAFB7F5EB88314F104528D01AE7355EB75ED028B91

Uniqueness

Uniqueness Score: -1.00%

Function 069553E0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00c084624aefe9c7066354a3e79067d382c953472edcec0bebcffd96dafcc4cf
Instruction ID: 9825f6d5055ae9f3b677a139332c8b75269f17b68d2275992ac06a7c598a2e6c
Opcode Fuzzy Hash: 00c084624aefe9c7066354a3e79067d382c953472edcec0bebcffd96dafcc4cf
Instruction Fuzzy Hash: 1831A171E006058FCB70CE99C8C1AAFFBB6FB84310F22492AD556D7A55D730E8558B91

Uniqueness

Uniqueness Score: -1.00%

Function 06952088 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f1b006a11419b85e784861f6184d23962c97c585fb3a9b28e4084697ab4d146
Instruction ID: f476d84d69804d4df66dc5ed004568ce5ffefbe6a8913d1cc270ef85310b2b44
Opcode Fuzzy Hash: 7f1b006a11419b85e784861f6184d23962c97c585fb3a9b28e4084697ab4d146
Instruction Fuzzy Hash: C9318034F102099BCB15CF65D894A9EB7B6FF89300F108929E916E7750DB71AD82CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06953E70 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cbddacf9b38808e6823e199faddff6ea5370bab3c96f6f83860ffd9484e481b
Instruction ID: d12ec08c0c115a8bfdab961f0de21ae51353655a8c03e902948cafb6982bc33d
Opcode Fuzzy Hash: 6cbddacf9b38808e6823e199faddff6ea5370bab3c96f6f83860ffd9484e481b
Instruction Fuzzy Hash: 43219F75F112199FDB00DFB8D950AEEBBF5AB48250F158425E949E7344E730EC028B94

Uniqueness

Uniqueness Score: -1.00%

Function 06953E80 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099fe908d8a05e373caa1f052be4de2b7dc84c698f1f28a0d632657eb217608f
Instruction ID: 273a69d07e8b63bb5d41b123bbb934066b3c55b4276333dadd27e5ba91305c6d
Opcode Fuzzy Hash: 099fe908d8a05e373caa1f052be4de2b7dc84c698f1f28a0d632657eb217608f
Instruction Fuzzy Hash: E621AE71F102099FEB40DF79D950AAEB7F5FB48250F118025E909E7384E731EC018B90

Uniqueness

Uniqueness Score: -1.00%

Function 01300B1C Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4078327794.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1300000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43a1dba53b01bee4037e67db589a38491c8f9d4f2cb0f3b83007b244d4891771
Instruction ID: 82f00d13eeff1d4afa980015a0e4957d200aa9f837914e00df64eaf1896a8156
Opcode Fuzzy Hash: 43a1dba53b01bee4037e67db589a38491c8f9d4f2cb0f3b83007b244d4891771
Instruction Fuzzy Hash: 2F31E2B0C01218DFDB15CFAAC598BDEBFF5EB09318F24845AE444AB290D3B55885CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FCD3BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4072556508.0000000000FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fcd000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75d797b1365046b0756f04b6bf55011c6bb6e8d5a54a51e9b3b0513ff490f675
Instruction ID: ebb92f1863fc010ebd185bb29007c997a27107dee6b88d9eaaf0e18ae0e0ddd9
Opcode Fuzzy Hash: 75d797b1365046b0756f04b6bf55011c6bb6e8d5a54a51e9b3b0513ff490f675
Instruction Fuzzy Hash: EA212971904245DFCB08DF14D6C5F2ABBA5FB84324F20C57DD9094B296C376E846DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00FCD20C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4072556508.0000000000FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fcd000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227d49ff2338da979737a1fe5d0777de3d12202cbdac8844d8931566f3422168
Instruction ID: 2282c0575c4a5486089988f007856787c68a94519083416efba2043b97b06719
Opcode Fuzzy Hash: 227d49ff2338da979737a1fe5d0777de3d12202cbdac8844d8931566f3422168
Instruction Fuzzy Hash: 92214672904245DFCB04DF14DAC4F6EBB65FB84324F20C67DD8490B241C376D806DA61

Uniqueness

Uniqueness Score: -1.00%

Function 00FCD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4072556508.0000000000FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fcd000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3964a6103ddd21eab78fc2767ebe1aac221b66ea0ec19dc27b3ff771ac72b04c
Instruction ID: ecc1114c7fb64fd5cd30ba8430f41488a7016e9e115431278c4bbdda6b800836
Opcode Fuzzy Hash: 3964a6103ddd21eab78fc2767ebe1aac221b66ea0ec19dc27b3ff771ac72b04c
Instruction Fuzzy Hash: 04217971544205DFCB00DF18CAC1F2ABB65FB84324F20C57DE8494B356C736D846EA62

Uniqueness

Uniqueness Score: -1.00%

Function 00FCD12C Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4072556508.0000000000FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fcd000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e74b5c923661f20ccb46e9efcdee950e35c627d7c3c0a8b7924cafb97e93c4f
Instruction ID: a715b352e27f8a102860a88216939905b1e1b1a426dda92ec3f0c68cc281e34e
Opcode Fuzzy Hash: 6e74b5c923661f20ccb46e9efcdee950e35c627d7c3c0a8b7924cafb97e93c4f
Instruction Fuzzy Hash: 9F2104B1944241DFEB05DF14CAC1F2ABFA5FB94324F28C67DD8094B262C336D846D661

Uniqueness

Uniqueness Score: -1.00%

Function 013004B4 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4078327794.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1300000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f92f97f756ba394819ed6f037e428786f95b88abd88be05d04281d67e5e4d85b
Instruction ID: 757ef873801eb91aa7b90d17a279d90cecd299102231e2907a2e308f7b674c30
Opcode Fuzzy Hash: f92f97f756ba394819ed6f037e428786f95b88abd88be05d04281d67e5e4d85b
Instruction Fuzzy Hash: C331C2B0D01218DFDB25CF99C594B9EBBF5EB48358F14805AE404AB290C7B59885CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06956CE8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d7eb7d7cddc44bab6b29c9559cf9787a3aa885b7d3168f9fc693a27f39df01c
Instruction ID: 94bc87c792b532acba344622edae824c6834f54d99be03b6dbcc33ba5599de95
Opcode Fuzzy Hash: 4d7eb7d7cddc44bab6b29c9559cf9787a3aa885b7d3168f9fc693a27f39df01c
Instruction Fuzzy Hash: 36210631B101199FCF94DB69E9506AEB7F6EF84310F618826D809EB754DB31ED418B80

Uniqueness

Uniqueness Score: -1.00%

Function 0695F919 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dbd1cd9a506a591b3e7c22f8a84d7625d7f5b610aab3c62344348f67de7e9a9
Instruction ID: 36f827f8f4b8158dd13d4ec67b6d5aee36a12c2d547e9e5308da574ceca9c3fe
Opcode Fuzzy Hash: 7dbd1cd9a506a591b3e7c22f8a84d7625d7f5b610aab3c62344348f67de7e9a9
Instruction Fuzzy Hash: 11112630B10618ABEF24667C8C6072F658ED786760F31083AE84AD7B94C85ACC8147A2

Uniqueness

Uniqueness Score: -1.00%

Function 06953430 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f0dcb0e03278dc70fc781670e8f40fa81ccd5a8fd3246ae7e56333c9e67c42f
Instruction ID: 8d58d2cabc89f0c92faab67829b8f58be6e489ae724150340827bca7d4e3b677
Opcode Fuzzy Hash: 6f0dcb0e03278dc70fc781670e8f40fa81ccd5a8fd3246ae7e56333c9e67c42f
Instruction Fuzzy Hash: 7011BE30E002288BCF54DF69D8805DEB7B6EB89340F1084A9D80AEB300EA36DE45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0695F928 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc9e21e1f4338a70297ae61ce9ae771322f681e7b9276a127e6a575ddbf71e58
Instruction ID: 589fc668e56acf278a65f56e7a889b8c6c22c240faa218cd1383c6fbc4854629
Opcode Fuzzy Hash: fc9e21e1f4338a70297ae61ce9ae771322f681e7b9276a127e6a575ddbf71e58
Instruction Fuzzy Hash: 5601AC30B50618A7EF64666D8D6472F508ED7C5770F31483AE90ED7BD4C95ACC8507D2

Uniqueness

Uniqueness Score: -1.00%

Function 06953F90 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56d34ba4b69be86945e2f9c86f427eeff0f611e99f699fb1c95173495aa0e3d0
Instruction ID: 3987e6cb9dfdffe77f8cb46b6f12f360d60b833bc1594abc61224e0f7508fc92
Opcode Fuzzy Hash: 56d34ba4b69be86945e2f9c86f427eeff0f611e99f699fb1c95173495aa0e3d0
Instruction Fuzzy Hash: 0011A136B101285FDF84D678C814AAF77EAABC8754B15843AD80AE7340EE69DC429BD1

Uniqueness

Uniqueness Score: -1.00%

Function 069541C9 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c61aef2e3ca0f03855347719648d70ffe22bd1691ccc5436e4fc6dc6254299c
Instruction ID: 29e3098dca9e4ed495ecdac9b74a5778dd057b1bbcab79335bde146cf4d4a620
Opcode Fuzzy Hash: 2c61aef2e3ca0f03855347719648d70ffe22bd1691ccc5436e4fc6dc6254299c
Instruction Fuzzy Hash: 0E01D239B141204FDBA1D6AD9850B6AB7DEDFC9B00F25843AE54ACB745EA20DC428791

Uniqueness

Uniqueness Score: -1.00%

Function 0695F15A Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04b31fffd73a1770b1f7e54b2dad7085523e0ea4929f91dd7cfb2295b813616b
Instruction ID: 11c31862fa3dc06100eb8c580434671e863a65f60f0d082233411194763fc1ba
Opcode Fuzzy Hash: 04b31fffd73a1770b1f7e54b2dad7085523e0ea4929f91dd7cfb2295b813616b
Instruction Fuzzy Hash: B8012474B001104FCB26DB28D85072E77EADB89720F24882AE54ACB741EE21CC024B85

Uniqueness

Uniqueness Score: -1.00%

Function 00FCD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4072556508.0000000000FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fcd000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 526cc52ca7b52058fe8d342483763a789cf681d47745e91f623caa3e720f47a0
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 1B11BE75944244CFDB11CF14C6C4B1ABB61FB44324F28C6AED8494B656C33AD84ADB51

Uniqueness

Uniqueness Score: -1.00%

Function 00FCD3B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4072556508.0000000000FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fcd000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 1a6c78f2c6f75ac73bfa7f84df4944b7c2b70b9648ec6e82ffc5ea46a1ba4fa6
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 9711D075904240CFCB05CF10D6C4B19BF62FB44324F24C6AED9494B256C33AE84ADB51

Uniqueness

Uniqueness Score: -1.00%

Function 00FCD207 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4072556508.0000000000FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fcd000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction ID: 398876aef46933a50e2fbf7146cffe6a8dc4761483026af8870d79854128992c
Opcode Fuzzy Hash: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction Fuzzy Hash: 4511D075904284DFDB06CF10D6C4B5ABB61FB84324F24C6AED8490B646C33AD80ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 00FCD127 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4072556508.0000000000FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fcd000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e676ac0fa395c9d78ad1373b251d500d35a058fc48d93c8ca3093ca1b2890539
Instruction ID: a563db5373b74c5658f7cde3a1e2efe778bdd3dfe0a6b4abb7268588f07295cb
Opcode Fuzzy Hash: e676ac0fa395c9d78ad1373b251d500d35a058fc48d93c8ca3093ca1b2890539
Instruction Fuzzy Hash: 5511B275904280CFDB16CF14D6C4B19BF72FB94324F28C6ADD8494B666C33AD84ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 0695A2CA Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8717d2c2f683bb5ed79b772671eb9b798e0a5959140a659bb9253e58055e002a
Instruction ID: 7600bc4f44527290ae42d6aa2d87958cd3f334e4b15d6d928d006ac63954d9ed
Opcode Fuzzy Hash: 8717d2c2f683bb5ed79b772671eb9b798e0a5959140a659bb9253e58055e002a
Instruction Fuzzy Hash: 55012830B141044FDB61D62DE55175E77E5EF89704B24843AE409C7740EB31EC038789

Uniqueness

Uniqueness Score: -1.00%

Function 06953F7F Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59815fbd1fe0c722f9ec873d328705f4d8be12de4922d57eef53e31daf1e2a70
Instruction ID: 09a282427f838fe31b62affee2d29d5918146376f347a93f5dc156b380415cda
Opcode Fuzzy Hash: 59815fbd1fe0c722f9ec873d328705f4d8be12de4922d57eef53e31daf1e2a70
Instruction Fuzzy Hash: 31017C36B200195FEF94DA68DC64AEB73FA9BC8710F15453AD80AD7244EE24DC468BD2

Uniqueness

Uniqueness Score: -1.00%

Function 06953C50 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baec24c5f0f3f853a690e713b64aacd6625c28aabb1b7cfb5af7d5f7a431ea82
Instruction ID: 788903ccbffc566e0ebc38dc04275ffbd3518cb69ddc009a8f206b4d27cc9df7
Opcode Fuzzy Hash: baec24c5f0f3f853a690e713b64aacd6625c28aabb1b7cfb5af7d5f7a431ea82
Instruction Fuzzy Hash: 5611C2B1D01259AFCB00DF9AD984ACEFBF4FB48310F10812AE918A7200D374A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06953C49 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b872a2269da5234c0b2d344dc3c5c8def2d514f5e8d7cfd0dfac7b422fa2968a
Instruction ID: dd94cf0efb7c898d141e53c275b90e10e88d572faebe5ea176f3a428e49b24db
Opcode Fuzzy Hash: b872a2269da5234c0b2d344dc3c5c8def2d514f5e8d7cfd0dfac7b422fa2968a
Instruction Fuzzy Hash: A121CEB5D01219AFCB10CF9AD985ADEFBB4BB08320F10852AE918B7600D374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 069541D8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c72983f508f791a8bf792a992a48d59fa0a687007a0a7a1b0ec077b90056c89a
Instruction ID: faaf365792bf946803380e7aff6a131b7d4fe1a69653de9f69d8270a3c5810ff
Opcode Fuzzy Hash: c72983f508f791a8bf792a992a48d59fa0a687007a0a7a1b0ec077b90056c89a
Instruction Fuzzy Hash: 7B01AD38B100245BDBA0D6AEA454B2BB7DEDBC9B14F21843AE90ECB744DE61DC428795

Uniqueness

Uniqueness Score: -1.00%

Function 013002F8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4078327794.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1300000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e2f9e911b2436bc18673f3303822c33d16c07db9d44ba25826d4188b5fc526d
Instruction ID: b2b21fae145a19c3fd0f8122da55a13903f4dc4f8b11fe92036c3bd76b0a8461
Opcode Fuzzy Hash: 0e2f9e911b2436bc18673f3303822c33d16c07db9d44ba25826d4188b5fc526d
Instruction Fuzzy Hash: 791125B59002488FDB21DFAAC548BDEFBF4EF48324F24845AE958A7250D335A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0695FF41 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9318eb87043d9ae7ffef50f0d19f9afa982f772e1fcb82147155d64ea31d7131
Instruction ID: 0aa7e7a38f0e3341a1daf0a1a0f6f664814ae2ad43a77dc12a6455d94b168f03
Opcode Fuzzy Hash: 9318eb87043d9ae7ffef50f0d19f9afa982f772e1fcb82147155d64ea31d7131
Instruction Fuzzy Hash: 1F118C70D053049FCB62CFB884040A9BBF4EF4632072645AAE884CB922E7358849CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0695F168 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4553ca612a866db4df659568db64c68f2e283e54a00b6aa7e921ad4765ee0fc
Instruction ID: 9b02269b54ef89e78deb6bfdc97824d6ea9108324c7a4a81062a81e3b9ae5999
Opcode Fuzzy Hash: f4553ca612a866db4df659568db64c68f2e283e54a00b6aa7e921ad4765ee0fc
Instruction Fuzzy Hash: 7901D175B100101BCB64D62EE854B2FB7DADBC9724F248839F90AC7740DE21DC024B85

Uniqueness

Uniqueness Score: -1.00%

Function 0695A2D8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 782aa4790429cb12f8f3518c3380c5e91e9fb5a47c1fbe57df17bc4fdf711576
Instruction ID: dbb976c92428503706a8efa5b534876f5aa2fe1fac3b6afdae79be869254435d
Opcode Fuzzy Hash: 782aa4790429cb12f8f3518c3380c5e91e9fb5a47c1fbe57df17bc4fdf711576
Instruction Fuzzy Hash: 10018130B101185FDB60E669E961B2E77DAEB89714F208529E50AC7744EE35EC428789

Uniqueness

Uniqueness Score: -1.00%

Function 0695C782 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75e1ea3e5e2a3003b3ac6a381b7180fbd9c3fe7a862767496e94538b7a1fd6a1
Instruction ID: 5b784e50e14b1eb7e2c5fab38659088ff4b43f46c1d8e5e6250dab61d2153cd0
Opcode Fuzzy Hash: 75e1ea3e5e2a3003b3ac6a381b7180fbd9c3fe7a862767496e94538b7a1fd6a1
Instruction Fuzzy Hash: CA01F735E24328ABCB14DA79E850A9DB775FB45314F10453DE940EB785E735A8048B84

Uniqueness

Uniqueness Score: -1.00%

Function 00FBD8C5 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4072389323.0000000000FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fbd000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6920c8f429b79f8c6903ca69a9707dcfcfa66d59cc2ebd5d607e7791c9669865
Instruction ID: 8f54ff9e0c11fe66f50588a16d4b3a10f2390f81cf1b29e1063e0e064c5b6861
Opcode Fuzzy Hash: 6920c8f429b79f8c6903ca69a9707dcfcfa66d59cc2ebd5d607e7791c9669865
Instruction Fuzzy Hash: 7201A731408344AAE7115E1BDD847A7BFA8EF45334F18C42AED094A286E679D840EE72

Uniqueness

Uniqueness Score: -1.00%

Function 01300300 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4078327794.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1300000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65e5aa084e6a76bf34f8dce7f98d3f60c45faaf63885f459b86165d6974ed872
Instruction ID: 958abe52f14f5f4c52d35eb98443557fa6cd22195cc71be41be6e4c7990dff9d
Opcode Fuzzy Hash: 65e5aa084e6a76bf34f8dce7f98d3f60c45faaf63885f459b86165d6974ed872
Instruction Fuzzy Hash: 831112B59002488FDB20DF9AC584BDEFBF4EB48324F20845AE959A7350D374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0695C790 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bb503cf5fb987db2b63b02be5523f2c6345c0b2100a45fdc5c854f59c24d8a2
Instruction ID: ee395c64f5514411bc21fff1fd33a3864aaaa60f6b707eca24edfa7a255bd441
Opcode Fuzzy Hash: 4bb503cf5fb987db2b63b02be5523f2c6345c0b2100a45fdc5c854f59c24d8a2
Instruction Fuzzy Hash: 6401A435F20328ABCF14AA6AE850A9EB779FB85314F10443DE905EB744DB75AC048B84

