Edit tour

Windows Analysis Report
Invoice-BL. Payment TT $ 16945.99.exe

Overview

General Information

Sample name:	Invoice-BL. Payment TT $ 16945.99.exe
Analysis ID:	1572212
MD5:	eb7496ff2480e5b4fbd90e785a7328cd
SHA1:	0039713076f0ccb54bfea4fa060b62eada29d39e
SHA256:	d30d43ea8f103340a2307145035f404873d3d345f310dbeba6fa20f85d3fb790
Tags:	exeRedLineStealeruser-abuse_ch
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected RedLine Stealer

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Invoice-BL. Payment TT $ 16945.99.exe (PID: 6880 cmdline: "C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe" MD5: EB7496FF2480E5B4FBD90E785A7328CD)

powershell.exe (PID: 5960 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7392 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 5940 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\haYzNpEpfrrs" /XML "C:\Users\user\AppData\Local\Temp\tmp4600.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Invoice-BL. Payment TT $ 16945.99.exe (PID: 7216 cmdline: "C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe" MD5: EB7496FF2480E5B4FBD90E785A7328CD)

haYzNpEpfrrs.exe (PID: 7264 cmdline: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe MD5: EB7496FF2480E5B4FBD90E785A7328CD)

schtasks.exe (PID: 7496 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\haYzNpEpfrrs" /XML "C:\Users\user\AppData\Local\Temp\tmpBEE8.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

haYzNpEpfrrs.exe (PID: 7540 cmdline: "C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe" MD5: EB7496FF2480E5B4FBD90E785A7328CD)

haYzNpEpfrrs.exe (PID: 7548 cmdline: "C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe" MD5: EB7496FF2480E5B4FBD90E785A7328CD)

haYzNpEpfrrs.exe (PID: 7556 cmdline: "C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe" MD5: EB7496FF2480E5B4FBD90E785A7328CD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["45.137.22.164:1912"], "Bot Id": "SystemCache", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000006.00000002.1798528235.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1687136757.0000000003CCC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1687136757.0000000003B01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000D.00000002.1854830160.0000000002E6C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.1800626325.0000000002A12000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Invoice-BL. Payment TT $ 16945.99.exe PID: 6880	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Invoice-BL. Payment TT $ 16945.99.exe PID: 6880	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: Invoice-BL. Payment TT $ 16945.99.exe PID: 7216	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Invoice-BL. Payment TT $ 16945.99.exe PID: 7216	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: haYzNpEpfrrs.exe PID: 7264	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: haYzNpEpfrrs.exe PID: 7556	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: haYzNpEpfrrs.exe PID: 7556	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.Invoice-BL. Payment TT $ 16945.99.exe.3cd4cb0.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.Invoice-BL. Payment TT $ 16945.99.exe.3cd4cb0.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
6.2.Invoice-BL. Payment TT $ 16945.99.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.Invoice-BL. Payment TT $ 16945.99.exe.3c89a90.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.Invoice-BL. Payment TT $ 16945.99.exe.3c89a90.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe", ParentImage: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe, ParentProcessId: 6880, ParentProcessName: Invoice-BL. Payment TT $ 16945.99.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe", ProcessId: 5960, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\haYzNpEpfrrs" /XML "C:\Users\user\AppData\Local\Temp\tmpBEE8.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\haYzNpEpfrrs" /XML "C:\Users\user\AppData\Local\Temp\tmpBEE8.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe, ParentImage: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe, ParentProcessId: 7264, ParentProcessName: haYzNpEpfrrs.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\haYzNpEpfrrs" /XML "C:\Users\user\AppData\Local\Temp\tmpBEE8.tmp", ProcessId: 7496, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\haYzNpEpfrrs" /XML "C:\Users\user\AppData\Local\Temp\tmp4600.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\haYzNpEpfrrs" /XML "C:\Users\user\AppData\Local\Temp\tmp4600.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe", ParentImage: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe, ParentProcessId: 6880, ParentProcessName: Invoice-BL. Payment TT $ 16945.99.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\haYzNpEpfrrs" /XML "C:\Users\user\AppData\Local\Temp\tmp4600.tmp", ProcessId: 5940, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe", ParentImage: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe, ParentProcessId: 6880, ParentProcessName: Invoice-BL. Payment TT $ 16945.99.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe", ProcessId: 5960, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\haYzNpEpfrrs" /XML "C:\Users\user\AppData\Local\Temp\tmp4600.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\haYzNpEpfrrs" /XML "C:\Users\user\AppData\Local\Temp\tmp4600.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe", ParentImage: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe, ParentProcessId: 6880, ParentProcessName: Invoice-BL. Payment TT $ 16945.99.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\haYzNpEpfrrs" /XML "C:\Users\user\AppData\Local\Temp\tmp4600.tmp", ProcessId: 5940, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T09:17:02.420478+0100	2043234	1	A Network Trojan was detected	45.137.22.164	1912	192.168.2.4	49733	TCP
2024-12-10T09:17:07.682772+0100	2043234	1	A Network Trojan was detected	45.137.22.164	1912	192.168.2.4	49736	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T09:17:02.030831+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49733	45.137.22.164	1912	TCP
2024-12-10T09:17:06.742113+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49736	45.137.22.164	1912	TCP
2024-12-10T09:17:07.543715+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49733	45.137.22.164	1912	TCP
2024-12-10T09:17:10.554388+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49733	45.137.22.164	1912	TCP
2024-12-10T09:17:11.009802+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49733	45.137.22.164	1912	TCP
2024-12-10T09:17:12.811063+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49736	45.137.22.164	1912	TCP
2024-12-10T09:17:15.615330+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49736	45.137.22.164	1912	TCP
2024-12-10T09:17:16.056822+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49736	45.137.22.164	1912	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T09:17:09.080209+0100	2046056	1	A Network Trojan was detected	45.137.22.164	1912	192.168.2.4	49733	TCP
2024-12-10T09:17:14.206852+0100	2046056	1	A Network Trojan was detected	45.137.22.164	1912	192.168.2.4	49736	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T09:17:02.030831+0100	2046045	1	A Network Trojan was detected	192.168.2.4	49733	45.137.22.164	1912	TCP
2024-12-10T09:17:06.742113+0100	2046045	1	A Network Trojan was detected	192.168.2.4	49736	45.137.22.164	1912	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.1687136757.0000000003B01000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": ["45.137.22.164:1912"], "Bot Id": "SystemCache", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe

ReversingLabs: Detection: 28%

Multi AV Scanner detection for submitted file

Source: Invoice-BL. Payment TT $ 16945.99.exe

ReversingLabs: Detection: 28%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Invoice-BL. Payment TT $ 16945.99.exe