Uniqueness

Uniqueness Score: -1.00%

Function 00FBD8C4 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4072389323.0000000000FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fbd000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 722069d2b342d690d4b0d571653d29b18a0d3bf1d6bb7f3b2b6e0f009dd456cb
Instruction ID: a83257c890e5c536a0a51c9ec5d5450e1b9997d4a784e0e50a77547c3155780f
Opcode Fuzzy Hash: 722069d2b342d690d4b0d571653d29b18a0d3bf1d6bb7f3b2b6e0f009dd456cb
Instruction Fuzzy Hash: 53F0CD72408340AEEB108E1AD8C4BA6FFA8EF51334F18C45AED480A286D2799840CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 01300E4C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4078327794.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1300000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c0efea65f26c95eda1ecf4e45a0032c0a75fe270e321e975de796344e9b3a14
Instruction ID: 6e973a5cf39fa6ff272eabc2e46076604a62734841f1ecab73dfa9767fa99d08
Opcode Fuzzy Hash: 7c0efea65f26c95eda1ecf4e45a0032c0a75fe270e321e975de796344e9b3a14
Instruction Fuzzy Hash: 1E010C71900619DFDB1ACF69C4583AEBBF1BF49354F248169F418AA290D7744A40CFD0

Uniqueness

Uniqueness Score: -1.00%

Function 01300EF0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4078327794.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1300000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14f3b3a8ccf2538ff6e1c0229d0f4b92f518a858d3b838966d4b55d4855a9767
Instruction ID: a4f9ffb810aefd165cddaa660bae4a9637fa092fa666d15508efa3e407c92cd1
Opcode Fuzzy Hash: 14f3b3a8ccf2538ff6e1c0229d0f4b92f518a858d3b838966d4b55d4855a9767
Instruction Fuzzy Hash: 77F082717042046FD7049B7E988495BFBEDEFCA720B2444BEE144C7361CA71AC01C6A4

Uniqueness

Uniqueness Score: -1.00%

Function 01300E58 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4078327794.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1300000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a64df600c8929dd39e05c2391265d0a189b39729625f5b204113ea3c2bea3fd2
Instruction ID: 38a02c7e2f2b27fd2535dc444ebf3841361cf9a2a00472f64f4bb6f70c5265aa
Opcode Fuzzy Hash: a64df600c8929dd39e05c2391265d0a189b39729625f5b204113ea3c2bea3fd2
Instruction Fuzzy Hash: B401E871800619DFEB19CF6AC4147AEBAF5AF49394F248229E828AA290D7744A40CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 01300EF8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4078327794.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1300000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d6f0deb240ba19097e968a80c542cdc5aac6672499fa293f1046e42f621cda
Instruction ID: 3c2a8a2a5780d95a6c1b623602474e50bbae743ce92c57fd0df0314f7768f97c
Opcode Fuzzy Hash: 16d6f0deb240ba19097e968a80c542cdc5aac6672499fa293f1046e42f621cda
Instruction Fuzzy Hash: 4AE06D717002186FD3049A5E9C80E6BFBEEEFC9B20B21807AF544D7361CAB0AC0086A4

Uniqueness

Uniqueness Score: -1.00%

Function 01301218 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4078327794.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1300000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b21159a8241fefb36bfa23a186794a0f20e198e8c4389f16d523c482b85984a
Instruction ID: cb075927e731b576d45e69af5700d7b5d88c726a9efc49e835f3255027deb6a4
Opcode Fuzzy Hash: 8b21159a8241fefb36bfa23a186794a0f20e198e8c4389f16d523c482b85984a
Instruction Fuzzy Hash: 06F0D4B0E0420A9FDB54DFA9D855ABEBBF8AB48304F1085A9D918E7340E77496048BD0

Uniqueness

Uniqueness Score: -1.00%

Function 01301209 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4078327794.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1300000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b756ccc54c205113e969830ffe10921ae7e7a00351b63b5096fca36ec6d906b
Instruction ID: 06db8254831a729a6e462f3e8ecbc2941cbab437fb0774059891bb68383de379
Opcode Fuzzy Hash: 2b756ccc54c205113e969830ffe10921ae7e7a00351b63b5096fca36ec6d906b
Instruction Fuzzy Hash: AEF0C4B0D0030A9FDB48EFA9D5556AEBFF4AF48318F10496DD514E7251D37196118F90

Uniqueness

Uniqueness Score: -1.00%

Function 0695FF68 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4e39ff1e40be87ea90750c5d528b4dcd7d7d1fada7dd59552e22c80d6ccd505
Instruction ID: b4b100545f8eef6562c787c62191b62aa215e0ec1380ebe380d656b5d88c5e33
Opcode Fuzzy Hash: a4e39ff1e40be87ea90750c5d528b4dcd7d7d1fada7dd59552e22c80d6ccd505
Instruction Fuzzy Hash: DBF03075E10714AB8B34CFA9D84449ABBF9EF49710B41856AE89593A00D731EA14CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01300F44 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4078327794.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1300000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30e74ad349c8d91f78166d084fb66f54e1d8b248cf7298bee9160c616cc850c8
Instruction ID: 34f27b9430cd7819272ca7f78914fee479b2e15317b8ce5816019116cc3e4373
Opcode Fuzzy Hash: 30e74ad349c8d91f78166d084fb66f54e1d8b248cf7298bee9160c616cc850c8
Instruction Fuzzy Hash: 9DE04F363042106FC3148A6EEC98D46FBE9EF89634B55806AF609C7761C931AC01C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 06956448 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef62a5773b66f5d32631520c2d317e137227a0ba9f564e39befaf82eb1dfbf61
Instruction ID: 784146825250c5f457f5fcc54f53ea62386977fd6e5eb8b2f255fc0c1e7ccfe9
Opcode Fuzzy Hash: ef62a5773b66f5d32631520c2d317e137227a0ba9f564e39befaf82eb1dfbf61
Instruction Fuzzy Hash: 79E0D870E181889FDF91CFB49A9535A3B799B42208F3149E6C848CB293E175CA028391

Uniqueness

Uniqueness Score: -1.00%

Function 01300F48 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4078327794.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1300000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4bf9e2c139efac2e0415e6a93131072d981b16a081d5e858653b0fa2ed5be73
Instruction ID: 88104f38a95f8a46cb265b9e009f03c8e5c0adb4ff67217fabb4a8d14613ed29
Opcode Fuzzy Hash: a4bf9e2c139efac2e0415e6a93131072d981b16a081d5e858653b0fa2ed5be73
Instruction Fuzzy Hash: 99E08C363002106FC3148A0FEC88D06FBEDEFC8630B50802AFA09C7360CA30AC01CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 013011B1 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4078327794.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1300000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e6635e9219084152dc54f988b0aee8a40bd8e5e60c32845fed7e24525953578
Instruction ID: c3c6045b1e0c8a9961430802c5c90784769daf75e5e65a7916eee5df069ea789
Opcode Fuzzy Hash: 7e6635e9219084152dc54f988b0aee8a40bd8e5e60c32845fed7e24525953578
Instruction Fuzzy Hash: 3FF0D4B091020ADFCB44EF79C514659BBF0BF49308F1189AED015E7262E7759610CF40

Uniqueness

Uniqueness Score: -1.00%

Function 06956458 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 352d4e2008c92ae84fde51fe48398ca9d3f89834aea1d97f1a769fb66f901f7c
Instruction ID: 8caf1b40fdfcf8e01127663c6c3da19b522df7eca5d9b28b26d07a629909c13e
Opcode Fuzzy Hash: 352d4e2008c92ae84fde51fe48398ca9d3f89834aea1d97f1a769fb66f901f7c
Instruction Fuzzy Hash: 80E0C2B0E10108ABDF50CEB4D95575A77BDD701204F3185A4DC08C7611E172CA028380

Uniqueness

Uniqueness Score: -1.00%

Function 013012A9 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4078327794.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1300000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5c31106e390d81d86a962560ef6a4cf26d0fe5045b47e3dcff49dc9196d2ef0
Instruction ID: 8a6f072d29791a349bf5e7aae48749591f5214a7d838f8e9251c2bbc11d66ad8
Opcode Fuzzy Hash: d5c31106e390d81d86a962560ef6a4cf26d0fe5045b47e3dcff49dc9196d2ef0
Instruction Fuzzy Hash: DBE08C325483089FCB82DFB8D4508D13BF4FF3932070080AAE504CB462E2269926DB10

Uniqueness

Uniqueness Score: -1.00%

Function 013011C0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4078327794.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1300000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c804bd79a79115e9377354dc1530c84b0454aa0d174ce725863c6be1840db767
Instruction ID: 9011dc5b1e7af29fdd564a235b03501f67cd71bfbe9e012af8c1f2644bbefb6e
Opcode Fuzzy Hash: c804bd79a79115e9377354dc1530c84b0454aa0d174ce725863c6be1840db767
Instruction Fuzzy Hash: A2E0B6B0D44209DFD744EFB9C915A5EBBF4BF08304F1185A9D019E7352EBB496048F91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06957668 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$^q, xrefs: 06957764
$^q, xrefs: 06957BC0
$^q, xrefs: 06957789
$^q, xrefs: 06957B21
$^q, xrefs: 06957795
$^q, xrefs: 06957B15
$^q, xrefs: 06957BCA
$^q, xrefs: 06957BD6
$^q, xrefs: 06957BB4
$^q, xrefs: 06957758

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2222239885
Opcode ID: 1b0a0f9c98baa532c801f818c4e8ebd05dcd001bcbdabd0b2557559c2466b1c2
Instruction ID: 0509261006313a7a40a786badc9cc90fb5b89405e375a9b77cbbecfbe043b5e7
Opcode Fuzzy Hash: 1b0a0f9c98baa532c801f818c4e8ebd05dcd001bcbdabd0b2557559c2466b1c2
Instruction Fuzzy Hash: B0124D30E002198FDB68DFA5D954A9EB7F6BF84304F2185A9D409AF754DB309E85CF81

Uniqueness

Uniqueness Score: -1.00%

Function 0695A8F8 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$^q, xrefs: 0695AA74
$^q, xrefs: 0695AA49
$^q, xrefs: 0695AAB6
$^q, xrefs: 0695AAAA
$^q, xrefs: 0695A9FA
$^q, xrefs: 0695A9EE
$^q, xrefs: 0695AA55
$^q, xrefs: 0695AA80

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: f4ea76059667c79aa8e0b66cfed59996c275be8d0268f532d1ffb9fe9a45232e
Instruction ID: 4a86878e7db037cea6c300faf1cd9f71f849416d27a535178c6f825a75c392aa
Opcode Fuzzy Hash: f4ea76059667c79aa8e0b66cfed59996c275be8d0268f532d1ffb9fe9a45232e
Instruction Fuzzy Hash: C5919130E0020D9FEB64EF64DA54BAE77F6BF84310F218629E8019B758DB749C45CB94

Uniqueness

Uniqueness Score: -1.00%

Function 06957068 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$^q, xrefs: 069573B0
$^q, xrefs: 06957504
$^q, xrefs: 0695734A
$^q, xrefs: 06957570
.5vq, xrefs: 069570C3
$^q, xrefs: 069573A4
$^q, xrefs: 0695757C

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: .5vq$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-390881366
Opcode ID: c3b0464ba6bdcb339693f16d64405b30707782a1348f30dbe5926d8a202e2c10
Instruction ID: de44147db1fea5759dc9f44399deb3e31dd005f97588dea8eb5b1ac8b00971b6
Opcode Fuzzy Hash: c3b0464ba6bdcb339693f16d64405b30707782a1348f30dbe5926d8a202e2c10
Instruction Fuzzy Hash: 85F13C30B01209CFDB58EBA4D594AAEB7B6FF84300F218568D8459B75CDB35ED86CB81

Uniqueness

Uniqueness Score: -1.00%

Function 069583A0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$^q, xrefs: 0695865F
$^q, xrefs: 0695866B
$^q, xrefs: 06958606
$^q, xrefs: 069585FA

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: ce410cc8e98aadab5e97643429f80d4f14e77b53da0424e1f6d9ddc1f20828c9
Instruction ID: 4fe4fdd933293b242a3dda946318b000e5a8c29c950b5a26a12ee04a36e56b44
Opcode Fuzzy Hash: ce410cc8e98aadab5e97643429f80d4f14e77b53da0424e1f6d9ddc1f20828c9
Instruction Fuzzy Hash: 0AB16C30B102198FDB54EF69D694A9EB7B6FF84300F258869D806DB759DB35DC82CB80

Uniqueness

Uniqueness Score: -1.00%

Function 069587B8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LR^q, xrefs: 069588FA
$^q, xrefs: 06958837
LR^q, xrefs: 069588AB
$^q, xrefs: 06958843

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: LR^q$LR^q$$^q$$^q
API String ID: 0-2454687669
Opcode ID: e62ce898ee21218dad0e8e154234c5e25c34d6138ca20f7f886749b87c70b39e
Instruction ID: 423a7c8e0f0f4ac093678f1e02392bdf17ad72dd756d6113be0deab52e824391
Opcode Fuzzy Hash: e62ce898ee21218dad0e8e154234c5e25c34d6138ca20f7f886749b87c70b39e
Instruction Fuzzy Hash: B8511730B002159FCB58EB29DA64A6E77F5FF84304F118968E812DB7A9DB30EC45CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0695AC8B Relevance: 5.2, Strings: 4, Instructions: 156COMMON

Download Yara Rule

Strings

$^q, xrefs: 0695AE5C
$^q, xrefs: 0695AE33
$^q, xrefs: 0695AE04
$^q, xrefs: 0695ADB1

Memory Dump Source

Source File: 00000008.00000002.4126032878.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6950000_Statement of Account PDF.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 1bbf31ca59f75aafeb433ded2d38b08562fc00ba271d7769fa4af16c0164477d
Instruction ID: 5a1091eea69abe178fbd100b28a52d884c5b9b5ff195a07a547ab8f0170dc1b3
Opcode Fuzzy Hash: 1bbf31ca59f75aafeb433ded2d38b08562fc00ba271d7769fa4af16c0164477d
Instruction Fuzzy Hash: 87518D30E102098FDF65EB64E5906ADB7B6FB84200F218A2AE845DB758DB34EC45CB94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: gDdsxauPhk.exePID: 7440, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	380
Total number of Limit Nodes:	29

Executed Functions

Function 06A12368 Relevance: 11.0, Strings: 8, Instructions: 970
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 06A14254
Hbq, xrefs: 06A14050
Hbq, xrefs: 06A142B3
Hbq, xrefs: 06A14472
Hbq, xrefs: 06A13E91
(bq, xrefs: 06A13B8D
PH^q, xrefs: 06A13B61
Hbq, xrefs: 06A13E32

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: (bq$Hbq$Hbq$Hbq$Hbq$Hbq$Hbq$PH^q
API String ID: 0-3076519024
Opcode ID: 6949f7edbb5c40d84344f39b2c374909f40d930b1c89c8f855e7f36e186ea401
Instruction ID: 883964d918cf2dc5f2ef03371898406780b64bede3c7d39a5ddcfa4f7244ea71
Opcode Fuzzy Hash: 6949f7edbb5c40d84344f39b2c374909f40d930b1c89c8f855e7f36e186ea401
Instruction Fuzzy Hash: 83728930B002148FCB54AF79C85466E7BA6AFC9310F248579D50ADF3A5CE35DD46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A1A688 Relevance: 8.5, Strings: 6, Instructions: 1042
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 06A1AEE2
&IH3, xrefs: 06A1AA80
xbaq, xrefs: 06A1A7B8
4'^q, xrefs: 06A1B289
pbq, xrefs: 06A1B361
TJcq, xrefs: 06A1A82D

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: &IH3$4'^q$TJcq$Te^q$pbq$xbaq
API String ID: 0-1216527603
Opcode ID: 766568a4d5566c2cecda1a6b95561f5decc615e1ab60d9734776fea301b21687
Instruction ID: 9668a7e86c8eeb83575bc2c1595580c01fbc341a7f73a19e745eee2130e40aed
Opcode Fuzzy Hash: 766568a4d5566c2cecda1a6b95561f5decc615e1ab60d9734776fea301b21687
Instruction Fuzzy Hash: D3B2C475E00628CFDB54DF69C984AD9BBB2FF89304F1581E9E509AB225DB319E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 06D37A20 Relevance: 4.0, Strings: 3, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 06D37C4E
)", xrefs: 06D37ACA
Te^q, xrefs: 06D37A89

Memory Dump Source

Source File: 0000000A.00000002.1769219286.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6d30000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: Te^q$Te^q$)"
API String ID: 0-4031938444
Opcode ID: 4faed6147cacc38f452498a1f86029a67b2be3a729283f655a46d7126433f8c9
Instruction ID: 8c145fe9f8f4dbfb7b30dc1977c4027cb3b07522bebf4abfb3b690f5e90db846
Opcode Fuzzy Hash: 4faed6147cacc38f452498a1f86029a67b2be3a729283f655a46d7126433f8c9
Instruction Fuzzy Hash: AD81D5B4E006199FDB48CFEAC984AAEFBB2FF88300F14942AD519AB354D7349945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 06D39BC0 Relevance: 1.6, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

tIh, xrefs: 06D39F75

Memory Dump Source

Source File: 0000000A.00000002.1769219286.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6d30000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: tIh
API String ID: 0-443931868
Opcode ID: 9427bdded998bb2c40b3af16a7696beddc83af4c64e82aa447f07ae1159ca529
Instruction ID: a0a8f08f73f01ab7168097b994bedd9056d75eebb851dc91d19eea95c335e35c
Opcode Fuzzy Hash: 9427bdded998bb2c40b3af16a7696beddc83af4c64e82aa447f07ae1159ca529
Instruction Fuzzy Hash: BBD15770E0521ADFDB44CF9AD4948AEFBB2FF88300B14D559D512AB214E774EA82CF94

Uniqueness

Uniqueness Score: -1.00%

Function 06A16CD8 Relevance: .8, Instructions: 800COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f145c6049a046d58414f990b9a42e8941bdee72adc50467502ae09c52def9cf1
Instruction ID: d3cdc876d487cddf33572d584bb5294550da97245cb27b576c3f4d9f84ecf7c7
Opcode Fuzzy Hash: f145c6049a046d58414f990b9a42e8941bdee72adc50467502ae09c52def9cf1
Instruction Fuzzy Hash: 50721C70A00219CFCB54EF68C994AADB7B2FF89310F1586A9D459AB351DB30ED85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06D3C900 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1769219286.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6d30000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a074d81bf4e5a5a459479280e1678d291f994690b289c1cc636e4d7acb9ee23a
Instruction ID: 791788d545657b622885a7c842b6e5572542b342cba8fb45465bf010e67b220e
Opcode Fuzzy Hash: a074d81bf4e5a5a459479280e1678d291f994690b289c1cc636e4d7acb9ee23a
Instruction Fuzzy Hash: 4D810074E1422ADFDB44CFA9C8809AEFBB2FB88300F10955AD455BB254D7789906CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06A19C15 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 190a6c800bebeb0475f3fcc2ccef6c70b65e8b79840376913d13183846486bb7
Instruction ID: b5f20d8ddab4af924f5dc53a1f700c51d270d0fcd6ae4b5c406f4dba3b058f07
Opcode Fuzzy Hash: 190a6c800bebeb0475f3fcc2ccef6c70b65e8b79840376913d13183846486bb7
Instruction Fuzzy Hash: E331AFB1D056588BD709EFAE895429EFBF2EFC9300F18C17AC4595F269DB300946CB40

Uniqueness

Uniqueness Score: -1.00%

Function 06A19CB8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ad7e3e64074a1bc55f4460ef504cc7a08185fe58b78336b2c5b616770d0d61d
Instruction ID: b2d84e7475e400060d53da45eb1033614617ef0b8255325bc7d529fef41669ba
Opcode Fuzzy Hash: 3ad7e3e64074a1bc55f4460ef504cc7a08185fe58b78336b2c5b616770d0d61d
Instruction Fuzzy Hash: 0A214AB1E056088BEB1CDFABC80429EBBF7AFC9300F04C07AD5186B268EB700546CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06A19CC8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a5c368c507c1e84f0a9c8cd9616f12a8b3b6fe119b5b6a8787452387c67ebf9
Instruction ID: 47771195c059e6db30c804b56bcba48fa3ddf65820fa69f6b210844710c8b32b
Opcode Fuzzy Hash: 5a5c368c507c1e84f0a9c8cd9616f12a8b3b6fe119b5b6a8787452387c67ebf9
Instruction Fuzzy Hash: EF11E971E056188BEB5CDFABD90429EBAF7AFC9300F04C07A9519AB258EB740946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 007FDF58 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 007FDFDE
GetCurrentThread.KERNEL32 ref: 007FE01B
GetCurrentProcess.KERNEL32 ref: 007FE058
GetCurrentThreadId.KERNEL32 ref: 007FE0B1

Memory Dump Source

Source File: 0000000A.00000002.1761249544.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7f0000_gDdsxauPhk.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 6612569eb14df7c8bb1739eed2bdc98bf4436d8a2eef00e71ab7778cd55f6408
Instruction ID: b476098ec1d546ddd7e0d889012a29374282f2d6ccc278552378a009095b3f31
Opcode Fuzzy Hash: 6612569eb14df7c8bb1739eed2bdc98bf4436d8a2eef00e71ab7778cd55f6408
Instruction Fuzzy Hash: F65167B0900209CFDB14DFA9D548BEEBBF1EF88314F208569E419A7360DB749984CF65

Uniqueness

Uniqueness Score: -1.00%

Function 007FDF60 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 007FDFDE
GetCurrentThread.KERNEL32 ref: 007FE01B
GetCurrentProcess.KERNEL32 ref: 007FE058
GetCurrentThreadId.KERNEL32 ref: 007FE0B1

Memory Dump Source

Source File: 0000000A.00000002.1761249544.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7f0000_gDdsxauPhk.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 8ca87177092eedb9c2d571519db9512239acd6afeb6f0fbacc71b25ac5527fa4
Instruction ID: eeeb864c0b05e1dcfcf484bd74e7ea42cb2ce50598ce6d81fe329812f55c3bb6
Opcode Fuzzy Hash: 8ca87177092eedb9c2d571519db9512239acd6afeb6f0fbacc71b25ac5527fa4
Instruction Fuzzy Hash: E15168B0900209CFDB14DFA9D548BEEBBF1EF48314F208569E419A7360CB749984CF65

Uniqueness

Uniqueness Score: -1.00%

Function 06A19D5F Relevance: 5.1, Strings: 4, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06A1A0A9
$^q, xrefs: 06A19E18
$^q, xrefs: 06A19E02
$^q, xrefs: 06A1A093

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 220c95b6b9e8e973d45f42400d239a06ac5e5f18077b7cba4ce073e26f64e4e5
Instruction ID: 5b273153b47125007f0dcee7e60e457b4e4a7a2db7b7b5f74bbff16afc87fd9a
Opcode Fuzzy Hash: 220c95b6b9e8e973d45f42400d239a06ac5e5f18077b7cba4ce073e26f64e4e5
Instruction Fuzzy Hash: 2341D178E01228CFEB68DF64D994B99B7B2BB49300F1080D9E549AB394CB315E85CF42

Uniqueness

Uniqueness Score: -1.00%

Function 06A12778 Relevance: 2.8, Strings: 2, Instructions: 296
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 06A12A54
PH^q, xrefs: 06A128E6

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 636a6d12a82257a794e3eb3fc9988c5ecc9bb95f705d24f1dec906caca57eee1
Instruction ID: 99a5809989433491c6541cac777198d8e285c5712532e0b00768a68fca3573d6
Opcode Fuzzy Hash: 636a6d12a82257a794e3eb3fc9988c5ecc9bb95f705d24f1dec906caca57eee1
Instruction Fuzzy Hash: C5C1E734A002148FCB54EF68D558AADBBF2FF88310B1545A8E506EF3A1DB31ED85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06A19F41 Relevance: 2.7, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 06A19FB2
Te^q, xrefs: 06A1A169

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: 0e84ac9a987ed7134880b61a9a2ac4b0c033db5b5b8bdc5ee5cec3649e7bf1da
Instruction ID: 5f7dbd631cc183857dcc5b9b39040b2390696ad96be25df0b804905ece21e1e3
Opcode Fuzzy Hash: 0e84ac9a987ed7134880b61a9a2ac4b0c033db5b5b8bdc5ee5cec3649e7bf1da
Instruction Fuzzy Hash: 15514978E05218CFDB94EFA8D544BEDBBF6BB49300F205029E60AAB355DB745A44CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06A19D48 Relevance: 2.6, Strings: 2, Instructions: 150
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 06A19FB2
Te^q, xrefs: 06A1A169

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: 7c22fb2c7328ef5e4dbb4d5b6b0e8cb88798ccde97d0e782d9dbbf62a9f45923
Instruction ID: 1afad2ecb393d4904300b6630eb165c08a24e6c51699dc9cbe44de1c82c80d46
Opcode Fuzzy Hash: 7c22fb2c7328ef5e4dbb4d5b6b0e8cb88798ccde97d0e782d9dbbf62a9f45923
Instruction Fuzzy Hash: 2C514A78E05208CFDB94EFA8D544BEDB7B6BB49300F205059E60AAB395DB745A44CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06ED60A4 Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06ED62E6

Memory Dump Source

Source File: 0000000A.00000002.1769554852.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ed0000_gDdsxauPhk.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 7dd1b0185c343a369fd444353f4b0994628ea54499a4b65d67659f659e5d4fef
Instruction ID: 74e9dcf2b9cb612c6cede37632d2cbc28df0b2d309b0612440a5732a6dfa4b44
Opcode Fuzzy Hash: 7dd1b0185c343a369fd444353f4b0994628ea54499a4b65d67659f659e5d4fef
Instruction Fuzzy Hash: BDA16971D00319CFDB60CFA8C845BEEBBB2BF48314F0485A9E849A7250DB749986CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06ED60B0 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06ED62E6

Memory Dump Source

Source File: 0000000A.00000002.1769554852.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ed0000_gDdsxauPhk.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 013e7b940152152b21cb74f84ca30c8cf722482b04bcff7b3ca9f1686f9d4d30
Instruction ID: 9f47f519692450c17ab04143db29130dcfb54def1fc3c59a5274d9a05e7b0017
Opcode Fuzzy Hash: 013e7b940152152b21cb74f84ca30c8cf722482b04bcff7b3ca9f1686f9d4d30
Instruction Fuzzy Hash: B7916971D00319CFDB50CFA8C845BEEBBB2BF48314F1495A9E858A7250DB749986CF91

Uniqueness

Uniqueness Score: -1.00%

Function 007FBCB8 Relevance: 1.7, APIs: 1, Instructions: 203COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 007FBF1E

Memory Dump Source

Source File: 0000000A.00000002.1761249544.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7f0000_gDdsxauPhk.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4e85bac419749aa30885c018987ca548e6f45d00b617b4a75185d302e2724bc7
Instruction ID: 095eaf96abc367c839e0229f26b35f35ff24c2d77f645b3d64eb27222eada808
Opcode Fuzzy Hash: 4e85bac419749aa30885c018987ca548e6f45d00b617b4a75185d302e2724bc7
Instruction Fuzzy Hash: 6D811370A00B098FDB24DF29D44576ABBF1BF88304F10892DD58ADBB50D779E94ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 023F2804 Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 023F2922

Memory Dump Source

Source File: 0000000A.00000002.1762855295.00000000023F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23f0000_gDdsxauPhk.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: df6ae21d732db2b8bfd5590a9408fd74d8a77098e32a2273d8441fb9cb2db841
Instruction ID: 6fb70334c0b186d4503e75229e35d37409ce0be1af8362ee29999cf2bde3fea5
Opcode Fuzzy Hash: df6ae21d732db2b8bfd5590a9408fd74d8a77098e32a2273d8441fb9cb2db841
Instruction Fuzzy Hash: AD51CDB1D00349DFDB14CFAAD984ADEBFB5BF48314F24812AE919AB210D7719885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 023F2810 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 023F2922

Memory Dump Source

Source File: 0000000A.00000002.1762855295.00000000023F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23f0000_gDdsxauPhk.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 0b95543c6e97d55450083251dc4c597ae03f8ac311849eb5d1c79dea00f5be21
Instruction ID: 436e5b9cfbc00c4b94ce7d9f79dd41c5af6e464271af342d7c2e3e397598bfa5
Opcode Fuzzy Hash: 0b95543c6e97d55450083251dc4c597ae03f8ac311849eb5d1c79dea00f5be21
Instruction Fuzzy Hash: 9F41BDB1D00309DFDB14CFAAD984ADEBFB5BF48314F24812AE919AB210D7749885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 023F1DC4 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 023F4EA1

Memory Dump Source

Source File: 0000000A.00000002.1762855295.00000000023F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23f0000_gDdsxauPhk.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 1325de5fafb4f0862ced75df4d611dc4bad39d7e4b758168bf6c35bafdd195ff
Instruction ID: 348c6733bbd3c9d7dc0cc577589baab7b4be7639ed063a5e66ca5e3105179dd0
Opcode Fuzzy Hash: 1325de5fafb4f0862ced75df4d611dc4bad39d7e4b758168bf6c35bafdd195ff
Instruction Fuzzy Hash: 014127B8A00205DFCB54CF99D488BABBBF5FB98314F24C459D619AB321D375A840CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 007F4538 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 007F5DC9

Memory Dump Source

Source File: 0000000A.00000002.1761249544.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7f0000_gDdsxauPhk.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 511f5e500c7aea60b104fed59605395a704a359cbbdaf12ec3203418b73e765f
Instruction ID: 886952cd429f3f69df5aa19284a47afc3b5c90c9118097605d5c935414cf2c41
Opcode Fuzzy Hash: 511f5e500c7aea60b104fed59605395a704a359cbbdaf12ec3203418b73e765f
Instruction Fuzzy Hash: DD41E2B0C0071DCBDB24CFA9C884B9EBBB5BF48304F24816AD518AB255DB796945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 007F5D0D Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 007F5DC9

Memory Dump Source

Source File: 0000000A.00000002.1761249544.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7f0000_gDdsxauPhk.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8854b8b0d6a220e8ef1f88aa349651db09c41a4da2c3d0500192368db7038e3c
Instruction ID: 9fa72b6b0387270b27383f1eb14ec2d4b40f6807b74e3177174b5ac6633fb1ec
Opcode Fuzzy Hash: 8854b8b0d6a220e8ef1f88aa349651db09c41a4da2c3d0500192368db7038e3c
Instruction Fuzzy Hash: E441D1B0C0061DCFDB24CFA9C884BDEBBB5BF49304F24816AD518AB255DB755986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 068F81EC Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,068F9EC5,?,?), ref: 068F9F77

Memory Dump Source

Source File: 0000000A.00000002.1768181256.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_68f0000_gDdsxauPhk.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: dd63289258ac5548c54a40ebfab6d03dd1e9cc7f714d6bba37530efad80a97d0
Instruction ID: 8d7b6e9c37e6bf83dd8192155f0756fbd60a80035471d9c128f8eafab7710483
Opcode Fuzzy Hash: dd63289258ac5548c54a40ebfab6d03dd1e9cc7f714d6bba37530efad80a97d0
Instruction Fuzzy Hash: DE31E2B5D002099FDB50CF9AD884ADEFBF4FB48310F14842AEA19A7210D374A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06ED5A22 Relevance: 1.6, APIs: 1, Instructions: 71injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06ED5AB8

Memory Dump Source

Source File: 0000000A.00000002.1769554852.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ed0000_gDdsxauPhk.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: c7e9f9e1a27c914f9d887f73910afb1649801829c9d6948bdf4ee436c787c601
Instruction ID: 5e48139b46c45b55cbe65e8576cf44c747884b5389861604e6d521f63dc33d68
Opcode Fuzzy Hash: c7e9f9e1a27c914f9d887f73910afb1649801829c9d6948bdf4ee436c787c601
Instruction Fuzzy Hash: 8A2146B19003599FCB10CFA9C885BEEBFF5FF48310F108429E959A7240C7789944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 068F9ED8 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,068F9EC5,?,?), ref: 068F9F77

Memory Dump Source

Source File: 0000000A.00000002.1768181256.00000000068F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_68f0000_gDdsxauPhk.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 77f888837332cad3dbee418c56ce4f56819bab741d8eb5a8b6d65ce530ff94a0
Instruction ID: 941c307057bc39de270647d20714409d63aca7773193d3c49348918634d39339
Opcode Fuzzy Hash: 77f888837332cad3dbee418c56ce4f56819bab741d8eb5a8b6d65ce530ff94a0
Instruction Fuzzy Hash: 5F31C0B5D012499FDB50CF9AD884ADEBBF5FF48320F14842AEA19A7311D774A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06ED5A28 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06ED5AB8

Memory Dump Source

Source File: 0000000A.00000002.1769554852.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ed0000_gDdsxauPhk.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 01da3d163821af04dfbcd44ea950d4356767d6e7afa5096ec03f3bb83d73bd23
Instruction ID: 6a4593d421921412b4ab1618a017c94a07e153b3da5c61e58ca2a4d43d7356f2
Opcode Fuzzy Hash: 01da3d163821af04dfbcd44ea950d4356767d6e7afa5096ec03f3bb83d73bd23
Instruction Fuzzy Hash: AA2125B19003599FCB10CFA9C885BEEBBF5FF48314F10842AE959A7250C7789945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 007FE1A0 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 007FE22F

Memory Dump Source

Source File: 0000000A.00000002.1761249544.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7f0000_gDdsxauPhk.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 961bd5704f035c24d8e993b03416c62d4d6202c3aef26b79371dd70b2f6874c6
Instruction ID: 4a7f02f1d19b6b20971611a755e30664f0069f338368574a72ca412b3d95909f
Opcode Fuzzy Hash: 961bd5704f035c24d8e993b03416c62d4d6202c3aef26b79371dd70b2f6874c6
Instruction Fuzzy Hash: DE21E5B59002189FDB10CFA9D984AEEBBF8FB48310F14841AE954A7350D378A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06ED5B11 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06ED5B98

Memory Dump Source

Source File: 0000000A.00000002.1769554852.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ed0000_gDdsxauPhk.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: ba030c0d6814e2cf91f245de2ad4e7e333e6c3b7e478eecca2c0e4d1687bbb2c
Instruction ID: 656eae4aab356d4fa64304e400cad3d4724dc000e4e7d0242733956712f777f5
Opcode Fuzzy Hash: ba030c0d6814e2cf91f245de2ad4e7e333e6c3b7e478eecca2c0e4d1687bbb2c
Instruction Fuzzy Hash: 0C2128B1C003599FDB10CFA9C885AEEBBF5FF88310F10842AE959A7250C7749955DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06ED5888 Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06ED590E

Memory Dump Source

Source File: 0000000A.00000002.1769554852.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ed0000_gDdsxauPhk.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 98d81abbc47847d405971afe46fa8e0e904874f5d12239235cfc0a53b8647772
Instruction ID: 2e2a09a798db45d5c372cc8ba4fe4bbfc8b6a8151c503200ef75ebb0d8e777ff
Opcode Fuzzy Hash: 98d81abbc47847d405971afe46fa8e0e904874f5d12239235cfc0a53b8647772
Instruction Fuzzy Hash: C12137B5D003098FDB10DFAAC4857EEBBF5EF88324F14842AD559A7250C7789946CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06ED5B18 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06ED5B98

Memory Dump Source

Source File: 0000000A.00000002.1769554852.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ed0000_gDdsxauPhk.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b40d7b17550d94bd951a25bfc4e722e0780afb4980831a5f3f6cf7addc28abdc
Instruction ID: 1d799a78605e39c1d756bc8dafbaae09b76973765d5cc8935cd863cc26258a57
Opcode Fuzzy Hash: b40d7b17550d94bd951a25bfc4e722e0780afb4980831a5f3f6cf7addc28abdc
Instruction Fuzzy Hash: 9721E4B19003599FCB10DFAAC885AEEBBF5FF48320F10842AE559A7250C7789945CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 06ED5890 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06ED590E

Memory Dump Source

Source File: 0000000A.00000002.1769554852.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ed0000_gDdsxauPhk.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 2d9bf24dab89892f69c27ff51ef59828067c1545ef71a4e252ab953050ce9959
Instruction ID: 2294f87845e4388a5c3d5ca102079507b64a679920ff03658b01b3048dd2223c
Opcode Fuzzy Hash: 2d9bf24dab89892f69c27ff51ef59828067c1545ef71a4e252ab953050ce9959
Instruction Fuzzy Hash: 462118B1D003098FDB10DFAAC4857EEBBF4EF48324F148429D559A7240C7789945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 007FE1A8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 007FE22F