Joe Sandbox ML: detected

Source: Invoice-BL. Payment TT $ 16945.99.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Invoice-BL. Payment TT $ 16945.99.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: jXdm.pdbSHA256T source: Invoice-BL. Payment TT $ 16945.99.exe, haYzNpEpfrrs.exe.0.dr
Source:	Binary string: jXdm.pdb source: Invoice-BL. Payment TT $ 16945.99.exe, haYzNpEpfrrs.exe.0.dr

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 4x nop then jmp 077466EAh	6_2_07746428
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	6_2_07743BE0
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 4x nop then jmp 07745D8Ah	6_2_07745968
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 4x nop then jmp 0774620Ah	6_2_07745968
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 4x nop then jmp 0774540Bh	6_2_077451D8
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 4x nop then jmp 077419BFh	6_2_077419A7
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 4x nop then jmp 0774040Dh	6_2_07740040
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 4x nop then jmp 0774040Dh	6_2_0774001B
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 4x nop then jmp 0774040Dh	6_2_07740007
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 4x nop then jmp 06FB5C23h	13_2_06FB59F0
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	13_2_06FB39A0
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 4x nop then jmp 06FB65A2h	13_2_06FB6180
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 4x nop then jmp 06FB6A22h	13_2_06FB6180
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 4x nop then jmp 06FB3565h	13_2_06FB3198
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 4x nop then jmp 06FB3565h	13_2_06FB3189

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.4:49733 -> 45.137.22.164:1912
Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.4:49736 -> 45.137.22.164:1912
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.4:49733 -> 45.137.22.164:1912
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.4:49736 -> 45.137.22.164:1912
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 45.137.22.164:1912 -> 192.168.2.4:49733
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 45.137.22.164:1912 -> 192.168.2.4:49736
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 45.137.22.164:1912 -> 192.168.2.4:49733
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 45.137.22.164:1912 -> 192.168.2.4:49736

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 45.137.22.164:1912

Source: global traffic

TCP traffic: 192.168.2.4:49733 -> 45.137.22.164:1912

Source: Joe Sandbox View

ASN Name: ROOTLAYERNETNL ROOTLAYERNETNL

Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.164

Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800294591.000000000101E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purl.oen
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1684498941.0000000002B01000.00000004.00000800.00020000.00000000.sdmp, Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 00000007.00000002.1738139117.0000000002521000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002C22000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002D1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002C22000.00000004.00000800.00020000.00000000.sdmp, Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002D1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002C22000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002D1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3ResponseD
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1694125149.00000000070F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1694125149.00000000070F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1694125149.00000000070F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1694125149.00000000070F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1694125149.00000000070F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1694125149.00000000070F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1694125149.00000000070F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1694125149.00000000070F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1694125149.00000000070F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1694125149.00000000070F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1694125149.00000000070F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1694125149.00000000070F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1694125149.00000000070F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1694125149.00000000070F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1694125149.00000000070F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1694125149.00000000070F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1694125149.00000000070F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1694125149.00000000070F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1694125149.00000000070F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1694125149.00000000070F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1694125149.00000000070F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1694125149.00000000070F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1694125149.00000000070F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1694125149.00000000070F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1694125149.00000000070F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002D89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1687136757.0000000003B01000.00000004.00000800.00020000.00000000.sdmp, Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1687136757.0000000003CCC000.00000004.00000800.00020000.00000000.sdmp, Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1798528235.0000000000402000.00000040.00000400.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002D89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002D89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002D89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002D89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002D89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002D89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002D89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002D89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Invoice-BL. Payment TT $ 16945.99.exe

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 0_2_01153E34	0_2_01153E34
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 0_2_0115E124	0_2_0115E124
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 0_2_01156F90	0_2_01156F90
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 0_2_05EB3668	0_2_05EB3668
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 0_2_05EB4128	0_2_05EB4128
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 0_2_05EB1240	0_2_05EB1240
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 0_2_05EB11F8	0_2_05EB11F8
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 0_2_05EB1230	0_2_05EB1230
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 0_2_07C09FF5	0_2_07C09FF5
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 0_2_07C085E9	0_2_07C085E9
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 0_2_07C00040	0_2_07C00040
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 0_2_07C03788	0_2_07C03788
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 0_2_07C03350	0_2_07C03350
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 0_2_07C02F18	0_2_07C02F18
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 0_2_07C04E60	0_2_07C04E60
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 0_2_07C04A28	0_2_07C04A28
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 6_2_0269DC74	6_2_0269DC74
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 6_2_077496B8	6_2_077496B8
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 6_2_07746428	6_2_07746428
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 6_2_07741C17	6_2_07741C17
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 6_2_07743BE0	6_2_07743BE0
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 6_2_07740A80	6_2_07740A80
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 6_2_07745968	6_2_07745968
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 6_2_07744180	6_2_07744180
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 6_2_077410C0	6_2_077410C0
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 6_2_07743BD0	6_2_07743BD0
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 6_2_07743380	6_2_07743380
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 6_2_07740A72	6_2_07740A72
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 6_2_07742299	6_2_07742299
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 6_2_07745957	6_2_07745957
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 6_2_07740040	6_2_07740040
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 6_2_0774001B	6_2_0774001B
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 6_2_07740007	6_2_07740007
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 7_2_04A43E34	7_2_04A43E34
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 7_2_04A4E124	7_2_04A4E124
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 7_2_04A46F90	7_2_04A46F90
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 7_2_058E0BD4	7_2_058E0BD4
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 7_2_058E0120	7_2_058E0120
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 7_2_058E0130	7_2_058E0130
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 7_2_058E20F0	7_2_058E20F0
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 7_2_058E0BC8	7_2_058E0BC8
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 7_2_072F94A0	7_2_072F94A0
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 7_2_072F0040	7_2_072F0040
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 7_2_072F78D4	7_2_072F78D4
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 7_2_072F2F18	7_2_072F2F18
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 7_2_072F3788	7_2_072F3788
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 7_2_072F4E60	7_2_072F4E60
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 7_2_072F2EF9	7_2_072F2EF9
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 7_2_072F3350	7_2_072F3350
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 7_2_072F4A28	7_2_072F4A28
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 7_2_072F0006	7_2_072F0006
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 7_2_072F00E3	7_2_072F00E3
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 7_2_08744117	7_2_08744117
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 7_2_08741240	7_2_08741240
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 7_2_08743668	7_2_08743668
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 7_2_08746D08	7_2_08746D08
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 7_2_08741230	7_2_08741230
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 13_2_0295DC74	13_2_0295DC74
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 13_2_0510EE58	13_2_0510EE58
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 13_2_05108850	13_2_05108850
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 13_2_05100AFC	13_2_05100AFC
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 13_2_05100007	13_2_05100007
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 13_2_05100040	13_2_05100040
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 13_2_05108840	13_2_05108840
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 13_2_05100AF9	13_2_05100AF9
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 13_2_05101FF0	13_2_05101FF0
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 13_2_06FB9678	13_2_06FB9678
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 13_2_06FB4018	13_2_06FB4018
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 13_2_06FB39A0	13_2_06FB39A0
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 13_2_06FB6180	13_2_06FB6180
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 13_2_06FB0788	13_2_06FB0788
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 13_2_06FB0778	13_2_06FB0778
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 13_2_06FB4AE8	13_2_06FB4AE8
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 13_2_06FB4AD8	13_2_06FB4AD8
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 13_2_06FB20F0	13_2_06FB20F0
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 13_2_06FB3198	13_2_06FB3198
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 13_2_06FB3990	13_2_06FB3990
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 13_2_06FB3189	13_2_06FB3189
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 13_2_06FB6170	13_2_06FB6170

Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1682696891.0000000000B6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Invoice-BL. Payment TT $ 16945.99.exe
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1695792598.0000000009120000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Invoice-BL. Payment TT $ 16945.99.exe
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000000.1649883210.00000000006A2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamejXdm.exeJ vs Invoice-BL. Payment TT $ 16945.99.exe
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1687136757.0000000003D25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs Invoice-BL. Payment TT $ 16945.99.exe
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1687136757.0000000003D25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Invoice-BL. Payment TT $ 16945.99.exe
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1687136757.0000000003B01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs Invoice-BL. Payment TT $ 16945.99.exe
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1687136757.0000000003B01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Invoice-BL. Payment TT $ 16945.99.exe
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1687136757.0000000003CCC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs Invoice-BL. Payment TT $ 16945.99.exe
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1687136757.0000000003D17000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs Invoice-BL. Payment TT $ 16945.99.exe
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000000.00000002.1695001468.0000000007880000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs Invoice-BL. Payment TT $ 16945.99.exe
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1798528235.0000000000446000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs Invoice-BL. Payment TT $ 16945.99.exe
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs Invoice-BL. Payment TT $ 16945.99.exe
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000029C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefirefox.exe0 vs Invoice-BL. Payment TT $ 16945.99.exe
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000029C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $kq,\\StringFileInfo\\000004B0\\OriginalFilename vs Invoice-BL. Payment TT $ 16945.99.exe
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000029C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamechrome.exe< vs Invoice-BL. Payment TT $ 16945.99.exe
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000029C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $kq,\\StringFileInfo\\040904B0\\OriginalFilename vs Invoice-BL. Payment TT $ 16945.99.exe
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000029C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXE.MUID vs Invoice-BL. Payment TT $ 16945.99.exe
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000029C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXED vs Invoice-BL. Payment TT $ 16945.99.exe
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000029C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $kq,\\StringFileInfo\\080904B0\\OriginalFilename vs Invoice-BL. Payment TT $ 16945.99.exe
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.00000000029C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe> vs Invoice-BL. Payment TT $ 16945.99.exe
Source: Invoice-BL. Payment TT $ 16945.99.exe	Binary or memory string: OriginalFilenamejXdm.exeJ vs Invoice-BL. Payment TT $ 16945.99.exe

Source: Invoice-BL. Payment TT $ 16945.99.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Invoice-BL. Payment TT $ 16945.99.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: haYzNpEpfrrs.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3db1d88.2.raw.unpack, ESUYSjpJ1jS9kdLtPJ.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3db1d88.2.raw.unpack, ESUYSjpJ1jS9kdLtPJ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3db1d88.2.raw.unpack, ESUYSjpJ1jS9kdLtPJ.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, ESUYSjpJ1jS9kdLtPJ.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, ESUYSjpJ1jS9kdLtPJ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, ESUYSjpJ1jS9kdLtPJ.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.9120000.5.raw.unpack, eP7KFHYxkowkSxeuGX.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3db1d88.2.raw.unpack, eP7KFHYxkowkSxeuGX.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, eP7KFHYxkowkSxeuGX.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.9120000.5.raw.unpack, ESUYSjpJ1jS9kdLtPJ.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.9120000.5.raw.unpack, ESUYSjpJ1jS9kdLtPJ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.9120000.5.raw.unpack, ESUYSjpJ1jS9kdLtPJ.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@20/11@0/1

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe

File created: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6776:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3340:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7504:120:WilError_03
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net data provider for sqlserver

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe

File created: C:\Users\user\AppData\Local\Temp\tmp4600.tmp

Jump to behavior

Source: Invoice-BL. Payment TT $ 16945.99.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Invoice-BL. Payment TT $ 16945.99.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Invoice-BL. Payment TT $ 16945.99.exe

ReversingLabs: Detection: 28%

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe

File read: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe "C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe"
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\haYzNpEpfrrs" /XML "C:\Users\user\AppData\Local\Temp\tmp4600.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process created: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe "C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\haYzNpEpfrrs" /XML "C:\Users\user\AppData\Local\Temp\tmpBEE8.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process created: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe "C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe"
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process created: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe "C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe"
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process created: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe "C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe"
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\haYzNpEpfrrs" /XML "C:\Users\user\AppData\Local\Temp\tmp4600.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process created: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe "C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\haYzNpEpfrrs" /XML "C:\Users\user\AppData\Local\Temp\tmpBEE8.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process created: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe "C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process created: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe "C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process created: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe "C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Section loaded: windowscodecs.dll

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Invoice-BL. Payment TT $ 16945.99.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Invoice-BL. Payment TT $ 16945.99.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Invoice-BL. Payment TT $ 16945.99.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: jXdm.pdbSHA256T source: Invoice-BL. Payment TT $ 16945.99.exe, haYzNpEpfrrs.exe.0.dr
Source:	Binary string: jXdm.pdb source: Invoice-BL. Payment TT $ 16945.99.exe, haYzNpEpfrrs.exe.0.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3db1d88.2.raw.unpack, ESUYSjpJ1jS9kdLtPJ.cs	.Net Code: bZ6RcTZovb System.Reflection.Assembly.Load(byte[])
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, ESUYSjpJ1jS9kdLtPJ.cs	.Net Code: bZ6RcTZovb System.Reflection.Assembly.Load(byte[])
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.9120000.5.raw.unpack, ESUYSjpJ1jS9kdLtPJ.cs	.Net Code: bZ6RcTZovb System.Reflection.Assembly.Load(byte[])

Source: Invoice-BL. Payment TT $ 16945.99.exe

Static PE information: 0xF8F576FC [Fri May 12 00:19:08 2102 UTC]

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Code function: 0_2_078AA7F8 pushad ; iretd	0_2_078AA7F9
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 7_2_06F9A7F8 pushad ; iretd	7_2_06F9A7F9
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 13_2_0510D442 push eax; ret	13_2_0510D451
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 13_2_06FB2F10 push es; ret	13_2_06FB2F20
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 13_2_06FB8DB0 push es; ret	13_2_06FB8DC6
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Code function: 13_2_06FB759F push es; iretd	13_2_06FB75AC