Memory Dump Source

Source File: 0000000A.00000002.1761249544.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7f0000_gDdsxauPhk.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c55a2b1463247057d62e7a16de0b67468c8b0bba6b0f9ee8c609bd9af2751665
Instruction ID: ed8b95f4f6de4792b7791d8b809d9655bd4a4a86c3d28dec69b57654bdb3ce0c
Opcode Fuzzy Hash: c55a2b1463247057d62e7a16de0b67468c8b0bba6b0f9ee8c609bd9af2751665
Instruction Fuzzy Hash: EA21C4B59002589FDB10CF9AD984AEEBFF8FB48310F14841AE958A7350D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 007FB6C8 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,007FBF99,00000800,00000000,00000000), ref: 007FC1AA

Memory Dump Source

Source File: 0000000A.00000002.1761249544.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7f0000_gDdsxauPhk.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e91d793adffb9c9772e55783d53d688de127430a1d74af090c1062fe83c7304c
Instruction ID: 252cb7b3d11d8491964dc9614efed72faa2a245d9bdd312ef8387d26cbafaf85
Opcode Fuzzy Hash: e91d793adffb9c9772e55783d53d688de127430a1d74af090c1062fe83c7304c
Instruction Fuzzy Hash: 791114B6D0020D9FDB20CF9AD944AEEFBF4EB48310F10842AE519A7311C379A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06ED5960 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06ED59D6

Memory Dump Source

Source File: 0000000A.00000002.1769554852.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ed0000_gDdsxauPhk.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: abf0154b4a208da6195b57a4978a0f7e95e12ec6d265305370ccccaeedf77066
Instruction ID: 1c3c8f613a0f058e051b01dbbeb059034a90b7233e9d3e0e8e2c5a20e0a8b734
Opcode Fuzzy Hash: abf0154b4a208da6195b57a4978a0f7e95e12ec6d265305370ccccaeedf77066
Instruction Fuzzy Hash: 7E116AB19002498FCB20DFA9D845BEEBFF5EF88324F24842AE559A7250C7759545CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06ED5968 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06ED59D6

Memory Dump Source

Source File: 0000000A.00000002.1769554852.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ed0000_gDdsxauPhk.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 08cf04647b8c96a54539ca7633122092b036997a469dd906c0d69b6c3abc5a8a
Instruction ID: 98bb4422c355e73818a59720ce93949a539150cc641744463edab609c21ed337
Opcode Fuzzy Hash: 08cf04647b8c96a54539ca7633122092b036997a469dd906c0d69b6c3abc5a8a
Instruction Fuzzy Hash: 7F1137B19002499FCB10DFAAC845BDEBFF5EF88324F24841AE569A7250C775A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 007FC138 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,007FBF99,00000800,00000000,00000000), ref: 007FC1AA

Memory Dump Source

Source File: 0000000A.00000002.1761249544.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7f0000_gDdsxauPhk.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: adacbd001e0dc0469c20c73006536c6aa44fa93c554b23d8624920f21fc92bab
Instruction ID: 2b75b50b6fd2d72574ad262bef0008ebbd59ee698a9c303ac0027953cba37e2e
Opcode Fuzzy Hash: adacbd001e0dc0469c20c73006536c6aa44fa93c554b23d8624920f21fc92bab
Instruction Fuzzy Hash: B31126B6D003498FDB10CFAAC944ADEFBF4EB48320F14842AD559A7311C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06ED53A2 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06ED540A

Memory Dump Source

Source File: 0000000A.00000002.1769554852.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ed0000_gDdsxauPhk.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 4d889cf6b47f272289dd8309336745f7369beddb755a1a76f19497deccf47e3b
Instruction ID: da2117c05c042116f90c654312d0dea41027917cc6b56e5d780bd0effcca0baf
Opcode Fuzzy Hash: 4d889cf6b47f272289dd8309336745f7369beddb755a1a76f19497deccf47e3b
Instruction Fuzzy Hash: 2F1146B19003488BCB20DFAAC8457DEFFF4EB88324F248429D559A7240CB75A945CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 06ED53A8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06ED540A

Memory Dump Source

Source File: 0000000A.00000002.1769554852.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ed0000_gDdsxauPhk.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: bf2e5f6b1ceb494128729c482f493d001cdd6a7ca34f43d4e365aacc455e9986
Instruction ID: 6ec00af53b883bef39b65230c7fdcf2a1b7c8c68086320a35c0bb7c4391ff64c
Opcode Fuzzy Hash: bf2e5f6b1ceb494128729c482f493d001cdd6a7ca34f43d4e365aacc455e9986
Instruction Fuzzy Hash: 461136B1D003488FCB20DFAAC8457DEFBF4EB88324F208429D559A7250CB75A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06EDA918 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06EDA97D

Memory Dump Source

Source File: 0000000A.00000002.1769554852.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ed0000_gDdsxauPhk.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 26c1f005728876bd92952a7b772e7b5d7af2813574823875a411666144a8633d
Instruction ID: b8952f816281a8edd5d07830af9e669a1ee691d31bdfba42be52fe494f69667e
Opcode Fuzzy Hash: 26c1f005728876bd92952a7b772e7b5d7af2813574823875a411666144a8633d
Instruction Fuzzy Hash: 341106B58003489FCB10DF99D885BDEFFF8EB48320F108459E558A7210C375A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06ED5CF0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06EDA97D

Memory Dump Source

Source File: 0000000A.00000002.1769554852.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ed0000_gDdsxauPhk.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: e49b94aef7d2728f487dbb9c67eb1e51e96045ca662bf9e49addb0ef2575e413
Instruction ID: a4154ad684b1b21effc4933b5383e800f694a4638c705df13d859b2e4a895522
Opcode Fuzzy Hash: e49b94aef7d2728f487dbb9c67eb1e51e96045ca662bf9e49addb0ef2575e413
Instruction Fuzzy Hash: 1B1106B5800348DFDB10DF99D845BDEBFF8EB48320F108419E558A7210C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 007FBEB8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 007FBF1E

Memory Dump Source

Source File: 0000000A.00000002.1761249544.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7f0000_gDdsxauPhk.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d2daa0e9e22b379b700a9783d038d9e00dacd76ece8f32d5a3d8bfa1e39540a3
Instruction ID: cebc51ff09ba16f4b75661a7d661c118b60745a5c8ad1f78d8be9aea83586710
Opcode Fuzzy Hash: d2daa0e9e22b379b700a9783d038d9e00dacd76ece8f32d5a3d8bfa1e39540a3
Instruction Fuzzy Hash: 7F11E0B6C002498FCB10CF9AD844ADEFBF4EB88324F14842AD569A7310C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06A12F10 Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

Hbq, xrefs: 06A130AA

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 9702fbec9a6d139b1750ebe9da325b0d2e737682a70c1c8f87ba97458c8211e4
Instruction ID: 9f73709ab815a4081675790f8523be70a923b0d8087e837dad2b7e2c9ac0baae
Opcode Fuzzy Hash: 9702fbec9a6d139b1750ebe9da325b0d2e737682a70c1c8f87ba97458c8211e4
Instruction Fuzzy Hash: 76619B30B002089FCB58EB78D4546AE7BB6EFC5310F2485A9D4599F3A1CE35DE46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06D36D14 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06D3E721

Memory Dump Source

Source File: 0000000A.00000002.1769219286.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6d30000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: b56caad010c425eb06d44a664564f31a7ec8b4c3e39024f590365a5145384c27
Instruction ID: 2b8b38f004a914c8d7126141c03888db83bda5089b1993589523923af54e5dd7
Opcode Fuzzy Hash: b56caad010c425eb06d44a664564f31a7ec8b4c3e39024f590365a5145384c27
Instruction Fuzzy Hash: CD519E31B002168FCB15DB7999589BEBBF6EFC4220724896AE469DB391EB309D058790

Uniqueness

Uniqueness Score: -1.00%

Function 06A13992 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06A13B61

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 5dc314f12b176c60957c69362aa243b2a20394593c2b0e9ac6519f5b2737f4da
Instruction ID: 9e3b3ac3d22b18f244607696cac820dd4f273f7efcae4c0c5e9765f42d5ecf7d
Opcode Fuzzy Hash: 5dc314f12b176c60957c69362aa243b2a20394593c2b0e9ac6519f5b2737f4da
Instruction Fuzzy Hash: A7515530A046058FDB54DF39C998BAABBB1EF49304F1981A9E446DF262DB35EC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06A12768 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06A128E6

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 5d4de5bce3544984753ccf2a9d3b70dcacd6c88d914c2c2691f7f29179ea5a6f
Instruction ID: 27d945672969f4000086afb0e71dec0cbed1b288eb565944d3052505d05f6dd4
Opcode Fuzzy Hash: 5d4de5bce3544984753ccf2a9d3b70dcacd6c88d914c2c2691f7f29179ea5a6f
Instruction Fuzzy Hash: F851E334A102048FCB94EF68C598AA9BBF1BF49714B1585A8E416EF3B1DB31ED85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06A18B90 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

(bq, xrefs: 06A18BE7

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: c4e8914c990fedd4a5ce5b2b169a21602a106853c57c3ad341c7e0a06eec7364
Instruction ID: c4849f781cefc2620dddbda5697589e10be62368cc43661171157d963933563b
Opcode Fuzzy Hash: c4e8914c990fedd4a5ce5b2b169a21602a106853c57c3ad341c7e0a06eec7364
Instruction Fuzzy Hash: B931BC71E052598FCB44EFB998141EEBBF2EF89310F24846AD915FB250EA3099058BA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A13B8C Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

(bq, xrefs: 06A13B8D

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: ad1589e1e5233e35106bf081b6cc0646e1461c1754ee8b6009c5afac2287146b
Instruction ID: 0f143154db33ba0e9433713b20f69209e46fdaf4ec3c7a1bfccb0ec7c8d1e08d
Opcode Fuzzy Hash: ad1589e1e5233e35106bf081b6cc0646e1461c1754ee8b6009c5afac2287146b
Instruction Fuzzy Hash: F2415E306006108FDBA4AF38C448B9A7BA6BF85314F1585A9D05ACF3A1CF75E88ACB40

Uniqueness

Uniqueness Score: -1.00%

Function 06D3C350 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

O};5, xrefs: 06D3C388

Memory Dump Source

Source File: 0000000A.00000002.1769219286.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6d30000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: O};5
API String ID: 0-3558557551
Opcode ID: 6b8c982406f615e2ef35b8afacb0edbb303bb349a7e6d6048cd3408fa5df1219
Instruction ID: 74be86ff04f5ce6ebfb02f6fe71e2187a24b5285a778aa3243f1fa39929aea88
Opcode Fuzzy Hash: 6b8c982406f615e2ef35b8afacb0edbb303bb349a7e6d6048cd3408fa5df1219
Instruction Fuzzy Hash: 8E415970A14619DFDB84CFA9D5848AEFBB2FF89300B60D895C459AB328D730DA25CB54

Uniqueness

Uniqueness Score: -1.00%

Function 06A1F208 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06A1F380

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 5942296f30994c21e23283e38282075c890f567cc0ec8255c98dc1ba111275a4
Instruction ID: b811863d9180a4405d3c6061e1b0064140cb0178720c4f3529bed0c28471c384
Opcode Fuzzy Hash: 5942296f30994c21e23283e38282075c890f567cc0ec8255c98dc1ba111275a4
Instruction Fuzzy Hash: 63315C74E05248CFDB44DFAAC4456EEBBF6AF89300F14802AD419AF354DB345906CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06A1F218 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06A1F380

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 2887c698ccfda54acbf8a100169a0995a5b2455e55dab78c9a33c0f12924e36d
Instruction ID: dea95f48c9d4210a6f416962d332aedf54dbe769b2f9246623e5677f18a362de
Opcode Fuzzy Hash: 2887c698ccfda54acbf8a100169a0995a5b2455e55dab78c9a33c0f12924e36d
Instruction Fuzzy Hash: F931F474E04248CFDB48DFEAC5446AEFBF6AF89300F10802AD419AB358DB345906CF80

Uniqueness

Uniqueness Score: -1.00%

Function 06D3DDE0 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

8bq, xrefs: 06D3DE5B

Memory Dump Source

Source File: 0000000A.00000002.1769219286.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6d30000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: 8bq
API String ID: 0-187764589
Opcode ID: 9c2445df45e24092eba2be7419077d72a143a0ae5f1bb28ddc52314bb9095b51
Instruction ID: 1efffcdc88623fb4ed3d84e36c472ff5f246c1cf62c059f827076b8b646d2260
Opcode Fuzzy Hash: 9c2445df45e24092eba2be7419077d72a143a0ae5f1bb28ddc52314bb9095b51
Instruction Fuzzy Hash: 363125B4E04219CFDB84EFA9D944AAEBBF6FB49300F108029D556B7354DB345A45CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06A1B982 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

8bq, xrefs: 06A1B9FC

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: 8bq
API String ID: 0-187764589
Opcode ID: a2fd50ca8e4977037a37da1098dad465a69dc2458f9b7c2b98816d72a5e29b61
Instruction ID: 927ce23a8a58d11ef9eeefa01cd5dffd4438c8d210830bc4bcdc51ee4e3d9ee6
Opcode Fuzzy Hash: a2fd50ca8e4977037a37da1098dad465a69dc2458f9b7c2b98816d72a5e29b61
Instruction Fuzzy Hash: 01215E78E08249CFCB00DFA8D5508EEBBF1FB4E304B104566D519AB3A5E7345A06CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06D3E0D8 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06D3E143

Memory Dump Source

Source File: 0000000A.00000002.1769219286.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6d30000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 4e0670163de0e1dfbc71f2354edbfd96748ae3bfb6bbccafe865f9eb0a899cfd
Instruction ID: e379f4caa785bc63acbe8acc563cf45b8a2efd086710eba704b93f00def835ec
Opcode Fuzzy Hash: 4e0670163de0e1dfbc71f2354edbfd96748ae3bfb6bbccafe865f9eb0a899cfd
Instruction Fuzzy Hash: 8E112131F002199BCB54EBB9D9105EEB7F6AF85250B20406AC505E7344EB358D06CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 06A1F2E4 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06A1F2F4

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: d070b165f6eef825478772a7417263ba0c0fdd3e3dbbfdb275c84099b3f48e49
Instruction ID: ddc3b7ab0ae597332db4aecfdf552ef4d76e6e954f9295ae309ed67f337ea1dc
Opcode Fuzzy Hash: d070b165f6eef825478772a7417263ba0c0fdd3e3dbbfdb275c84099b3f48e49
Instruction Fuzzy Hash: AF114F75E00219DFCF08DFE9D8849ADBBB2FB88310F10812AEA19AB365C7356955CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06A1084B Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb715300ac79195902046085f0a330d82ce4d1120e5c52848b7968a96f70591c
Instruction ID: 2c856b7ab0e1f579e771a08b904126abba1e6dc2a7864e1ebc813f2bbffb84cb
Opcode Fuzzy Hash: eb715300ac79195902046085f0a330d82ce4d1120e5c52848b7968a96f70591c
Instruction Fuzzy Hash: 2202E434A40104DFDB54EF68D598AADBBF2BF89314F1581A8E4099F366CB35EC85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06D3F6F8 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1769219286.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6d30000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 326097b077e22b647f9793c21859244c72225da72b3e1cdfde8de1944e6ab9d4
Instruction ID: 9cb4d3223b1cb9f078da6f72bb68b352b47efc07094aaa0eef83e00e482e0f59
Opcode Fuzzy Hash: 326097b077e22b647f9793c21859244c72225da72b3e1cdfde8de1944e6ab9d4
Instruction Fuzzy Hash: 516138B4D0921DDFDF48CFA9D444AEEBBB6EF49300F109029E519AB215D7709946CF80

Uniqueness

Uniqueness Score: -1.00%

Function 06D3ED88 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1769219286.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6d30000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 091a83a222de7102b4dbaeba1368e7ec134ba948e782b9e54633b28fb450ff7b
Instruction ID: b305350b344212f51294130c781b775f3b1fd30444e46a76a24b16d7725bf772
Opcode Fuzzy Hash: 091a83a222de7102b4dbaeba1368e7ec134ba948e782b9e54633b28fb450ff7b
Instruction Fuzzy Hash: 45611A31A00619DFDB54DFA9C454A9DBBF1FF88310F21815AE509AB3A0DB71ED45CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06A1FA19 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75c67b9889e71675b81df7a22db30fb73e8d7bc84702afd33a4997ff8a2cff85
Instruction ID: d39061b4f38a30c1cacfa6853a9d56dd93de0ffa1d5cbca58934ada18310014a
Opcode Fuzzy Hash: 75c67b9889e71675b81df7a22db30fb73e8d7bc84702afd33a4997ff8a2cff85
Instruction Fuzzy Hash: 6A418C70E09258DFEB48DBAAD8446EEBBF6FF8C310F14D029E409AB251D7384941CB94

Uniqueness

Uniqueness Score: -1.00%

Function 06A11352 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3afeefb9d28705279d42e84bb525054f24cd24ef9a23c6bb24b35d4586109a76
Instruction ID: 9ed9218de8ad9310cfa4a87d03afa85e2dce895f9ff5964bc5eb46af57b0e68d
Opcode Fuzzy Hash: 3afeefb9d28705279d42e84bb525054f24cd24ef9a23c6bb24b35d4586109a76
Instruction Fuzzy Hash: D841A230700601CFDBA5AB28C894B7EB3B2BF85714F148569D256CF6A1CB75AC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06A11360 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48da5849b0d443724b1aee14922472eff8b0b66a91ab28a41d0afac5d44a3201
Instruction ID: 0e5ba4f50fd112829554dbfdbcaf0d9a55209c09ff048d9d3ee557304bec800e
Opcode Fuzzy Hash: 48da5849b0d443724b1aee14922472eff8b0b66a91ab28a41d0afac5d44a3201
Instruction Fuzzy Hash: EF417F307106019FDBA4AB28C894B7EB3B2BF85714F108529D216CF7A4DB71EC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06A18C28 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 236a65e1d703ad191adba810f1474fc62110c8c413d239c9b44128ea59e94079
Instruction ID: aff3a651d5c1e165a24b666a36d9f3c98261a3ca620f55b8ae7b56a4ab0d0c2b
Opcode Fuzzy Hash: 236a65e1d703ad191adba810f1474fc62110c8c413d239c9b44128ea59e94079
Instruction Fuzzy Hash: E9413E70E102088BDF44EBA9D498AEEBBF2BF88700F14C566E411AB354DB349C04CB94