Source: Invoice-BL. Payment TT $ 16945.99.exe	Static PE information: section name: .text entropy: 7.634839633173352
Source: haYzNpEpfrrs.exe.0.dr	Static PE information: section name: .text entropy: 7.634839633173352

Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3db1d88.2.raw.unpack, e7TN4PnOnqqB1XnTNa.cs	High entropy of concatenated method names: 'FFrFuGqQBU', 'BMeFLk1GBA', 'lPrIqSYHur', 'e2WIOQhYiD', 'L0RIdTCGaG', 'HbPIsCA6WY', 'Yq6IVZKF0w', 'Xk5IhatQ8H', 'UbdI4CeaLC', 'RehI7dH1Pt'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3db1d88.2.raw.unpack, KbC8tU5yG5eux3Yk9B.cs	High entropy of concatenated method names: 'tMXI6NgAUc', 'Uy1Ia4wCH4', 'dJDIYluVGn', 'TqGI5CPth2', 'f2WIfGV2mt', 'OaQIBI8puH', 'UpkID1ZNkG', 'EbEI1lRk0f', 'UXTIAfMvJ7', 'BJCIJWfpEG'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3db1d88.2.raw.unpack, VHZrGHG2wXeGJdZoyl.cs	High entropy of concatenated method names: 'ad6cXOews', 'leA6TiX2f', 'VGhaP7oNu', 'I8sLDPK7Z', 'AAL50BlnT', 'cn0nO5dCs', 'yymnUWyBnVTbC5pQWJ', 'As1InUuDaKRYiWyOlW', 'tM8lRpYOfOVRytVLSd', 'oof1jYsHj'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3db1d88.2.raw.unpack, s93qNXSGbNbWJP7aVIn.cs	High entropy of concatenated method names: 'ToString', 'iwRkYVRc9I', 'SCfk5GcGgu', 'tj9kn2bm7H', 'u1lkgqjkl2', 'h7lk2DPtRG', 'tIPkqvbl8e', 'SMukOWNs70', 'Vty6oPI4JjKha3MmK54', 'tBpLAhI2cpb55RNoj2Y'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3db1d88.2.raw.unpack, u0Gl3uSSaGneLr4jH2h.cs	High entropy of concatenated method names: 'fWkJ3jQsf9', 'aRPJzkwNLC', 'HRakTeqqfp', 'duikSwNtq2', 'MR8kG7cscI', 'tyikbQ1gvE', 'Sw2kRfJP1n', 'kdikwb6hWd', 'SYmklEEGd2', 'WEVkW0X7oj'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3db1d88.2.raw.unpack, LEdKxJREXSd8iRYU11.cs	High entropy of concatenated method names: 'M3wSeP7KFH', 'nkoSpwkSxe', 'vyGS95eux3', 'Dk9SxBw7TN', 'xnTSfNadWh', 'gMKSBbO9xr', 'SEXFV8lXNVgljsxMjy', 'rZ9UPcLuko3R22uOyd', 'fVSSSqvxHh', 'Q22SbibeJk'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3db1d88.2.raw.unpack, vGenll45Z3mdtqb5Ms.cs	High entropy of concatenated method names: 'IWNerDn8Sd', 'cu2ejLVaw0', 'Wc0ec3PhdN', 'QG2e6OvKQA', 'jiReukXpVD', 'xHeeaL7JpB', 'ioceLs5nP0', 'Kt2eYQoSTB', 'FSae5525QY', 'qgben7VNuH'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3db1d88.2.raw.unpack, dghlcHSTQVJdmyqA9rM.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'agZJPHIHmr', 'e10JQNm5PC', 'vLrJv2UI77', 'qedJNGIvlV', 'vlJJCcPMg5', 'cP1JMZyIrx', 'f6jJ0iq7fH'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3db1d88.2.raw.unpack, ODvLNRzM3FAwHc17Mj.cs	High entropy of concatenated method names: 'mxtJayHpxl', 'VZPJYDK50x', 'MVjJ55q5Ji', 'SoCJg1sl0j', 'B2oJ2i1M4A', 'Xc4JOjTXCb', 'jttJd9ET3H', 'tFiJXcppkc', 'fjYJr3Umcx', 'EyxJjOnT91'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3db1d88.2.raw.unpack, uLtONgybIk8sD7YNCT.cs	High entropy of concatenated method names: 'VKxAgqwtv5', 'Y8iA2VeALk', 'NJFAqga9IZ', 'lLnAODAyJs', 'jUjAdbWbBp', 'bYNAsici2A', 'ndeAV6895U', 'dHPAhHcTSH', 'R4nA4EVrAv', 'fREA7NBbWZ'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3db1d88.2.raw.unpack, ER1fQI040O1uAmAo6y.cs	High entropy of concatenated method names: 'LXED9qX5YL', 'PGgDxNOXBq', 'ToString', 'sC2Dl8T6Vc', 'dUFDWBpI6D', 'prFDIuBhIn', 'FxlDFdmdKj', 'WvVDoA1ZJv', 'TC3DeVQDJV', 'jStDpl4vJF'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3db1d88.2.raw.unpack, JWhIMKgbO9xr7L04SE.cs	High entropy of concatenated method names: 'pcBowH3LpJ', 'kNWoWduCxa', 'ybsoF2tWrq', 'rCcoedaOlA', 'xyWopviGYa', 'CEYF8vKWUT', 'dLHFEYbG5t', 'V9OFKNU5y1', 'AQ8FipUwqG', 'l23FyOtr7r'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3db1d88.2.raw.unpack, jZV4koSRBfvyB75E1vY.