Uniqueness

Uniqueness Score: -1.00%

Function 06A120C8 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 530dd9177830594b482b072a7574c6d195a227aee1d07372e1e9cc188eb15de4
Instruction ID: eb62442ffd961c8333323fc27aab3d9695ed728c694ac74048d415eb6a30ff0f
Opcode Fuzzy Hash: 530dd9177830594b482b072a7574c6d195a227aee1d07372e1e9cc188eb15de4
Instruction Fuzzy Hash: 1A312C347106148FD798EB29C884B69B3A6BF89614F1580A9E619CF371DF31ED81CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06A14B20 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db0bf629fc001bc09afdc7bb6c26f7810efabf03814c95eceb8e5dbec224b7f5
Instruction ID: cdec8187ce84094da88937eddde79a5cc29d3e6516f374ef445430422b2ceec5
Opcode Fuzzy Hash: db0bf629fc001bc09afdc7bb6c26f7810efabf03814c95eceb8e5dbec224b7f5
Instruction Fuzzy Hash: 3E3128757002149FCB54EF68C984AAEBBB6FF88320B1142A9E5259F2B1CB71DD41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06A14B12 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6de45694f1a98b06610cd34af90eea0052a4fae943794f4581c4cf05b6e4d4e
Instruction ID: b4bd8d71cfef34f9d810dd65b6b3a90a630845bd8126f9b7e57974f252de784e
Opcode Fuzzy Hash: a6de45694f1a98b06610cd34af90eea0052a4fae943794f4581c4cf05b6e4d4e
Instruction Fuzzy Hash: 4E316C75B042149FCB14EF68C988AADBBB6FF88320F1142A9E5258F2B1C771DD01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06A120B8 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 281043bbde0b68264169967e73d6966d3e0cf68fc89810373e01f0187a61fce7
Instruction ID: 3d9bdbb0182838bc568519000751aa5a10420bcd41885195565d79057c128740
Opcode Fuzzy Hash: 281043bbde0b68264169967e73d6966d3e0cf68fc89810373e01f0187a61fce7
Instruction Fuzzy Hash: 6A312A347105008FD754EB28C884BA977A5BF89614F1580A9E65ACF371DB35ED86CB60

Uniqueness

Uniqueness Score: -1.00%

Function 06A1C7F8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6af3417dca397035479d67d6b0056f4cf38f15ecedce063eb33a3d642e00c510
Instruction ID: 0f75bd659cbf057c892a0fb26779f527a8c28180f7fc65bdf7192bef4bcafef9
Opcode Fuzzy Hash: 6af3417dca397035479d67d6b0056f4cf38f15ecedce063eb33a3d642e00c510
Instruction Fuzzy Hash: 44316B74E44108DFDB44EFA9D084AEEBBF6EB88320F109069D426AB354DB359945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06A125D4 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba1d2ae9fe5d3481a948a9d1d82faf191f9886cba866645c2c5f2883f7404a42
Instruction ID: 546a514f557819d16ac39ef94800440ca27160898a23a23370afad687b06de15
Opcode Fuzzy Hash: ba1d2ae9fe5d3481a948a9d1d82faf191f9886cba866645c2c5f2883f7404a42
Instruction Fuzzy Hash: 1F314E306406108FDBA4EF28C888B9677A5FF84724F50C569E55A8F3B1DF71E88ACB40

Uniqueness

Uniqueness Score: -1.00%

Function 06A12DA0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0be244405bac35823cac96889a05017467dc75339758c80329cd89382ab4d86c
Instruction ID: a9b1402f25a43b548e01d8f4c4b4f8dec89d45ddcb5f3584cbee6ee57c2dca45
Opcode Fuzzy Hash: 0be244405bac35823cac96889a05017467dc75339758c80329cd89382ab4d86c
Instruction Fuzzy Hash: 7D216234B401048F9B997B399A5873E2AD79FCA6407194029D906CF3D8EF24CF86C7E6

Uniqueness

Uniqueness Score: -1.00%

Function 06A1C7F3 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ff000579c1e8599b56ec1ed8f0ea378deaf8f8292373473c55a4ba5894f8112
Instruction ID: e9f5a00482ccea8081a499f4cc09698e611473cf0873316cdd04fbda95c59452
Opcode Fuzzy Hash: 8ff000579c1e8599b56ec1ed8f0ea378deaf8f8292373473c55a4ba5894f8112
Instruction Fuzzy Hash: 7F318D74E44108DFDB44EFA9D484AEEBBF6EF88320F109029D426AB350DB349945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06A12A6D Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e455332d009186d7e5a9a934a2b800cccfe5fb29d4b5618dc40dec2b2d6ee63
Instruction ID: 7dd0f73742cf89fabbb2e9cde9ee73ce6e422fef3c6ef4b4b5dae17abb2bd1ef
Opcode Fuzzy Hash: 4e455332d009186d7e5a9a934a2b800cccfe5fb29d4b5618dc40dec2b2d6ee63
Instruction Fuzzy Hash: 1A312834A00208CFCBA5EF69D544AADB7F2EF88311F155468E506AF3A1DB31ED85CB60

Uniqueness

Uniqueness Score: -1.00%

Function 06A15CB0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa6ea1d0bcd9eb6cfe02fd0406c37d9a5aa7a336ade335d9df695db9bba772f8
Instruction ID: bd3997533d90696d2ad9744972df7802138c1459ccb5306961537b7280359870
Opcode Fuzzy Hash: aa6ea1d0bcd9eb6cfe02fd0406c37d9a5aa7a336ade335d9df695db9bba772f8
Instruction Fuzzy Hash: 5A21AE30A00349CFC764EF35C8909AA77F5FF822057604A7EE4669E290DB35E995CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0079D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1761033250.000000000079D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0079D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_79d000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02cc28582979854781e41b622e4cc6f443554a605273fb7562f68e7fe173ba58
Instruction ID: 0118fa9f690f3352fef71654dd6b421d97dc02746b79e356aff503c384ab6ad2
Opcode Fuzzy Hash: 02cc28582979854781e41b622e4cc6f443554a605273fb7562f68e7fe173ba58
Instruction Fuzzy Hash: 762128B1500244DFDF15DF14E9C0B26BF65FB94314F20C169DD094B266C33AEC56C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 06A12258 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 447dc12e2681c33aa6d927ec1773298a86f195847d30f5b1d7d9d5c2aeee77c5
Instruction ID: 074d257c8103db832c28c8b56db77b7af606ecd1a83e1d2c2ba7fff53f2fad92
Opcode Fuzzy Hash: 447dc12e2681c33aa6d927ec1773298a86f195847d30f5b1d7d9d5c2aeee77c5
Instruction Fuzzy Hash: 863118306506008FCBA5DB38D448BA97BE2EF85314F1585A9E18ECF361DE71AC8ACB40

Uniqueness

Uniqueness Score: -1.00%

Function 06A12D90 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d378db0d85c2fbb6492ec90df437201886f8b841e9ef7b39efd5f9f8700fbb05
Instruction ID: f706a35cc49c5afe56369d6492dfa4ea0cb246bb41b98f4b1d9a08236b185054
Opcode Fuzzy Hash: d378db0d85c2fbb6492ec90df437201886f8b841e9ef7b39efd5f9f8700fbb05
Instruction Fuzzy Hash: A1115C34B401108B9BA97B39995863E3BE79FC66517094029D906CF398EF28CF42C7D6

Uniqueness

Uniqueness Score: -1.00%

Function 007AD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1761090592.00000000007AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ad000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6393d592e21b426beb5ea65adfa12978e989e1c60bfefc0c7f06adadfef3fcc5
Instruction ID: 10b4d25d1189bcc55be9207e7c1656e3348ee04cb724cad37861cc5ee64edeb4
Opcode Fuzzy Hash: 6393d592e21b426beb5ea65adfa12978e989e1c60bfefc0c7f06adadfef3fcc5
Instruction Fuzzy Hash: 5821F271604204DFCB24DF24D9C4B27BBA5EBC9314F20C669E84A4B696C37ADC47CA61

Uniqueness

Uniqueness Score: -1.00%

Function 007AD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1761090592.00000000007AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ad000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e013e069aea37076a500ff16650974664a6e2e0384260a6eda6ed1e18940204
Instruction ID: b15bedffd849b91278af4f798bb93b15d8e826f04ff3c4da78eb906eb795b3c8
Opcode Fuzzy Hash: 2e013e069aea37076a500ff16650974664a6e2e0384260a6eda6ed1e18940204
Instruction Fuzzy Hash: 60210471504204EFDB25DF14DAC4B26BBA5FBC9314F20C66DE80A4B696C33ADC46CA61

Uniqueness

Uniqueness Score: -1.00%

Function 06A12268 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e71568e3f6fa9c5fe0a95153a43693aa5e46d1aa682ab1f46324bf87a68ecd79
Instruction ID: 867c4732db2bf2a8d369d19d65bad43c9eeacc8b242310bb83df79300d7836de
Opcode Fuzzy Hash: e71568e3f6fa9c5fe0a95153a43693aa5e46d1aa682ab1f46324bf87a68ecd79
Instruction Fuzzy Hash: B231F5302106008FC7A49B28D448BAAB7E6FF85715F5585A9E15ECF361DF71EC8ACB40

Uniqueness

Uniqueness Score: -1.00%

Function 06A17EA1 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93aba3b200c0f5cc61fab86ddd16408434b22d608e32e83c6112e54fb2276e6b
Instruction ID: 78ee39e4b7149f0e4125a7dbf261aecfb89f9b01622f6fedd001c936dc2f6f7a
Opcode Fuzzy Hash: 93aba3b200c0f5cc61fab86ddd16408434b22d608e32e83c6112e54fb2276e6b
Instruction Fuzzy Hash: A211AF305491889FC705DF7CD8646AE7FB2EF82214B2442FAD0588F2A3CE359E56CB61

Uniqueness

Uniqueness Score: -1.00%

Function 06D3E770 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1769219286.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6d30000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 674f8805838ea407c222013e1301da2b44dfe39c8fd82825d4b5ee7e64985fd9
Instruction ID: 95e91de726c49f94c339f3466add04c62948d5f1cd918207555d1573274ec90d
Opcode Fuzzy Hash: 674f8805838ea407c222013e1301da2b44dfe39c8fd82825d4b5ee7e64985fd9
Instruction Fuzzy Hash: D221D5B0D01218DFDB60CF99C588B8DBFF4AB48314F14801AE514B7390C7B55845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06D3C278 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1769219286.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6d30000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73e780327ced1268198bbe9ff9c6f8862a72a5e41fed1792b9ed71b8811ff49a
Instruction ID: 05c3613f04c835a1b81e0ff51509a8614f6d7ea39a6bdd925e5d1af836ba9aec
Opcode Fuzzy Hash: 73e780327ced1268198bbe9ff9c6f8862a72a5e41fed1792b9ed71b8811ff49a
Instruction Fuzzy Hash: F52190B4A00A08DFC744DF9AE084999BFF1FF88314F5281D5D9489B265EB71A9A5CB01

Uniqueness

Uniqueness Score: -1.00%

Function 06A10700 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 465a354904fbe8082e6f54f4ac478d799962fabfde7e6b74af33b9655e5b952e
Instruction ID: 9fbc8e826031b822e086398b2823cd831c70eca66a707170379fcc1095a6fead
Opcode Fuzzy Hash: 465a354904fbe8082e6f54f4ac478d799962fabfde7e6b74af33b9655e5b952e
Instruction Fuzzy Hash: 9B115970B006008FC794EF28D89096EB7F2BF89214B208969D126DB7A1DB71E80ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 06A12010 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e236e6afae8bf2e8183311a83be5e3ae49f7b54d9915e734aa1db590b20f08bb
Instruction ID: 6e1d6b950afcd3608b9080393e362e25c68687b6c475b1c10b0a316e66442b7b
Opcode Fuzzy Hash: e236e6afae8bf2e8183311a83be5e3ae49f7b54d9915e734aa1db590b20f08bb
Instruction Fuzzy Hash: E7119D317106048FC764EF38D9A092AB7B6EF8621171406AEE106CF370DA32DD85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 06A1FB89 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79bcba42ff6bc26c311ac79005e052aae9cfc0e555792bf99916f5033a316989
Instruction ID: 6e194752956a7fbc9d32d10d99738f3950eedacf859622dbf7b833636bd542e4
Opcode Fuzzy Hash: 79bcba42ff6bc26c311ac79005e052aae9cfc0e555792bf99916f5033a316989
Instruction Fuzzy Hash: 2121EDB8D09249DFCB84DFA9D1809AEBBF5FB48310F609165D809AB315D770AE41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A1FB90 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44f2ee8dd3c9ce4c53305b3f2e996036929f7ffd3103b06a9e52bfc1b7a5b0f1
Instruction ID: f973cf2f63f5d504f186e4555b31b278043f11987af9a3deb76deca76dc57fd8
Opcode Fuzzy Hash: 44f2ee8dd3c9ce4c53305b3f2e996036929f7ffd3103b06a9e52bfc1b7a5b0f1
Instruction Fuzzy Hash: 0921EAB8E08249DFCB84DF99D1809AEBBF5FB48310F609065D809AB315D770AE41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06D3E474 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1769219286.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6d30000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25de044734fa2d6bf68ea74aedceb5a7831b2b449afb8392c3ca535c75d5047f
Instruction ID: a8f8585f48e11dc3a938fd8248967d227aa646875db605a3af10915535b40d67
Opcode Fuzzy Hash: 25de044734fa2d6bf68ea74aedceb5a7831b2b449afb8392c3ca535c75d5047f
Instruction Fuzzy Hash: 1621FFB5D002599FCB20CF9AD984ADEBBF4FB48320F10842AE919A7211C374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0079D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1761033250.000000000079D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0079D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_79d000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: e875b694dc7f8d03931e2de062d8ec68d9605580ca8aeba5c624fbbc9d58d5ee
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 29119D76504280DFDF16CF14D5C4B16BF62FB94324F24C6A9DD090B666C33AE85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A1FC77 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c2af839a1862e75e170343a1ce92d44f618c78ae8844f4c4ed6d88e7f3dcc56
Instruction ID: 62f290816cdcf4c92c4bda11226e6c0fe42d4e955e39a7935366d305e8932e8f
Opcode Fuzzy Hash: 8c2af839a1862e75e170343a1ce92d44f618c78ae8844f4c4ed6d88e7f3dcc56
Instruction Fuzzy Hash: 1211FA74E08108EFDB44EFA9D5409AEBBF9FB88310F10D5A5E8189B316D730AA459F80

Uniqueness

Uniqueness Score: -1.00%

Function 007AD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1761090592.00000000007AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ad000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: a2c6989f82d3ef7b181c3c979d0de90743c0bb593515bb822fcea514a034f428
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: A2118B75504280DFDB16CF14D5C4B15BBA1FB85324F24C6AAD84A4B6A6C33AD84ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 007AD017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1761090592.00000000007AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ad000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 09bd2bef44edd7cc7428e83c854cfcae8e9f689826cd44c81fa9d40ea35a2875
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 5911D075504280CFCB11CF14D5C4B16FF71FB89314F24C6AAD84A4B656C33AD80ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 06A1B880 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 116122f18834b96c6aacf2996b5ae1ee52449842616e917391a2430dd296d5cd
Instruction ID: c12645977b8b806c48302e0e18d3aa9d35d2b8d4fc142f84f36e3b0c54b41a10
Opcode Fuzzy Hash: 116122f18834b96c6aacf2996b5ae1ee52449842616e917391a2430dd296d5cd
Instruction Fuzzy Hash: F7113CB4E09209DFDB44EFA9D5445BEBBF6FB48300F1085A9D515AB354D7704A00DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A1B872 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07459743cf24df0a91a5bdbfc73bf311b2027ff4d311966f4583c35cf2393e7e
Instruction ID: e524c27160305d96aa00091a29a74ef98e5cca8b171b80bc945e5bd7b7ccc07a
Opcode Fuzzy Hash: 07459743cf24df0a91a5bdbfc73bf311b2027ff4d311966f4583c35cf2393e7e
Instruction Fuzzy Hash: A511C274E0920ADFDB44EFA8D6445BEBBF6FB89300F109598D515AB355C7300A00DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A12001 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91e1758439087b2dab4d51955578eac0e91534ce723d23f60f33832ead8a3abf
Instruction ID: 095ad7fcf7f8bf24296bd8557d6153c8ae3d03e311c9de70ebe3163b08c623c5
Opcode Fuzzy Hash: 91e1758439087b2dab4d51955578eac0e91534ce723d23f60f33832ead8a3abf
Instruction Fuzzy Hash: 2E01D831704240CFC764EF39D8A0A6A7BF5EF8625170402AAE055CF371DA32DD91CB21

Uniqueness

Uniqueness Score: -1.00%

Function 06D3E464 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1769219286.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6d30000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f00f2a7a5f79be13604449961629943992b0128a528f4c296cc3ad45c9e3102a
Instruction ID: 057873bcad6af44f0bbf8d3633fc9a5afebae4a4db331e0ab062af76adf7b6ca
Opcode Fuzzy Hash: f00f2a7a5f79be13604449961629943992b0128a528f4c296cc3ad45c9e3102a
Instruction Fuzzy Hash: 07F0F632A18318AFDF48DF68EC44CAE7FEAEF48210B10847AE406D7360DA30ED508794

Uniqueness

Uniqueness Score: -1.00%

Function 06A12D01 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45a5e1d96917fc2c8fd1c319822730c53a4a9df53a9a51a7f562b7ff950e9d00
Instruction ID: d354a79c5b8d682f55c5a26c78a8d241a76c0ce93241dcc6df72994d0fbd18f2
Opcode Fuzzy Hash: 45a5e1d96917fc2c8fd1c319822730c53a4a9df53a9a51a7f562b7ff950e9d00
Instruction Fuzzy Hash: AA01D4316042808FC762A738C9947AA3FF5EF82244F0A00EAC1D5CF266DA24EC96C795

Uniqueness

Uniqueness Score: -1.00%

Function 06A183F0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3596337a1d98eab6d90cc52dd65dcdf8bfc3467cd304ac5605aedda091017958
Instruction ID: 0328ed39ad589d06ee11cb9b49422396dca345fa738871f71f1cb4eba1f12d61
Opcode Fuzzy Hash: 3596337a1d98eab6d90cc52dd65dcdf8bfc3467cd304ac5605aedda091017958
Instruction Fuzzy Hash: 200144326083418FEB64DB24D4807BABBF9AF44214F04406DC08A8F262CE35E847CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06A18400 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9ccc5ee0f743eb0773189a8b35eba863ad92f45426446c7d8a301e8eea92524
Instruction ID: 57efbae37b4a2d575d5e74b92c21a73836e46902f70e393392b915a5238e8a5b
Opcode Fuzzy Hash: f9ccc5ee0f743eb0773189a8b35eba863ad92f45426446c7d8a301e8eea92524
Instruction Fuzzy Hash: F1F0C2316047009FEB68EB15D54076AB7F9EF44314F50453DD50A8F6A0DF79E886C790

Uniqueness

Uniqueness Score: -1.00%

Function 06A1F2B8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8eddb9a76d8320212f3d07c2181021d923c7ac048e88ad9c0ceaaee407cde62
Instruction ID: 28331b59423dcc0a5fee6da9ad9fcec4158b5d160d0411ecbd0d45d6e511549e
Opcode Fuzzy Hash: d8eddb9a76d8320212f3d07c2181021d923c7ac048e88ad9c0ceaaee407cde62
Instruction Fuzzy Hash: D701D638E08248CFDB50DFA5D498AADBBF6BF4A311F149069D429AF356D7359806CF01

Uniqueness

Uniqueness Score: -1.00%

Function 06D36808 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1769219286.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6d30000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9d85d58e070dec55437535d378730a87f2aca9d8f19bb5b840e13705e1d9650
Instruction ID: f5ece812d068850fecb266242ccf4b1195bbce50853cb2b51becd1143956f78e
Opcode Fuzzy Hash: a9d85d58e070dec55437535d378730a87f2aca9d8f19bb5b840e13705e1d9650
Instruction Fuzzy Hash: 10F04F78E09218EFDB80DFA9D5406AEBBB9EB4E300F1091A9D41993344E7709A01CF80

Uniqueness

Uniqueness Score: -1.00%

Function 06D3AE20 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1769219286.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6d30000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe31b168a3129268500fb43befefd3cf0fa4da4e461452370b3b77994771d4f7
Instruction ID: 377f4b8d8d999ca798342187ea14ed719d6bbc15cc671431ccb7dc9b35e48cfb
Opcode Fuzzy Hash: fe31b168a3129268500fb43befefd3cf0fa4da4e461452370b3b77994771d4f7
Instruction Fuzzy Hash: 8101C874D002199FCB40DFA8D4855AEBFF5BB08310F1485AAE954E7341D7349A80CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06A12D28 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b061ea9444c8a99380a6f56762b81fd60dc693e196004c897be5044a3d7550e3
Instruction ID: 395fc035216b46f2847f47e308eea4cddbf1e11a1736b00ca5b5533d3fd47602
Opcode Fuzzy Hash: b061ea9444c8a99380a6f56762b81fd60dc693e196004c897be5044a3d7550e3
Instruction Fuzzy Hash: FBF0BE307102044FD6A4A738CA84BAA33EAEFC5254F050479C295CF328DE34ED8187D1

Uniqueness

Uniqueness Score: -1.00%

Function 06D3A2F8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1769219286.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6d30000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f1bb1290068a4db462dea5fb67306b794dc7ca234c8e926d2f0b2a641d44f04
Instruction ID: 8f459a6d220d7156144449f1022dd091ec28eed8d858955e704d719a79e9be93
Opcode Fuzzy Hash: 9f1bb1290068a4db462dea5fb67306b794dc7ca234c8e926d2f0b2a641d44f04
Instruction Fuzzy Hash: 50016274E00208EFCB44DFA9D588A9DBFF2AF48310F15C0A9A9489B365DA74EA40CF41

Uniqueness

Uniqueness Score: -1.00%

Function 06A18A4F Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5601c1fefaa546cf2fd35c8a7139c724d44b76c3bdbab169bbe37e19881cb990
Instruction ID: 9dad849b2c4eeb8805e6331ca982be0a41f4fa3e3a47dc6bc953cd3ccb676856
Opcode Fuzzy Hash: 5601c1fefaa546cf2fd35c8a7139c724d44b76c3bdbab169bbe37e19881cb990
Instruction Fuzzy Hash: 1201F274D08219DFCB84EFA8E9446EEBFF1FB89300F1081AAD859A3250E7755A51CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06A170B7 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31b7a555d74afe236b1169bf82282da6d40afd48e456ec9878a1d66ab03ca38e
Instruction ID: 45d90eec7d9a0b2f6fcd8e41f404f83d0f7d67d6281cfc1ec374f9cb8ca635eb
Opcode Fuzzy Hash: 31b7a555d74afe236b1169bf82282da6d40afd48e456ec9878a1d66ab03ca38e
Instruction Fuzzy Hash: 09F0E93391024C9BDF61EFA88C105ED3BA0EF06334F144666E9E5EA111D379D571DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A18468 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a1f4ad561ae70f8346ee9837a474d56e7a6ac1f5c0948e27e20694335e867c5
Instruction ID: 7d28dc4ccda9743b220163e0464fd03166c78b3b0d3dc360d5fe7bf2b129f3a9
Opcode Fuzzy Hash: 3a1f4ad561ae70f8346ee9837a474d56e7a6ac1f5c0948e27e20694335e867c5
Instruction Fuzzy Hash: B1E092213450515BC354976EA898DEEBFDAEFCA17071540B9E15DC7322CA514C0787A0

Uniqueness

Uniqueness Score: -1.00%

Function 06A18A60 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1db885a69bd0dd6d7604a9d9e13e7324dacf91032ab0026a373d1127cb2cfff6
Instruction ID: d4d498eb2cef7487822b8edf9ef253d5367947ce48644427c4a9d2f50dd3017b
Opcode Fuzzy Hash: 1db885a69bd0dd6d7604a9d9e13e7324dacf91032ab0026a373d1127cb2cfff6
Instruction Fuzzy Hash: 9FF0B7B4D04219DFCB84EFA9D9446AEBBF5FF88300F1081AA9819B7350EB745A40CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06A170C8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43a0d8df753947e859c0ac3d7512094df0fcd82ab67e5bbb05c0e1b8a3ad28f5
Instruction ID: 7430379de39266c436b12882c5dcbfe89146b48b0b54cc452625d319ec750506
Opcode Fuzzy Hash: 43a0d8df753947e859c0ac3d7512094df0fcd82ab67e5bbb05c0e1b8a3ad28f5
Instruction Fuzzy Hash: 52F0653291021DEB5F50EE588C015DD37A4EF0A274F148522F9A5DA150D375EA609BE1

Uniqueness

Uniqueness Score: -1.00%

Function 06A1BB20 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4289baf324682201c7e856961cdf78efb8e1976d7faba13b58e0688200f697fb
Instruction ID: 929a27721697b621e684fd7ba26b0ce256186ab8712d992d90483a4096ba4406
Opcode Fuzzy Hash: 4289baf324682201c7e856961cdf78efb8e1976d7faba13b58e0688200f697fb
Instruction Fuzzy Hash: B0F08C75E09248EFC780EFA8D4916ACBFF5EB48200F00C0E9986897302D6319A41DF51

Uniqueness

Uniqueness Score: -1.00%

Function 06A15AA0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb5e01392831d28cd33e75ba78446dbda809188888cc4f9cdd0dfa23a3c62236
Instruction ID: 704621a07a62f7e06168c9d845c73016b24f95cd0ce50c7d9e6c76d0f39410ef
Opcode Fuzzy Hash: fb5e01392831d28cd33e75ba78446dbda809188888cc4f9cdd0dfa23a3c62236
Instruction Fuzzy Hash: 7EE086313800105B8684B65EA8C887FB6DEEBCA630751447AF20DC7356CE619C054394

Uniqueness

Uniqueness Score: -1.00%

Function 06A1BAD8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91bd1d0dc8c2e40443197b7d396b7fe3cafeec298ee0e4e41727eb3cb1d057c3
Instruction ID: 497df406484f2526862672b14bfebb42121f8eacc6473048609daac1307bfa64
Opcode Fuzzy Hash: 91bd1d0dc8c2e40443197b7d396b7fe3cafeec298ee0e4e41727eb3cb1d057c3
Instruction Fuzzy Hash: 88E0227640A148AFC782EFB898006EA3FB8CB06200F0050E5D1018B111D9328950DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A1A398 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9d3310497deb51124851151ef7c0b03856ac4eb307b92f846f5251355301845
Instruction ID: b6d823bdef7c9558f9d90eef3b9f6a153efd3ce3e15a249e8b178e7b6f351131
Opcode Fuzzy Hash: a9d3310497deb51124851151ef7c0b03856ac4eb307b92f846f5251355301845
Instruction Fuzzy Hash: 5CE0D87194A208DFD740EFA4D50469EBBFADB8A300F1094E696859B150FA324E01EF92

Uniqueness

Uniqueness Score: -1.00%

Function 06A1B830 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58b6418e4e35c2cee5caa20cda2ae94327777037b3ff489626ccd99b2ed5be32
Instruction ID: a53af1dfc97d35177728a34e44a14016103bcd6c45a30ea988c2596a1378e1f6
Opcode Fuzzy Hash: 58b6418e4e35c2cee5caa20cda2ae94327777037b3ff489626ccd99b2ed5be32
Instruction Fuzzy Hash: 43E0D87890D249EFCB40DFA8E850AFDBFB4EB46304F1491D9D8941B341CA326953DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A1E997 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70d56a973ea95afce46e84f61be8acb626a0ffd8791fd46ba6d16ed6560bb2bc
Instruction ID: f9e63a6ebe47c49464a72d492ae79a54e0fef77046f1f66b94ef4be2f023abca
Opcode Fuzzy Hash: 70d56a973ea95afce46e84f61be8acb626a0ffd8791fd46ba6d16ed6560bb2bc
Instruction Fuzzy Hash: 10E06D34A0A205CFDB94EB55C9905ACB7BABF88300F009868C81AAB265CB305945CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06D36688 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1769219286.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6d30000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffd3df46e28ee7dfd46b2bae31b09bf0d84aa528ae4f8c2fbde21a98556d7e33
Instruction ID: 2f35da1f4e0b975ba3e7360edcd207dd749c845e3c0e8fd5ef67f970ddcd1b51
Opcode Fuzzy Hash: ffd3df46e28ee7dfd46b2bae31b09bf0d84aa528ae4f8c2fbde21a98556d7e33
Instruction Fuzzy Hash: FFF0C274905208FFCB84DF98D840AADBBB9EB48310F14C1A9EC1857350D6329A61EF84

Uniqueness

Uniqueness Score: -1.00%

Function 06A12F01 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fec9ca0acc9297ec07055f136e2acd742738912f0927f1b36460972d7a1d1008
Instruction ID: da133c6961756450a1da524aaaf33b9186007b95b663e0d3dcffd1d77e753a4f
Opcode Fuzzy Hash: fec9ca0acc9297ec07055f136e2acd742738912f0927f1b36460972d7a1d1008
Instruction Fuzzy Hash: 40E04F3440B2419FC76A9B24D8196513F349F03225F2946DAE8548F2F3D231D957CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 06A13D60 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e99fa27c91b21349a0bef2c6595343830cd42ff752354914c094c0f7ebaba58
Instruction ID: 9b1a17da8c47e5507603c1479b8e956bba98483ff9f2dc92244ea79a2f5d586e
Opcode Fuzzy Hash: 5e99fa27c91b21349a0bef2c6595343830cd42ff752354914c094c0f7ebaba58
Instruction Fuzzy Hash: 72E01A71A1011DABCF40EA5AEC48A9FFBBDFB84361F508126E51892100D7705A1487A1

Uniqueness

Uniqueness Score: -1.00%

Function 06A1C94B Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae10539e8bfda1f4780ab0f3da5e7de48ccfd8f5c923f009878ef1dd64f069a8
Instruction ID: 69bd38a78bd55dba257bc884ff779a7bf03feae4a833f89c7a8d245f03a0b4c5
Opcode Fuzzy Hash: ae10539e8bfda1f4780ab0f3da5e7de48ccfd8f5c923f009878ef1dd64f069a8
Instruction Fuzzy Hash: CCE01274E05208EFC784EFA8D5506ACBBF5FB49314F10C1E9D85997341D6759A42DF80

Uniqueness

Uniqueness Score: -1.00%

Function 06A1EB84 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: befecf47836d9f6a2c0632cf85c0a2a9ccb432e6b0f7470d4070fa53ca8fe30c
Instruction ID: 54060afa4e6fecf9117202c7e207b30d77c473565f4e9a952418642a41b45c16
Opcode Fuzzy Hash: befecf47836d9f6a2c0632cf85c0a2a9ccb432e6b0f7470d4070fa53ca8fe30c
Instruction Fuzzy Hash: D1E09B30A0A205CFDB90EF54C5945ACB77ABF45200F0049E9D81A9F26ACB304A44CF11

Uniqueness

Uniqueness Score: -1.00%

Function 06A1BB30 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9a87f698032b96632d9d51d9527a2da18575104853188f31b604e6ed431fd42
Instruction ID: b392aeaf60467276773a4b7df2c59ad93b65f8bdfd5e3cf936658cd02f7b6b00
Opcode Fuzzy Hash: d9a87f698032b96632d9d51d9527a2da18575104853188f31b604e6ed431fd42
Instruction Fuzzy Hash: D4E0E574E09208EFCB84EFA8D4856ACFBF4EB48300F10C1A9981897341D6319A41CF81

Uniqueness

Uniqueness Score: -1.00%

Function 06A1A3A8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c47960ac4ede880b8125a05a10eed2dcfc52c0a5d07c206f896c7ec937a2d31
Instruction ID: 314b712e8185632a1407fec14eff39bdc101c5ee70e978e36289a611ef9c3319
Opcode Fuzzy Hash: 5c47960ac4ede880b8125a05a10eed2dcfc52c0a5d07c206f896c7ec937a2d31
Instruction Fuzzy Hash: 8FE0127194A209DFC780EFE4D5046AEBBFEEB0A201F0095A5960A9B150FE724E45EF91

Uniqueness

Uniqueness Score: -1.00%

Function 06A1BAE8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 287108914b9beb435340fba36c3b151eb840cb8660e80f38447a19f2ff524356
Instruction ID: c7d6d66739c704b0b06a0f377361c40430e8f1f6d4556853efaa6789e58a355a
Opcode Fuzzy Hash: 287108914b9beb435340fba36c3b151eb840cb8660e80f38447a19f2ff524356
Instruction Fuzzy Hash: 49E0C27094B10CEBC781FFA895009AE77FDDB0A200F0184A5D1058B110EA724E54DB91

Uniqueness

Uniqueness Score: -1.00%

Function 06A19F10 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58c1a9b4a55188f3f9aab880761273e72efb39317efaef4477f528007afbdb6f
Instruction ID: 46fd00e4162851aba754938404e6e9d0068de6a1ce54567b1851fa8d14b8cdd5
Opcode Fuzzy Hash: 58c1a9b4a55188f3f9aab880761273e72efb39317efaef4477f528007afbdb6f
Instruction Fuzzy Hash: 65D01276601154CFDB14AF64E404ADDB779DB4D352F0080A6E60AEB514CB3596168FA0

Uniqueness

Uniqueness Score: -1.00%

Function 06D36ED8 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1769219286.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6d30000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95e504539c759a6f021d344aa5042c316c6ab8e07d02fa5d8e78b577958bfad2
Instruction ID: 24678686385369469d572b0bdf2df237d86ea9adbb4759873634adae5f866ec2
Opcode Fuzzy Hash: 95e504539c759a6f021d344aa5042c316c6ab8e07d02fa5d8e78b577958bfad2
Instruction Fuzzy Hash: A4C08070501308DBC350DFF9E80875977ADDF05265F004055E918D7140DFF15544C665

Uniqueness

Uniqueness Score: -1.00%

Function 06A19F74 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71c0fc346635379c51946b60d532fbf2e79321bcfdd2d507c43fdb96b7e9b4f0
Instruction ID: bee576d7200c20b7c2d9817c352c8b0fae9175765c23f3b674a75656d997a42f
Opcode Fuzzy Hash: 71c0fc346635379c51946b60d532fbf2e79321bcfdd2d507c43fdb96b7e9b4f0
Instruction Fuzzy Hash: ADE01778E0421ACFDB64DF28D440BADB7B2FB48304F1000A8D519A771AE7706E81CF80

Uniqueness

Uniqueness Score: -1.00%

Function 06A1A105 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ca936bd44c636004ccfd63a58c562f6b56cc95ea2a11316f3ba7ae0bff4a37d
Instruction ID: 7543f5b6b7e20cb5370a9d5a9537ba3f18e1f6fb050ff5f29aeb6e7f8e423e1e
Opcode Fuzzy Hash: 7ca936bd44c636004ccfd63a58c562f6b56cc95ea2a11316f3ba7ae0bff4a37d
Instruction Fuzzy Hash: C3E04278905219CFFB94DF64DD54B9DB7B2FB48300F108195D90EAB385DA715A84CF10

Uniqueness

Uniqueness Score: -1.00%

Function 06A19E33 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd461c57ae9e3eeb67623d351d85362e92830d738deb5b24af8826d193b20acb
Instruction ID: b5d1ae3eab09f4879b60b6b9ef92e6f8c2d33c6dd3e9500a1c23fe2d63259be8
Opcode Fuzzy Hash: dd461c57ae9e3eeb67623d351d85362e92830d738deb5b24af8826d193b20acb
Instruction Fuzzy Hash: 4DD09234908298CFCB80EF90D8986ACBBB5BB19302F1094A5910FAA245CB311984CF40

Uniqueness

Uniqueness Score: -1.00%

Function 06A1E823 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e12a98e0fb9a7a34ef50be0af82f8b4484fd2408073329ebdbdf0d15dc16e29
Instruction ID: d7330af8f7c46b56a9227f3c77f7ce2692ac6e6bcba22abb0433413a92f6c7ef
Opcode Fuzzy Hash: 4e12a98e0fb9a7a34ef50be0af82f8b4484fd2408073329ebdbdf0d15dc16e29
Instruction Fuzzy Hash: 68C08C30402300C7C2603BE5F50C3AA3A2AA704232F040021FF0D8A050CFB54493CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 06A1E828 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9eabd6c391330917343f4b4766ceecf025426a7eac622c4ef6f1a926f38b93d
Instruction ID: 2968feeebd0307050cabb074c83c01571a49f34d766e16f9b2655f1c9872d41c
Opcode Fuzzy Hash: f9eabd6c391330917343f4b4766ceecf025426a7eac622c4ef6f1a926f38b93d
Instruction Fuzzy Hash: 32C08C3000230487C2502BAAB50C3693B69A700232F440021F708850508EB45082CB29

Uniqueness

Uniqueness Score: -1.00%

Function 06D3E41C Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1769219286.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6d30000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc2013c76a678c85cd34d73c86a64515c6cfc9caeb885aa6ff3d2d9cf59c6821
Instruction ID: 89896c6bec493626271103d74c66921bfc8a48e2417b7de0647c65b00d44d34e
Opcode Fuzzy Hash: cc2013c76a678c85cd34d73c86a64515c6cfc9caeb885aa6ff3d2d9cf59c6821
Instruction Fuzzy Hash: 56B012655E4710A6FA8063644F50D3BEAA1FBBD700B008C26B38550058C860C464D27F