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'DptZAJ3Ma8', 'VjLZJKKbtW', 'MbrZkI4XFy', 'CkUZZ5AN8c', 'UYGZU8y15t', 'eryZmHv25D', 'vRtZXXPKmJ'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3db1d88.2.raw.unpack, MSd3BNM9dQZOh2hKMM.cs	High entropy of concatenated method names: 'ToString', 'lnHBPG0OMN', 'pkuB29NVAl', 'pSOBqBvNis', 'F9NBOKBoS9', 'IMrBdCZUSl', 'Cn7BsdMEEt', 'enyBVaw5mN', 'DwYBhmZ1uo', 'hTIB4p4a8C'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3db1d88.2.raw.unpack, ESUYSjpJ1jS9kdLtPJ.cs	High entropy of concatenated method names: 'FVMbw06EHF', 'qwEblBN0ZW', 'wpqbW7haQf', 'nqEbIfV0Tq', 'KKSbFdCGkf', 'tlNboBy3EM', 'piDbeVP9ms', 'kFRbp4IiFD', 'g9xbtjNjOY', 'i7tb92B8LH'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3db1d88.2.raw.unpack, P1eSWVE42NiH1cPGAT.cs	High entropy of concatenated method names: 'vXJDimZURa', 'ROfD3tHor8', 'w8n1TrRAYi', 'wSd1SYRUQU', 'euIDPFUEH8', 'jgiDQkuY3I', 'zNFDvvrbZp', 'MNCDNGfwLd', 'rptDCgCkJm', 'ey9DMlx9Uq'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3db1d88.2.raw.unpack, ShRkBn35B1kHB42EQe.cs	High entropy of concatenated method names: 'GsIJIIGmXj', 'C0TJFGJTOC', 'qZPJo4xovJ', 'eDKJeKvnfC', 'sAcJA40397', 'BqdJpvZYLx', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3db1d88.2.raw.unpack, jYCtcYKn20p3lckyj0.cs	High entropy of concatenated method names: 'eOoAfQHDlZ', 'P8hADQDi0I', 'nCqAAoI6PK', 'm9VAkGBgBE', 'RxnAUVR2OM', 'RlcAXWwd40', 'Dispose', 'MEd1lgIaen', 'EWi1Woh5UA', 'LEC1IxYudm'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3db1d88.2.raw.unpack, eP7KFHYxkowkSxeuGX.cs	High entropy of concatenated method names: 'YXFWNhOpVs', 'bR0WCRFrHA', 'AfZWMN2kw5', 'dxaW0KYR7Y', 'kxAW8uq7RG', 'AcxWEy4EiY', 'jQ6WKP9SuL', 'ITMWiicQWZ', 'ESMWygfyIX', 'ElLW3jdvfa'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3db1d88.2.raw.unpack, Vs3EWJWRqxX6oSNoJc.cs	High entropy of concatenated method names: 'Dispose', 'Tp3Sylckyj', 'SMsG2J2inU', 'eB2nOlsesE', 'TnsS3DRbOL', 'vP7SzKDtMG', 'ProcessDialogKey', 'KqZGTLtONg', 'cIkGS8sD7Y', 'QCTGGMhRkB'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3db1d88.2.raw.unpack, KPkJuIvMSB23gq0ZxP.cs	High entropy of concatenated method names: 'ivNHYPveOg', 'dt3H56AvWL', 'HAHHgjB2ZL', 'EE7H2fBZ4I', 'WI9HOM39FQ', 'x7eHdbLHqL', 'cuWHVe8YvY', 'tRbHh3lwft', 'J99H7Qd1b9', 'e2sHP5FSFc'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, e7TN4PnOnqqB1XnTNa.cs	High entropy of concatenated method names: 'FFrFuGqQBU', 'BMeFLk1GBA', 'lPrIqSYHur', 'e2WIOQhYiD', 'L0RIdTCGaG', 'HbPIsCA6WY', 'Yq6IVZKF0w', 'Xk5IhatQ8H', 'UbdI4CeaLC', 'RehI7dH1Pt'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, KbC8tU5yG5eux3Yk9B.cs	High entropy of concatenated method names: 'tMXI6NgAUc', 'Uy1Ia4wCH4', 'dJDIYluVGn', 'TqGI5CPth2', 'f2WIfGV2mt', 'OaQIBI8puH', 'UpkID1ZNkG', 'EbEI1lRk0f', 'UXTIAfMvJ7', 'BJCIJWfpEG'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, VHZrGHG2wXeGJdZoyl.cs	High entropy of concatenated method names: 'ad6cXOews', 'leA6TiX2f', 'VGhaP7oNu', 'I8sLDPK7Z', 'AAL50BlnT', 'cn0nO5dCs', 'yymnUWyBnVTbC5pQWJ', 'As1InUuDaKRYiWyOlW', 'tM8lRpYOfOVRytVLSd', 'oof1jYsHj'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, s93qNXSGbNbWJP7aVIn.cs	High entropy of concatenated method names: 'ToString', 'iwRkYVRc9I', 'SCfk5GcGgu', 'tj9kn2bm7H', 'u1lkgqjkl2', 'h7lk2DPtRG', 'tIPkqvbl8e', 'SMukOWNs70', 'Vty6oPI4JjKha3MmK54', 'tBpLAhI2cpb55RNoj2Y'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, u0Gl3uSSaGneLr4jH2h.cs	High entropy of concatenated method names: 'fWkJ3jQsf9', 'aRPJzkwNLC', 'HRakTeqqfp', 'duikSwNtq2', 'MR8kG7cscI', 'tyikbQ1gvE', 'Sw2kRfJP1n', 'kdikwb6hWd', 'SYmklEEGd2', 'WEVkW0X7oj'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, LEdKxJREXSd8iRYU11.cs	High entropy of concatenated method names: 'M3wSeP7KFH', 'nkoSpwkSxe', 'vyGS95eux3', 'Dk9SxBw7TN', 'xnTSfNadWh', 'gMKSBbO9xr', 'SEXFV8lXNVgljsxMjy', 'rZ9UPcLuko3R22uOyd', 'fVSSSqvxHh', 'Q22SbibeJk'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, vGenll45Z3mdtqb5Ms.cs	High entropy of concatenated method names: 'IWNerDn8Sd', 'cu2ejLVaw0', 'Wc0ec3PhdN', 'QG2e6OvKQA', 'jiReukXpVD', 'xHeeaL7JpB', 'ioceLs5nP0', 'Kt2eYQoSTB', 'FSae5525QY', 'qgben7VNuH'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, dghlcHSTQVJdmyqA9rM.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'agZJPHIHmr', 'e10JQNm5PC', 'vLrJv2UI77', 'qedJNGIvlV', 'vlJJCcPMg5', 'cP1JMZyIrx', 'f6jJ0iq7fH'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, ODvLNRzM3FAwHc17Mj.cs	High entropy of concatenated method names: 'mxtJayHpxl', 'VZPJYDK50x', 'MVjJ55q5Ji', 'SoCJg1sl0j', 'B2oJ2i1M4A', 'Xc4JOjTXCb', 'jttJd9ET3H', 'tFiJXcppkc', 'fjYJr3Umcx', 'EyxJjOnT91'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, uLtONgybIk8sD7YNCT.cs	High entropy of concatenated method names: 'VKxAgqwtv5', 'Y8iA2VeALk', 'NJFAqga9IZ', 'lLnAODAyJs', 'jUjAdbWbBp', 'bYNAsici2A', 'ndeAV6895U', 'dHPAhHcTSH', 'R4nA4EVrAv', 'fREA7NBbWZ'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, ER1fQI040O1uAmAo6y.cs	High entropy of concatenated method names: 'LXED9qX5YL', 'PGgDxNOXBq', 'ToString', 'sC2Dl8T6Vc', 'dUFDWBpI6D', 'prFDIuBhIn', 'FxlDFdmdKj', 'WvVDoA1ZJv', 'TC3DeVQDJV', 'jStDpl4vJF'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, JWhIMKgbO9xr7L04SE.cs	High entropy of concatenated method names: 'pcBowH3LpJ', 'kNWoWduCxa', 'ybsoF2tWrq', 'rCcoedaOlA', 'xyWopviGYa', 'CEYF8vKWUT', 'dLHFEYbG5t', 'V9OFKNU5y1', 'AQ8FipUwqG', 'l23FyOtr7r'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, jZV4koSRBfvyB75E1vY.