Uniqueness

Uniqueness Score: -1.00%

Function 06A17F60 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a395fa17e5ccc614d9133f09f2df3dfc1f53e91879dbc6656f804608b570d0fb
Instruction ID: 3b7de6b061446d60b7f8c9282ec3a45da301db3083e440000166a89c328ecda9
Opcode Fuzzy Hash: a395fa17e5ccc614d9133f09f2df3dfc1f53e91879dbc6656f804608b570d0fb
Instruction Fuzzy Hash: D1B09230190209CFC2009B58E448E6137E8AB08A04F0100F0E1088B632D621F8008A91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06A1C388 Relevance: 5.3, Strings: 4, Instructions: 259COMMON

Download Yara Rule

Strings

[V~*, xrefs: 06A1C4ED
]\`, xrefs: 06A1C60A
[V~*, xrefs: 06A1C4F4
T+-q, xrefs: 06A1C6C2

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: T+-q$[V~*$[V~*$]\`
API String ID: 0-1849991408
Opcode ID: 4aada9b94a7c923530b05f5fead0d61519773f300394766398abc54fcc204987
Instruction ID: 21d64de16f43464ba19786c6f9208d9f767625b81a98031b9b87cd23a124d021
Opcode Fuzzy Hash: 4aada9b94a7c923530b05f5fead0d61519773f300394766398abc54fcc204987
Instruction Fuzzy Hash: 45B11870E592299FCB44DFEAD5808AEFBF2BF88310B14E52AD416BB214D3349901CF58

Uniqueness

Uniqueness Score: -1.00%

Function 06A15570 Relevance: 6.4, Strings: 5, Instructions: 187COMMON

Download Yara Rule

Strings

B, xrefs: 06A15643
Hbq, xrefs: 06A1568D
@, xrefs: 06A1563E
@, xrefs: 06A15591
B, xrefs: 06A15596

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: @$@$B$B$Hbq
API String ID: 0-1093311442
Opcode ID: 2d91dd7f270e556396462e5823c19cb56a4f2387933943e9d8ef3bf75ea4d4fb
Instruction ID: ee34107787f85bc0fff7ca41fe9e2e7ca7c40ef753b686dbf145005c6cf2c1c1
Opcode Fuzzy Hash: 2d91dd7f270e556396462e5823c19cb56a4f2387933943e9d8ef3bf75ea4d4fb
Instruction Fuzzy Hash: B0518E75B002058FCB64EF78D88456ABBF6EFC9220724856AD419CF761DB31EC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06A184C0 Relevance: 5.3, Strings: 4, Instructions: 312COMMON

Download Yara Rule

Strings

$^q, xrefs: 06A18544
Hbq, xrefs: 06A18773
$^q, xrefs: 06A1859A
$^q, xrefs: 06A185A6

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: Hbq$$^q$$^q$$^q
API String ID: 0-314989797
Opcode ID: 3c9488d60ce5cbca6f2150db8d667fc53cf231ab5cd55512aee732b946b4f051
Instruction ID: 9f307ddd74d49426f336542e3c60e7d0164c64ef566f5356a2811266c7514683
Opcode Fuzzy Hash: 3c9488d60ce5cbca6f2150db8d667fc53cf231ab5cd55512aee732b946b4f051
Instruction Fuzzy Hash: 06B1C130B102048FDBA4EF69C944BAEB7F2EF85320F14856AD416DF295DB78D846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06A15560 Relevance: 5.1, Strings: 4, Instructions: 81COMMON

Download Yara Rule

Strings

B, xrefs: 06A15643
@, xrefs: 06A1563E
@, xrefs: 06A15591
B, xrefs: 06A15596

Memory Dump Source

Source File: 0000000A.00000002.1768906730.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6a10000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: @$@$B$B
API String ID: 0-685577651
Opcode ID: 867f2c5ddb5bc135400959f569c7062fc7d9bc10238aed36aee9661d947b36cd
Instruction ID: 8a12e7fecf4df6ff25978f6bea1124ba2872e8c6b2e4066ee47632b1b8be9d0b
Opcode Fuzzy Hash: 867f2c5ddb5bc135400959f569c7062fc7d9bc10238aed36aee9661d947b36cd
Instruction Fuzzy Hash: 65216BB5E002198FDBA4EF69C8849AEBBB6EFC9220B184066D025DF261D730DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: gDdsxauPhk.exePID: 7720, Parent PID: 7440COMMON

Execution Graph

Execution Coverage:	12.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	27
Total number of Limit Nodes:	6

Executed Functions

Function 06B43438 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06B43B37
$^q, xrefs: 06B43B60
$^q, xrefs: 06B43B6C
$^q, xrefs: 06B43B43
$^q, xrefs: 06B43B84
$^q, xrefs: 06B43B90

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: ee90073d7f717a9020c8a5b57164c4f3e34871b2e6f7974525ff7d7c7f062c3e
Instruction ID: c47e098b665d3193e19cb3cbac365a251dba615cf135a973a1546dacd8196e10
Opcode Fuzzy Hash: ee90073d7f717a9020c8a5b57164c4f3e34871b2e6f7974525ff7d7c7f062c3e
Instruction Fuzzy Hash: 97321D31E1065A8FCB54EF79C89459DB7F2FF89300F1486A9D409AB264EF34AD85CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06B47D50 Relevance: 3.0, Strings: 2, Instructions: 474
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06B482EB
$^q, xrefs: 06B482F7

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: c2ee7ffb60930d58eb217538b08a5f05a99ef474202b5b74c843d6c802616e09
Instruction ID: c48d5c2d8be68c8fe9311bd1ff86b25c1d8243bf00bd7ddd017b9c5b1ddbf114
Opcode Fuzzy Hash: c2ee7ffb60930d58eb217538b08a5f05a99ef474202b5b74c843d6c802616e09
Instruction Fuzzy Hash: F3029D70B102159FDB54EF68D5906AEB7E2FF84304F1485A9E406AB394DF35EC46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06B45570 Relevance: 1.9, Strings: 1, Instructions: 602
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06B45C66

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 1131d4cf680370c4ab628a8b354033c8dc894837ffa60da7c73cb0dd8c295f15
Instruction ID: d51dd186cf08f36d7ffd1aa0d7d33813974bca756f435933df7c49260eedbe32
Opcode Fuzzy Hash: 1131d4cf680370c4ab628a8b354033c8dc894837ffa60da7c73cb0dd8c295f15
Instruction Fuzzy Hash: BF22C1B2E006199FDF64EFA8C4806AEB7B2FF85310F2084A9D419AB344DB35DD45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06B465D0 Relevance: .8, Instructions: 824COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a4fd8173a96d7d0e24439904e150c1fa52b542f24148d3a78f31290d9d8c19
Instruction ID: 7a95448407f350a64b99804e020a3e9e4ca5de35ecbe86b9e3751a607a9efed7
Opcode Fuzzy Hash: 07a4fd8173a96d7d0e24439904e150c1fa52b542f24148d3a78f31290d9d8c19
Instruction Fuzzy Hash: 2662C070B002059FDB54EB68D584BADB7F2EF89314F1494A9E406EB391EB35EC46DB80

Uniqueness

Uniqueness Score: -1.00%

Function 06B4B1F0 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f72d9cfe02dfc655f04e5b79fcdcb0daa6334d9b01f5400a7c09c8a87f38b67
Instruction ID: ada8bd55e2bb0dbd8b31ff71368550c2862455e88cd8a86e6f851a61b6e23652
Opcode Fuzzy Hash: 9f72d9cfe02dfc655f04e5b79fcdcb0daa6334d9b01f5400a7c09c8a87f38b67
Instruction Fuzzy Hash: FF2293B0E101099FDF64EB6CD4807ADB7B6FB89310F209965E509EB391CA39DC81DB91

Uniqueness

Uniqueness Score: -1.00%

Function 06B4AC98 Relevance: 10.4, Strings: 8, Instructions: 391
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06B4ADC5
$^q, xrefs: 06B4ADB9
$^q, xrefs: 06B4AE18
$^q, xrefs: 06B4AE3B
$^q, xrefs: 06B4AE47
$^q, xrefs: 06B4AE0C
$^q, xrefs: 06B4AE64
$^q, xrefs: 06B4AE70

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: af8a183296e51d18f86370325629218f94929b07d74c5c555f29249544290a45
Instruction ID: 3240a8bdc0b14aea2fa9f485e8ba9d4c912aecee574c840669e9abadfdd96530
Opcode Fuzzy Hash: af8a183296e51d18f86370325629218f94929b07d74c5c555f29249544290a45
Instruction Fuzzy Hash: A4E18F70F5021A8FDB69EF69D5846AEB7B2FF84304F208569D409AB358DB34DC46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06B4B610 Relevance: 8.0, Strings: 6, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06B4BB65
$^q, xrefs: 06B4BB59
$^q, xrefs: 06B4BBC1
$^q, xrefs: 06B4BB8D
$^q, xrefs: 06B4BB99
$^q, xrefs: 06B4BBCD

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 4d9ae1ddebadaa230f203323ba4ed4d787e5840195239c28feb0a05e1ef176fc
Instruction ID: d20e12f9624e66ddd406cdb13c00b2a7de057358522e17e0f575cdbe4a1207e5
Opcode Fuzzy Hash: 4d9ae1ddebadaa230f203323ba4ed4d787e5840195239c28feb0a05e1ef176fc
Instruction Fuzzy Hash: E802AFB0E1020A9FDF64EF68C5806ADB7B2FB84304F1085AAE505DB355DB35EC86DB81

Uniqueness

Uniqueness Score: -1.00%

Function 06B49120 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06B491D7
$^q, xrefs: 06B4919C
$^q, xrefs: 06B49190
$^q, xrefs: 06B491CB

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 3dfa6291f6482f9df8f8c7d3e124dfa8b23dfced40fd28bcd8d223f077c151b7
Instruction ID: 0878ef74a94dbc383fd1ea31c7cf10bd81979d05fbdceda740195796c1d92735
Opcode Fuzzy Hash: 3dfa6291f6482f9df8f8c7d3e124dfa8b23dfced40fd28bcd8d223f077c151b7
Instruction Fuzzy Hash: 02913C70B0021A9FDB54EF65D8507AFB3F6FF89240F1085A9D809EB384EE749D468B91

Uniqueness

Uniqueness Score: -1.00%

Function 06B4CF08 Relevance: 4.6, Strings: 3, Instructions: 803
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06B4D313
$^q, xrefs: 06B4D2FF
$^q, xrefs: 06B4D307

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q
API String ID: 0-831282457
Opcode ID: dbbaeb8646a9e64a6aa8517fe3671ad1f74d14f97f264a5480c7fb8bdf4cce7d
Instruction ID: 9cdfc6c66df8effd166cd4c27c1053629cf70905050f684af606fa70b8edbe6e
Opcode Fuzzy Hash: dbbaeb8646a9e64a6aa8517fe3671ad1f74d14f97f264a5480c7fb8bdf4cce7d
Instruction Fuzzy Hash: 16624070A0021A9FCB55EF68D590A5DBBF2FF84304B108A79D0099F365DB75ED8ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 06B44B40 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPcq, xrefs: 06B44C6D
\Ocq, xrefs: 06B44CF7
fcq, xrefs: 06B4524D

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: fcq$XPcq$\Ocq
API String ID: 0-3575482020
Opcode ID: b52a56f214448543f5cb2b821742127a979ccdf9ecbc8ae67f5adaa05ba3f2c0
Instruction ID: 6f29fc0f00e69c8df09f61aa42f797639acccc39113e3f7178e1a13e7c78a866
Opcode Fuzzy Hash: b52a56f214448543f5cb2b821742127a979ccdf9ecbc8ae67f5adaa05ba3f2c0
Instruction Fuzzy Hash: E7618170F002199FEB54DFA8C8547AEBBF6FB88700F20852AE106AB395DF754C459B51

Uniqueness

Uniqueness Score: -1.00%

Function 06B49110 Relevance: 2.7, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06B49190
$^q, xrefs: 06B491CB

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 4e7a67487b328d6daec23d94d2e06fef5fcfae40c73c34440166137bcb4aa038
Instruction ID: 71d7e9c8f570821634d63c272beb2bfd9032b48eb7ef6e480ce4939da2ec4aed
Opcode Fuzzy Hash: 4e7a67487b328d6daec23d94d2e06fef5fcfae40c73c34440166137bcb4aa038
Instruction Fuzzy Hash: BA517E70B00216AFDB54EB74D850B6FB7FAEBC8644F108569D809EB384DE34DC428B95

Uniqueness

Uniqueness Score: -1.00%

Function 01408168 Relevance: 1.6, APIs: 1, Instructions: 59
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 014081E0

Memory Dump Source

Source File: 0000000F.00000002.4074154183.0000000001400000.00000040.00000800.00020000.00000000.sdmp, Offset: 01400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1400000_gDdsxauPhk.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 6fe69de5314259592ca01696a177b920cf035f103680d4857953a7895bc478d2
Instruction ID: dc1a23f8e137064e581c6d9a208bc2c505cdd2e619b061f6636ba3d01379639b
Opcode Fuzzy Hash: 6fe69de5314259592ca01696a177b920cf035f103680d4857953a7895bc478d2
Instruction Fuzzy Hash: 3D2147B1C0065A9FDB10CF9AD9457DEFBF4BF48320F10812AD858A7251D738A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01408170 Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 014081E0

Memory Dump Source

Source File: 0000000F.00000002.4074154183.0000000001400000.00000040.00000800.00020000.00000000.sdmp, Offset: 01400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1400000_gDdsxauPhk.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 4112c2c66b3a4a9d6e7fe4245efa4258bdfcdcdfd0a0a49447e20ed478b8f1d7
Instruction ID: 78a3b7e16e18f14e30fb8ea134249a1b64ae12d10e60e57abacc009315f1227e
Opcode Fuzzy Hash: 4112c2c66b3a4a9d6e7fe4245efa4258bdfcdcdfd0a0a49447e20ed478b8f1d7
Instruction Fuzzy Hash: 2D1133B1C0061A9BCB14CF9AC544B9EFBB4BF48320F10812AD858B7250D738A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0140F086 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0140F0EF

Memory Dump Source

Source File: 0000000F.00000002.4074154183.0000000001400000.00000040.00000800.00020000.00000000.sdmp, Offset: 01400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1400000_gDdsxauPhk.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: f0184114be461ea936be7a4054e2955b2ef23d131e0e84305c8aeb86a7a9d464
Instruction ID: 573937d5d1df01a9d61dbb8079f50d78de10bc17c82c722f3f5ea2a632a2a694
Opcode Fuzzy Hash: f0184114be461ea936be7a4054e2955b2ef23d131e0e84305c8aeb86a7a9d464
Instruction Fuzzy Hash: 461114B1C002699BCB20CF9AC444BDEFBF4AB48320F15812AE818A7251D778A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0140F088 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0140F0EF

Memory Dump Source

Source File: 0000000F.00000002.4074154183.0000000001400000.00000040.00000800.00020000.00000000.sdmp, Offset: 01400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1400000_gDdsxauPhk.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 7717100f208fec6c96744e4a493ece143d95fbf432bbe80552685fb6d87bd7bd
Instruction ID: 4ee8d57f312ee9816bb971927fed8dec8df98d07b02ed42a97e73c9c7ba11184
Opcode Fuzzy Hash: 7717100f208fec6c96744e4a493ece143d95fbf432bbe80552685fb6d87bd7bd
Instruction Fuzzy Hash: 4C1123B1C002699BCB10CF9AC444BDEFBF4AF48320F15812AE818B7250D778A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06B44B31 Relevance: 1.4, Strings: 1, Instructions: 132COMMON

Download Yara Rule

Strings

XPcq, xrefs: 06B44C6D

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: XPcq
API String ID: 0-714321711
Opcode ID: 2fd4d0f1b6595e300a7cf4e8ae57807910fda0730daabfa748c8a02bfc566a92
Instruction ID: 5b4d7afa9acc31843f2ed81dcc88ad8f32d5c773c2beffbef27d5dbf45e58175
Opcode Fuzzy Hash: 2fd4d0f1b6595e300a7cf4e8ae57807910fda0730daabfa748c8a02bfc566a92
Instruction Fuzzy Hash: 6241BF70B102199FDB55DFA8C854BAEBBF6FF88700F20852AE105AB395DB758C01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06B4DA7D Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06B4DBD9

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: d1e7607d14561a4c7796bc23a73b221b0137e7d7a93f6e64461309920c6ccaff
Instruction ID: 6f7be7e3286d1a0d40eb31a09df42989cc4f8c535700c4cb276db298944718ba
Opcode Fuzzy Hash: d1e7607d14561a4c7796bc23a73b221b0137e7d7a93f6e64461309920c6ccaff
Instruction Fuzzy Hash: 2B418FB0E0070A9FDB65EF65D89469EBBB2FF86300F104969E406EB240DB74D846DB91

Uniqueness

Uniqueness Score: -1.00%

Function 06B421C8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06B42303

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: e88853a833fc1874ab4024597c6e1be52c1d2ec432a17bd92dca9a4a844af7df
Instruction ID: 9b6bce96204bf2c9c341316950f922ac7ea5a20b4de47f928a2abbcf3c48d8f8
Opcode Fuzzy Hash: e88853a833fc1874ab4024597c6e1be52c1d2ec432a17bd92dca9a4a844af7df
Instruction Fuzzy Hash: 5D31E170B002058FDB59AB74D41466F7BA2FB89210F108578E406DB394DE39DD45EBA5

Uniqueness

Uniqueness Score: -1.00%

Function 06B482A0 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

$^q, xrefs: 06B482EB

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: c62a2dd714b322a790c6f23897cd6a3febb5cdcdf5e66102d30877b3cac09c86
Instruction ID: 0703699d4dc955f41280a36626e8997fb328e7aeca53f70375f9a350a266aff8
Opcode Fuzzy Hash: c62a2dd714b322a790c6f23897cd6a3febb5cdcdf5e66102d30877b3cac09c86
Instruction Fuzzy Hash: 89F08CB1B002059FDF78AE59AA807B877A5EB40314F1450B9E905DB240CB39DD06EB91

Uniqueness

Uniqueness Score: -1.00%

Function 06B44270 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df08479f70662362dd9662a548a1eca37a8204aa9e55a45693a38230cc8c1580
Instruction ID: 415b8cf5d300333ce02135ba6ce3247425bc67f30afd1b3f7ab91d9a90a40f4a
Opcode Fuzzy Hash: df08479f70662362dd9662a548a1eca37a8204aa9e55a45693a38230cc8c1580
Instruction Fuzzy Hash: 41815C70B102099FDF54DFA9D49079EB7F6EB88304F108569E40AEB394EB34EC428B91