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'DptZAJ3Ma8', 'VjLZJKKbtW', 'MbrZkI4XFy', 'CkUZZ5AN8c', 'UYGZU8y15t', 'eryZmHv25D', 'vRtZXXPKmJ'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, MSd3BNM9dQZOh2hKMM.cs	High entropy of concatenated method names: 'ToString', 'lnHBPG0OMN', 'pkuB29NVAl', 'pSOBqBvNis', 'F9NBOKBoS9', 'IMrBdCZUSl', 'Cn7BsdMEEt', 'enyBVaw5mN', 'DwYBhmZ1uo', 'hTIB4p4a8C'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, ESUYSjpJ1jS9kdLtPJ.cs	High entropy of concatenated method names: 'FVMbw06EHF', 'qwEblBN0ZW', 'wpqbW7haQf', 'nqEbIfV0Tq', 'KKSbFdCGkf', 'tlNboBy3EM', 'piDbeVP9ms', 'kFRbp4IiFD', 'g9xbtjNjOY', 'i7tb92B8LH'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, P1eSWVE42NiH1cPGAT.cs	High entropy of concatenated method names: 'vXJDimZURa', 'ROfD3tHor8', 'w8n1TrRAYi', 'wSd1SYRUQU', 'euIDPFUEH8', 'jgiDQkuY3I', 'zNFDvvrbZp', 'MNCDNGfwLd', 'rptDCgCkJm', 'ey9DMlx9Uq'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, ShRkBn35B1kHB42EQe.cs	High entropy of concatenated method names: 'GsIJIIGmXj', 'C0TJFGJTOC', 'qZPJo4xovJ', 'eDKJeKvnfC', 'sAcJA40397', 'BqdJpvZYLx', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, jYCtcYKn20p3lckyj0.cs	High entropy of concatenated method names: 'eOoAfQHDlZ', 'P8hADQDi0I', 'nCqAAoI6PK', 'm9VAkGBgBE', 'RxnAUVR2OM', 'RlcAXWwd40', 'Dispose', 'MEd1lgIaen', 'EWi1Woh5UA', 'LEC1IxYudm'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, eP7KFHYxkowkSxeuGX.cs	High entropy of concatenated method names: 'YXFWNhOpVs', 'bR0WCRFrHA', 'AfZWMN2kw5', 'dxaW0KYR7Y', 'kxAW8uq7RG', 'AcxWEy4EiY', 'jQ6WKP9SuL', 'ITMWiicQWZ', 'ESMWygfyIX', 'ElLW3jdvfa'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, Vs3EWJWRqxX6oSNoJc.cs	High entropy of concatenated method names: 'Dispose', 'Tp3Sylckyj', 'SMsG2J2inU', 'eB2nOlsesE', 'TnsS3DRbOL', 'vP7SzKDtMG', 'ProcessDialogKey', 'KqZGTLtONg', 'cIkGS8sD7Y', 'QCTGGMhRkB'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, KPkJuIvMSB23gq0ZxP.cs	High entropy of concatenated method names: 'ivNHYPveOg', 'dt3H56AvWL', 'HAHHgjB2ZL', 'EE7H2fBZ4I', 'WI9HOM39FQ', 'x7eHdbLHqL', 'cuWHVe8YvY', 'tRbHh3lwft', 'J99H7Qd1b9', 'e2sHP5FSFc'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.9120000.5.raw.unpack, e7TN4PnOnqqB1XnTNa.cs	High entropy of concatenated method names: 'FFrFuGqQBU', 'BMeFLk1GBA', 'lPrIqSYHur', 'e2WIOQhYiD', 'L0RIdTCGaG', 'HbPIsCA6WY', 'Yq6IVZKF0w', 'Xk5IhatQ8H', 'UbdI4CeaLC', 'RehI7dH1Pt'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.9120000.5.raw.unpack, KbC8tU5yG5eux3Yk9B.cs	High entropy of concatenated method names: 'tMXI6NgAUc', 'Uy1Ia4wCH4', 'dJDIYluVGn', 'TqGI5CPth2', 'f2WIfGV2mt', 'OaQIBI8puH', 'UpkID1ZNkG', 'EbEI1lRk0f', 'UXTIAfMvJ7', 'BJCIJWfpEG'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.9120000.5.raw.unpack, VHZrGHG2wXeGJdZoyl.cs	High entropy of concatenated method names: 'ad6cXOews', 'leA6TiX2f', 'VGhaP7oNu', 'I8sLDPK7Z', 'AAL50BlnT', 'cn0nO5dCs', 'yymnUWyBnVTbC5pQWJ', 'As1InUuDaKRYiWyOlW', 'tM8lRpYOfOVRytVLSd', 'oof1jYsHj'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.9120000.5.raw.unpack, s93qNXSGbNbWJP7aVIn.cs	High entropy of concatenated method names: 'ToString', 'iwRkYVRc9I', 'SCfk5GcGgu', 'tj9kn2bm7H', 'u1lkgqjkl2', 'h7lk2DPtRG', 'tIPkqvbl8e', 'SMukOWNs70', 'Vty6oPI4JjKha3MmK54', 'tBpLAhI2cpb55RNoj2Y'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.9120000.5.raw.unpack, u0Gl3uSSaGneLr4jH2h.cs	High entropy of concatenated method names: 'fWkJ3jQsf9', 'aRPJzkwNLC', 'HRakTeqqfp', 'duikSwNtq2', 'MR8kG7cscI', 'tyikbQ1gvE', 'Sw2kRfJP1n', 'kdikwb6hWd', 'SYmklEEGd2', 'WEVkW0X7oj'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.9120000.5.raw.unpack, LEdKxJREXSd8iRYU11.cs	High entropy of concatenated method names: 'M3wSeP7KFH', 'nkoSpwkSxe', 'vyGS95eux3', 'Dk9SxBw7TN', 'xnTSfNadWh', 'gMKSBbO9xr', 'SEXFV8lXNVgljsxMjy', 'rZ9UPcLuko3R22uOyd', 'fVSSSqvxHh', 'Q22SbibeJk'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.9120000.5.raw.unpack, vGenll45Z3mdtqb5Ms.cs	High entropy of concatenated method names: 'IWNerDn8Sd', 'cu2ejLVaw0', 'Wc0ec3PhdN', 'QG2e6OvKQA', 'jiReukXpVD', 'xHeeaL7JpB', 'ioceLs5nP0', 'Kt2eYQoSTB', 'FSae5525QY', 'qgben7VNuH'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.9120000.5.raw.unpack, dghlcHSTQVJdmyqA9rM.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'agZJPHIHmr', 'e10JQNm5PC', 'vLrJv2UI77', 'qedJNGIvlV', 'vlJJCcPMg5', 'cP1JMZyIrx', 'f6jJ0iq7fH'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.9120000.5.raw.unpack, ODvLNRzM3FAwHc17Mj.cs	High entropy of concatenated method names: 'mxtJayHpxl', 'VZPJYDK50x', 'MVjJ55q5Ji', 'SoCJg1sl0j', 'B2oJ2i1M4A', 'Xc4JOjTXCb', 'jttJd9ET3H', 'tFiJXcppkc', 'fjYJr3Umcx', 'EyxJjOnT91'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.9120000.5.raw.unpack, uLtONgybIk8sD7YNCT.cs	High entropy of concatenated method names: 'VKxAgqwtv5', 'Y8iA2VeALk', 'NJFAqga9IZ', 'lLnAODAyJs', 'jUjAdbWbBp', 'bYNAsici2A', 'ndeAV6895U', 'dHPAhHcTSH', 'R4nA4EVrAv', 'fREA7NBbWZ'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.9120000.5.raw.unpack, ER1fQI040O1uAmAo6y.cs	High entropy of concatenated method names: 'LXED9qX5YL', 'PGgDxNOXBq', 'ToString', 'sC2Dl8T6Vc', 'dUFDWBpI6D', 'prFDIuBhIn', 'FxlDFdmdKj', 'WvVDoA1ZJv', 'TC3DeVQDJV', 'jStDpl4vJF'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.9120000.5.raw.unpack, JWhIMKgbO9xr7L04SE.cs	High entropy of concatenated method names: 'pcBowH3LpJ', 'kNWoWduCxa', 'ybsoF2tWrq', 'rCcoedaOlA', 'xyWopviGYa', 'CEYF8vKWUT', 'dLHFEYbG5t', 'V9OFKNU5y1', 'AQ8FipUwqG', 'l23FyOtr7r'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.9120000.5.raw.unpack, jZV4koSRBfvyB75E1vY.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'DptZAJ3Ma8', 'VjLZJKKbtW', 'MbrZkI4XFy', 'CkUZZ5AN8c', 'UYGZU8y15t', 'eryZmHv25D', 'vRtZXXPKmJ'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.9120000.5.raw.unpack, MSd3BNM9dQZOh2hKMM.cs	High entropy of concatenated method names: 'ToString', 'lnHBPG0OMN', 'pkuB29NVAl', 'pSOBqBvNis', 'F9NBOKBoS9', 'IMrBdCZUSl', 'Cn7BsdMEEt', 'enyBVaw5mN', 'DwYBhmZ1uo', 'hTIB4p4a8C'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.9120000.5.raw.unpack, ESUYSjpJ1jS9kdLtPJ.cs	High entropy of concatenated method names: 'FVMbw06EHF', 'qwEblBN0ZW', 'wpqbW7haQf', 'nqEbIfV0Tq', 'KKSbFdCGkf', 'tlNboBy3EM', 'piDbeVP9ms', 'kFRbp4IiFD', 'g9xbtjNjOY', 'i7tb92B8LH'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.9120000.5.raw.unpack, P1eSWVE42NiH1cPGAT.cs	High entropy of concatenated method names: 'vXJDimZURa', 'ROfD3tHor8', 'w8n1TrRAYi', 'wSd1SYRUQU', 'euIDPFUEH8', 'jgiDQkuY3I', 'zNFDvvrbZp', 'MNCDNGfwLd', 'rptDCgCkJm', 'ey9DMlx9Uq'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.9120000.5.raw.unpack, ShRkBn35B1kHB42EQe.cs	High entropy of concatenated method names: 'GsIJIIGmXj', 'C0TJFGJTOC', 'qZPJo4xovJ', 'eDKJeKvnfC', 'sAcJA40397', 'BqdJpvZYLx', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.9120000.5.raw.unpack, jYCtcYKn20p3lckyj0.cs	High entropy of concatenated method names: 'eOoAfQHDlZ', 'P8hADQDi0I', 'nCqAAoI6PK', 'm9VAkGBgBE', 'RxnAUVR2OM', 'RlcAXWwd40', 'Dispose', 'MEd1lgIaen', 'EWi1Woh5UA', 'LEC1IxYudm'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.9120000.5.raw.unpack, eP7KFHYxkowkSxeuGX.cs	High entropy of concatenated method names: 'YXFWNhOpVs', 'bR0WCRFrHA', 'AfZWMN2kw5', 'dxaW0KYR7Y', 'kxAW8uq7RG', 'AcxWEy4EiY', 'jQ6WKP9SuL', 'ITMWiicQWZ', 'ESMWygfyIX', 'ElLW3jdvfa'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.9120000.5.raw.unpack, Vs3EWJWRqxX6oSNoJc.cs	High entropy of concatenated method names: 'Dispose', 'Tp3Sylckyj', 'SMsG2J2inU', 'eB2nOlsesE', 'TnsS3DRbOL', 'vP7SzKDtMG', 'ProcessDialogKey', 'KqZGTLtONg', 'cIkGS8sD7Y', 'QCTGGMhRkB'
Source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.9120000.5.raw.unpack, KPkJuIvMSB23gq0ZxP.cs	High entropy of concatenated method names: 'ivNHYPveOg', 'dt3H56AvWL', 'HAHHgjB2ZL', 'EE7H2fBZ4I', 'WI9HOM39FQ', 'x7eHdbLHqL', 'cuWHVe8YvY', 'tRbHh3lwft', 'J99H7Qd1b9', 'e2sHP5FSFc'

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	File created: \invoice-bl. payment tt $ 16945.99.exe
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	File created: \invoice-bl. payment tt $ 16945.99.exe
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	File created: \invoice-bl. payment tt $ 16945.99.exe
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	File created: \invoice-bl. payment tt $ 16945.99.exe	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	File created: \invoice-bl. payment tt $ 16945.99.exe	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	File created: \invoice-bl. payment tt $ 16945.99.exe	Jump to behavior

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe

File created: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\haYzNpEpfrrs" /XML "C:\Users\user\AppData\Local\Temp\tmp4600.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Invoice-BL. Payment TT $ 16945.99.exe PID: 6880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: haYzNpEpfrrs.exe PID: 7264, type: MEMORYSTR

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Memory allocated: 1110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Memory allocated: 2B00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Memory allocated: 4B00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Memory allocated: 92F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Memory allocated: A2F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Memory allocated: A510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Memory allocated: B510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Memory allocated: 2670000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Memory allocated: 27F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Memory allocated: 47F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Memory allocated: 23E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Memory allocated: 2520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Memory allocated: 4520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Memory allocated: 8950000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Memory allocated: 9950000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Memory allocated: 9B60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Memory allocated: AB60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Memory allocated: 2950000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Memory allocated: 2B70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Memory allocated: 4B70000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 239884	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 239766	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 239645	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 239531	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 239421	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 239311	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 239194	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 239078	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 238969	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 238844	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 238734	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 238624	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 238467	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 238334	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 238207	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 237703	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 237516	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 237293	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 237164	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 237031	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 238875	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 238744	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 238632	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 238525	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 238408	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 238281	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 238171	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 238062	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 237953	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 237844	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 237722	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 237594	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 237484	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 237375	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 237265	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Window / User API: threadDelayed 1496	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Window / User API: threadDelayed 1482	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8762	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 856	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Window / User API: threadDelayed 1461	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Window / User API: threadDelayed 2924	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Window / User API: threadDelayed 1010	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Window / User API: threadDelayed 1954	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Window / User API: threadDelayed 500
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Window / User API: threadDelayed 4056

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe TID: 3288	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe TID: 3288	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe TID: 3288	Thread sleep time: -239884s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe TID: 3288	Thread sleep time: -239766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe TID: 3288	Thread sleep time: -239645s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe TID: 3288	Thread sleep time: -239531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe TID: 3288	Thread sleep time: -239421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe TID: 3288	Thread sleep time: -239311s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe TID: 3288	Thread sleep time: -239194s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe TID: 3288	Thread sleep time: -239078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe TID: 3288	Thread sleep time: -238969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe TID: 3288	Thread sleep time: -238844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe TID: 3288	Thread sleep time: -238734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe TID: 3288	Thread sleep time: -238624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe TID: 3288	Thread sleep time: -238467s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe TID: 3288	Thread sleep time: -238334s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe TID: 3288	Thread sleep time: -238207s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe TID: 3288	Thread sleep time: -237703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe TID: 3288	Thread sleep time: -237516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe TID: 3288	Thread sleep time: -237293s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe TID: 3288	Thread sleep time: -237164s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe TID: 3288	Thread sleep time: -237031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe TID: 6112	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7260	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe TID: 7668	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe TID: 7248	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe TID: 7320	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe TID: 7320	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe TID: 7320	Thread sleep time: -238875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe TID: 7320	Thread sleep time: -238744s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe TID: 7320	Thread sleep time: -238632s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe TID: 7320	Thread sleep time: -238525s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe TID: 7320	Thread sleep time: -238408s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe TID: 7320	Thread sleep time: -238281s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe TID: 7320	Thread sleep time: -238171s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe TID: 7320	Thread sleep time: -238062s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe TID: 7320	Thread sleep time: -237953s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe TID: 7320	Thread sleep time: -237844s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe TID: 7320	Thread sleep time: -237722s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe TID: 7320	Thread sleep time: -237594s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe TID: 7320	Thread sleep time: -237484s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe TID: 7320	Thread sleep time: -237375s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe TID: 7320	Thread sleep time: -237265s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe TID: 7300	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe TID: 7776	Thread sleep time: -13835058055282155s >= -30000s
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe TID: 7580	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 239884	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 239766	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 239645	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 239531	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 239421	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 239311	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 239194	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 239078	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 238969	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 238844	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 238734	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 238624	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 238467	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 238334	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 238207	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 237703	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 237516	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 237293	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 237164	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 237031	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 238875	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 238744	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 238632	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 238525	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 238408	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 238281	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 238171	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 238062	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 237953	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 237844	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 237722	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 237594	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 237484	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 237375	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 237265	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Thread delayed: delay time: 922337203685477

Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800151668.0000000000C92000.00000004.00000020.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1849868035.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe"
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Memory written: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Memory written: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\haYzNpEpfrrs" /XML "C:\Users\user\AppData\Local\Temp\tmp4600.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Process created: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe "C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\haYzNpEpfrrs" /XML "C:\Users\user\AppData\Local\Temp\tmpBEE8.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process created: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe "C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process created: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe "C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Process created: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe "C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Queries volume information: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Queries volume information: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1816187695.0000000007B69000.00000004.00000020.00020000.00000000.sdmp, haYzNpEpfrrs.exe, 0000000D.00000002.1872656825.000000000601D000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3cd4cb0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3cd4cb0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Invoice-BL. Payment TT $ 16945.99.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3c89a90.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3c89a90.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1798528235.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1687136757.0000000003CCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1687136757.0000000003B01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Invoice-BL. Payment TT $ 16945.99.exe PID: 6880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Invoice-BL. Payment TT $ 16945.99.exe PID: 7216, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: haYzNpEpfrrs.exe PID: 7556, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumE#
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002A12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $kq1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: JaxxE#
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002A12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLRkqX
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002A12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLRkq
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusE#
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002A12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $kq%appdata%`,kqdC:\Users\user\AppData\Roaming`,kqdC:\Users\user\AppData\Roaming\Binance
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002A12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $kq&%localappdata%\Coinomi\Coinomi\walletsLRkq
Source: Invoice-BL. Payment TT $ 16945.99.exe, 00000006.00000002.1800626325.0000000002A12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $kq5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-BL. Payment TT $ 16945.99.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Users\user\AppData\Roaming\haYzNpEpfrrs.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\

Source: Yara match	File source: 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1854830160.0000000002E6C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1800626325.0000000002A12000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Invoice-BL. Payment TT $ 16945.99.exe PID: 7216, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: haYzNpEpfrrs.exe PID: 7556, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3cd4cb0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3cd4cb0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Invoice-BL. Payment TT $ 16945.99.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3c89a90.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3c89a90.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Invoice-BL. Payment TT $ 16945.99.exe.3bfa470.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.1800626325.0000000002886000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1798528235.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1854830160.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1687136757.0000000003CCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1687136757.0000000003B01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Invoice-BL. Payment TT $ 16945.99.exe PID: 6880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Invoice-BL. Payment TT $ 16945.99.exe PID: 7216, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: haYzNpEpfrrs.exe PID: 7556, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 Scheduled Task/Job	111 Process Injection	1 Masquerading	1 OS Credential Dumping	331 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	11 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Invoice-BL. Payment TT $ 16945.99.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Invoice-BL. Payment TT $ 16945.99.exe