Uniqueness

Uniqueness Score: -1.00%

Function 06B461C8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be9de72ed8fe4ff108a24492af1d949d0237e4a25c5d2a3cd38f6a913ecc9732
Instruction ID: f7e268ab9b0bb85af0078ac52e127da81b28fd353957dd5f65774a4404cbf0f2
Opcode Fuzzy Hash: be9de72ed8fe4ff108a24492af1d949d0237e4a25c5d2a3cd38f6a913ecc9732
Instruction Fuzzy Hash: 8F61CFB1F001214FDB54AA7EC88466FAAD7EFC5624B15407AD80EDB360EEA5DD0287C2

Uniqueness

Uniqueness Score: -1.00%

Function 06B44594 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab022a10d241b95a68dc64003c706d68f125d76fa5c963080a028f04ee7510b2
Instruction ID: ae4b0cb03a80b911c3c592eae46a872e1d39e39aea983d4773f500edf36f5cd9
Opcode Fuzzy Hash: ab022a10d241b95a68dc64003c706d68f125d76fa5c963080a028f04ee7510b2
Instruction Fuzzy Hash: 79916F70E106198FDF60DF68C880B9DB7B1FF85304F208699D549BB295DB70AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06B445A8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfd95a919f62940fa6f70ec120df1a3c2d2293a38c3136c343dc7d257f079e10
Instruction ID: 8addc0b4d36cb9626388e2adfa757ae8ff543e16bed0ad77501a40345466ae72
Opcode Fuzzy Hash: bfd95a919f62940fa6f70ec120df1a3c2d2293a38c3136c343dc7d257f079e10
Instruction Fuzzy Hash: 5D913D70E106198BDF60DF68C880B9DB7B1FF89304F208699D549BB255DB70A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06B4EEE0 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e9bbdaa2045e0c7880490e918bfd6d07899a33465ef7a9624494766dd042fe8
Instruction ID: 724ee0aa1eef01c933ee965643724c9fc5049594f93e9c6169c067fd020d1415
Opcode Fuzzy Hash: 7e9bbdaa2045e0c7880490e918bfd6d07899a33465ef7a9624494766dd042fe8
Instruction Fuzzy Hash: CD715C70A012199FDB54EFA9D980AADBBF6FF88300F148569E049EB355DB34EC46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06B4EEF0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed8dc0ba94a483a41c8f0cd4a04ae641df5f455751534d8416ea796ce1d26b91
Instruction ID: f265e7d3a336a7758008a409cb008110f483545e39422217b457d9481954b571
Opcode Fuzzy Hash: ed8dc0ba94a483a41c8f0cd4a04ae641df5f455751534d8416ea796ce1d26b91
Instruction Fuzzy Hash: 81713C70A012199FDB54EFA9D980AADBBF6FF84300F148569E405EB354DB74EC46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06B4FC49 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baca06400bb595bd3c889e13b55f64f35b125c306fb632a6fdf071698e82e3f7
Instruction ID: c09f47051be8822609705c3707d861a0be95d21852291bcb5af58a871cf8c133
Opcode Fuzzy Hash: baca06400bb595bd3c889e13b55f64f35b125c306fb632a6fdf071698e82e3f7
Instruction Fuzzy Hash: 4451D1B1E102099FDB24BB78E4846AEBBB6FBC5315F1088B9E10AD7251DB358855CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06B4F9F7 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f716553769de30de6e74fa200538760c1166caf227e90bbb8593e565bf99c4f
Instruction ID: d99fe3c56b2763c024c527b57447c2b720184692f7431cac29f85b3f7b03be81
Opcode Fuzzy Hash: 1f716553769de30de6e74fa200538760c1166caf227e90bbb8593e565bf99c4f
Instruction Fuzzy Hash: 3F51D1B0B102049FEF646ABC999473F2A6ED7C9310F20587AE40AE7395C97DCC459792

Uniqueness

Uniqueness Score: -1.00%

Function 06B4FA08 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44b1a91c2be1d37e1aba20a2bd746451217f200485462a1186685c29cb61ddf3
Instruction ID: 2addd89daebb9025512d2c2efb8e5125afb83d1f11a557705686e97d0f2409fa
Opcode Fuzzy Hash: 44b1a91c2be1d37e1aba20a2bd746451217f200485462a1186685c29cb61ddf3
Instruction Fuzzy Hash: 7F51C3B0B102049FEF646ABCD99473F2A6ED7C9310F20583AE50AE7394C97DCC4557A2

Uniqueness

Uniqueness Score: -1.00%

Function 06B453E8 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c45f80278e62aafde171e8179dd6617e538a4c6ceca7777bdf21c3cbd784d4f
Instruction ID: 45aafa2949f1c0fd8393e28794a592c8bd104dc825d01aa4bc2f7f3f411737c1
Opcode Fuzzy Hash: 5c45f80278e62aafde171e8179dd6617e538a4c6ceca7777bdf21c3cbd784d4f
Instruction Fuzzy Hash: 6241A2B2E006098FCF70DEA9D880AAFFBB2EB45210F10496AE216D7654C330E855DB91

Uniqueness

Uniqueness Score: -1.00%

Function 06B4D930 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523c71ca4af77be9d4e6e9dd460a0e84f9fa3e67c2f5e54adec21850d9f3183f
Instruction ID: a167eb2a0dd64df941fedb1067de8775a7074ac115f33bb01d2b7a1cc75acd86
Opcode Fuzzy Hash: 523c71ca4af77be9d4e6e9dd460a0e84f9fa3e67c2f5e54adec21850d9f3183f
Instruction Fuzzy Hash: 9131A170A1031A9FCF25DF69C99069EBBB5FF85304F104969E405EB341EBB1E846CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06B42078 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d890e6e4781905cfd405eda7db3651bc7d2834d986f781f0bc720961236da8df
Instruction ID: c18d3fdabab7348bd3fa133dd5546f1fa0c22df9e415ada64ab933b9b0b1797a
Opcode Fuzzy Hash: d890e6e4781905cfd405eda7db3651bc7d2834d986f781f0bc720961236da8df
Instruction Fuzzy Hash: 1731BA70E002169FDB19DFA5D89469EBBF2EF89300F108569F906E7740DB30AD46DB40

Uniqueness

Uniqueness Score: -1.00%

Function 06B42088 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19081adf3f565ee06c41d9f14a93bce3726e539d629959dd011f5f8a61fb73c8
Instruction ID: 7b8271e58df353ae791b369f807572019cbc01cabe55daa632a5ba5334940523
Opcode Fuzzy Hash: 19081adf3f565ee06c41d9f14a93bce3726e539d629959dd011f5f8a61fb73c8
Instruction Fuzzy Hash: 2B319A70E0021A9BDB58DFA5D89469EB7F2FF89300F108529F906E7740DB71AD42DB90

Uniqueness

Uniqueness Score: -1.00%

Function 06B43E78 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8155ab0af055de84e2e96c6892b3b9e7118c1136d18fc94f5e58658e90a6029
Instruction ID: 74ddd2f2d4bcf819cb21e9ec5bd82c8748ffc3fa01d9e6986527d0f2743120be
Opcode Fuzzy Hash: a8155ab0af055de84e2e96c6892b3b9e7118c1136d18fc94f5e58658e90a6029
Instruction Fuzzy Hash: CA219CB1F112559FDB00DF69D880AAEBBF5FB88610F148069E905E7380E739DD018B91

Uniqueness

Uniqueness Score: -1.00%

Function 06B43E88 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e6eebb85513ba0b8a1009524d7e90f29f9886c211172977041f20af156ba488
Instruction ID: ba4bbdf2a9613c1a6fe516fe960bc4f576b9647d95eb93d57e1ac2c31db14269
Opcode Fuzzy Hash: 3e6eebb85513ba0b8a1009524d7e90f29f9886c211172977041f20af156ba488
Instruction Fuzzy Hash: 86217CB5F112159FDB40DF6AD880AAEBBF5FB88710F148069E905E7390E739DD018B91

Uniqueness

Uniqueness Score: -1.00%

Function 0126D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4072563153.000000000126D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_126d000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae243ef908f44edc6ad20798faad5f02068d6b1df0329d124f5f7feec5f7d57d
Instruction ID: e7128020b83c98849496884af2f09bee0825a91d957039c42b041740f5da2784
Opcode Fuzzy Hash: ae243ef908f44edc6ad20798faad5f02068d6b1df0329d124f5f7feec5f7d57d
Instruction Fuzzy Hash: C821377161420CDFCB11DF68C9C4B26BB69FB84314F20C5ADE9894B292C777D486CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0126D20C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4072563153.000000000126D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_126d000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f73a681b8e17795ff9faafccd52d6db6c5695f47d50abbd445e7453f29ab7c8
Instruction ID: 3eb44bbfd7469ca8b9a48220985f3088d495d7ab86c5fff536b52a8eedb0ee7b
Opcode Fuzzy Hash: 1f73a681b8e17795ff9faafccd52d6db6c5695f47d50abbd445e7453f29ab7c8
Instruction Fuzzy Hash: 6421687172424CDFDB01DF58D5C4B2ABB69FB84334F20C669D9890B283C376D486CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0126D3BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4072563153.000000000126D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_126d000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54d25df95b14e1b4d7320d4f77508580be35e7ad95e792c1aefa2d5a9ebaa0f7
Instruction ID: 50d95b00ebc3cb55e4b3b93fcc95215cdf715a94a2f0a459042d6a1b1986f6a7
Opcode Fuzzy Hash: 54d25df95b14e1b4d7320d4f77508580be35e7ad95e792c1aefa2d5a9ebaa0f7
Instruction Fuzzy Hash: 2A21347161024CDFCB01DF58D5C0B26BBA9FB84314F20C56DE9894B2D6C376E886CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 06B43428 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd19272a2b789bb325d6ea100cc20deb2721fac90fd6a633ac3f7e8d9f255fb4
Instruction ID: 398fd68725cbc4bda801b1f85ddc5eeb1e7bb3ec6848941c2399f227a84efde7
Opcode Fuzzy Hash: dd19272a2b789bb325d6ea100cc20deb2721fac90fd6a633ac3f7e8d9f255fb4
Instruction Fuzzy Hash: BE2193B1E002289FCB65EB7AD8405DEFBE5EB89310F1485A9E10AE7241DA32D945CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 06B441D1 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03c69a3655f615496980ae4689f71d27c1dbe2a59bb2d165c501a8ca726e0df9
Instruction ID: 8f4502efaf817948402d327b0d1d35cfe39e345644e897342aa9a138d81be674
Opcode Fuzzy Hash: 03c69a3655f615496980ae4689f71d27c1dbe2a59bb2d165c501a8ca726e0df9
Instruction Fuzzy Hash: 3201F534B202211FD761E67EA850B6BBBDECBC9610F14847AF50EC7381DE24CC1243A1

Uniqueness

Uniqueness Score: -1.00%

Function 06B43F98 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 507a11f8331f61ecb88ca89103ac9435ca85e9cfc3db336d8b2e89223b790380
Instruction ID: 34f275b9d13683ba9046bae181d9e871f035a562e63c1148f325769600ac9ed8
Opcode Fuzzy Hash: 507a11f8331f61ecb88ca89103ac9435ca85e9cfc3db336d8b2e89223b790380
Instruction Fuzzy Hash: 1D11AD32B041295FDF58AA68CC14AAF73FAEBC8211B04457AD50AE7340DE69DC129BD2

Uniqueness

Uniqueness Score: -1.00%

Function 06B43C52 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 516d582b12293876f35ed477edadbf6e1d779d13eba8bd583b8dc7ec6b26a776
Instruction ID: 16d6ea68687b333688e6a9f24a9693455aa9d3909650e5be27ff6cea35decfe6
Opcode Fuzzy Hash: 516d582b12293876f35ed477edadbf6e1d779d13eba8bd583b8dc7ec6b26a776
Instruction Fuzzy Hash: 9521C7B5D01269AFCB10DF9AD885ACEFFB8FB48314F10812AE918A7241C3756554CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 06B4A2D2 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f526348272064b52a9e057e067756b0e94e773374ad8376d611b643266796c6
Instruction ID: 7ca2768807cb3382561e40a5e11f3f5f63885a5a6aa0f5147ff3ef4817ea3309
Opcode Fuzzy Hash: 6f526348272064b52a9e057e067756b0e94e773374ad8376d611b643266796c6
Instruction Fuzzy Hash: 0201F170B142101FDB71E62DA850B6B7BEAEB8A604F108479F00ACB345EE25DC029791

Uniqueness

Uniqueness Score: -1.00%

Function 06B4F161 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 341508a56ce15a01c7f2777902ff4dec843570abac1607631c4e6403b4de3e08
Instruction ID: 03d38b8f53fa5de14c13ab8d74c9a6ed290f787b294e9496c03d6da8a245310a
Opcode Fuzzy Hash: 341508a56ce15a01c7f2777902ff4dec843570abac1607631c4e6403b4de3e08
Instruction Fuzzy Hash: EE01DFB1B001201BDB65EA2ED8A4B7F77DBDBC9610F108829E50FC7340DA25DC034391

Uniqueness

Uniqueness Score: -1.00%

Function 06B43024 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4163e061d65078af849bafb78bbb778cf54e0e321460366be97d8fd82c267b0
Instruction ID: d859dbf12a0cacf20bd944717f2dd091a8bb7a2798a115569bc04ffbc18774dd
Opcode Fuzzy Hash: c4163e061d65078af849bafb78bbb778cf54e0e321460366be97d8fd82c267b0
Instruction Fuzzy Hash: EF21E5B1D00219AFCB00DF9AD884ADEFBF4FB48310F10816AE918A7201C3746954CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0126D207 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4072563153.000000000126D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_126d000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction ID: 85d04c1d4745cfbe6c180e1801d4e2886e2fb3644a5e35df5bbeda7444b2cf7d
Opcode Fuzzy Hash: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction Fuzzy Hash: 7511D075504288CFDB12CF54D5C4B16BF61FB84224F24C6AAD9490B687C33AD44ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 0126D3B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4072563153.000000000126D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_126d000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 1d114044a15ad21e7240ba4cb3a698888d6540e8a50dc247236e8643666ec816
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 4711D075604288CFDB02CF54D5C4B55BF71FB84314F24C6AAD9494B296C33AE84ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 0126D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4072563153.000000000126D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_126d000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 7a68ecb687e18753e8234ac738e473b6bea66afbd0eba7d58ddd114843c95459
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: AE11D075604248CFDB12CF54C9C4B15BF61FB84314F24C6A9DD894B292C33AD44ACF51

Uniqueness

Uniqueness Score: -1.00%

Function 06B43F87 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82d8f6cc689493803bc24f6cd31186069df758946163741685a66678488a8df0
Instruction ID: 542a0495ac42d82b8044c79e38a1cdf97928ff8f4d87acab6873b1e5ac4c1d49
Opcode Fuzzy Hash: 82d8f6cc689493803bc24f6cd31186069df758946163741685a66678488a8df0
Instruction Fuzzy Hash: 0901D831B201255BEB549A689C10BEB73FBDBC4204F04013AE40AD7344DE688C1247D1

Uniqueness

Uniqueness Score: -1.00%

Function 06B441E0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b34b4162275699994784e4399656da6a0e45c08c54fb2fc82c47681dd954efc
Instruction ID: 8c4d1821190878521fcd23675834b13f51db2cf21c4110e8e9dac88c8c35c421
Opcode Fuzzy Hash: 5b34b4162275699994784e4399656da6a0e45c08c54fb2fc82c47681dd954efc
Instruction Fuzzy Hash: 2D01DC70B101211BDB64AABEA860B2BF2DADBC9710F20843AE50EC7380EE35DC024395

Uniqueness

Uniqueness Score: -1.00%

Function 06B4C78A Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae2206ddb044d7b7116a31dbbe413937dde663654c74c5b28dc516b3deacf247
Instruction ID: 9197e3058af30047d55c68be402b36083146c924febd45bfc41ea500e8552263
Opcode Fuzzy Hash: ae2206ddb044d7b7116a31dbbe413937dde663654c74c5b28dc516b3deacf247
Instruction Fuzzy Hash: D2014C71A122256BCB259A3AEC40A9ABF79E785710F004179F405EB381DB369C0487D0

Uniqueness

Uniqueness Score: -1.00%

Function 06B4F170 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5e873b6849b77e860e229451da798610f1b07524bd61f8aa728c8fb854e0831
Instruction ID: 4d372b00ca6e0149d6360b595aaa082ba73f401ab26d69e55760d201ae7413f2
Opcode Fuzzy Hash: e5e873b6849b77e860e229451da798610f1b07524bd61f8aa728c8fb854e0831
Instruction Fuzzy Hash: 8B018CB1B101211BDB64AA2ED894B3EB7DBEBC9610F14987AE60AC7340DA25DC024385

Uniqueness

Uniqueness Score: -1.00%

Function 06B4A2E0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66a0ff5400141065ce7329a389dea63fc7451f6e97432352a12db4708e2507a1
Instruction ID: ac61488e8af75d9c47ae602ea8d1d3c1d57eb9044f364b7fd630cbd0d32776ef
Opcode Fuzzy Hash: 66a0ff5400141065ce7329a389dea63fc7451f6e97432352a12db4708e2507a1
Instruction Fuzzy Hash: DA01A470B401141FDB74EA7DE554B2EB7EAE789710F109479E10ED7744EE25EC028785

Uniqueness

Uniqueness Score: -1.00%

Function 06B46450 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4127561671.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b40000_gDdsxauPhk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ef338648a435af1cb9c769aca2dd8c075d999c770f993f7fdd6c8b6ed0a3059
Instruction ID: 801eadf63e56ffacd72c71ad2023dbc0ed4bf1ac69f6060054d108f80f6c7b0b
Opcode Fuzzy Hash: 5ef338648a435af1cb9c769aca2dd8c075d999c770f993f7fdd6c8b6ed0a3059
Instruction Fuzzy Hash: 62E022B0A082486FCF60EEB48C5064B7FA9CB03258F1080E2D444CB243E536C9029BE1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Statement of Account PDF.bat.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_BjTxJte.exe_f5c09dd75b90d612af8c658c8837992c387ee89_843aacda_4690c535-c6af-41e6-8128-f3000ded106c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_BjTxJte.exe_f5c09dd75b90d612af8c658c8837992c387ee89_843aacda_f7977af1-9a55-4b84-b1d5-dbe8f1aea04e\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_gDdsxauPhk.exe_e2c8de6e9dfbc3bf198524a8a8bae3ea56c2edb2_cb724c00_6c828731-bc0c-4d10-93b3-5ed4934f0644\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER123.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER211D.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2312.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2351.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4195.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4281.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER42A1.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC5.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFDF5.tmp.dmp

Windows Analysis Report
Statement of Account PDF.bat.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre