Edit tour

Windows Analysis Report
Payslip_October_2024_pdf.exe

Overview

General Information

Sample name:	Payslip_October_2024_pdf.exe
Analysis ID:	1548311
MD5:	0d4985c828f3f9f6974b1602c92ee962
SHA1:	0f11a5deef40a3dec6cb8cb0cc6ae057bd56c2dd
SHA256:	59cbe4e681c4371b18a5f6d457369560ce9e4f0eda5a39de1acab8b5bdf73bda
Tags:	AgentTeslaexeuser-threatcat_ch
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Contains functionality to log keystrokes (.Net Source)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses FTP

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Payslip_October_2024_pdf.exe (PID: 2888 cmdline: "C:\Users\user\Desktop\Payslip_October_2024_pdf.exe" MD5: 0D4985C828F3F9F6974B1602C92EE962)

Payslip_October_2024_pdf.exe (PID: 528 cmdline: "C:\Users\user\Desktop\Payslip_October_2024_pdf.exe" MD5: 0D4985C828F3F9F6974B1602C92EE962)

sgxIb.exe (PID: 432 cmdline: "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe" MD5: 0D4985C828F3F9F6974B1602C92EE962)

sgxIb.exe (PID: 6552 cmdline: "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe" MD5: 0D4985C828F3F9F6974B1602C92EE962)

sgxIb.exe (PID: 6192 cmdline: "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe" MD5: 0D4985C828F3F9F6974B1602C92EE962)

sgxIb.exe (PID: 2800 cmdline: "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe" MD5: 0D4985C828F3F9F6974B1602C92EE962)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.haliza.com.my", "Username": "origin@haliza.com.my", "Password": "JesusChrist007$"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2252894462.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2252894462.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.2249540840.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2249540840.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.4494723073.0000000003091000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.4494723073.0000000003091000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.2252894462.0000000002F7C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.4494723073.00000000030BC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.4494330855.0000000002D0B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.4494330855.0000000002D0B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2033528319.00000000041EC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2033528319.00000000041EC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Payslip_October_2024_pdf.exe PID: 2888	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Payslip_October_2024_pdf.exe PID: 2888	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Payslip_October_2024_pdf.exe PID: 2888	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Payslip_October_2024_pdf.exe PID: 528	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Payslip_October_2024_pdf.exe PID: 528	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: sgxIb.exe PID: 432	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: sgxIb.exe PID: 6552	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: sgxIb.exe PID: 6552	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: sgxIb.exe PID: 2800	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: sgxIb.exe PID: 2800	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Payslip_October_2024_pdf.exe.44f8068.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Payslip_October_2024_pdf.exe.44f8068.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Payslip_October_2024_pdf.exe.44f8068.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3317c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x331ee:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33278:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3330a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33374:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x333e6:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3347c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3350c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Payslip_October_2024_pdf.exe.44f8068.3.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x30370:$s2: GetPrivateProfileString 0x2f9fa:$s3: get_OSFullName 0x3116b:$s5: remove_Key 0x31357:$s5: remove_Key 0x32275:$s6: FtpWebRequest 0x3315e:$s7: logins 0x336d0:$s7: logins 0x36427:$s7: logins 0x36493:$s7: logins 0x37f12:$s7: logins 0x3702d:$s9: 1.85 (Hash, version 2, native byte-order)
5.2.sgxIb.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.sgxIb.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.2.sgxIb.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34f7c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34fee:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35078:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3510a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35174:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x351e6:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3527c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3530c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.sgxIb.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x32170:$s2: GetPrivateProfileString 0x317fa:$s3: get_OSFullName 0x32f6b:$s5: remove_Key 0x33157:$s5: remove_Key 0x34075:$s6: FtpWebRequest 0x34f5e:$s7: logins 0x354d0:$s7: logins 0x38227:$s7: logins 0x38293:$s7: logins 0x39d12:$s7: logins 0x38e2d:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.Payslip_October_2024_pdf.exe.44f8068.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Payslip_October_2024_pdf.exe.44f8068.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Payslip_October_2024_pdf.exe.44f8068.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34f7c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x7179c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xaddbc:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34fee:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x7180e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xade2e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35078:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x71898:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xadeb8:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3510a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x7192a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xadf4a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35174:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x71994:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xadfb4:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x351e6:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x71a06:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xae026:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3527c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x71a9c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xae0bc:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.Payslip_October_2024_pdf.exe.44f8068.3.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x32170:$s2: GetPrivateProfileString 0x6e990:$s2: GetPrivateProfileString 0xaafb0:$s2: GetPrivateProfileString 0x317fa:$s3: get_OSFullName 0x6e01a:$s3: get_OSFullName 0xaa63a:$s3: get_OSFullName 0x32f6b:$s5: remove_Key 0x33157:$s5: remove_Key 0x6f78b:$s5: remove_Key 0x6f977:$s5: remove_Key 0xabdab:$s5: remove_Key 0xabf97:$s5: remove_Key 0x34075:$s6: FtpWebRequest 0x70895:$s6: FtpWebRequest 0xaceb5:$s6: FtpWebRequest 0x34f5e:$s7: logins 0x354d0:$s7: logins 0x38227:$s7: logins 0x38293:$s7: logins 0x39d12:$s7: logins 0x7177e:$s7: logins
0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0xb339c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xefbbc:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x12c1dc:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xb340e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xefc2e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x12c24e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xb3498:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xefcb8:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x12c2d8:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xb352a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xefd4a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x12c36a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xb3594:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xefdb4:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x12c3d4:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xb3606:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xefe26:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x12c446:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xb369c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xefebc:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x12c4dc:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0xb0590:$s2: GetPrivateProfileString 0xecdb0:$s2: GetPrivateProfileString 0x1293d0:$s2: GetPrivateProfileString 0xafc1a:$s3: get_OSFullName 0xec43a:$s3: get_OSFullName 0x128a5a:$s3: get_OSFullName 0xb138b:$s5: remove_Key 0xb1577:$s5: remove_Key 0xedbab:$s5: remove_Key 0xedd97:$s5: remove_Key 0x12a1cb:$s5: remove_Key 0x12a3b7:$s5: remove_Key 0xb2495:$s6: FtpWebRequest 0xeecb5:$s6: FtpWebRequest 0x12b2d5:$s6: FtpWebRequest 0xb337e:$s7: logins 0xb38f0:$s7: logins 0xb6647:$s7: logins 0xb66b3:$s7: logins 0xb8132:$s7: logins 0xefb9e:$s7: logins
0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x1317bc:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16dfdc:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1aa5fc:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x13182e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16e04e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1aa66e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1318b8:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16e0d8:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1aa6f8:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x13194a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16e16a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1aa78a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1319b4:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16e1d4:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x1aa7f4:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x131a26:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16e246:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x1aa866:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x131abc:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16e2dc:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x1aa8fc:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x12e9b0:$s2: GetPrivateProfileString 0x16b1d0:$s2: GetPrivateProfileString 0x1a77f0:$s2: GetPrivateProfileString 0x12e03a:$s3: get_OSFullName 0x16a85a:$s3: get_OSFullName 0x1a6e7a:$s3: get_OSFullName 0x12f7ab:$s5: remove_Key 0x12f997:$s5: remove_Key 0x16bfcb:$s5: remove_Key 0x16c1b7:$s5: remove_Key 0x1a85eb:$s5: remove_Key 0x1a87d7:$s5: remove_Key 0x1308b5:$s6: FtpWebRequest 0x16d0d5:$s6: FtpWebRequest 0x1a96f5:$s6: FtpWebRequest 0x13179e:$s7: logins 0x131d10:$s7: logins 0x134a67:$s7: logins 0x134ad3:$s7: logins 0x136552:$s7: logins 0x16dfbe:$s7: logins
Click to see the 17 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe, ProcessId: 528, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sgxIb

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-04T10:13:19.167320+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.5	49717	TCP
2024-11-04T10:13:58.256553+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.5	49929	TCP

ET MALWARE AgentTesla Exfil via FTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-04T10:13:19.381403+0100	2029927	1	A Network Trojan was detected	192.168.2.5	49716	110.4.45.197	21	TCP
2024-11-04T10:13:27.924804+0100	2029927	1	A Network Trojan was detected	192.168.2.5	49745	110.4.45.197	21	TCP

ETPRO MALWARE Agent Tesla CnC Exfil Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-04T10:13:20.357961+0100	2855542	1	A Network Trojan was detected	192.168.2.5	49722	110.4.45.197	61813	TCP
2024-11-04T10:13:20.363581+0100	2855542	1	A Network Trojan was detected	192.168.2.5	49722	110.4.45.197	61813	TCP
2024-11-04T10:13:28.852402+0100	2855542	1	A Network Trojan was detected	192.168.2.5	49766	110.4.45.197	64083	TCP
2024-11-04T10:13:28.863602+0100	2855542	1	A Network Trojan was detected	192.168.2.5	49766	110.4.45.197	64083	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.Payslip_October_2024_pdf.exe.44f8068.3.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.haliza.com.my", "Username": "origin@haliza.com.my", "Password": "JesusChrist007$"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

ReversingLabs: Detection: 34%

Multi AV Scanner detection for submitted file

Source: Payslip_October_2024_pdf.exe

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Payslip_October_2024_pdf.exe

Joe Sandbox ML: detected

Source: Payslip_October_2024_pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49739 version: TLS 1.2

Source: Payslip_October_2024_pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: eopJ.pdb source: Payslip_October_2024_pdf.exe, sgxIb.exe.3.dr
Source:	Binary string: eopJ.pdbSHA256 source: Payslip_October_2024_pdf.exe, sgxIb.exe.3.dr

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 4x nop then jmp 06D1B7C8h		0_2_06D1B06B
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 4x nop then jmp 0B3CB7C8h		4_2_0B3CB06B

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.5:49722 -> 110.4.45.197:61813
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.5:49766 -> 110.4.45.197:64083
Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.5:49716 -> 110.4.45.197:21
Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.5:49745 -> 110.4.45.197:21

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 110.4.45.197 ports 62073,63363,49933,62375,64015,65027,56294,58054,58497,57320,56137,52591,54378,50752,53227,53903,49628,65335,58781,64647,58161,61813,1,2,61927,50066,53852,53156,57499,60003,53855,53556,51512,53414,64083,49362,56946,21

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.5:49712 -> 110.4.45.197:53855

Source: Joe Sandbox View	IP Address: 110.4.45.197 110.4.45.197
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: EXABYTES-AS-APExaBytesNetworkSdnBhdMY EXABYTES-AS-APExaBytesNetworkSdnBhdMY

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.5:49717
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.5:49929

Source: unknown

FTP traffic detected: 110.4.45.197:21 -> 192.168.2.5:49709 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 26 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 26 of 50 allowed.220-Local time is now 17:13. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 26 of 50 allowed.220-Local time is now 17:13. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 26 of 50 allowed.220-Local time is now 17:13. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 26 of 50 allowed.220-Local time is now 17:13. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ftp.haliza.com.my

Source: Payslip_October_2024_pdf.exe, 00000003.00000002.4494330855.00000000030B6000.00000004.00000800.00020000.00000000.sdmp, Payslip_October_2024_pdf.exe, 00000003.00000002.4494330855.0000000002EB4000.00000004.00000800.00020000.00000000.sdmp, Payslip_October_2024_pdf.exe, 00000003.00000002.4494330855.0000000002EDB000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000005.00000002.2252894462.0000000002F7C000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000008.00000002.4494723073.0000000003468000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000008.00000002.4494723073.0000000003257000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000008.00000002.4494723073.00000000030BC000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000008.00000002.4494723073.00000000032D6000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000008.00000002.4494723073.0000000003291000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.haliza.com.my
Source: Payslip_October_2024_pdf.exe, 00000003.00000002.4494330855.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000005.00000002.2252894462.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000008.00000002.4494723073.000000000304C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Payslip_October_2024_pdf.exe, 00000000.00000002.2033528319.00000000041EC000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000005.00000002.2249540840.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Payslip_October_2024_pdf.exe, 00000000.00000002.2033528319.00000000041EC000.00000004.00000800.00020000.00000000.sdmp, Payslip_October_2024_pdf.exe, 00000003.00000002.4494330855.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000005.00000002.2249540840.0000000000402000.00000040.00000400.00020000.00000000.sdmp, sgxIb.exe, 00000005.00000002.2252894462.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000008.00000002.4494723073.000000000304C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: sgxIb.exe, 00000005.00000002.2252894462.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000008.00000002.4494723073.000000000304C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: sgxIb.exe, 00000005.00000002.2252894462.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000008.00000002.4494723073.000000000304C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49739 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.Payslip_October_2024_pdf.exe.44f8068.3.raw.unpack, SKTzxzsJw.cs

.Net Code: _71ZRqC1D

Installs a global keyboard hook

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\Payslip_October_2024_pdf.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe			Jump to behavior

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.Payslip_October_2024_pdf.exe.44f8068.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Payslip_October_2024_pdf.exe.44f8068.3.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 5.2.sgxIb.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.sgxIb.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.Payslip_October_2024_pdf.exe.44f8068.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Payslip_October_2024_pdf.exe.44f8068.3.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Payslip_October_2024_pdf.exe

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_02744210	0_2_02744210
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_02746F90	0_2_02746F90
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_0274DBDC	0_2_0274DBDC
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_054DD470	0_2_054DD470
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_054DC1A3	0_2_054DC1A3
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_054DFB78	0_2_054DFB78
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_06D1CFC8	0_2_06D1CFC8
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_06D10798	0_2_06D10798
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_06D10789	0_2_06D10789
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_06D1859F	0_2_06D1859F
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_06D185B0	0_2_06D185B0
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_06D19548	0_2_06D19548
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_06D19538	0_2_06D19538
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_06D17300	0_2_06D17300
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_06D16ED8	0_2_06D16ED8
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_06D10A17	0_2_06D10A17
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_06D10A28	0_2_06D10A28
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_06D189E8	0_2_06D189E8
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 3_2_01094198	3_2_01094198
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 3_2_0109E9F8	3_2_0109E9F8
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 3_2_01094A68	3_2_01094A68
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 3_2_0109AD90	3_2_0109AD90
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 3_2_01093E50	3_2_01093E50
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 3_2_06847E90	3_2_06847E90
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 3_2_068456A8	3_2_068456A8
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 3_2_06846700	3_2_06846700
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 3_2_0684B342	3_2_0684B342
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 3_2_06843578	3_2_06843578
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 3_2_0684E788	3_2_0684E788
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 3_2_068477B0	3_2_068477B0
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 3_2_06842710	3_2_06842710
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 3_2_06840040	3_2_06840040
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 3_2_06845DF7	3_2_06845DF7
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 3_2_0684003E	3_2_0684003E
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 4_2_01674210	4_2_01674210
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 4_2_01676F90	4_2_01676F90
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 4_2_0167DBDC	4_2_0167DBDC
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 4_2_0B3CCFC8	4_2_0B3CCFC8
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 4_2_0B3C0A28	4_2_0B3C0A28
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 4_2_0B3C0A17	4_2_0B3C0A17
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 4_2_0B3C89E8	4_2_0B3C89E8
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 4_2_0B3C6ED8	4_2_0B3C6ED8
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 4_2_0B3C7300	4_2_0B3C7300
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 4_2_0B3C8340	4_2_0B3C8340
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 4_2_0B3C0798	4_2_0B3C0798
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 4_2_0B3C0789	4_2_0B3C0789
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 4_2_0B3C9538	4_2_0B3C9538
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 4_2_0B3C9548	4_2_0B3C9548
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 4_2_0B3C85B0	4_2_0B3C85B0
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 4_2_0B3C859F	4_2_0B3C859F
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 5_2_02CE4A68	5_2_02CE4A68
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 5_2_02CEE8D8	5_2_02CEE8D8
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 5_2_02CE3E50	5_2_02CE3E50
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 5_2_02CE4198	5_2_02CE4198
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 5_2_06BD56B0	5_2_06BD56B0
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 5_2_06BD6708	5_2_06BD6708
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 5_2_06BD3580	5_2_06BD3580
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 5_2_06BD7E98	5_2_06BD7E98
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 5_2_06BD77B8	5_2_06BD77B8
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 5_2_06BDE4D0	5_2_06BDE4D0
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 5_2_06BD0040	5_2_06BD0040
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 5_2_06BD5DFF	5_2_06BD5DFF
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 5_2_06BD0006	5_2_06BD0006
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 7_2_03024210	7_2_03024210
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 7_2_03026F90	7_2_03026F90
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 7_2_0302DBDC	7_2_0302DBDC
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 7_2_056D02A0	7_2_056D02A0
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 7_2_056D0290	7_2_056D0290
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 8_2_013CA4B0	8_2_013CA4B0
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 8_2_013CE8E8	8_2_013CE8E8
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 8_2_013C4A68	8_2_013C4A68
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 8_2_013C3E50	8_2_013C3E50
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 8_2_013C4198	8_2_013C4198
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 8_2_013CAC80	8_2_013CAC80
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 8_2_06DB7E98	8_2_06DB7E98
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 8_2_06DB56B0	8_2_06DB56B0
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 8_2_06DB6708	8_2_06DB6708
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 8_2_06DB3580	8_2_06DB3580
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 8_2_06DB5E10	8_2_06DB5E10
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 8_2_06DB77B8	8_2_06DB77B8
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 8_2_06DB0040	8_2_06DB0040
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 8_2_06DB0007	8_2_06DB0007

Source: Payslip_October_2024_pdf.exe, 00000000.00000002.2033528319.00000000041EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Payslip_October_2024_pdf.exe
Source: Payslip_October_2024_pdf.exe, 00000000.00000002.2033528319.00000000041EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename472d0e4f-32a4-4ea2-b137-597340264f0d.exe4 vs Payslip_October_2024_pdf.exe
Source: Payslip_October_2024_pdf.exe, 00000000.00000002.2033211026.0000000002BD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename472d0e4f-32a4-4ea2-b137-597340264f0d.exe4 vs Payslip_October_2024_pdf.exe
Source: Payslip_October_2024_pdf.exe, 00000000.00000002.2045308094.00000000077C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Payslip_October_2024_pdf.exe
Source: Payslip_October_2024_pdf.exe, 00000000.00000002.2032307215.0000000000A4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Payslip_October_2024_pdf.exe
Source: Payslip_October_2024_pdf.exe, 00000000.00000000.2022449219.0000000000582000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameeopJ.exe. vs Payslip_October_2024_pdf.exe
Source: Payslip_October_2024_pdf.exe, 00000003.00000002.4490410074.00000000009E9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Payslip_October_2024_pdf.exe
Source: Payslip_October_2024_pdf.exe	Binary or memory string: OriginalFilenameeopJ.exe. vs Payslip_October_2024_pdf.exe

Source: Payslip_October_2024_pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.Payslip_October_2024_pdf.exe.44f8068.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Payslip_October_2024_pdf.exe.44f8068.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 5.2.sgxIb.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.sgxIb.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.Payslip_October_2024_pdf.exe.44f8068.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Payslip_October_2024_pdf.exe.44f8068.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: Payslip_October_2024_pdf.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: sgxIb.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Payslip_October_2024_pdf.exe.44f8068.3.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payslip_October_2024_pdf.exe.44f8068.3.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payslip_October_2024_pdf.exe.44f8068.3.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payslip_October_2024_pdf.exe.44f8068.3.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payslip_October_2024_pdf.exe.44f8068.3.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payslip_October_2024_pdf.exe.44f8068.3.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payslip_October_2024_pdf.exe.44f8068.3.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payslip_October_2024_pdf.exe.44f8068.3.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 0.2.Payslip_October_2024_pdf.exe.77c0000.6.raw.unpack, VoothtBB9ZTWwF5DWY.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Payslip_October_2024_pdf.exe.77c0000.6.raw.unpack, VoothtBB9ZTWwF5DWY.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payslip_October_2024_pdf.exe.77c0000.6.raw.unpack, VoothtBB9ZTWwF5DWY.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, HhRnp80YNIZjcH3iKc.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, VoothtBB9ZTWwF5DWY.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, VoothtBB9ZTWwF5DWY.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, VoothtBB9ZTWwF5DWY.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, HhRnp80YNIZjcH3iKc.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payslip_October_2024_pdf.exe.77c0000.6.raw.unpack, HhRnp80YNIZjcH3iKc.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, VoothtBB9ZTWwF5DWY.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, VoothtBB9ZTWwF5DWY.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, VoothtBB9ZTWwF5DWY.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@9/4@2/2

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Payslip_October_2024_pdf.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

Mutant created: NULL

Source: Payslip_October_2024_pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Payslip_October_2024_pdf.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Payslip_October_2024_pdf.exe, 00000000.00000000.2022449219.0000000000582000.00000002.00000001.01000000.00000003.sdmp, sgxIb.exe.3.dr

Binary or memory string: SELECT mv.code, mv.title, mv.image, gr.description AS genre, mv.year, mv.seconds, mv.membership_types_id AS id, mv.description, mv.code AS code2 FROM movies_record mr INNER JOIN movies mv ON (mv.code = mr.movie_code) INNER JOIN genres gr ON (mv.genre_id = gr.id) ;WHERE mr.membership_id = {0}

Source: Payslip_October_2024_pdf.exe

ReversingLabs: Detection: 34%

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

File read: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe "C:\Users\user\Desktop\Payslip_October_2024_pdf.exe"
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process created: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe "C:\Users\user\Desktop\Payslip_October_2024_pdf.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process created: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe "C:\Users\user\Desktop\Payslip_October_2024_pdf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Payslip_October_2024_pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Payslip_October_2024_pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Payslip_October_2024_pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: eopJ.pdb source: Payslip_October_2024_pdf.exe, sgxIb.exe.3.dr
Source:	Binary string: eopJ.pdbSHA256 source: Payslip_October_2024_pdf.exe, sgxIb.exe.3.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, VoothtBB9ZTWwF5DWY.cs	.Net Code: AbTT8O94en System.Reflection.Assembly.Load(byte[])
Source: 0.2.Payslip_October_2024_pdf.exe.54b0000.5.raw.unpack, XlF5VlCIHRSQX8M5eh.cs	.Net Code: _200C_200C_202D_206C_200B_206A_206D_200B_200D_200C_202D_206A_206D_202A_206A_206B_202B_206C_202D_200B_202E_202B_202A_206C_206A_206D_202D_206B_206D_206B_200D_202B_202D_206C_206F_206C_200B_202B_206A_206D_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.Payslip_October_2024_pdf.exe.39d72f8.1.raw.unpack, XlF5VlCIHRSQX8M5eh.cs	.Net Code: _200C_200C_202D_206C_200B_206A_206D_200B_200D_200C_202D_206A_206D_202A_206A_206B_202B_206C_202D_200B_202E_202B_202A_206C_206A_206D_202D_206B_206D_206B_200D_202B_202D_206C_206F_206C_200B_202B_206A_206D_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, VoothtBB9ZTWwF5DWY.cs	.Net Code: AbTT8O94en System.Reflection.Assembly.Load(byte[])
Source: 0.2.Payslip_October_2024_pdf.exe.77c0000.6.raw.unpack, VoothtBB9ZTWwF5DWY.cs	.Net Code: AbTT8O94en System.Reflection.Assembly.Load(byte[])
Source: 0.2.Payslip_October_2024_pdf.exe.39b72d8.4.raw.unpack, XlF5VlCIHRSQX8M5eh.cs	.Net Code: _200C_200C_202D_206C_200B_206A_206D_200B_200D_200C_202D_206A_206D_202A_206A_206B_202B_206C_202D_200B_202E_202B_202A_206C_206A_206D_202D_206B_206D_206B_200D_202B_202D_206C_206F_206C_200B_202B_206A_206D_202E System.Reflection.Assembly.Load(byte[])

Source: Payslip_October_2024_pdf.exe

Static PE information: 0xA7C547C1 [Wed Mar 12 19:47:13 2059 UTC]

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_0274E768 pushfd ; retf	0_2_0274E769
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 4_2_0167E768 pushfd ; retf	4_2_0167E769
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 5_2_02CEF7C8 pushad ; retf	5_2_02CEF7D1
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 5_2_02CE0C55 push edi; retf	5_2_02CE0C7A
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 7_2_0302E768 pushfd ; retf	7_2_0302E769
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 8_2_013CF7C8 pushad ; retf	8_2_013CF7D1
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 8_2_013C0C55 push edi; retf	8_2_013C0C7A

Source: Payslip_October_2024_pdf.exe	Static PE information: section name: .text entropy: 7.659760721121941
Source: sgxIb.exe.3.dr	Static PE information: section name: .text entropy: 7.659760721121941

Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, LeX4FpN6i9lh5NCcFF.cs	High entropy of concatenated method names: 'iRxIsgdJHo', 'jePIvoH9pP', 'zBoIjiV0hj', 'MtDjUDHBr4', 'B88jzlmJx3', 'Ss3Io40h8x', 'dkDImay5pP', 'zKPIaxLqGg', 'YV4IFCDoO6', 'OSLITf2MoY'
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, YbeSGBq7nB9iDUIwaD.cs	High entropy of concatenated method names: 'KgWP5D9VQY', 'Tb0PZ0npiJ', 'dnSvAWySKC', 'XcZvwqeVqw', 'hF8vuws7mT', 'Nm2vJHqUc7', 'F3mvNcQZ6s', 'p5KvR9anqa', 'Cj3vnu3rUO', 'sp7vcbWTgO'
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, eEULqaLTsaeIwLQZoi.cs	High entropy of concatenated method names: 'mFFj1L8Xfi', 'v58jpU0PDK', 'BPxjPcnVQG', 'tHBjINrjTw', 'r44jByArHK', 'ex2P4riCOI', 'hETPKLJulF', 'UeYPHBqkbI', 'XrRPETgJaI', 'TK3POuv8NU'
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, VoothtBB9ZTWwF5DWY.cs	High entropy of concatenated method names: 'QWEF1AXdKW', 'kQIFstr0Yg', 'l1kFpv4ewi', 'y4oFvGJ8KM', 'd69FPTMvaE', 'vBOFjx8EXk', 'KEaFIL5vUe', 'PmXFBpTwDx', 'iLTFCfKl5p', 'lWgFQ1kXiw'
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, l1hZG5aV7hCTL71C8h.cs	High entropy of concatenated method names: 'Mk88u1J5M', 'DqP35QLWB', 'rRyxtv7kB', 'fi9Z405ui', 'wwidyN83Z', 'ibwq12bvp', 'UavVqaVideFgQohqB2', 'GjGBRBQ8AFk6nMoGSX', 'FobfR5GHF', 'NPPh4juk6'
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, nV21fcXrTc5iuW9NMa.cs	High entropy of concatenated method names: 'nJYgQ2brUQ', 'P9lgiUXMGt', 'ToString', 'CCRgsdiLR5', 'EtZgpTARAA', 'fCPgvNGSOS', 'XTVgPvj0e7', 'Nfqgjl2kjK', 'wtrgInOUD9', 'ABfgBpiAu7'
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, JnbD2KUM8G8JBgsAof.cs	High entropy of concatenated method names: 'KKJMmktD3Y', 'vZ7MFYgHBU', 'FxyMToDORn', 'EJnMsNkfAt', 'vy2MpSD2mk', 'tYaMPZrhSI', 'w1pMjs2Dqq', 'tSjfHymZCR', 'zAufEPZmJM', 'VDofOYZkCP'
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, IOPXjUeqXlyqXiL1A6.cs	High entropy of concatenated method names: 'ROIY0J7u8s', 'b8kYddKQEF', 'VhaYLoic86', 'ifxYlx3ceZ', 'R1yYwYVZCv', 'zaCYuTbfSR', 'zCoYNujK2U', 'poDYRyKd6W', 'OwiYchaV5s', 'JEjYDMCilJ'
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, NOQnugKbQgmf98fjro.cs	High entropy of concatenated method names: 'ldAgEKp0RX', 'NX3gUXy864', 'BoFfoeFJZp', 'fIsfmFvWPh', 'Y7jgDyJVIi', 'Ltog7cEvQx', 'c9MgeAlcX3', 'LingG3OAnW', 'avlgtjYdU9', 'ydOg2MCevt'
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, HhRnp80YNIZjcH3iKc.cs	High entropy of concatenated method names: 'EHOpGrU3ov', 'lDJptlqCia', 'ryRp2IN35O', 'VFopXYGIIE', 'bAAp4IXtgV', 'Mh2pKYyP0y', 'hKOpH8nMXg', 'cmTpEQWvHY', 'g6XpO003fp', 'caIpU7iFg6'
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, Gn7jTymF8Guf4n5v8c8.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'IHmhGF2M6i', 'DiuhtVDqwP', 'KPuh2yhjCw', 'qZ7hXwxGvV', 'gbwh4vF9ZZ', 'bXMhK7iiwU', 'i25hHCwbgg'
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, ir7xw0dQgUU613gg97.cs	High entropy of concatenated method names: 'Jyiv3J51ig', 'BhUvxs3eTN', 'YU4v08Ilq6', 'j5BvdaiQRJ', 'SSBv6VWJrT', 'fkKvSEa5YB', 'GsevgmxuDV', 'wiQvfIkhKg', 'pnsvMOuMSm', 'pjMvhZgTql'
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, NUh8tJG3dF1wRcPdyC.cs	High entropy of concatenated method names: 'S5y6cy7CyG', 'ACx67uvpWb', 'v6j6GL3RTR', 'Ios6tY1kE4', 'nto6leskns', 'e5N6AU36Ox', 'TLn6w1baHw', 'YZZ6uBkrQN', 'zEi6JeOOHu', 'bAw6NISg4w'
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, dIqP5DOFjSuxjC5UrE.cs	High entropy of concatenated method names: 'apffLRurEj', 'G9qfl8EbyO', 'qFAfAPMaUG', 'y6DfwBRlKH', 'cZRfGQeGFd', 'V9rfuvem38', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, b7HwaCzHwTk3HmbbLI.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'utqMYi602h', 'qhOM6AlAmY', 'L4PMSLKJjg', 'Yc3MgKbiU4', 'PUEMfMmReH', 'GcpMMA306Y', 'zUuMhTQOVQ'
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, nBTdErmm9l7KcE2fpCx.cs	High entropy of concatenated method names: 'ToString', 'FaShFoqk5Z', 'VXBhTffu2e', 'qg3h1XoH4D', 'foOhsBRg53', 'CoUhpI1Mnh', 'ySjhvs7glP', 'OXshP6jVuX', 'Bm368G6OfsnuqYT6G7X', 'bJDa9E60W2ybRNiKAPZ'
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, Wj329MTPLq1QqODYbJ.cs	High entropy of concatenated method names: 'USlmIhRnp8', 'oNImBZjcH3', 'DQgmQUU613', 'pg9mi7UbeS', 'YIwm6aD1EU', 'GqamSTsaeI', 'zL1iPt2iEockm3kLrO', 'UA8nddJ0oEjcTZCnrg', 'nBMmmyjNDI', 'qYMmFm7XbX'
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, YZs4uRpVZWp8IRtc8l.cs	High entropy of concatenated method names: 'Dispose', 'PxtmOrxEmo', 'kBualDUWZQ', 'pVKwwVfQx7', 'bJBmUPPT1W', 'Iw1mzmPWbm', 'ProcessDialogKey', 'sbTaoIqP5D', 'djSamuxjC5', 'YrEaaunbD2'
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, MiCEWYmoJa161u2i4UQ.cs	High entropy of concatenated method names: 'F24MyLGFRk', 'TmOMWKbwfW', 'Jg1M8f7ETt', 'kRvM3wNDnF', 'tq2M5m3C9j', 'ANqMxTIxY5', 'y3uMZmM9WI', 'a7jM0ixOAa', 'yvtMd1l3QO', 'BoIMqmjaUR'
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, KBPPT1EWww1mPWbmMb.cs	High entropy of concatenated method names: 'GcofsG1Esn', 'Yr1fp8JLxS', 'U6vfvYUKKX', 'hqafPdxlO6', 'XOdfjRQDN7', 'EKRfI4DKjE', 'trDfBhmEXy', 'FS0fCBtRJc', 'tSbfQVAq17', 'u5Cfi6o2Xw'
Source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, TTWhxAnE79rwZHoEYw.cs	High entropy of concatenated method names: 'S8nIyGC0My', 'rieIWGJDJx', 'nOEI8TW8Fw', 'dw1I3UfvKo', 'mxnI5K7aZI', 'MQSIx6EWcy', 'BUJIZxjZLL', 'YngI0b0Nc4', 'OQCIdw7XYJ', 'dx9IqHRr9Z'
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, LeX4FpN6i9lh5NCcFF.cs	High entropy of concatenated method names: 'iRxIsgdJHo', 'jePIvoH9pP', 'zBoIjiV0hj', 'MtDjUDHBr4', 'B88jzlmJx3', 'Ss3Io40h8x', 'dkDImay5pP', 'zKPIaxLqGg', 'YV4IFCDoO6', 'OSLITf2MoY'
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, YbeSGBq7nB9iDUIwaD.cs	High entropy of concatenated method names: 'KgWP5D9VQY', 'Tb0PZ0npiJ', 'dnSvAWySKC', 'XcZvwqeVqw', 'hF8vuws7mT', 'Nm2vJHqUc7', 'F3mvNcQZ6s', 'p5KvR9anqa', 'Cj3vnu3rUO', 'sp7vcbWTgO'
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, eEULqaLTsaeIwLQZoi.cs	High entropy of concatenated method names: 'mFFj1L8Xfi', 'v58jpU0PDK', 'BPxjPcnVQG', 'tHBjINrjTw', 'r44jByArHK', 'ex2P4riCOI', 'hETPKLJulF', 'UeYPHBqkbI', 'XrRPETgJaI', 'TK3POuv8NU'
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, VoothtBB9ZTWwF5DWY.cs	High entropy of concatenated method names: 'QWEF1AXdKW', 'kQIFstr0Yg', 'l1kFpv4ewi', 'y4oFvGJ8KM', 'd69FPTMvaE', 'vBOFjx8EXk', 'KEaFIL5vUe', 'PmXFBpTwDx', 'iLTFCfKl5p', 'lWgFQ1kXiw'
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, l1hZG5aV7hCTL71C8h.cs	High entropy of concatenated method names: 'Mk88u1J5M', 'DqP35QLWB', 'rRyxtv7kB', 'fi9Z405ui', 'wwidyN83Z', 'ibwq12bvp', 'UavVqaVideFgQohqB2', 'GjGBRBQ8AFk6nMoGSX', 'FobfR5GHF', 'NPPh4juk6'
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, nV21fcXrTc5iuW9NMa.cs	High entropy of concatenated method names: 'nJYgQ2brUQ', 'P9lgiUXMGt', 'ToString', 'CCRgsdiLR5', 'EtZgpTARAA', 'fCPgvNGSOS', 'XTVgPvj0e7', 'Nfqgjl2kjK', 'wtrgInOUD9', 'ABfgBpiAu7'
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, JnbD2KUM8G8JBgsAof.cs	High entropy of concatenated method names: 'KKJMmktD3Y', 'vZ7MFYgHBU', 'FxyMToDORn', 'EJnMsNkfAt', 'vy2MpSD2mk', 'tYaMPZrhSI', 'w1pMjs2Dqq', 'tSjfHymZCR', 'zAufEPZmJM', 'VDofOYZkCP'
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, IOPXjUeqXlyqXiL1A6.cs	High entropy of concatenated method names: 'ROIY0J7u8s', 'b8kYddKQEF', 'VhaYLoic86', 'ifxYlx3ceZ', 'R1yYwYVZCv', 'zaCYuTbfSR', 'zCoYNujK2U', 'poDYRyKd6W', 'OwiYchaV5s', 'JEjYDMCilJ'
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, NOQnugKbQgmf98fjro.cs	High entropy of concatenated method names: 'ldAgEKp0RX', 'NX3gUXy864', 'BoFfoeFJZp', 'fIsfmFvWPh', 'Y7jgDyJVIi', 'Ltog7cEvQx', 'c9MgeAlcX3', 'LingG3OAnW', 'avlgtjYdU9', 'ydOg2MCevt'
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, HhRnp80YNIZjcH3iKc.cs	High entropy of concatenated method names: 'EHOpGrU3ov', 'lDJptlqCia', 'ryRp2IN35O', 'VFopXYGIIE', 'bAAp4IXtgV', 'Mh2pKYyP0y', 'hKOpH8nMXg', 'cmTpEQWvHY', 'g6XpO003fp', 'caIpU7iFg6'
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, Gn7jTymF8Guf4n5v8c8.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'IHmhGF2M6i', 'DiuhtVDqwP', 'KPuh2yhjCw', 'qZ7hXwxGvV', 'gbwh4vF9ZZ', 'bXMhK7iiwU', 'i25hHCwbgg'
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, ir7xw0dQgUU613gg97.cs	High entropy of concatenated method names: 'Jyiv3J51ig', 'BhUvxs3eTN', 'YU4v08Ilq6', 'j5BvdaiQRJ', 'SSBv6VWJrT', 'fkKvSEa5YB', 'GsevgmxuDV', 'wiQvfIkhKg', 'pnsvMOuMSm', 'pjMvhZgTql'
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, NUh8tJG3dF1wRcPdyC.cs	High entropy of concatenated method names: 'S5y6cy7CyG', 'ACx67uvpWb', 'v6j6GL3RTR', 'Ios6tY1kE4', 'nto6leskns', 'e5N6AU36Ox', 'TLn6w1baHw', 'YZZ6uBkrQN', 'zEi6JeOOHu', 'bAw6NISg4w'
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, dIqP5DOFjSuxjC5UrE.cs	High entropy of concatenated method names: 'apffLRurEj', 'G9qfl8EbyO', 'qFAfAPMaUG', 'y6DfwBRlKH', 'cZRfGQeGFd', 'V9rfuvem38', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, b7HwaCzHwTk3HmbbLI.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'utqMYi602h', 'qhOM6AlAmY', 'L4PMSLKJjg', 'Yc3MgKbiU4', 'PUEMfMmReH', 'GcpMMA306Y', 'zUuMhTQOVQ'
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, nBTdErmm9l7KcE2fpCx.cs	High entropy of concatenated method names: 'ToString', 'FaShFoqk5Z', 'VXBhTffu2e', 'qg3h1XoH4D', 'foOhsBRg53', 'CoUhpI1Mnh', 'ySjhvs7glP', 'OXshP6jVuX', 'Bm368G6OfsnuqYT6G7X', 'bJDa9E60W2ybRNiKAPZ'
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, Wj329MTPLq1QqODYbJ.cs	High entropy of concatenated method names: 'USlmIhRnp8', 'oNImBZjcH3', 'DQgmQUU613', 'pg9mi7UbeS', 'YIwm6aD1EU', 'GqamSTsaeI', 'zL1iPt2iEockm3kLrO', 'UA8nddJ0oEjcTZCnrg', 'nBMmmyjNDI', 'qYMmFm7XbX'
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, YZs4uRpVZWp8IRtc8l.cs	High entropy of concatenated method names: 'Dispose', 'PxtmOrxEmo', 'kBualDUWZQ', 'pVKwwVfQx7', 'bJBmUPPT1W', 'Iw1mzmPWbm', 'ProcessDialogKey', 'sbTaoIqP5D', 'djSamuxjC5', 'YrEaaunbD2'
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, MiCEWYmoJa161u2i4UQ.cs	High entropy of concatenated method names: 'F24MyLGFRk', 'TmOMWKbwfW', 'Jg1M8f7ETt', 'kRvM3wNDnF', 'tq2M5m3C9j', 'ANqMxTIxY5', 'y3uMZmM9WI', 'a7jM0ixOAa', 'yvtMd1l3QO', 'BoIMqmjaUR'
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, KBPPT1EWww1mPWbmMb.cs	High entropy of concatenated method names: 'GcofsG1Esn', 'Yr1fp8JLxS', 'U6vfvYUKKX', 'hqafPdxlO6', 'XOdfjRQDN7', 'EKRfI4DKjE', 'trDfBhmEXy', 'FS0fCBtRJc', 'tSbfQVAq17', 'u5Cfi6o2Xw'
Source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, TTWhxAnE79rwZHoEYw.cs	High entropy of concatenated method names: 'S8nIyGC0My', 'rieIWGJDJx', 'nOEI8TW8Fw', 'dw1I3UfvKo', 'mxnI5K7aZI', 'MQSIx6EWcy', 'BUJIZxjZLL', 'YngI0b0Nc4', 'OQCIdw7XYJ', 'dx9IqHRr9Z'
Source: 0.2.Payslip_October_2024_pdf.exe.77c0000.6.raw.unpack, LeX4FpN6i9lh5NCcFF.cs	High entropy of concatenated method names: 'iRxIsgdJHo', 'jePIvoH9pP', 'zBoIjiV0hj', 'MtDjUDHBr4', 'B88jzlmJx3', 'Ss3Io40h8x', 'dkDImay5pP', 'zKPIaxLqGg', 'YV4IFCDoO6', 'OSLITf2MoY'
Source: 0.2.Payslip_October_2024_pdf.exe.77c0000.6.raw.unpack, YbeSGBq7nB9iDUIwaD.cs	High entropy of concatenated method names: 'KgWP5D9VQY', 'Tb0PZ0npiJ', 'dnSvAWySKC', 'XcZvwqeVqw', 'hF8vuws7mT', 'Nm2vJHqUc7', 'F3mvNcQZ6s', 'p5KvR9anqa', 'Cj3vnu3rUO', 'sp7vcbWTgO'
Source: 0.2.Payslip_October_2024_pdf.exe.77c0000.6.raw.unpack, eEULqaLTsaeIwLQZoi.cs	High entropy of concatenated method names: 'mFFj1L8Xfi', 'v58jpU0PDK', 'BPxjPcnVQG', 'tHBjINrjTw', 'r44jByArHK', 'ex2P4riCOI', 'hETPKLJulF', 'UeYPHBqkbI', 'XrRPETgJaI', 'TK3POuv8NU'
Source: 0.2.Payslip_October_2024_pdf.exe.77c0000.6.raw.unpack, VoothtBB9ZTWwF5DWY.cs	High entropy of concatenated method names: 'QWEF1AXdKW', 'kQIFstr0Yg', 'l1kFpv4ewi', 'y4oFvGJ8KM', 'd69FPTMvaE', 'vBOFjx8EXk', 'KEaFIL5vUe', 'PmXFBpTwDx', 'iLTFCfKl5p', 'lWgFQ1kXiw'
Source: 0.2.Payslip_October_2024_pdf.exe.77c0000.6.raw.unpack, l1hZG5aV7hCTL71C8h.cs	High entropy of concatenated method names: 'Mk88u1J5M', 'DqP35QLWB', 'rRyxtv7kB', 'fi9Z405ui', 'wwidyN83Z', 'ibwq12bvp', 'UavVqaVideFgQohqB2', 'GjGBRBQ8AFk6nMoGSX', 'FobfR5GHF', 'NPPh4juk6'
Source: 0.2.Payslip_October_2024_pdf.exe.77c0000.6.raw.unpack, nV21fcXrTc5iuW9NMa.cs	High entropy of concatenated method names: 'nJYgQ2brUQ', 'P9lgiUXMGt', 'ToString', 'CCRgsdiLR5', 'EtZgpTARAA', 'fCPgvNGSOS', 'XTVgPvj0e7', 'Nfqgjl2kjK', 'wtrgInOUD9', 'ABfgBpiAu7'
Source: 0.2.Payslip_October_2024_pdf.exe.77c0000.6.raw.unpack, JnbD2KUM8G8JBgsAof.cs	High entropy of concatenated method names: 'KKJMmktD3Y', 'vZ7MFYgHBU', 'FxyMToDORn', 'EJnMsNkfAt', 'vy2MpSD2mk', 'tYaMPZrhSI', 'w1pMjs2Dqq', 'tSjfHymZCR', 'zAufEPZmJM', 'VDofOYZkCP'
Source: 0.2.Payslip_October_2024_pdf.exe.77c0000.6.raw.unpack, IOPXjUeqXlyqXiL1A6.cs	High entropy of concatenated method names: 'ROIY0J7u8s', 'b8kYddKQEF', 'VhaYLoic86', 'ifxYlx3ceZ', 'R1yYwYVZCv', 'zaCYuTbfSR', 'zCoYNujK2U', 'poDYRyKd6W', 'OwiYchaV5s', 'JEjYDMCilJ'
Source: 0.2.Payslip_October_2024_pdf.exe.77c0000.6.raw.unpack, NOQnugKbQgmf98fjro.cs	High entropy of concatenated method names: 'ldAgEKp0RX', 'NX3gUXy864', 'BoFfoeFJZp', 'fIsfmFvWPh', 'Y7jgDyJVIi', 'Ltog7cEvQx', 'c9MgeAlcX3', 'LingG3OAnW', 'avlgtjYdU9', 'ydOg2MCevt'
Source: 0.2.Payslip_October_2024_pdf.exe.77c0000.6.raw.unpack, HhRnp80YNIZjcH3iKc.cs	High entropy of concatenated method names: 'EHOpGrU3ov', 'lDJptlqCia', 'ryRp2IN35O', 'VFopXYGIIE', 'bAAp4IXtgV', 'Mh2pKYyP0y', 'hKOpH8nMXg', 'cmTpEQWvHY', 'g6XpO003fp', 'caIpU7iFg6'
Source: 0.2.Payslip_October_2024_pdf.exe.77c0000.6.raw.unpack, Gn7jTymF8Guf4n5v8c8.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'IHmhGF2M6i', 'DiuhtVDqwP', 'KPuh2yhjCw', 'qZ7hXwxGvV', 'gbwh4vF9ZZ', 'bXMhK7iiwU', 'i25hHCwbgg'
Source: 0.2.Payslip_October_2024_pdf.exe.77c0000.6.raw.unpack, ir7xw0dQgUU613gg97.cs	High entropy of concatenated method names: 'Jyiv3J51ig', 'BhUvxs3eTN', 'YU4v08Ilq6', 'j5BvdaiQRJ', 'SSBv6VWJrT', 'fkKvSEa5YB', 'GsevgmxuDV', 'wiQvfIkhKg', 'pnsvMOuMSm', 'pjMvhZgTql'
Source: 0.2.Payslip_October_2024_pdf.exe.77c0000.6.raw.unpack, NUh8tJG3dF1wRcPdyC.cs	High entropy of concatenated method names: 'S5y6cy7CyG', 'ACx67uvpWb', 'v6j6GL3RTR', 'Ios6tY1kE4', 'nto6leskns', 'e5N6AU36Ox', 'TLn6w1baHw', 'YZZ6uBkrQN', 'zEi6JeOOHu', 'bAw6NISg4w'
Source: 0.2.Payslip_October_2024_pdf.exe.77c0000.6.raw.unpack, dIqP5DOFjSuxjC5UrE.cs	High entropy of concatenated method names: 'apffLRurEj', 'G9qfl8EbyO', 'qFAfAPMaUG', 'y6DfwBRlKH', 'cZRfGQeGFd', 'V9rfuvem38', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Payslip_October_2024_pdf.exe.77c0000.6.raw.unpack, b7HwaCzHwTk3HmbbLI.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'utqMYi602h', 'qhOM6AlAmY', 'L4PMSLKJjg', 'Yc3MgKbiU4', 'PUEMfMmReH', 'GcpMMA306Y', 'zUuMhTQOVQ'
Source: 0.2.Payslip_October_2024_pdf.exe.77c0000.6.raw.unpack, nBTdErmm9l7KcE2fpCx.cs	High entropy of concatenated method names: 'ToString', 'FaShFoqk5Z', 'VXBhTffu2e', 'qg3h1XoH4D', 'foOhsBRg53', 'CoUhpI1Mnh', 'ySjhvs7glP', 'OXshP6jVuX', 'Bm368G6OfsnuqYT6G7X', 'bJDa9E60W2ybRNiKAPZ'
Source: 0.2.Payslip_October_2024_pdf.exe.77c0000.6.raw.unpack, Wj329MTPLq1QqODYbJ.cs	High entropy of concatenated method names: 'USlmIhRnp8', 'oNImBZjcH3', 'DQgmQUU613', 'pg9mi7UbeS', 'YIwm6aD1EU', 'GqamSTsaeI', 'zL1iPt2iEockm3kLrO', 'UA8nddJ0oEjcTZCnrg', 'nBMmmyjNDI', 'qYMmFm7XbX'
Source: 0.2.Payslip_October_2024_pdf.exe.77c0000.6.raw.unpack, YZs4uRpVZWp8IRtc8l.cs	High entropy of concatenated method names: 'Dispose', 'PxtmOrxEmo', 'kBualDUWZQ', 'pVKwwVfQx7', 'bJBmUPPT1W', 'Iw1mzmPWbm', 'ProcessDialogKey', 'sbTaoIqP5D', 'djSamuxjC5', 'YrEaaunbD2'
Source: 0.2.Payslip_October_2024_pdf.exe.77c0000.6.raw.unpack, MiCEWYmoJa161u2i4UQ.cs	High entropy of concatenated method names: 'F24MyLGFRk', 'TmOMWKbwfW', 'Jg1M8f7ETt', 'kRvM3wNDnF', 'tq2M5m3C9j', 'ANqMxTIxY5', 'y3uMZmM9WI', 'a7jM0ixOAa', 'yvtMd1l3QO', 'BoIMqmjaUR'
Source: 0.2.Payslip_October_2024_pdf.exe.77c0000.6.raw.unpack, KBPPT1EWww1mPWbmMb.cs	High entropy of concatenated method names: 'GcofsG1Esn', 'Yr1fp8JLxS', 'U6vfvYUKKX', 'hqafPdxlO6', 'XOdfjRQDN7', 'EKRfI4DKjE', 'trDfBhmEXy', 'FS0fCBtRJc', 'tSbfQVAq17', 'u5Cfi6o2Xw'
Source: 0.2.Payslip_October_2024_pdf.exe.77c0000.6.raw.unpack, TTWhxAnE79rwZHoEYw.cs	High entropy of concatenated method names: 'S8nIyGC0My', 'rieIWGJDJx', 'nOEI8TW8Fw', 'dw1I3UfvKo', 'mxnI5K7aZI', 'MQSIx6EWcy', 'BUJIZxjZLL', 'YngI0b0Nc4', 'OQCIdw7XYJ', 'dx9IqHRr9Z'

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

File created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sgxIb			Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sgxIb			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

File opened: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Payslip_October_2024_pdf.exe PID: 2888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sgxIb.exe PID: 432, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Memory allocated: 2740000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Memory allocated: 2990000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Memory allocated: 27A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Memory allocated: 8CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Memory allocated: 9CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Memory allocated: 9F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Memory allocated: AF00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Memory allocated: B310000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Memory allocated: C310000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Memory allocated: D310000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Memory allocated: 1070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Memory allocated: 2CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Memory allocated: 2AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 1670000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 3030000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 5030000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 8DF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 9DF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 9FE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: AFE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: B710000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: C710000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: D710000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 2CE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 2F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 2D40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 2F80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 3190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 2F80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 8F40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 9F40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: A130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 76A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: B380000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: C380000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: D380000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 13A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 3040000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 5140000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 598719	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 598606	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 598484	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 598366	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 598191	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 598068	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 597938	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 597813	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 597688	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 597563	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 597438	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 597219	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 596871	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 596766	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 596547	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 596438	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 596313	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 596094	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 595856	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 595730	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 595526	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 595313	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 594969	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 594749	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 594422	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 594313	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 594188	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 594078	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598641	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598076	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597750	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597641	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597313	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596969	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596749	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596641	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596526	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596420	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596283	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596035	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595906	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595797	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595670	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595016	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594900	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594794	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594681	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594344	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594234	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599649	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598985	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598860	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598735	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597248	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596998	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596766	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596438	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596328	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596219	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596094	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595984	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595875	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595766	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595656	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594606	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594397	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594282	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594157	Jump to behavior

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Window / User API: threadDelayed 7719	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Window / User API: threadDelayed 2117	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Window / User API: threadDelayed 6298	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Window / User API: threadDelayed 3552	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Window / User API: threadDelayed 2422	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Window / User API: threadDelayed 7415	Jump to behavior

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 4400	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -35048813740048126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -599641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -599531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -599422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -599313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -598953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -598844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -598719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -598606s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -598484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -598366s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -598191s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -598068s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -597938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -597813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -597688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -597563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -597438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -597328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -597219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -597094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -596984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -596871s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -596766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -596656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -596547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -596438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -596313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -596203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -596094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -595969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -595856s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -595730s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -595526s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -595422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -595313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -595203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -595094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -594969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -594859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -594749s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -594640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -594531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -594422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -594313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -594188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe TID: 6128	Thread sleep time: -594078s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 320	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 1628	Thread sleep count: 6298 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 1628	Thread sleep count: 3552 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -599219s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -598891s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -598766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -598641s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -598531s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -598422s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -598312s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -598203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -598076s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -597969s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -597859s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -597750s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -597641s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -597531s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -597422s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -597313s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -597203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -597094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -596969s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -596859s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -596749s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -596641s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -596526s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -596420s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -596283s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -596035s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -595906s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -595797s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -595670s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -595562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -595453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -595344s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -595234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -595125s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -595016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -594900s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -594794s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -594681s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -594578s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -594469s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -594344s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 5596	Thread sleep time: -594234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6224	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -599649s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -599531s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -599422s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -599312s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -599203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -599094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -598985s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -598860s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -598735s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -598610s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -598485s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -598360s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -598235s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -598110s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -597985s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -597860s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -597735s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -597360s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -597248s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -597125s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -596998s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -596875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -596766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -596656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -596547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -596438s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -596328s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -596219s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -596094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -595984s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -595875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -595766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -595656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -595547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -595437s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -595328s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -595219s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -595094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -594985s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -594860s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -594735s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -594606s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -594397s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -594282s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 6428	Thread sleep time: -594157s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 598719	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 598606	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 598484	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 598366	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 598191	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 598068	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 597938	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 597813	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 597688	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 597563	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 597438	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 597219	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 596871	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 596766	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 596547	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 596438	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 596313	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 596094	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 595856	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 595730	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 595526	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 595313	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 594969	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 594749	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 594422	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 594313	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 594188	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Thread delayed: delay time: 594078	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598641	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598076	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597750	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597641	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597313	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596969	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596749	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596641	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596526	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596420	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596283	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596035	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595906	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595797	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595670	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595016	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594900	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594794	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594681	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594344	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594234	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599649	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598985	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598860	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598735	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597248	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596998	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596766	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596438	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596328	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596219	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 596094	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595984	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595875	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595766	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595656	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594606	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594397	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594282	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 594157	Jump to behavior

Source: sgxIb.exe, 00000008.00000002.4491421148.0000000001498000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll<
Source: Payslip_October_2024_pdf.exe, 00000003.00000002.4490676412.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, sgxIb.exe, 00000005.00000002.2250372221.000000000109C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Memory written: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory written: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process created: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe "C:\Users\user\Desktop\Payslip_October_2024_pdf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"	Jump to behavior

Source: Payslip_October_2024_pdf.exe, 00000003.00000002.4494330855.0000000002EB4000.00000004.00000800.00020000.00000000.sdmp, Payslip_October_2024_pdf.exe, 00000003.00000002.4494330855.0000000002D0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: Payslip_October_2024_pdf.exe, 00000003.00000002.4494330855.0000000002EB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]q9<b>[ Program Manager]</b> (04/11/2024 18:06:09)<br>{Win}rTHbq
Source: Payslip_October_2024_pdf.exe, 00000003.00000002.4494330855.0000000002EB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q
Source: Payslip_October_2024_pdf.exe, 00000003.00000002.4494330855.0000000002EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: <html>Time: 11/17/2024 21:53:38<br>User Name: user<br>Computer Name: 960781<br>OSFullName: Microsoft Windows 10 Pro<br>CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz<br>RAM: 8191.25 MB<br>IP Address: 173.254.250.69<br><hr><b>[ Program Manager]</b> (04/11/2024 18:06:09)<br>{Win}r</html>
Source: Payslip_October_2024_pdf.exe, 00000003.00000002.4494330855.0000000002EB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]q8<b>[ Program Manager]</b> (04/11/2024 18:06:09)<br>{Win}THbq
Source: Payslip_October_2024_pdf.exe, 00000003.00000002.4494330855.0000000002EB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]q3<b>[ Program Manager]</b> (04/11/2024 18:06:09)<br>

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Queries volume information: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Queries volume information: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.Payslip_October_2024_pdf.exe.44f8068.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.sgxIb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payslip_October_2024_pdf.exe.44f8068.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2252894462.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2249540840.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4494723073.0000000003091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2252894462.0000000002F7C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4494723073.00000000030BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4494330855.0000000002D0B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2033528319.00000000041EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payslip_October_2024_pdf.exe PID: 2888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Payslip_October_2024_pdf.exe PID: 528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sgxIb.exe PID: 6552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sgxIb.exe PID: 2800, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.Payslip_October_2024_pdf.exe.44f8068.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.sgxIb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payslip_October_2024_pdf.exe.44f8068.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2252894462.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2249540840.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4494723073.0000000003091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4494330855.0000000002D0B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2033528319.00000000041EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payslip_October_2024_pdf.exe PID: 2888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Payslip_October_2024_pdf.exe PID: 528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sgxIb.exe PID: 6552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sgxIb.exe PID: 2800, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.Payslip_October_2024_pdf.exe.44f8068.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.sgxIb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payslip_October_2024_pdf.exe.44f8068.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payslip_October_2024_pdf.exe.4479c48.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payslip_October_2024_pdf.exe.43fb828.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2252894462.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2249540840.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4494723073.0000000003091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2252894462.0000000002F7C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4494723073.00000000030BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4494330855.0000000002D0B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2033528319.00000000041EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payslip_October_2024_pdf.exe PID: 2888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Payslip_October_2024_pdf.exe PID: 528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sgxIb.exe PID: 6552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sgxIb.exe PID: 2800, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	1 Exfiltration Over Alternative Protocol	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	112 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	3 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	211 Security Software Discovery	Distributed Component Object Model	21 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	2 Process Discovery	SSH	1 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Files and Directories	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Payslip_October_2024_pdf.exe	34%	ReversingLabs	Win32.Trojan.Generic
Payslip_October_2024_pdf.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	34%	ReversingLabs	Win32.Trojan.AgentTesla

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://ftp.haliza.com.my	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	172.67.74.152	true	false		unknown
ftp.haliza.com.my	110.4.45.197	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	Payslip_October_2024_pdf.exe, 00000000.00000002.2033528319.00000000041EC000.00000004.00000800.00020000.00000000.sdmp, Payslip_October_2024_pdf.exe, 00000003.00000002.4494330855.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000005.00000002.2249540840.0000000000402000.00000040.00000400.00020000.00000000.sdmp, sgxIb.exe, 00000005.00000002.2252894462.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000008.00000002.4494723073.000000000304C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	Payslip_October_2024_pdf.exe, 00000000.00000002.2033528319.00000000041EC000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000005.00000002.2249540840.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ftp.haliza.com.my	Payslip_October_2024_pdf.exe, 00000003.00000002.4494330855.00000000030B6000.00000004.00000800.00020000.00000000.sdmp, Payslip_October_2024_pdf.exe, 00000003.00000002.4494330855.0000000002EB4000.00000004.00000800.00020000.00000000.sdmp, Payslip_October_2024_pdf.exe, 00000003.00000002.4494330855.0000000002EDB000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000005.00000002.2252894462.0000000002F7C000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000008.00000002.4494723073.0000000003468000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000008.00000002.4494723073.0000000003257000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000008.00000002.4494723073.00000000030BC000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000008.00000002.4494723073.00000000032D6000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000008.00000002.4494723073.0000000003291000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org/t	sgxIb.exe, 00000005.00000002.2252894462.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000008.00000002.4494723073.000000000304C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Payslip_October_2024_pdf.exe, 00000003.00000002.4494330855.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000005.00000002.2252894462.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, sgxIb.exe, 00000008.00000002.4494723073.000000000304C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
110.4.45.197	ftp.haliza.com.my	Malaysia		46015	EXABYTES-AS-APExaBytesNetworkSdnBhdMY	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1548311
Start date and time:	2024-11-04 10:12:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Payslip_October_2024_pdf.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@9/4@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 280 Number of non-executed functions: 34
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Payslip_October_2024_pdf.exe

Simulations

Behavior and APIs

Time	Type	Description
04:12:59	API Interceptor	8875822x Sleep call for process: Payslip_October_2024_pdf.exe modified
04:13:12	API Interceptor	7027046x Sleep call for process: sgxIb.exe modified
10:13:04	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run sgxIb C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
10:13:12	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run sgxIb C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
110.4.45.197	Payslip_October_2024_pdf.exe	Get hash	malicious	AgentTesla	Browse
	Payslip_October_2024.pdf.exe	Get hash	malicious	AgentTesla	Browse
	rMT103_126021720924.exe	Get hash	malicious	AgentTesla	Browse
	z1Transaction_ID_REF2418_cmd.bat	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse
	z20SWIFT_MT103_Payment_552016_pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Order Specifications for Materials.docx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	z14Employee_Contract_pdf.exe	Get hash	malicious	AgentTesla	Browse
	Order Specifications for Materials.docx.exe	Get hash	malicious	AgentTesla	Browse
	DHL_Shipment_Details_8th_October.pdf.exe	Get hash	malicious	AgentTesla	Browse
	z92BankPayment38_735.exe	Get hash	malicious	AgentTesla	Browse
172.67.74.152	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	4F08j2Rmd9.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	y8tCHz7CwC.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	2zYP8qOYmJ.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ftp.haliza.com.my	Payslip_October_2024_pdf.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	Payslip_October_2024.pdf.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	rMT103_126021720924.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	z1Transaction_ID_REF2418_cmd.bat	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	110.4.45.197
	z20SWIFT_MT103_Payment_552016_pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	110.4.45.197
	Order Specifications for Materials.docx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	110.4.45.197
	z14Employee_Contract_pdf.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	Order Specifications for Materials.docx.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	DHL_Shipment_Details_8th_October.pdf.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	z92BankPayment38_735.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
api.ipify.org	Quotation.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Copia de pago de la Orden de compra OI16014 y OI16015.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	QUOTATION#09678.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Payslip_October_2024_pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	V7FWuG5Lct.exe	Get hash	malicious	Quasar	Browse	172.67.74.152
	7ll96oOSBF.exe	Get hash	malicious	Quasar	Browse	104.26.12.205
	Payload 94.75 (4).225.exe	Get hash	malicious	Kronos, Strela Stealer	Browse	104.26.12.205
	Ordine d'acquisto OI16014 e OI1601.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://v90hdblg6c012.b-cdn.net/ppo45-fill-captch.html	Get hash	malicious	LummaC	Browse	104.26.12.205
	SecuriteInfo.com.Win32.Malware-gen.1695.31617.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
EXABYTES-AS-APExaBytesNetworkSdnBhdMY	Payslip_October_2024_pdf.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	Txwd 4063517991 djxjdlxmbk.pdf	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	103.6.199.200
	Payslip_October_2024.pdf.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	rMT103_126021720924.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	z1Transaction_ID_REF2418_cmd.bat	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	110.4.45.197
	z20SWIFT_MT103_Payment_552016_pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	110.4.45.197
	Order Specifications for Materials.docx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	110.4.45.197
	z14Employee_Contract_pdf.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	Order Specifications for Materials.docx.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	na.elf	Get hash	malicious	Mirai	Browse	203.142.6.25
CLOUDFLARENETUS	debit#U00a0note#U00a0607-36099895#U00a0#U00a0.exe	Get hash	malicious	FormBook	Browse	104.21.3.144
	Quotation.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Copia de pago de la Orden de compra OI16014 y OI16015.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	SC16C750BIB64 PHILIPS 2000pcs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	client1.exe	Get hash	malicious	Unknown	Browse	172.67.168.106
	https://www.supercontable.es/emailing/track_superc.php?Destino=!:%7D%7D%7C.fasttravelnet.xyz/YW5kcmVzLnRvcmliaW9AY2VsbG5leHRlbGVjb20uY29t&IdTracking=9008&user=000000	Get hash	malicious	Phisher	Browse	104.17.25.14
	B6EGeOHEFm.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.1.100
	Q60ZbERXWZ.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.1.100
	nuVM6HVKRG.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.1.100
	XCubQJqiz7.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.1.100

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://email.abprotector.com/c/eJwUzU2OrCAQAODTwE4DBc3PgsXbeA1TUuWTDDadBsfJnH7SB_jyUbIRYDeSk_ZGuQA6RHkkAJfRs995x93paDmToYhsSONmUJbkPARNlh5b9LiCecRgLQQvrAIm0OTdtG0WJ-uUnTYinBwhZ_ocIc4nliprOsZ4dWH-CVgELPd9z6_8v2Lv3OfcTgFL53y9mdbrt62v9h5YBSzlSfwzH-Os8p36WcbRbn5a9RBWtWvU1r4-XI5yci1PXgslbYwJwSvj5XeCvwAAAP__4WRNQg#c2VkZGlrLmJlbmFyYmlhQGF1Yi1zYW50ZS5mcg==	Get hash	malicious	Unknown	Browse	172.67.74.152
	Quotation.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Copia de pago de la Orden de compra OI16014 y OI16015.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	SC16C750BIB64 PHILIPS 2000pcs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.74.152
	B6EGeOHEFm.exe	Get hash	malicious	Phemedrone Stealer	Browse	172.67.74.152
	Q60ZbERXWZ.exe	Get hash	malicious	Phemedrone Stealer	Browse	172.67.74.152
	nuVM6HVKRG.exe	Get hash	malicious	Phemedrone Stealer	Browse	172.67.74.152
	XCubQJqiz7.exe	Get hash	malicious	Phemedrone Stealer	Browse	172.67.74.152
	upd.ps1	Get hash	malicious	Phemedrone Stealer	Browse	172.67.74.152
	WDSecureUtil.exe	Get hash	malicious	Phemedrone Stealer	Browse	172.67.74.152

Process:	C:\Users\user\Desktop\Payslip_October_2024_pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\sgxIb.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

Download File

Process:	C:\Users\user\Desktop\Payslip_October_2024_pdf.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	780288
Entropy (8bit):	7.6529324185750145
Encrypted:	false
SSDEEP:	12288:Tlx7M0cl2LPU1ceS3UoWl8whrP9jltoinVaYt3u/32z0oBGg7QeKhZfmGt:LA0c+2SA6whr14kbt3fz0oBftK/f5
MD5:	0D4985C828F3F9F6974B1602C92EE962
SHA1:	0F11A5DEEF40A3DEC6CB8CB0CC6AE057BD56C2DD
SHA-256:	59CBE4E681C4371B18A5F6D457369560CE9E4F0EDA5A39DE1ACAB8B5BDF73BDA
SHA-512:	5EDA720231DEF9F8C7260DFB412AB753321338FD4A31E561F78A59445EEB63C92C547DC5A4145A3114B33DA022771D7EEB271FD5978D4696351B323F9AD9BB15
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....G...............0.............v.... ........@.. .......................@............@.................................!...O............................ ......P...p............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................U.......H.......P....~..........Xe...n..........................................&.(.........0.............s.....+......0..3...........{....o........o......o.........,..o........+............"......:..{....o.....:..{....o.....:..{....o.........0..l........s.....r...p...(......+4...rA..po.....rG..po.....r_..po....(....s....o.......o......-.....,..o.........+...*........DY.......0...........s ....ri..p.o.....?...(!....s........(....}.....+J.....(...........s"...o#....{....r...po..

C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Payslip_October_2024_pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.6529324185750145
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Payslip_October_2024_pdf.exe
File size:	780'288 bytes
MD5:	0d4985c828f3f9f6974b1602c92ee962
SHA1:	0f11a5deef40a3dec6cb8cb0cc6ae057bd56c2dd
SHA256:	59cbe4e681c4371b18a5f6d457369560ce9e4f0eda5a39de1acab8b5bdf73bda
SHA512:	5eda720231def9f8c7260dfb412ab753321338fd4a31e561f78a59445eeb63c92c547dc5a4145a3114b33da022771d7eeb271fd5978d4696351b323f9ad9bb15
SSDEEP:	12288:Tlx7M0cl2LPU1ceS3UoWl8whrP9jltoinVaYt3u/32z0oBGg7QeKhZfmGt:LA0c+2SA6whr14kbt3fz0oBftK/f5
TLSH:	C8F4BEE03A767B1ADEA95BB09559DDB183F02969B004FAE65DD93BC7349C7009E08F03
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....G................0.............v.... ........@.. .......................@............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4bfc76
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xA7C547C1 [Wed Mar 12 19:47:13 2059 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
push ebx
add byte ptr [ecx+00h], bh
jnc 00007F548CEE2F12h
je 00007F548CEE2F12h
add byte ptr [ebp+00h], ch
add byte ptr [ecx+00h], al
arpl word ptr [eax], ax
je 00007F548CEE2F12h
imul eax, dword ptr [eax], 00610076h
je 00007F548CEE2F12h
outsd
add byte ptr [edx+00h], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbfc21	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc0000	0x594	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xbd450	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xbdc9c	0xbde00	631935b13bb35572cd75b81871249138	False	0.8473682315668203	data	7.659760721121941	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc0000	0x594	0x600	c656935232eedc387a607a918ab6d6c0	False	0.4140625	data	4.025842667742365	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc2000	0xc	0x200	61e37f9e3cd1f0e6dfa6db6e84d930e5	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xc0090	0x304	data			0.4339378238341969
RT_MANIFEST	0xc03a4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-04T10:13:19.167320+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.5	49717	TCP
2024-11-04T10:13:19.381403+0100	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.5	49716	110.4.45.197	21	TCP
2024-11-04T10:13:20.357961+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.5	49722	110.4.45.197	61813	TCP
2024-11-04T10:13:20.363581+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.5	49722	110.4.45.197	61813	TCP
2024-11-04T10:13:27.924804+0100	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.5	49745	110.4.45.197	21	TCP
2024-11-04T10:13:28.852402+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.5	49766	110.4.45.197	64083	TCP
2024-11-04T10:13:28.863602+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.5	49766	110.4.45.197	64083	TCP
2024-11-04T10:13:58.256553+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.5	49929	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 4, 2024 10:13:01.671607018 CET	49706	443	192.168.2.5	172.67.74.152
Nov 4, 2024 10:13:01.671622038 CET	443	49706	172.67.74.152	192.168.2.5
Nov 4, 2024 10:13:01.671694994 CET	49706	443	192.168.2.5	172.67.74.152
Nov 4, 2024 10:13:01.679464102 CET	49706	443	192.168.2.5	172.67.74.152
Nov 4, 2024 10:13:01.679482937 CET	443	49706	172.67.74.152	192.168.2.5
Nov 4, 2024 10:13:02.291179895 CET	443	49706	172.67.74.152	192.168.2.5
Nov 4, 2024 10:13:02.291260958 CET	49706	443	192.168.2.5	172.67.74.152
Nov 4, 2024 10:13:02.300559998 CET	49706	443	192.168.2.5	172.67.74.152
Nov 4, 2024 10:13:02.300573111 CET	443	49706	172.67.74.152	192.168.2.5
Nov 4, 2024 10:13:02.300867081 CET	443	49706	172.67.74.152	192.168.2.5
Nov 4, 2024 10:13:02.352834940 CET	49706	443	192.168.2.5	172.67.74.152
Nov 4, 2024 10:13:02.432604074 CET	49706	443	192.168.2.5	172.67.74.152
Nov 4, 2024 10:13:02.475332975 CET	443	49706	172.67.74.152	192.168.2.5
Nov 4, 2024 10:13:02.611354113 CET	443	49706	172.67.74.152	192.168.2.5
Nov 4, 2024 10:13:02.611424923 CET	443	49706	172.67.74.152	192.168.2.5
Nov 4, 2024 10:13:02.611556053 CET	49706	443	192.168.2.5	172.67.74.152
Nov 4, 2024 10:13:02.620316982 CET	49706	443	192.168.2.5	172.67.74.152
Nov 4, 2024 10:13:03.460407019 CET	49708	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:03.466933012 CET	21	49708	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:03.467048883 CET	49708	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:03.471188068 CET	49708	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:03.478086948 CET	21	49708	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:03.478408098 CET	49708	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:03.505875111 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:03.512501955 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:03.512624025 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:04.461606026 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:04.461891890 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:04.466952085 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:04.824552059 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:04.827223063 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:04.832037926 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:05.222310066 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:05.222513914 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:05.227333069 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:05.580542088 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:05.580734015 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:05.585705996 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:05.936120987 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:05.936284065 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:05.941879034 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:06.294846058 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:06.295129061 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:06.300028086 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:06.650208950 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:06.650954008 CET	49712	53855	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:06.655807972 CET	53855	49712	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:06.655981064 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:06.655982018 CET	49712	53855	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:06.660856009 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:07.585129976 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:07.594105959 CET	49712	53855	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:07.594156981 CET	49712	53855	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:07.599097013 CET	53855	49712	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:07.599518061 CET	53855	49712	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:07.599577904 CET	49712	53855	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:07.634948015 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:07.941498995 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:07.942117929 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:07.946978092 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:08.297616005 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:08.298134089 CET	49713	49362	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:08.303066015 CET	49362	49713	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:08.303136110 CET	49713	49362	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:08.303241968 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:08.308128119 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:09.216640949 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:09.220038891 CET	49713	49362	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:09.225929976 CET	49362	49713	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:09.227768898 CET	49713	49362	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:09.274728060 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:09.561566114 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:09.561956882 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:09.566780090 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:09.917282104 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:09.917845011 CET	49714	62375	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:09.922812939 CET	62375	49714	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:09.922933102 CET	49714	62375	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:09.923052073 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:09.927804947 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:10.881580114 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:10.881820917 CET	49714	62375	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:10.887000084 CET	62375	49714	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:10.887059927 CET	49714	62375	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:10.930986881 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:11.250051975 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:11.290363073 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:14.564222097 CET	49715	443	192.168.2.5	172.67.74.152
Nov 4, 2024 10:13:14.564256907 CET	443	49715	172.67.74.152	192.168.2.5
Nov 4, 2024 10:13:14.564332962 CET	49715	443	192.168.2.5	172.67.74.152
Nov 4, 2024 10:13:14.567694902 CET	49715	443	192.168.2.5	172.67.74.152
Nov 4, 2024 10:13:14.567708015 CET	443	49715	172.67.74.152	192.168.2.5
Nov 4, 2024 10:13:15.220114946 CET	443	49715	172.67.74.152	192.168.2.5
Nov 4, 2024 10:13:15.220242977 CET	49715	443	192.168.2.5	172.67.74.152
Nov 4, 2024 10:13:15.285068989 CET	49715	443	192.168.2.5	172.67.74.152
Nov 4, 2024 10:13:15.285085917 CET	443	49715	172.67.74.152	192.168.2.5
Nov 4, 2024 10:13:15.285403013 CET	443	49715	172.67.74.152	192.168.2.5
Nov 4, 2024 10:13:15.328852892 CET	49715	443	192.168.2.5	172.67.74.152
Nov 4, 2024 10:13:15.559633970 CET	49715	443	192.168.2.5	172.67.74.152
Nov 4, 2024 10:13:15.603336096 CET	443	49715	172.67.74.152	192.168.2.5
Nov 4, 2024 10:13:15.743804932 CET	443	49715	172.67.74.152	192.168.2.5
Nov 4, 2024 10:13:15.743870020 CET	443	49715	172.67.74.152	192.168.2.5
Nov 4, 2024 10:13:15.743964911 CET	49715	443	192.168.2.5	172.67.74.152
Nov 4, 2024 10:13:15.746670008 CET	49715	443	192.168.2.5	172.67.74.152
Nov 4, 2024 10:13:16.232513905 CET	49716	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:16.238100052 CET	21	49716	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:16.238217115 CET	49716	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:17.191484928 CET	21	49716	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:17.191725016 CET	49716	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:17.196718931 CET	21	49716	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:17.551525116 CET	21	49716	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:17.551703930 CET	49716	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:17.556844950 CET	21	49716	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:17.936074018 CET	21	49716	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:17.936476946 CET	49716	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:17.941629887 CET	21	49716	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:18.294068098 CET	21	49716	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:18.294240952 CET	49716	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:18.299438953 CET	21	49716	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:18.651875973 CET	21	49716	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:18.652288914 CET	49716	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:18.657196999 CET	21	49716	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:19.009896040 CET	21	49716	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:19.013953924 CET	49716	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:19.019087076 CET	21	49716	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:19.375341892 CET	21	49716	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:19.376250982 CET	49722	61813	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:19.381256104 CET	61813	49722	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:19.381321907 CET	49722	61813	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:19.381402969 CET	49716	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:19.386873007 CET	21	49716	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:20.357707024 CET	21	49716	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:20.357960939 CET	49722	61813	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:20.358042002 CET	49722	61813	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:20.363042116 CET	61813	49722	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:20.363521099 CET	61813	49722	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:20.363580942 CET	49722	61813	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:20.399741888 CET	49716	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:20.712255001 CET	21	49716	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:20.739705086 CET	49716	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:20.745652914 CET	21	49716	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:21.124290943 CET	21	49716	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:21.126398087 CET	49729	64015	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:21.139827013 CET	64015	49729	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:21.141788960 CET	49729	64015	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:21.141900063 CET	49716	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:21.148144960 CET	21	49716	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:22.771806955 CET	21	49716	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:22.771951914 CET	21	49716	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:22.771981955 CET	21	49716	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:22.772032976 CET	49716	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:22.773709059 CET	49716	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:23.210032940 CET	49739	443	192.168.2.5	172.67.74.152
Nov 4, 2024 10:13:23.210076094 CET	443	49739	172.67.74.152	192.168.2.5
Nov 4, 2024 10:13:23.210161924 CET	49739	443	192.168.2.5	172.67.74.152
Nov 4, 2024 10:13:23.214148045 CET	49739	443	192.168.2.5	172.67.74.152
Nov 4, 2024 10:13:23.214163065 CET	443	49739	172.67.74.152	192.168.2.5
Nov 4, 2024 10:13:23.823537111 CET	443	49739	172.67.74.152	192.168.2.5
Nov 4, 2024 10:13:23.823617935 CET	49739	443	192.168.2.5	172.67.74.152
Nov 4, 2024 10:13:23.829212904 CET	49739	443	192.168.2.5	172.67.74.152
Nov 4, 2024 10:13:23.829221964 CET	443	49739	172.67.74.152	192.168.2.5
Nov 4, 2024 10:13:23.829476118 CET	443	49739	172.67.74.152	192.168.2.5
Nov 4, 2024 10:13:23.884107113 CET	49739	443	192.168.2.5	172.67.74.152
Nov 4, 2024 10:13:23.891398907 CET	49739	443	192.168.2.5	172.67.74.152
Nov 4, 2024 10:13:23.935327053 CET	443	49739	172.67.74.152	192.168.2.5
Nov 4, 2024 10:13:24.063031912 CET	443	49739	172.67.74.152	192.168.2.5
Nov 4, 2024 10:13:24.063100100 CET	443	49739	172.67.74.152	192.168.2.5
Nov 4, 2024 10:13:24.063577890 CET	49739	443	192.168.2.5	172.67.74.152
Nov 4, 2024 10:13:24.066504955 CET	49739	443	192.168.2.5	172.67.74.152
Nov 4, 2024 10:13:24.347567081 CET	49716	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:24.348931074 CET	49729	64015	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:24.610375881 CET	49745	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:24.615746975 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:24.616365910 CET	49745	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:25.844021082 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:25.844403028 CET	49745	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:25.844455957 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:25.844511986 CET	49745	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:25.849560976 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:26.184287071 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:26.185314894 CET	49745	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:26.190713882 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:26.556669950 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:26.560091019 CET	49745	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:26.565233946 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:26.900331974 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:26.900731087 CET	49745	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:26.905666113 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:27.240027905 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:27.242155075 CET	49745	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:27.247369051 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:27.580374956 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:27.581007957 CET	49745	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:27.586807966 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:27.918997049 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:27.919557095 CET	49766	64083	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:27.924659967 CET	64083	49766	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:27.924737930 CET	49766	64083	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:27.924803972 CET	49745	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:27.929692030 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:28.852077007 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:28.852401972 CET	49766	64083	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:28.852449894 CET	49766	64083	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:28.857403994 CET	64083	49766	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:28.863527060 CET	64083	49766	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:28.863601923 CET	49766	64083	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:28.899727106 CET	49745	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:29.205054045 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:29.240055084 CET	49745	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:29.244944096 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:29.577224016 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:29.577826023 CET	49774	56137	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:29.582608938 CET	56137	49774	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:29.582706928 CET	49774	56137	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:29.582776070 CET	49745	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:29.587974072 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:30.494503021 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:30.494716883 CET	49774	56137	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:30.494749069 CET	49774	56137	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:30.499708891 CET	56137	49774	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:30.500118971 CET	56137	49774	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:30.500176907 CET	49774	56137	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:30.540388107 CET	49745	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:30.842742920 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:30.843142986 CET	49745	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:30.847856045 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:31.181891918 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:31.182421923 CET	49783	65335	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:31.187278986 CET	65335	49783	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:31.187361956 CET	49783	65335	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:31.187427044 CET	49745	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:31.192203045 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:32.126950026 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:32.127156019 CET	49783	65335	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:32.132755995 CET	65335	49783	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:32.132810116 CET	49783	65335	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:32.181005001 CET	49745	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:32.476691008 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:32.477042913 CET	49745	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:32.481935978 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:32.816212893 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:32.816824913 CET	49794	58054	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:32.821764946 CET	58054	49794	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:32.821863890 CET	49794	58054	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:32.821898937 CET	49745	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:32.826891899 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:33.740529060 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:33.740865946 CET	49794	58054	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:33.746295929 CET	58054	49794	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:33.746376038 CET	49794	58054	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:33.790399075 CET	49745	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:13:34.090506077 CET	21	49745	110.4.45.197	192.168.2.5
Nov 4, 2024 10:13:34.134129047 CET	49745	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:32.624996901 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:32.689357996 CET	49996	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:32.832688093 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:32.832704067 CET	21	49996	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:32.832782030 CET	49996	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:32.833149910 CET	49996	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:32.838279009 CET	21	49996	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:32.838323116 CET	49996	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:33.182800055 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:33.183273077 CET	49997	63363	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:33.188101053 CET	63363	49997	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:33.188177109 CET	49997	63363	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:33.188241005 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:33.193021059 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:34.113265038 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:34.113452911 CET	49997	63363	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:34.113497019 CET	49997	63363	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:34.118223906 CET	63363	49997	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:34.118628979 CET	63363	49997	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:34.118676901 CET	49997	63363	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:34.165401936 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:34.464957952 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:34.509263992 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:35.123785973 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:35.128592014 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:35.485382080 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:35.485990047 CET	49998	56294	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:35.490825891 CET	56294	49998	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:35.490891933 CET	49998	56294	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:35.490983963 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:35.495807886 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:36.384284019 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:36.392203093 CET	49998	56294	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:36.397134066 CET	56294	49998	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:36.397157907 CET	56294	49998	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:36.397201061 CET	56294	49998	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:36.397211075 CET	56294	49998	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:36.397239923 CET	56294	49998	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:36.397249937 CET	56294	49998	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:36.397265911 CET	49998	56294	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:36.397294998 CET	49998	56294	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:36.397304058 CET	56294	49998	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:36.397313118 CET	56294	49998	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:36.397341967 CET	56294	49998	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:36.397344112 CET	49998	56294	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:36.397351980 CET	56294	49998	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:36.397352934 CET	49998	56294	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:36.397372961 CET	49998	56294	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:36.397387981 CET	49998	56294	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:36.402324915 CET	56294	49998	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:36.402335882 CET	56294	49998	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:36.402350903 CET	56294	49998	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:36.402367115 CET	56294	49998	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:36.402395010 CET	56294	49998	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:36.402404070 CET	56294	49998	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:36.402412891 CET	49998	56294	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:36.402581930 CET	49998	56294	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:36.402647018 CET	56294	49998	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:36.402834892 CET	49998	56294	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:36.407490015 CET	56294	49998	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:36.407752037 CET	56294	49998	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:36.407958031 CET	56294	49998	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:36.408020020 CET	49998	56294	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:36.413096905 CET	56294	49998	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:36.414086103 CET	56294	49998	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:36.414139986 CET	49998	56294	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:36.433866024 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:37.137233019 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:37.181088924 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:42.815064907 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:42.820048094 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:43.174119949 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:43.174683094 CET	49999	49628	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:43.179574013 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:43.179646969 CET	49999	49628	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:43.179708958 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:43.184674978 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.120671988 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.121968031 CET	49999	49628	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:44.126964092 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.127013922 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.127023935 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.127041101 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.127047062 CET	49999	49628	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:44.127051115 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.127062082 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.127079964 CET	49999	49628	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:44.127082109 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.127095938 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.127111912 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.127121925 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.127151012 CET	49999	49628	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:44.127214909 CET	49999	49628	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:44.131937981 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.131992102 CET	49999	49628	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:44.132006884 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.132055044 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.132064104 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.132078886 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.132118940 CET	49999	49628	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:44.132158995 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.132169008 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.132179022 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.132193089 CET	49999	49628	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:44.132241964 CET	49999	49628	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:44.132263899 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.132272959 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.132281065 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.132311106 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.132350922 CET	49999	49628	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:44.136833906 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.137108088 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.137141943 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.137196064 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.137273073 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.137283087 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.137660027 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.137669086 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.137677908 CET	49628	49999	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:44.137855053 CET	49999	49628	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:44.165601015 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:44.955656052 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:45.009160042 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:53.779392958 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:53.784493923 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:54.134797096 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:54.136173964 CET	50000	53227	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:54.141423941 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:54.141547918 CET	50000	53227	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:54.141563892 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:54.146795988 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.062520981 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.062829018 CET	50000	53227	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:55.067816019 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.067827940 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.067843914 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.067854881 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.067862988 CET	50000	53227	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:55.067866087 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.067888021 CET	50000	53227	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:55.067934036 CET	50000	53227	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:55.068006039 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.068046093 CET	50000	53227	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:55.068052053 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.068092108 CET	50000	53227	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:55.068164110 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.068212032 CET	50000	53227	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:55.068315983 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.068325996 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.068361044 CET	50000	53227	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:55.072815895 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.072859049 CET	50000	53227	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:55.072886944 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.072896004 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.072920084 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.072942972 CET	50000	53227	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:55.072962999 CET	50000	53227	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:55.073040009 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.073080063 CET	50000	53227	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:55.073115110 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.073153019 CET	50000	53227	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:55.073159933 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.073210955 CET	50000	53227	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:55.073353052 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.073394060 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.073406935 CET	50000	53227	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:55.073436975 CET	50000	53227	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:55.073441029 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.073477983 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.073558092 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.078088999 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.078414917 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.078481913 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.078493118 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.079052925 CET	53227	50000	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.079088926 CET	50000	53227	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:55.196670055 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:55.841114998 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:55.901901960 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:57.222871065 CET	50001	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:57.227886915 CET	21	50001	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:57.227972984 CET	50001	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:57.230992079 CET	50001	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:57.235990047 CET	21	50001	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:57.236047029 CET	50001	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:57.506872892 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:57.511893988 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:57.868077993 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:57.876900911 CET	50002	51512	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:57.881979942 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:57.882196903 CET	50002	51512	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:57.882333040 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:57.887228012 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.959717035 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.959969044 CET	50002	51512	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:58.964895010 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.964941978 CET	50002	51512	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:58.964970112 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.964998007 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.965027094 CET	50002	51512	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:58.965043068 CET	50002	51512	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:58.965106964 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.965150118 CET	50002	51512	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:58.965157032 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.965167046 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.965183020 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.965204954 CET	50002	51512	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:58.965241909 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.965251923 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.965251923 CET	50002	51512	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:58.965261936 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.965286016 CET	50002	51512	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:58.965306997 CET	50002	51512	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:58.969897985 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.969908953 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.969918966 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.969928980 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.969949961 CET	50002	51512	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:58.969954967 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.969969988 CET	50002	51512	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:58.969981909 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.970007896 CET	50002	51512	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:58.970026970 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.970041037 CET	50002	51512	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:58.970052958 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.970067978 CET	50002	51512	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:58.970097065 CET	50002	51512	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:58.970112085 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.970151901 CET	50002	51512	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:58.970199108 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.970248938 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.970259905 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.970297098 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.975121975 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.975157976 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.975244999 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.975363970 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.975483894 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.975492954 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.975538969 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.975548029 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.975589037 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.975596905 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.975693941 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.976269007 CET	51512	50002	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:58.976314068 CET	50002	51512	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:59.047811031 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:59.047854900 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:14:59.746118069 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:14:59.899815083 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:09.796015024 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:09.801285982 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:10.151797056 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:10.152587891 CET	50003	58161	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:10.157433033 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:10.157993078 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:10.157998085 CET	50003	58161	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:10.162878036 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.051382065 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:11.056477070 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.056545019 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:11.089180946 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.089485884 CET	50003	58161	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:11.094521999 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.094573975 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.094575882 CET	50003	58161	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:11.094614983 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.094635963 CET	50003	58161	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:11.094647884 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.094661951 CET	50003	58161	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:11.094688892 CET	50003	58161	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:11.094795942 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.094811916 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.094822884 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.094836950 CET	50003	58161	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:11.094841957 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.094865084 CET	50003	58161	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:11.094878912 CET	50003	58161	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:11.094897032 CET	50003	58161	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:11.094945908 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.094955921 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.094994068 CET	50003	58161	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:11.099477053 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.099488020 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.099540949 CET	50003	58161	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:11.099577904 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.099594116 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.099602938 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.099611998 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.099622011 CET	50003	58161	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:11.099646091 CET	50003	58161	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:11.099659920 CET	50003	58161	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:11.100109100 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.100119114 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.100130081 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.100140095 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.100150108 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.100172997 CET	50003	58161	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:11.104475975 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.104513884 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.104896069 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.104968071 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.104980946 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.105015993 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.105207920 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.105225086 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.105273962 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.105356932 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.105807066 CET	58161	50003	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.105854034 CET	50003	58161	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:11.196697950 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:11.887828112 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.957633018 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:11.960347891 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:11.965384960 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:12.087330103 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:13.237684011 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:13.237834930 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:13.237855911 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:13.237893105 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:13.238195896 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:13.238229036 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:13.238683939 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:13.238719940 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:13.242614031 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:13.596108913 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:13.596257925 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:13.601094007 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:13.933480024 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:13.938083887 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:13.943005085 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:14.275235891 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:14.275672913 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:14.280577898 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:15.378047943 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:15.378062010 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:15.378109932 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:15.378156900 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:15.378196001 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:15.378372908 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:15.383136988 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:15.714868069 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:15.722832918 CET	50005	64647	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:15.727682114 CET	64647	50005	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:15.731568098 CET	50005	64647	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:15.731566906 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:15.736515045 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.156208992 CET	50006	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:16.161232948 CET	21	50006	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.164210081 CET	50006	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:16.164210081 CET	50006	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:16.170339108 CET	21	50006	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.176476002 CET	50006	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:16.665961027 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.666280985 CET	50005	64647	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:16.671428919 CET	64647	50005	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.671439886 CET	64647	50005	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.671472073 CET	64647	50005	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.671480894 CET	64647	50005	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.671492100 CET	64647	50005	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.671503067 CET	64647	50005	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.671504021 CET	50005	64647	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:16.671534061 CET	50005	64647	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:16.671547890 CET	50005	64647	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:16.671549082 CET	64647	50005	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.671561003 CET	64647	50005	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.671592951 CET	64647	50005	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.671597004 CET	50005	64647	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:16.671602964 CET	64647	50005	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.671648979 CET	50005	64647	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:16.676435947 CET	64647	50005	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.676445007 CET	64647	50005	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.676486015 CET	50005	64647	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:16.676506996 CET	50005	64647	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:16.676528931 CET	64647	50005	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.676538944 CET	64647	50005	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.676564932 CET	64647	50005	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.676573992 CET	64647	50005	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.676575899 CET	50005	64647	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:16.676601887 CET	50005	64647	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:16.676620960 CET	64647	50005	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.676623106 CET	50005	64647	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:16.676652908 CET	64647	50005	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.676661968 CET	64647	50005	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.676670074 CET	50005	64647	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:16.676695108 CET	64647	50005	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.676723957 CET	50005	64647	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:16.676732063 CET	64647	50005	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.676754951 CET	64647	50005	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.676808119 CET	64647	50005	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.681616068 CET	64647	50005	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.681932926 CET	64647	50005	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.682775974 CET	64647	50005	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:16.684722900 CET	50005	64647	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:16.712312937 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:17.490400076 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:17.618707895 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:19.968859911 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:19.973927021 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:20.324122906 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:20.326338053 CET	50007	58497	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:20.331502914 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:20.334017992 CET	50007	58497	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:20.334019899 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:20.342175007 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.267529011 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.267780066 CET	50007	58497	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:21.272780895 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.272806883 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.272825956 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.272835970 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.272845030 CET	50007	58497	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:21.272877932 CET	50007	58497	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:21.272891045 CET	50007	58497	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:21.272917986 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.272927999 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.272967100 CET	50007	58497	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:21.272979975 CET	50007	58497	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:21.272991896 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.273003101 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.273041010 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.273041964 CET	50007	58497	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:21.273088932 CET	50007	58497	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:21.273206949 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.273256063 CET	50007	58497	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:21.277687073 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.277719975 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.277755976 CET	50007	58497	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:21.277771950 CET	50007	58497	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:21.277796984 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.277848959 CET	50007	58497	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:21.277863026 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.277913094 CET	50007	58497	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:21.277983904 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.277996063 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.278049946 CET	50007	58497	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:21.278085947 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.278196096 CET	50007	58497	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:21.278207064 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.278217077 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.278304100 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.278310061 CET	50007	58497	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:21.278388977 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.278444052 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.282545090 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.282613993 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.282679081 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.282763004 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.282852888 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.282953024 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.282963037 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.283010006 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.283134937 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.283171892 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.283212900 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.283222914 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.283536911 CET	58497	50007	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:21.283584118 CET	50007	58497	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:21.399821997 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:22.076407909 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:22.197941065 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:27.903599977 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:27.908607960 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:28.259224892 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:28.260075092 CET	50008	53852	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:28.265052080 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:28.265127897 CET	50008	53852	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:28.265204906 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:28.269996881 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.161972046 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.162292957 CET	50008	53852	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:29.167279005 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.167289972 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.167301893 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.167332888 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.167363882 CET	50008	53852	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:29.167387009 CET	50008	53852	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:29.167431116 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.167440891 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.167481899 CET	50008	53852	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:29.167509079 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.167520046 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.167567968 CET	50008	53852	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:29.167613029 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.167624950 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.167663097 CET	50008	53852	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:29.167663097 CET	50008	53852	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:29.172230005 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.172271967 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.172283888 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.172287941 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.172328949 CET	50008	53852	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:29.172353983 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.172377110 CET	50008	53852	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:29.172380924 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.172401905 CET	50008	53852	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:29.172425985 CET	50008	53852	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:29.172878027 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.172970057 CET	50008	53852	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:29.177272081 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.177328110 CET	50008	53852	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:29.177499056 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.177876949 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.177925110 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.178278923 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.178324938 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.178378105 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.178538084 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.182331085 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.182939053 CET	53852	50008	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:29.182986975 CET	50008	53852	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:29.399832964 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:30.841465950 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:30.841900110 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:30.841958046 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:30.842664003 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:30.842757940 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:34.296973944 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:34.302050114 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:34.390192986 CET	50009	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:34.395140886 CET	21	50009	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:34.396219015 CET	50009	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:34.396219015 CET	50009	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:34.401485920 CET	21	50009	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:34.401623011 CET	50009	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:34.644059896 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:34.647950888 CET	50010	54378	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:34.652858019 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:34.654119968 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:34.654119968 CET	50010	54378	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:34.659035921 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.570746899 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.571065903 CET	50010	54378	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:35.575968981 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.576030970 CET	50010	54378	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:35.576420069 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.576430082 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.576466084 CET	50010	54378	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:35.576469898 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.576479912 CET	50010	54378	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:35.576483011 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.576518059 CET	50010	54378	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:35.576530933 CET	50010	54378	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:35.576560020 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.576570034 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.576579094 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.576589108 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.576600075 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.576610088 CET	50010	54378	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:35.576637983 CET	50010	54378	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:35.576658964 CET	50010	54378	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:35.581733942 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.581746101 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.581779957 CET	50010	54378	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:35.581800938 CET	50010	54378	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:35.582283974 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.582294941 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.582324982 CET	50010	54378	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:35.582334995 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.582345009 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.582353115 CET	50010	54378	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:35.582355022 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.582376957 CET	50010	54378	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:35.582391024 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.582412958 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.582412958 CET	50010	54378	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:35.582444906 CET	50010	54378	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:35.582469940 CET	50010	54378	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:35.582990885 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.583028078 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.583564997 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.583596945 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.588175058 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.588197947 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.588345051 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.588387966 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.588419914 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.588468075 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.588768959 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.588810921 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.588841915 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.589157104 CET	54378	50010	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:35.589201927 CET	50010	54378	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:35.712479115 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:15:36.351334095 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:15:36.416100979 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:00.077168941 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:00.082107067 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:00.432797909 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:00.441010952 CET	50011	57320	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:00.445895910 CET	57320	50011	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:00.450114965 CET	50011	57320	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:00.450118065 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:00.454978943 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:01.360764027 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:01.361093044 CET	50011	57320	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:01.365993977 CET	57320	50011	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:01.366044044 CET	57320	50011	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:01.366054058 CET	57320	50011	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:01.366055012 CET	50011	57320	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:01.366065979 CET	57320	50011	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:01.366076946 CET	57320	50011	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:01.366092920 CET	57320	50011	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:01.366113901 CET	50011	57320	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:01.366137981 CET	50011	57320	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:01.366149902 CET	57320	50011	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:01.366158962 CET	57320	50011	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:01.366163969 CET	50011	57320	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:01.366187096 CET	50011	57320	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:01.366211891 CET	50011	57320	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:01.366296053 CET	57320	50011	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:01.366348982 CET	50011	57320	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:01.366381884 CET	57320	50011	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:01.366429090 CET	50011	57320	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:01.370906115 CET	57320	50011	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:01.370917082 CET	57320	50011	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:01.370966911 CET	50011	57320	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:01.370985985 CET	57320	50011	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:01.371040106 CET	50011	57320	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:01.371047020 CET	57320	50011	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:01.371057034 CET	57320	50011	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:01.371064901 CET	57320	50011	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:01.371112108 CET	50011	57320	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:01.371143103 CET	50011	57320	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:01.371145964 CET	57320	50011	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:01.371160984 CET	57320	50011	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:01.371191978 CET	57320	50011	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:01.371222019 CET	50011	57320	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:01.371249914 CET	57320	50011	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:01.371339083 CET	57320	50011	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:01.376007080 CET	57320	50011	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:01.376142979 CET	57320	50011	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:01.377310991 CET	57320	50011	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:01.377393961 CET	50011	57320	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:01.399857044 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:02.145546913 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:02.197006941 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:03.409333944 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:03.414235115 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:03.745415926 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:03.754019976 CET	50012	62073	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:03.759013891 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:03.760102987 CET	50012	62073	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:03.760102987 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:03.765043020 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.662096024 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.662329912 CET	50012	62073	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:04.667236090 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.667248011 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.667260885 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.667285919 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.667294979 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.667347908 CET	50012	62073	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:04.667366028 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.667396069 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.667404890 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.667412996 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.667474031 CET	50012	62073	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:04.667516947 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.668214083 CET	50012	62073	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:04.672233105 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.672244072 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.672272921 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.672282934 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.672298908 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.672307968 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.672311068 CET	50012	62073	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:04.672328949 CET	50012	62073	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:04.672347069 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.672383070 CET	50012	62073	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:04.672435045 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.672492027 CET	50012	62073	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:04.672514915 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.672540903 CET	50012	62073	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:04.673336029 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.677150965 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.677190065 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.677227974 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.677243948 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.677319050 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.677326918 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.677361012 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.677416086 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.677458048 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.677484989 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.677499056 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.677534103 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.678091049 CET	62073	50012	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:04.678162098 CET	50012	62073	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:04.712376118 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:05.405729055 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:05.480427980 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:11.626420975 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:11.794723988 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:12.144942045 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:12.145378113 CET	50013	65027	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:12.150228977 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:12.152122021 CET	50013	65027	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:12.152189970 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:12.157049894 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.058892012 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.059165001 CET	50013	65027	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:13.067533016 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.067542076 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.067581892 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.067589998 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.067600012 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.067620993 CET	50013	65027	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:13.067682028 CET	50013	65027	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:13.071517944 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.071573019 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.071583033 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.071587086 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.071609020 CET	50013	65027	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:13.071652889 CET	50013	65027	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:13.073249102 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.073321104 CET	50013	65027	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:13.076572895 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.076582909 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.076595068 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.076602936 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.076617002 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.076625109 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.076630116 CET	50013	65027	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:13.076668978 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.076685905 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.076702118 CET	50013	65027	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:13.076706886 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.076765060 CET	50013	65027	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:13.076766968 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.076776981 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.076900005 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.078541040 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.081531048 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.081697941 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.081707001 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.081737995 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.081814051 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.081825972 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.081877947 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.082262993 CET	65027	50013	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.082309961 CET	50013	65027	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:13.196737051 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:13.835012913 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:13.900532961 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:15.858046055 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:15.863106966 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:16.213022947 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:16.221049070 CET	50014	53156	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:16.225895882 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:16.230135918 CET	50014	53156	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:16.230137110 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:16.234960079 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.184423923 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.184663057 CET	50014	53156	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:17.189589024 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.189600945 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.189610958 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.189620018 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.189637899 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.189650059 CET	50014	53156	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:17.189676046 CET	50014	53156	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:17.189698935 CET	50014	53156	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:17.189713955 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.189724922 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.189740896 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.189750910 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.189768076 CET	50014	53156	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:17.189785004 CET	50014	53156	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:17.189810038 CET	50014	53156	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:17.189840078 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.189887047 CET	50014	53156	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:17.194610119 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.194619894 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.194667101 CET	50014	53156	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:17.194694996 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.194736958 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.194741964 CET	50014	53156	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:17.194787979 CET	50014	53156	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:17.194813013 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.194823027 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.194833040 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.194855928 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.194864988 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.194890976 CET	50014	53156	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:17.194914103 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.194921970 CET	50014	53156	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:17.194924116 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.194935083 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.199584007 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.199729919 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.199760914 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.199832916 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.199842930 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.199858904 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.199870110 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.199882030 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.199947119 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.199958086 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.200331926 CET	53156	50014	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:17.200376034 CET	50014	53156	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:17.399898052 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:18.000878096 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:18.087378979 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:19.594584942 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:19.599487066 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:19.930874109 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:19.936050892 CET	50015	61927	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:19.940901041 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:19.942167044 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:19.942168951 CET	50015	61927	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:19.947027922 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.848534107 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.849884033 CET	50015	61927	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:20.854789019 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.854834080 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.854844093 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.854845047 CET	50015	61927	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:20.854851961 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.854861975 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.854876995 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.854882002 CET	50015	61927	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:20.854895115 CET	50015	61927	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:20.854942083 CET	50015	61927	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:20.854954958 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.854965925 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.854969025 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.855001926 CET	50015	61927	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:20.855020046 CET	50015	61927	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:20.855108976 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.855154037 CET	50015	61927	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:20.861484051 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.861495018 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.861504078 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.861519098 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.861529112 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.861536980 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.861557961 CET	50015	61927	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:20.861592054 CET	50015	61927	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:20.861743927 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.861752987 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.861759901 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.861768961 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.861778021 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.861788034 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.861816883 CET	50015	61927	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:20.869102955 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.869112015 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.869116068 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.869121075 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.869128942 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.869138002 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.869142056 CET	61927	50015	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:20.869188070 CET	50015	61927	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:20.953421116 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:21.615130901 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:21.714720011 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:21.905455112 CET	50016	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:21.910375118 CET	21	50016	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:21.910499096 CET	50016	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:22.842093945 CET	21	50016	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:22.842247963 CET	50016	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:22.847363949 CET	21	50016	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:23.191158056 CET	21	50016	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:23.191308975 CET	50016	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:23.196178913 CET	21	50016	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:23.561048031 CET	21	50016	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:23.561178923 CET	50016	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:23.566050053 CET	21	50016	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:23.910518885 CET	21	50016	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:23.916021109 CET	50016	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:23.921014071 CET	21	50016	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:24.265996933 CET	21	50016	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:24.272486925 CET	50016	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:24.277411938 CET	21	50016	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:24.623590946 CET	21	50016	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:24.627492905 CET	50016	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:24.632484913 CET	21	50016	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:24.996318102 CET	21	50016	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:24.996870041 CET	50017	50752	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:25.001671076 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.001741886 CET	50017	50752	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:25.001816034 CET	50016	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:25.006665945 CET	21	50016	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.781315088 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:25.786443949 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.904494047 CET	21	50016	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.912406921 CET	50017	50752	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:25.917331934 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.917341948 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.917359114 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.917368889 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.917376995 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.917476892 CET	50017	50752	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:25.917562008 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.917572021 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.917574883 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.917577982 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.917587996 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.917690992 CET	50017	50752	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:25.917706966 CET	50017	50752	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:25.922411919 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.922420025 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.922435045 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.922442913 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.922447920 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.922465086 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.922503948 CET	50017	50752	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:25.922503948 CET	50017	50752	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:25.922782898 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.922920942 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.922977924 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.923043966 CET	50017	50752	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:25.927367926 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.927385092 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.927405119 CET	50017	50752	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:25.927429914 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.927942038 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.927958965 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.927977085 CET	50017	50752	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:25.927988052 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.928009987 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.928105116 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.928132057 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.932302952 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.932311058 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.932739019 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.933156967 CET	50752	50017	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:25.936117887 CET	50017	50752	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:26.103004932 CET	50016	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:26.136900902 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:26.137412071 CET	50018	58781	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:26.142273903 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:26.142643929 CET	50018	58781	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:26.142653942 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:26.149221897 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:26.681606054 CET	21	50016	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:26.830506086 CET	50016	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:27.075494051 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.075716019 CET	50018	58781	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:27.080677032 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.080688000 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.080698967 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.080715895 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.080724955 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.080729961 CET	50018	58781	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:27.080758095 CET	50018	58781	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:27.080784082 CET	50018	58781	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:27.080790997 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.080799103 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.080836058 CET	50018	58781	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:27.080852985 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.080862045 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.080872059 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.080902100 CET	50018	58781	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:27.085577965 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.085598946 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.085608959 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.085778952 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.085789919 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.085800886 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.085844994 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.085858107 CET	50018	58781	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:27.085901022 CET	50018	58781	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:27.085910082 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.085920095 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.085974932 CET	50018	58781	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:27.085984945 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.085994959 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.086065054 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.086075068 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.090857983 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.090898991 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.090955019 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.090997934 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.091008902 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.091125965 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.091135025 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.091145992 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.091155052 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.091197968 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.091517925 CET	58781	50018	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.091566086 CET	50018	58781	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:27.196741104 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:27.518811941 CET	50016	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:27.613878965 CET	21	50016	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.841684103 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:27.900051117 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:28.184540033 CET	21	50016	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:28.184973001 CET	50019	57499	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:28.189853907 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:28.192183018 CET	50019	57499	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:28.192312002 CET	50016	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:28.197144985 CET	21	50016	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.119743109 CET	21	50016	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.120043993 CET	50019	57499	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:29.125061035 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.125077009 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.125097990 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.125114918 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.125123978 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.125133991 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.125139952 CET	50019	57499	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:29.125149012 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.125159979 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.125212908 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.125236988 CET	50019	57499	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:29.125298023 CET	50019	57499	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:29.125360966 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.125408888 CET	50019	57499	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:29.130182028 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.130194902 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.130203009 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.130218983 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.130227089 CET	50019	57499	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:29.130228043 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.130239010 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.130247116 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.130268097 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.130275011 CET	50019	57499	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:29.130368948 CET	50019	57499	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:29.130456924 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.130795956 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.135190964 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.135236025 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.135245085 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.135308981 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.135324001 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.135355949 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.135411024 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.135425091 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.135432959 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.135588884 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.135646105 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.135730982 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.136004925 CET	57499	50019	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.136055946 CET	50019	57499	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:29.189801931 CET	50016	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:29.259356022 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:29.264238119 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.614650965 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.615293026 CET	50020	60003	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:29.620390892 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.620457888 CET	50020	60003	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:29.620557070 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:29.625484943 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:29.893259048 CET	21	50016	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.104068041 CET	50016	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:30.514843941 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.516930103 CET	50020	60003	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:30.521857023 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.521877050 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.521928072 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.521936893 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.521984100 CET	50020	60003	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:30.521985054 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.521997929 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.522015095 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.522022963 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.522028923 CET	50020	60003	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:30.522033930 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.522080898 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.522090912 CET	50020	60003	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:30.522157907 CET	50020	60003	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:30.526870012 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.526880026 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.526887894 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.526904106 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.526911974 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.526921034 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.526933908 CET	50020	60003	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:30.527000904 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.527051926 CET	50020	60003	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:30.527064085 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.527105093 CET	50020	60003	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:30.527348995 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.528774977 CET	50020	60003	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:30.531923056 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.531934023 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.531949043 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.531960011 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.532118082 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.532193899 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.532206059 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.533652067 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.533763885 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.534280062 CET	60003	50020	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:30.537852049 CET	50020	60003	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:30.594424963 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:31.032507896 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:31.037321091 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:31.262309074 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:31.368158102 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:31.368757010 CET	50021	53556	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:31.373636007 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:31.373703003 CET	50021	53556	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:31.373780012 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:31.378555059 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:31.399874926 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:32.277887106 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.278115034 CET	50021	53556	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:32.283596992 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.283606052 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.283615112 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.283624887 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.283632040 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.283715963 CET	50021	53556	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:32.283752918 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.283761978 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.283771038 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.283893108 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.283900976 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.284140110 CET	50021	53556	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:32.289246082 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.289254904 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.289264917 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.289274931 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.289284945 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.289294004 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.289325953 CET	50021	53556	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:32.289381981 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.289539099 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.289546013 CET	50021	53556	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:32.289547920 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.289752960 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.289761066 CET	50021	53556	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:32.289762020 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.289772987 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.294791937 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.294801950 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.294917107 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.294926882 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.294935942 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.295068026 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.295077085 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.295208931 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.295217991 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.295353889 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.295362949 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.295665979 CET	53556	50021	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:32.298237085 CET	50021	53556	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:32.418055058 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:33.051167011 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:33.103003025 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:39.517585993 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:39.522532940 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:39.854044914 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:39.866190910 CET	50022	52591	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:39.871131897 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:39.874892950 CET	50022	52591	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:39.875107050 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:39.879945040 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.778814077 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.780551910 CET	50022	52591	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:40.785537958 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.785551071 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.785567999 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.785588026 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.785598993 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.785643101 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.785654068 CET	50022	52591	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:40.785684109 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.785696983 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.785698891 CET	50022	52591	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:40.785726070 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.785756111 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.785765886 CET	50022	52591	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:40.785804033 CET	50022	52591	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:40.786154985 CET	50022	52591	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:40.790534973 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.790545940 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.790565014 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.790575027 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.790582895 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.790617943 CET	50022	52591	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:40.790647984 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.790657043 CET	50022	52591	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:40.790851116 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.790946960 CET	50022	52591	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:40.790999889 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.791184902 CET	50022	52591	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:40.795469046 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.795572042 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.795582056 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.795768976 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.795778990 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.795862913 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.795874119 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.795886040 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.796037912 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.800203085 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.800540924 CET	52591	50022	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:40.804433107 CET	50022	52591	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:40.864317894 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:41.545667887 CET	21	50004	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:41.628184080 CET	50004	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:49.846080065 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:49.851043940 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:50.204061985 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:50.208184958 CET	50023	56946	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:50.213139057 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:50.213270903 CET	50023	56946	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:50.213270903 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:50.218210936 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.127051115 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.127433062 CET	50023	56946	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:51.132412910 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.132424116 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.132431984 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.132491112 CET	50023	56946	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:51.132570028 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.132579088 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.132587910 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.132596970 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.132607937 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.132612944 CET	50023	56946	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:51.132627010 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.132628918 CET	50023	56946	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:51.132642984 CET	50023	56946	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:51.132647991 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.132653952 CET	50023	56946	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:51.132669926 CET	50023	56946	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:51.132699013 CET	50023	56946	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:51.137434959 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.137444973 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.137490034 CET	50023	56946	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:51.137521029 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.137572050 CET	50023	56946	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:51.137643099 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.137651920 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.137695074 CET	50023	56946	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:51.137696981 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.137708902 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.137734890 CET	50023	56946	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:51.137756109 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.137756109 CET	50023	56946	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:51.137765884 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.137774944 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.137797117 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.137830019 CET	50023	56946	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:51.137854099 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.138060093 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.142457962 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.142467976 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.142479897 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.142488956 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.142568111 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.142621994 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.142659903 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.142776012 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.142836094 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.142915010 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.143354893 CET	56946	50023	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:51.143471003 CET	50023	56946	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:51.196777105 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:51.906769037 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:52.088095903 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:57.504298925 CET	50024	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:57.509278059 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:57.509346962 CET	50024	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:58.451360941 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:58.457046986 CET	50024	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:58.461977959 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:58.812264919 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:58.816231012 CET	50024	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:58.821039915 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:59.197164059 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:59.197314024 CET	50024	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:59.202229023 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:59.552597046 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:16:59.552714109 CET	50024	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:16:59.557606936 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:00.009773016 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:00.012265921 CET	50024	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:00.017357111 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:00.412107944 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:00.412257910 CET	50024	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:00.417119026 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:00.767286062 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:00.773122072 CET	50025	49933	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:00.899893045 CET	50024	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:01.025422096 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.025461912 CET	49933	50025	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.025481939 CET	50024	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:01.025527954 CET	50025	49933	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:01.025851965 CET	50024	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:01.030667067 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.970776081 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.971080065 CET	50025	49933	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:01.975975037 CET	49933	50025	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.976052999 CET	49933	50025	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.976067066 CET	49933	50025	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.976080894 CET	49933	50025	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.976094007 CET	49933	50025	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.976114035 CET	49933	50025	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.976182938 CET	50025	49933	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:01.976221085 CET	49933	50025	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.976234913 CET	49933	50025	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.976249933 CET	49933	50025	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.976281881 CET	49933	50025	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.976290941 CET	50025	49933	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:01.976321936 CET	50025	49933	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:01.981152058 CET	49933	50025	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.981178045 CET	49933	50025	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.981192112 CET	49933	50025	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.981204987 CET	49933	50025	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.981281996 CET	49933	50025	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.981295109 CET	49933	50025	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.981322050 CET	50025	49933	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:01.981405020 CET	49933	50025	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.981415987 CET	50025	49933	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:01.981667042 CET	50025	49933	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:01.986186028 CET	49933	50025	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.986354113 CET	49933	50025	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.986399889 CET	49933	50025	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.986468077 CET	49933	50025	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.986540079 CET	49933	50025	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.986604929 CET	49933	50025	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.986640930 CET	49933	50025	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.986726999 CET	49933	50025	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.987113953 CET	49933	50025	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:01.987214088 CET	50025	49933	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:02.087433100 CET	50024	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:02.786523104 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:02.899902105 CET	50024	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:04.839067936 CET	50024	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:04.844753027 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:05.194322109 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:05.194960117 CET	50026	50066	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:05.200076103 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:05.200148106 CET	50026	50066	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:05.200253963 CET	50024	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:05.205096006 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.114967108 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.120174885 CET	50026	50066	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:06.125191927 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.125202894 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.125219107 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.125227928 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.125269890 CET	50026	50066	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:06.125272036 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.125282049 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.125315905 CET	50026	50066	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:06.125344038 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.125384092 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.125394106 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.125401974 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.125471115 CET	50026	50066	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:06.130183935 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.130234957 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.130289078 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.130297899 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.130346060 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.130354881 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.130388021 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.130392075 CET	50026	50066	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:06.130439043 CET	50026	50066	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:06.130605936 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.130732059 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.130778074 CET	50026	50066	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:06.132134914 CET	50026	50066	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:06.135404110 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.135514021 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.135546923 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.135620117 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.135667086 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.136984110 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.137017965 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.137408018 CET	50066	50026	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:06.141133070 CET	50026	50066	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:06.198127985 CET	50024	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:06.904292107 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:07.087397099 CET	50024	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:10.855658054 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:10.860506058 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:11.108489037 CET	50024	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:11.113238096 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:11.212542057 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:11.212903023 CET	50027	53903	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:11.217679977 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:11.217767954 CET	50027	53903	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:11.217829943 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:11.222592115 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:11.465626955 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:11.465950012 CET	50028	53414	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:11.472182989 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:11.472361088 CET	50028	53414	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:11.472387075 CET	50024	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:11.477207899 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.140006065 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.140950918 CET	50027	53903	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:12.145881891 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.145893097 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.145912886 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.145924091 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.145967007 CET	50027	53903	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:12.150557041 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.150568962 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.150578976 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.150588989 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.150599003 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.150609016 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.150620937 CET	50027	53903	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:12.150635958 CET	50027	53903	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:12.150670052 CET	50027	53903	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:12.150842905 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.150854111 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.150861979 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.150878906 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.150891066 CET	50027	53903	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:12.150902987 CET	50027	53903	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:12.150943041 CET	50027	53903	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:12.155355930 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.155366898 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.155375957 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.155416012 CET	50027	53903	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:12.155436039 CET	50027	53903	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:12.155550003 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.155560017 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.155569077 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.155586958 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.155613899 CET	50027	53903	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:12.155636072 CET	50027	53903	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:12.155705929 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.155747890 CET	50027	53903	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:12.160171986 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.160181999 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.160233021 CET	50027	53903	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:12.160341978 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.160449982 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.160460949 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.165045023 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.165055037 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.165064096 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.165074110 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.165083885 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.165230989 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.165960073 CET	53903	50027	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.166013002 CET	50027	53903	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:12.181162119 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:12.398058891 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.402285099 CET	50028	53414	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:12.407156944 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.407167912 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.407182932 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.407191992 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.407243967 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.407253981 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.407283068 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.407293081 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.407387018 CET	50028	53414	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:12.407394886 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.407406092 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.407450914 CET	50028	53414	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:12.412302971 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.412349939 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.412358046 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.412384987 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.412394047 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.412414074 CET	50028	53414	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:12.412415981 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.412450075 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.412450075 CET	50028	53414	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:12.412470102 CET	50028	53414	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:12.412478924 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.412501097 CET	50028	53414	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:12.412514925 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.412542105 CET	50028	53414	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:12.412545919 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.412576914 CET	50028	53414	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:12.412602901 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.412652969 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.412705898 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.418474913 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.418561935 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.418644905 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.419751883 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.419760942 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.420026064 CET	53414	50028	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.420243979 CET	50028	53414	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:12.446872950 CET	50024	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:12.910747051 CET	21	49709	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:12.962409973 CET	49709	21	192.168.2.5	110.4.45.197
Nov 4, 2024 10:17:13.186772108 CET	21	50024	110.4.45.197	192.168.2.5
Nov 4, 2024 10:17:13.243650913 CET	50024	21	192.168.2.5	110.4.45.197

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 4, 2024 10:13:01.644409895 CET	51372	53	192.168.2.5	1.1.1.1
Nov 4, 2024 10:13:01.651252985 CET	53	51372	1.1.1.1	192.168.2.5
Nov 4, 2024 10:13:03.203773022 CET	54978	53	192.168.2.5	1.1.1.1
Nov 4, 2024 10:13:03.459189892 CET	53	54978	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 4, 2024 10:13:01.644409895 CET	192.168.2.5	1.1.1.1	0x161c	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Nov 4, 2024 10:13:03.203773022 CET	192.168.2.5	1.1.1.1	0xa870	Standard query (0)	ftp.haliza.com.my	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 4, 2024 10:13:01.651252985 CET	1.1.1.1	192.168.2.5	0x161c	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Nov 4, 2024 10:13:01.651252985 CET	1.1.1.1	192.168.2.5	0x161c	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Nov 4, 2024 10:13:01.651252985 CET	1.1.1.1	192.168.2.5	0x161c	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Nov 4, 2024 10:13:03.459189892 CET	1.1.1.1	192.168.2.5	0xa870	No error (0)	ftp.haliza.com.my	110.4.45.197	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	172.67.74.152	443	528	C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-04 09:13:02 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-11-04 09:13:02 UTC	399	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 09:13:02 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8dd37c5e9dff2cd6-DFW server-timing: cfL4;desc="?proto=TCP&rtt=2359&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2816&recv_bytes=769&delivery_rate=1215785&cwnd=251&unsent_bytes=0&cid=3c841d748402eaf4&ts=330&x=0"
2024-11-04 09:13:02 UTC	14	IN	Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 Data Ascii: 173.254.250.69

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49715	172.67.74.152	443	6552	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-04 09:13:15 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-11-04 09:13:15 UTC	398	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 09:13:15 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8dd37cb0be47ddb3-DFW server-timing: cfL4;desc="?proto=TCP&rtt=1176&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2817&recv_bytes=769&delivery_rate=2443881&cwnd=73&unsent_bytes=0&cid=d0663724a7e0a820&ts=528&x=0"
2024-11-04 09:13:15 UTC	14	IN	Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 Data Ascii: 173.254.250.69

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49739	172.67.74.152	443	2800	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-04 09:13:23 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-11-04 09:13:24 UTC	399	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 09:13:24 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8dd37ce4bb741442-DFW server-timing: cfL4;desc="?proto=TCP&rtt=1196&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2817&recv_bytes=769&delivery_rate=2435660&cwnd=251&unsent_bytes=0&cid=54615130f8284974&ts=243&x=0"
2024-11-04 09:13:24 UTC	14	IN	Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 Data Ascii: 173.254.250.69

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 4, 2024 10:13:04.461606026 CET	21	49709	110.4.45.197	192.168.2.5	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 26 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 26 of 50 allowed.220-Local time is now 17:13. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 26 of 50 allowed.220-Local time is now 17:13. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 26 of 50 allowed.220-Local time is now 17:13. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 26 of 50 allowed.220-Local time is now 17:13. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Nov 4, 2024 10:13:04.461891890 CET	49709	21	192.168.2.5	110.4.45.197	USER origin@haliza.com.my
Nov 4, 2024 10:13:04.824552059 CET	21	49709	110.4.45.197	192.168.2.5	331 User origin@haliza.com.my OK. Password required
Nov 4, 2024 10:13:04.827223063 CET	49709	21	192.168.2.5	110.4.45.197	PASS JesusChrist007$
Nov 4, 2024 10:13:05.222310066 CET	21	49709	110.4.45.197	192.168.2.5	230 OK. Current restricted directory is /
Nov 4, 2024 10:13:05.580542088 CET	21	49709	110.4.45.197	192.168.2.5	504 Unknown command
Nov 4, 2024 10:13:05.580734015 CET	49709	21	192.168.2.5	110.4.45.197	PWD
Nov 4, 2024 10:13:05.936120987 CET	21	49709	110.4.45.197	192.168.2.5	257 "/" is your current location
Nov 4, 2024 10:13:05.936284065 CET	49709	21	192.168.2.5	110.4.45.197	TYPE I
Nov 4, 2024 10:13:06.294846058 CET	21	49709	110.4.45.197	192.168.2.5	200 TYPE is now 8-bit binary
Nov 4, 2024 10:13:06.295129061 CET	49709	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:13:06.650208950 CET	21	49709	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,210,95)
Nov 4, 2024 10:13:06.655981064 CET	49709	21	192.168.2.5	110.4.45.197	STOR CO_Chrome_Default.txt_user-960781_2024_11_04_04_33_02.txt
Nov 4, 2024 10:13:07.585129976 CET	21	49709	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:13:07.941498995 CET	21	49709	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.356 seconds (measured here), 0.79 Kbytes per second
Nov 4, 2024 10:13:07.942117929 CET	49709	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:13:08.297616005 CET	21	49709	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,192,210)
Nov 4, 2024 10:13:08.303241968 CET	49709	21	192.168.2.5	110.4.45.197	STOR CO_Edge Chromium_Default.txt_user-960781_2024_11_04_10_41_34.txt
Nov 4, 2024 10:13:09.216640949 CET	21	49709	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:13:09.561566114 CET	21	49709	110.4.45.197	192.168.2.5	226 File successfully transferred
Nov 4, 2024 10:13:09.561956882 CET	49709	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:13:09.917282104 CET	21	49709	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,243,167)
Nov 4, 2024 10:13:09.923052073 CET	49709	21	192.168.2.5	110.4.45.197	STOR CO_Firefox_v6zchhhv.default-release.txt_user-960781_2024_11_04_13_00_19.txt
Nov 4, 2024 10:13:10.881580114 CET	21	49709	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:13:11.250051975 CET	21	49709	110.4.45.197	192.168.2.5	226 File successfully transferred
Nov 4, 2024 10:13:17.191484928 CET	21	49716	110.4.45.197	192.168.2.5	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 28 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 28 of 50 allowed.220-Local time is now 17:13. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 28 of 50 allowed.220-Local time is now 17:13. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 28 of 50 allowed.220-Local time is now 17:13. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 28 of 50 allowed.220-Local time is now 17:13. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Nov 4, 2024 10:13:17.191725016 CET	49716	21	192.168.2.5	110.4.45.197	USER origin@haliza.com.my
Nov 4, 2024 10:13:17.551525116 CET	21	49716	110.4.45.197	192.168.2.5	331 User origin@haliza.com.my OK. Password required
Nov 4, 2024 10:13:17.551703930 CET	49716	21	192.168.2.5	110.4.45.197	PASS JesusChrist007$
Nov 4, 2024 10:13:17.936074018 CET	21	49716	110.4.45.197	192.168.2.5	230 OK. Current restricted directory is /
Nov 4, 2024 10:13:18.294068098 CET	21	49716	110.4.45.197	192.168.2.5	504 Unknown command
Nov 4, 2024 10:13:18.294240952 CET	49716	21	192.168.2.5	110.4.45.197	PWD
Nov 4, 2024 10:13:18.651875973 CET	21	49716	110.4.45.197	192.168.2.5	257 "/" is your current location
Nov 4, 2024 10:13:18.652288914 CET	49716	21	192.168.2.5	110.4.45.197	TYPE I
Nov 4, 2024 10:13:19.009896040 CET	21	49716	110.4.45.197	192.168.2.5	200 TYPE is now 8-bit binary
Nov 4, 2024 10:13:19.013953924 CET	49716	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:13:19.375341892 CET	21	49716	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,241,117)
Nov 4, 2024 10:13:19.381402969 CET	49716	21	192.168.2.5	110.4.45.197	STOR PW_user-960781_2024_11_04_04_13_15.html
Nov 4, 2024 10:13:20.357707024 CET	21	49716	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:13:20.712255001 CET	21	49716	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.364 seconds (measured here), 0.94 Kbytes per second
Nov 4, 2024 10:13:20.739705086 CET	49716	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:13:21.124290943 CET	21	49716	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,250,15)
Nov 4, 2024 10:13:21.141900063 CET	49716	21	192.168.2.5	110.4.45.197	STOR CO_Chrome_Default.txt_user-960781_2024_11_04_10_31_56.txt
Nov 4, 2024 10:13:22.771806955 CET	21	49716	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:13:22.771951914 CET	21	49716	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:13:22.771981955 CET	21	49716	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:13:25.844021082 CET	21	49745	110.4.45.197	192.168.2.5	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 28 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 28 of 50 allowed.220-Local time is now 17:13. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 28 of 50 allowed.220-Local time is now 17:13. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 28 of 50 allowed.220-Local time is now 17:13. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 28 of 50 allowed.220-Local time is now 17:13. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Nov 4, 2024 10:13:25.844403028 CET	49745	21	192.168.2.5	110.4.45.197	USER origin@haliza.com.my
Nov 4, 2024 10:13:25.844455957 CET	21	49745	110.4.45.197	192.168.2.5	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 28 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 28 of 50 allowed.220-Local time is now 17:13. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 28 of 50 allowed.220-Local time is now 17:13. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 28 of 50 allowed.220-Local time is now 17:13. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 28 of 50 allowed.220-Local time is now 17:13. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Nov 4, 2024 10:13:26.184287071 CET	21	49745	110.4.45.197	192.168.2.5	331 User origin@haliza.com.my OK. Password required
Nov 4, 2024 10:13:26.185314894 CET	49745	21	192.168.2.5	110.4.45.197	PASS JesusChrist007$
Nov 4, 2024 10:13:26.556669950 CET	21	49745	110.4.45.197	192.168.2.5	230 OK. Current restricted directory is /
Nov 4, 2024 10:13:26.900331974 CET	21	49745	110.4.45.197	192.168.2.5	504 Unknown command
Nov 4, 2024 10:13:26.900731087 CET	49745	21	192.168.2.5	110.4.45.197	PWD
Nov 4, 2024 10:13:27.240027905 CET	21	49745	110.4.45.197	192.168.2.5	257 "/" is your current location
Nov 4, 2024 10:13:27.242155075 CET	49745	21	192.168.2.5	110.4.45.197	TYPE I
Nov 4, 2024 10:13:27.580374956 CET	21	49745	110.4.45.197	192.168.2.5	200 TYPE is now 8-bit binary
Nov 4, 2024 10:13:27.581007957 CET	49745	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:13:27.918997049 CET	21	49745	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,250,83)
Nov 4, 2024 10:13:27.924803972 CET	49745	21	192.168.2.5	110.4.45.197	STOR PW_user-960781_2024_11_04_04_13_24.html
Nov 4, 2024 10:13:28.852077007 CET	21	49745	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:13:29.205054045 CET	21	49745	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.351 seconds (measured here), 0.97 Kbytes per second
Nov 4, 2024 10:13:29.240055084 CET	49745	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:13:29.577224016 CET	21	49745	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,219,73)
Nov 4, 2024 10:13:29.582776070 CET	49745	21	192.168.2.5	110.4.45.197	STOR CO_Chrome_Default.txt_user-960781_2024_11_04_10_41_57.txt
Nov 4, 2024 10:13:30.494503021 CET	21	49745	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:13:30.842742920 CET	21	49745	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.348 seconds (measured here), 0.81 Kbytes per second
Nov 4, 2024 10:13:30.843142986 CET	49745	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:13:31.181891918 CET	21	49745	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,255,55)
Nov 4, 2024 10:13:31.187427044 CET	49745	21	192.168.2.5	110.4.45.197	STOR CO_Edge Chromium_Default.txt_user-960781_2024_11_04_12_50_48.txt
Nov 4, 2024 10:13:32.126950026 CET	21	49745	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:13:32.476691008 CET	21	49745	110.4.45.197	192.168.2.5	226 File successfully transferred
Nov 4, 2024 10:13:32.477042913 CET	49745	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:13:32.816212893 CET	21	49745	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,226,198)
Nov 4, 2024 10:13:32.821898937 CET	49745	21	192.168.2.5	110.4.45.197	STOR CO_Firefox_v6zchhhv.default-release.txt_user-960781_2024_11_04_14_59_19.txt
Nov 4, 2024 10:13:33.740529060 CET	21	49745	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:13:34.090506077 CET	21	49745	110.4.45.197	192.168.2.5	226 File successfully transferred
Nov 4, 2024 10:14:32.624996901 CET	49709	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:14:33.182800055 CET	21	49709	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,247,131)
Nov 4, 2024 10:14:33.188241005 CET	49709	21	192.168.2.5	110.4.45.197	STOR KL_user-960781_2024_11_17_21_53_38.html
Nov 4, 2024 10:14:34.113265038 CET	21	49709	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:14:34.464957952 CET	21	49709	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.350 seconds (measured here), 0.80 Kbytes per second
Nov 4, 2024 10:14:35.123785973 CET	49709	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:14:35.485382080 CET	21	49709	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,219,230)
Nov 4, 2024 10:14:35.490983963 CET	49709	21	192.168.2.5	110.4.45.197	STOR SC_user-960781_2024_11_21_00_44_12.jpeg
Nov 4, 2024 10:14:36.384284019 CET	21	49709	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:14:37.137233019 CET	21	49709	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.753 seconds (measured here), 87.18 Kbytes per second
Nov 4, 2024 10:14:42.815064907 CET	49709	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:14:43.174119949 CET	21	49709	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,193,220)
Nov 4, 2024 10:14:43.179708958 CET	49709	21	192.168.2.5	110.4.45.197	STOR SC_user-960781_2024_11_26_10_28_10.jpeg
Nov 4, 2024 10:14:44.120671988 CET	21	49709	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:14:44.955656052 CET	21	49709	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.820 seconds (measured here), 78.62 Kbytes per second
Nov 4, 2024 10:14:53.779392958 CET	49709	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:14:54.134797096 CET	21	49709	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,207,235)
Nov 4, 2024 10:14:54.141563892 CET	49709	21	192.168.2.5	110.4.45.197	STOR SC_user-960781_2024_12_03_03_34_51.jpeg
Nov 4, 2024 10:14:55.062520981 CET	21	49709	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:14:55.841114998 CET	21	49709	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.779 seconds (measured here), 82.78 Kbytes per second
Nov 4, 2024 10:14:57.506872892 CET	49709	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:14:57.868077993 CET	21	49709	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,201,56)
Nov 4, 2024 10:14:57.882333040 CET	49709	21	192.168.2.5	110.4.45.197	STOR SC_user-960781_2024_12_06_22_46_31.jpeg
Nov 4, 2024 10:14:58.959717035 CET	21	49709	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:14:59.047811031 CET	21	49709	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:14:59.746118069 CET	21	49709	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.947 seconds (measured here), 68.04 Kbytes per second
Nov 4, 2024 10:15:09.796015024 CET	49709	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:15:10.151797056 CET	21	49709	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,227,49)
Nov 4, 2024 10:15:10.157993078 CET	49709	21	192.168.2.5	110.4.45.197	STOR SC_user-960781_2024_12_14_10_46_01.jpeg
Nov 4, 2024 10:15:11.089180946 CET	21	49709	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:15:11.887828112 CET	21	49709	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.801 seconds (measured here), 80.50 Kbytes per second
Nov 4, 2024 10:15:11.957633018 CET	21	50004	110.4.45.197	192.168.2.5	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 28 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 28 of 50 allowed.220-Local time is now 17:15. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 28 of 50 allowed.220-Local time is now 17:15. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 28 of 50 allowed.220-Local time is now 17:15. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 28 of 50 allowed.220-Local time is now 17:15. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Nov 4, 2024 10:15:11.960347891 CET	50004	21	192.168.2.5	110.4.45.197	USER origin@haliza.com.my
Nov 4, 2024 10:15:13.237684011 CET	21	50004	110.4.45.197	192.168.2.5	331 User origin@haliza.com.my OK. Password required
Nov 4, 2024 10:15:13.237834930 CET	50004	21	192.168.2.5	110.4.45.197	PASS JesusChrist007$
Nov 4, 2024 10:15:13.237855911 CET	21	50004	110.4.45.197	192.168.2.5	331 User origin@haliza.com.my OK. Password required
Nov 4, 2024 10:15:13.238195896 CET	21	50004	110.4.45.197	192.168.2.5	331 User origin@haliza.com.my OK. Password required
Nov 4, 2024 10:15:13.238683939 CET	21	50004	110.4.45.197	192.168.2.5	331 User origin@haliza.com.my OK. Password required
Nov 4, 2024 10:15:13.596108913 CET	21	50004	110.4.45.197	192.168.2.5	230 OK. Current restricted directory is /
Nov 4, 2024 10:15:13.933480024 CET	21	50004	110.4.45.197	192.168.2.5	504 Unknown command
Nov 4, 2024 10:15:13.938083887 CET	50004	21	192.168.2.5	110.4.45.197	PWD
Nov 4, 2024 10:15:14.275235891 CET	21	50004	110.4.45.197	192.168.2.5	257 "/" is your current location
Nov 4, 2024 10:15:14.275672913 CET	50004	21	192.168.2.5	110.4.45.197	TYPE I
Nov 4, 2024 10:15:15.378047943 CET	21	50004	110.4.45.197	192.168.2.5	200 TYPE is now 8-bit binary
Nov 4, 2024 10:15:15.378062010 CET	21	50004	110.4.45.197	192.168.2.5	200 TYPE is now 8-bit binary
Nov 4, 2024 10:15:15.378156900 CET	21	50004	110.4.45.197	192.168.2.5	200 TYPE is now 8-bit binary
Nov 4, 2024 10:15:15.378372908 CET	50004	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:15:15.714868069 CET	21	50004	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,252,135)
Nov 4, 2024 10:15:15.731566906 CET	50004	21	192.168.2.5	110.4.45.197	STOR SC_user-960781_2024_11_27_19_12_39.jpeg
Nov 4, 2024 10:15:16.665961027 CET	21	50004	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:15:17.490400076 CET	21	50004	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.824 seconds (measured here), 78.26 Kbytes per second
Nov 4, 2024 10:15:19.968859911 CET	49709	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:15:20.324122906 CET	21	49709	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,228,129)
Nov 4, 2024 10:15:20.334019899 CET	49709	21	192.168.2.5	110.4.45.197	STOR SC_user-960781_2024_12_20_15_57_08.jpeg
Nov 4, 2024 10:15:21.267529011 CET	21	49709	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:15:22.076407909 CET	21	49709	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.809 seconds (measured here), 79.67 Kbytes per second
Nov 4, 2024 10:15:27.903599977 CET	49709	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:15:28.259224892 CET	21	49709	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,210,92)
Nov 4, 2024 10:15:28.265204906 CET	49709	21	192.168.2.5	110.4.45.197	STOR SC_user-960781_2024_12_27_15_05_20.jpeg
Nov 4, 2024 10:15:29.161972046 CET	21	49709	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:15:30.841465950 CET	21	49709	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.756 seconds (measured here), 85.27 Kbytes per second
Nov 4, 2024 10:15:30.841900110 CET	21	49709	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.756 seconds (measured here), 85.27 Kbytes per second
Nov 4, 2024 10:15:30.842664003 CET	21	49709	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.756 seconds (measured here), 85.27 Kbytes per second
Nov 4, 2024 10:15:34.296973944 CET	50004	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:15:34.644059896 CET	21	50004	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,212,106)
Nov 4, 2024 10:15:34.654119968 CET	50004	21	192.168.2.5	110.4.45.197	STOR SC_user-960781_2024_12_15_21_24_05.jpeg
Nov 4, 2024 10:15:35.570746899 CET	21	50004	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:15:36.351334095 CET	21	50004	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.783 seconds (measured here), 82.35 Kbytes per second
Nov 4, 2024 10:16:00.077168941 CET	49709	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:16:00.432797909 CET	21	49709	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,223,232)
Nov 4, 2024 10:16:00.450118065 CET	49709	21	192.168.2.5	110.4.45.197	STOR SC_user-960781_2025_01_12_15_26_53.jpeg
Nov 4, 2024 10:16:01.360764027 CET	21	49709	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:16:02.145546913 CET	21	49709	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.774 seconds (measured here), 83.25 Kbytes per second
Nov 4, 2024 10:16:03.409333944 CET	50004	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:16:03.745415926 CET	21	50004	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,242,121)
Nov 4, 2024 10:16:03.760102987 CET	50004	21	192.168.2.5	110.4.45.197	STOR SC_user-960781_2025_01_01_16_59_51.jpeg
Nov 4, 2024 10:16:04.662096024 CET	21	50004	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:16:05.405729055 CET	21	50004	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.743 seconds (measured here), 86.80 Kbytes per second
Nov 4, 2024 10:16:11.626420975 CET	49709	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:16:12.144942045 CET	21	49709	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,254,3)
Nov 4, 2024 10:16:12.152189970 CET	49709	21	192.168.2.5	110.4.45.197	STOR SC_user-960781_2025_01_19_18_31_18.jpeg
Nov 4, 2024 10:16:13.058892012 CET	21	49709	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:16:13.835012913 CET	21	49709	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.777 seconds (measured here), 83.01 Kbytes per second
Nov 4, 2024 10:16:15.858046055 CET	49709	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:16:16.213022947 CET	21	49709	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,207,164)
Nov 4, 2024 10:16:16.230137110 CET	49709	21	192.168.2.5	110.4.45.197	STOR SC_user-960781_2025_01_23_18_07_24.jpeg
Nov 4, 2024 10:16:17.184423923 CET	21	49709	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:16:18.000878096 CET	21	49709	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.820 seconds (measured here), 78.60 Kbytes per second
Nov 4, 2024 10:16:19.594584942 CET	50004	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:16:19.930874109 CET	21	50004	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,241,231)
Nov 4, 2024 10:16:19.942167044 CET	50004	21	192.168.2.5	110.4.45.197	STOR SC_user-960781_2025_01_10_20_38_28.jpeg
Nov 4, 2024 10:16:20.848534107 CET	21	50004	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:16:21.615130901 CET	21	50004	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.767 seconds (measured here), 84.09 Kbytes per second
Nov 4, 2024 10:16:22.842093945 CET	21	50016	110.4.45.197	192.168.2.5	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 31 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 31 of 50 allowed.220-Local time is now 17:16. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 31 of 50 allowed.220-Local time is now 17:16. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 31 of 50 allowed.220-Local time is now 17:16. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 31 of 50 allowed.220-Local time is now 17:16. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Nov 4, 2024 10:16:22.842247963 CET	50016	21	192.168.2.5	110.4.45.197	USER origin@haliza.com.my
Nov 4, 2024 10:16:23.191158056 CET	21	50016	110.4.45.197	192.168.2.5	331 User origin@haliza.com.my OK. Password required
Nov 4, 2024 10:16:23.191308975 CET	50016	21	192.168.2.5	110.4.45.197	PASS JesusChrist007$
Nov 4, 2024 10:16:23.561048031 CET	21	50016	110.4.45.197	192.168.2.5	230 OK. Current restricted directory is /
Nov 4, 2024 10:16:23.910518885 CET	21	50016	110.4.45.197	192.168.2.5	504 Unknown command
Nov 4, 2024 10:16:23.916021109 CET	50016	21	192.168.2.5	110.4.45.197	PWD
Nov 4, 2024 10:16:24.265996933 CET	21	50016	110.4.45.197	192.168.2.5	257 "/" is your current location
Nov 4, 2024 10:16:24.272486925 CET	50016	21	192.168.2.5	110.4.45.197	TYPE I
Nov 4, 2024 10:16:24.623590946 CET	21	50016	110.4.45.197	192.168.2.5	200 TYPE is now 8-bit binary
Nov 4, 2024 10:16:24.627492905 CET	50016	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:16:24.996318102 CET	21	50016	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,198,64)
Nov 4, 2024 10:16:25.001816034 CET	50016	21	192.168.2.5	110.4.45.197	STOR SC_user-960781_2025_01_28_14_34_54.jpeg
Nov 4, 2024 10:16:25.781315088 CET	49709	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:16:25.904494047 CET	21	50016	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:16:26.136900902 CET	21	49709	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,229,157)
Nov 4, 2024 10:16:26.142653942 CET	49709	21	192.168.2.5	110.4.45.197	STOR SC_user-960781_2025_02_01_11_59_33.jpeg
Nov 4, 2024 10:16:26.681606054 CET	21	50016	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.777 seconds (measured here), 82.97 Kbytes per second
Nov 4, 2024 10:16:27.075494051 CET	21	49709	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:16:27.518811941 CET	50016	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:16:27.841684103 CET	21	49709	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.767 seconds (measured here), 84.07 Kbytes per second
Nov 4, 2024 10:16:28.184540033 CET	21	50016	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,224,155)
Nov 4, 2024 10:16:28.192312002 CET	50016	21	192.168.2.5	110.4.45.197	STOR SC_user-960781_2025_02_04_10_36_53.jpeg
Nov 4, 2024 10:16:29.119743109 CET	21	50016	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:16:29.259356022 CET	49709	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:16:29.614650965 CET	21	49709	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,234,99)
Nov 4, 2024 10:16:29.620557070 CET	49709	21	192.168.2.5	110.4.45.197	STOR SC_user-960781_2025_02_07_09_20_45.jpeg
Nov 4, 2024 10:16:29.893259048 CET	21	50016	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.774 seconds (measured here), 83.32 Kbytes per second
Nov 4, 2024 10:16:30.514843941 CET	21	49709	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:16:31.032507896 CET	50004	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:16:31.262309074 CET	21	49709	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.747 seconds (measured here), 86.27 Kbytes per second
Nov 4, 2024 10:16:31.368158102 CET	21	50004	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,209,52)
Nov 4, 2024 10:16:31.373780012 CET	50004	21	192.168.2.5	110.4.45.197	STOR SC_user-960781_2025_01_18_02_28_20.jpeg
Nov 4, 2024 10:16:32.277887106 CET	21	50004	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:16:33.051167011 CET	21	50004	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.774 seconds (measured here), 83.33 Kbytes per second
Nov 4, 2024 10:16:39.517585993 CET	50004	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:16:39.854044914 CET	21	50004	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,205,111)
Nov 4, 2024 10:16:39.875107050 CET	50004	21	192.168.2.5	110.4.45.197	STOR SC_user-960781_2025_01_23_22_58_49.jpeg
Nov 4, 2024 10:16:40.778814077 CET	21	50004	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:16:41.545667887 CET	21	50004	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.767 seconds (measured here), 90.24 Kbytes per second
Nov 4, 2024 10:16:49.846080065 CET	49709	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:16:50.204061985 CET	21	49709	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,222,114)
Nov 4, 2024 10:16:50.213270903 CET	49709	21	192.168.2.5	110.4.45.197	STOR SC_user-960781_2025_02_18_12_47_44.jpeg
Nov 4, 2024 10:16:51.127051115 CET	21	49709	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:16:51.906769037 CET	21	49709	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.783 seconds (measured here), 82.32 Kbytes per second
Nov 4, 2024 10:16:58.451360941 CET	21	50024	110.4.45.197	192.168.2.5	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 32 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 32 of 50 allowed.220-Local time is now 17:16. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 32 of 50 allowed.220-Local time is now 17:16. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 32 of 50 allowed.220-Local time is now 17:16. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 32 of 50 allowed.220-Local time is now 17:16. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Nov 4, 2024 10:16:58.457046986 CET	50024	21	192.168.2.5	110.4.45.197	USER origin@haliza.com.my
Nov 4, 2024 10:16:58.812264919 CET	21	50024	110.4.45.197	192.168.2.5	331 User origin@haliza.com.my OK. Password required
Nov 4, 2024 10:16:58.816231012 CET	50024	21	192.168.2.5	110.4.45.197	PASS JesusChrist007$
Nov 4, 2024 10:16:59.197164059 CET	21	50024	110.4.45.197	192.168.2.5	230 OK. Current restricted directory is /
Nov 4, 2024 10:16:59.552597046 CET	21	50024	110.4.45.197	192.168.2.5	504 Unknown command
Nov 4, 2024 10:16:59.552714109 CET	50024	21	192.168.2.5	110.4.45.197	PWD
Nov 4, 2024 10:17:00.009773016 CET	21	50024	110.4.45.197	192.168.2.5	257 "/" is your current location
Nov 4, 2024 10:17:00.012265921 CET	50024	21	192.168.2.5	110.4.45.197	TYPE I
Nov 4, 2024 10:17:00.412107944 CET	21	50024	110.4.45.197	192.168.2.5	200 TYPE is now 8-bit binary
Nov 4, 2024 10:17:00.412257910 CET	50024	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:17:00.767286062 CET	21	50024	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,195,13)
Nov 4, 2024 10:17:01.025422096 CET	21	50024	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,195,13)
Nov 4, 2024 10:17:01.025851965 CET	50024	21	192.168.2.5	110.4.45.197	STOR SC_user-960781_2025_02_02_22_26_07.jpeg
Nov 4, 2024 10:17:01.970776081 CET	21	50024	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:17:02.786523104 CET	21	50024	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.819 seconds (measured here), 78.66 Kbytes per second
Nov 4, 2024 10:17:04.839067936 CET	50024	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:17:05.194322109 CET	21	50024	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,195,146)
Nov 4, 2024 10:17:05.200253963 CET	50024	21	192.168.2.5	110.4.45.197	STOR SC_user-960781_2025_02_08_00_19_37.jpeg
Nov 4, 2024 10:17:06.114967108 CET	21	50024	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:17:06.904292107 CET	21	50024	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.790 seconds (measured here), 81.62 Kbytes per second
Nov 4, 2024 10:17:10.855658054 CET	49709	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:17:11.108489037 CET	50024	21	192.168.2.5	110.4.45.197	PASV
Nov 4, 2024 10:17:11.212542057 CET	21	49709	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,210,143)
Nov 4, 2024 10:17:11.217829943 CET	49709	21	192.168.2.5	110.4.45.197	STOR SC_user-960781_2024_11_04_04_17_10.jpeg
Nov 4, 2024 10:17:11.465626955 CET	21	50024	110.4.45.197	192.168.2.5	227 Entering Passive Mode (110,4,45,197,208,166)
Nov 4, 2024 10:17:11.472387075 CET	50024	21	192.168.2.5	110.4.45.197	STOR SC_user-960781_2024_11_04_04_17_10.jpeg
Nov 4, 2024 10:17:12.140006065 CET	21	49709	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:17:12.398058891 CET	21	50024	110.4.45.197	192.168.2.5	150 Accepted data connection
Nov 4, 2024 10:17:12.910747051 CET	21	49709	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.774 seconds (measured here), 83.32 Kbytes per second
Nov 4, 2024 10:17:13.186772108 CET	21	50024	110.4.45.197	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.789 seconds (measured here), 81.65 Kbytes per second

Target ID:	0
Start time:	04:12:59
Start date:	04/11/2024
Path:	C:\Users\user\Desktop\Payslip_October_2024_pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Payslip_October_2024_pdf.exe"
Imagebase:	0x580000
File size:	780'288 bytes
MD5 hash:	0D4985C828F3F9F6974B1602C92EE962
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2033528319.00000000041EC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2033528319.00000000041EC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:13:00
Start date:	04/11/2024
Path:	C:\Users\user\Desktop\Payslip_October_2024_pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Payslip_October_2024_pdf.exe"
Imagebase:	0x790000
File size:	780'288 bytes
MD5 hash:	0D4985C828F3F9F6974B1602C92EE962
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.4494330855.0000000002D0B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.4494330855.0000000002D0B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	04:13:12
Start date:	04/11/2024
Path:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Imagebase:	0xc50000
File size:	780'288 bytes
MD5 hash:	0D4985C828F3F9F6974B1602C92EE962
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:13:13
Start date:	04/11/2024
Path:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Imagebase:	0xb20000
File size:	780'288 bytes
MD5 hash:	0D4985C828F3F9F6974B1602C92EE962
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2252894462.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.2252894462.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2249540840.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.2249540840.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.2252894462.0000000002F7C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:13:20
Start date:	04/11/2024
Path:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Imagebase:	0xd80000
File size:	780'288 bytes
MD5 hash:	0D4985C828F3F9F6974B1602C92EE962
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:13:21
Start date:	04/11/2024
Path:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Imagebase:	0xd00000
File size:	780'288 bytes
MD5 hash:	0D4985C828F3F9F6974B1602C92EE962
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.4494723073.0000000003091000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.4494723073.0000000003091000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.4494723073.00000000030BC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	213
Total number of Limit Nodes:	10

Executed Functions

Function 06D1CFC8 Relevance: .6, Instructions: 595COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044682435.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cd5c89f29c378bb05c24cdcac6b17ffc79b1f8e0eedef2d2f0cdf357d9b32d0
Instruction ID: 58100cb6d2a733fa284b6694e2b0d42919be285e467b88f1803ee5e4f13b107a
Opcode Fuzzy Hash: 6cd5c89f29c378bb05c24cdcac6b17ffc79b1f8e0eedef2d2f0cdf357d9b32d0
Instruction Fuzzy Hash: C9228831B01214AFEB59DB69E564BAEB7F7AF89700F244469E0469F3A0CB74ED01CB50

Function 054DD470 Relevance: .6, Instructions: 559COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044494192.00000000054D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54d0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bee8c142d9196ba778e0b26e31a966619ad0f183543dab874dbcef2773d6beba
Instruction ID: b870a18f7eb2e433df4a9f45753144e5d263d517d8bca48c4cec9743dc077ddd
Opcode Fuzzy Hash: bee8c142d9196ba778e0b26e31a966619ad0f183543dab874dbcef2773d6beba
Instruction Fuzzy Hash: 87529F74E01219CFDB64CFA9C994BDDBBB2BF48310F5081AAD809A7355D730AA85CF60

Function 054DC1A3 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044494192.00000000054D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54d0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39fd9c0dc70854b96bb846a8a5c0b1130dc17001dee80b9d53ecb832e5cc51a8
Instruction ID: e91d0cab971441243cb068270a9dd0d88f0621523dcea423f2a9b29cdabd6871
Opcode Fuzzy Hash: 39fd9c0dc70854b96bb846a8a5c0b1130dc17001dee80b9d53ecb832e5cc51a8
Instruction Fuzzy Hash: E032B274A01219CFDB54DFA9C584A9EFBB2BF49311F55D196D408AB212CB30EE85CFA0

Function 054DFB78 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044494192.00000000054D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54d0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e94db46b6e7bd748f6675f658f31dd245ff9546d8f37a93d0c4ec346fc68ebac
Instruction ID: 54fc72605eac0724f7567063f0f8b417d070de919b420c21eae1a8f3d355a68d
Opcode Fuzzy Hash: e94db46b6e7bd748f6675f658f31dd245ff9546d8f37a93d0c4ec346fc68ebac
Instruction Fuzzy Hash: A5F12874E041199FCB14DFA8D5909AEFBF2FF89305F24816AD805AB356D730A946CFA0

Function 02746F90 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033087910.0000000002740000.00000040.00000800.00020000.00000000.sdmp, Offset: 02740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2740000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f542f8fd529939ff08dd932d87d1fa58084d286b872a4cd7eac80254bdcd6dd
Instruction ID: ec2f94d64eee8639c91ad8558480728d8adeb5b660e6fd11ab79a0ae6fa2b43c
Opcode Fuzzy Hash: 3f542f8fd529939ff08dd932d87d1fa58084d286b872a4cd7eac80254bdcd6dd
Instruction Fuzzy Hash: 5851D870E0120C9FDB09DFA5D855AEEBBB2FF88304F14852AD409AB365DB359946CF80

Function 02744210 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033087910.0000000002740000.00000040.00000800.00020000.00000000.sdmp, Offset: 02740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2740000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8936962d979a232e1105334aa05ee41b421e18618a981f7b226c02e30b6460f3
Instruction ID: 4a4d434c7ac226b4be6335d97675fae1f1265dfeed1567749791d92156358ec6
Opcode Fuzzy Hash: 8936962d979a232e1105334aa05ee41b421e18618a981f7b226c02e30b6460f3
Instruction Fuzzy Hash: C651C670E0120C9FDB09DFA9D855AEEBBB6FF88304F148529D409AB364DB359945CF80

Function 06D19B0C Relevance: 1.8, APIs: 1, Instructions: 252
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06D19D4E

Memory Dump Source

Source File: 00000000.00000002.2044682435.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 6125cc01436606629ddd1e5e144f0dd5917612b513f683030488a9d5d02dadf0
Instruction ID: 8cb7044e5aac61a6bf9752b2314a218ffc3f1db5942c4f57e8e8521e28c5b6fa
Opcode Fuzzy Hash: 6125cc01436606629ddd1e5e144f0dd5917612b513f683030488a9d5d02dadf0
Instruction Fuzzy Hash: F7A1AF71D00219DFEB60CF68D8617EDBBF2BF44314F148569D848AB240DBB49985CF92

Function 06D19B18 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06D19D4E

Memory Dump Source

Source File: 00000000.00000002.2044682435.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: cca8e27effccacada4ade1ca6a36923e6a209e6d29dff03eff9a374d2b758835
Instruction ID: fb52576c5d4b2131d3a501bec63aa9901f4c7f3217868cc429fe73316910dbdf
Opcode Fuzzy Hash: cca8e27effccacada4ade1ca6a36923e6a209e6d29dff03eff9a374d2b758835
Instruction Fuzzy Hash: D3918C71D00219DFEB64CF68D8607EDBBF2BF48314F14856AD849AB240DBB49985CF92

Function 0274AF11 Relevance: 1.7, APIs: 1, Instructions: 214
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2033087910.0000000002740000.00000040.00000800.00020000.00000000.sdmp, Offset: 02740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2740000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 823e8becc1bbd8908c1e81c9796fa2ba77363c34c43b370e3518d239ddf47a8d
Instruction ID: 02225a73b1c5c46af2636a4f4f50f69f427c48c172a388bf4350b630da15ebe7
Opcode Fuzzy Hash: 823e8becc1bbd8908c1e81c9796fa2ba77363c34c43b370e3518d239ddf47a8d
Instruction Fuzzy Hash: E58179B0A00B458FD724DF2AD54479ABBF5FF89304F008A2ED49AD7A51DB35E809CB90

Function 0274590C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 027459C9

Memory Dump Source

Source File: 00000000.00000002.2033087910.0000000002740000.00000040.00000800.00020000.00000000.sdmp, Offset: 02740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2740000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: fba65f064b3ccc331e63571b037eb945a243b034e52d96b7bea7386f8660dd1f
Instruction ID: 8d7246cbfb74d56402582c5743b3d22382751f528c77667cdd7d26881db6b9f0
Opcode Fuzzy Hash: fba65f064b3ccc331e63571b037eb945a243b034e52d96b7bea7386f8660dd1f
Instruction Fuzzy Hash: 0B41D1B0D00719CFDB24CFA9C884B9EBBF1BF49704F60806AD409AB255DB75694ACF91

Function 027444D4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 027459C9

Memory Dump Source

Source File: 00000000.00000002.2033087910.0000000002740000.00000040.00000800.00020000.00000000.sdmp, Offset: 02740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2740000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 50b21c8ef105d1538e14ca071c759690d829bec5c41c0f7f3f32d1c779403cda
Instruction ID: ff0ef54c0df74e2d7072fd160b4c67f827ca7cbc72e219db617c418502b94c79
Opcode Fuzzy Hash: 50b21c8ef105d1538e14ca071c759690d829bec5c41c0f7f3f32d1c779403cda
Instruction Fuzzy Hash: 5441E0B0C00619CBDB24CFA9C884B9EBBF5BF49304F60806AD408AB251DB756949CF91

Function 06D19450 Relevance: 1.6, APIs: 1, Instructions: 75
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06D194E8

Memory Dump Source

Source File: 00000000.00000002.2044682435.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 5ed0d713ae091c30d368502d74871bd31311933db5f3fe2020a29d4f407d8b44
Instruction ID: cef013137f3979ad525d3d4db5d0775599059e7ac3c1e4933763bed7a53ba481
Opcode Fuzzy Hash: 5ed0d713ae091c30d368502d74871bd31311933db5f3fe2020a29d4f407d8b44
Instruction Fuzzy Hash: 21215AB59003499FCB10CFA9D885BEEBFF5FF48310F10842AE919AB240C7789940CBA5

Function 0274D518 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0274D4E6,?,?,?,?,?), ref: 0274D5A7

Memory Dump Source

Source File: 00000000.00000002.2033087910.0000000002740000.00000040.00000800.00020000.00000000.sdmp, Offset: 02740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2740000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2f2537f53e66de0150b1e6bd55bec0f6ed83d73d69b7afbbb2e6cc95dcfd2732
Instruction ID: aeb100b9a24e0a8655e8a15664dea93a1e0f5857bdefba2558ab3a225ec63906
Opcode Fuzzy Hash: 2f2537f53e66de0150b1e6bd55bec0f6ed83d73d69b7afbbb2e6cc95dcfd2732
Instruction Fuzzy Hash: 702157B58002599FDB20CFA9D944AEEFFF4EF49324F24811AE954A7350C378A941CFA1

Function 06D19458 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06D194E8

Memory Dump Source

Source File: 00000000.00000002.2044682435.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: ea3f44f6436b59f1699b65c591e042f4a7d646ffa0ae1e5ef8ef3c1c123733e4
Instruction ID: 5c71ddee0a1ede1ed1aad4da93950be23282cfb77a3f40c576e346dc81b73bca
Opcode Fuzzy Hash: ea3f44f6436b59f1699b65c591e042f4a7d646ffa0ae1e5ef8ef3c1c123733e4
Instruction Fuzzy Hash: F92119B5D003499FCB10DFAAC985BEEBBF5FF48310F108429E919A7250D7789944CBA5

Function 06D19979 Relevance: 1.6, APIs: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06D19A00

Memory Dump Source

Source File: 00000000.00000002.2044682435.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 98c42a633460dd68dbf4185d9fe7ee6ddc632fc1b359ed2a1921d314e8c3b86a
Instruction ID: 2efd59dd261d5c7fbc3f84769e7af854e3453a98e5397420d5347fc16e8bfd2a
Opcode Fuzzy Hash: 98c42a633460dd68dbf4185d9fe7ee6ddc632fc1b359ed2a1921d314e8c3b86a
Instruction Fuzzy Hash: 802139B6C003499FCB10DFAAD841AEEFBF5FF48320F10842AE559A7250D7789945CBA1

Function 06D192B9 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06D1933E

Memory Dump Source

Source File: 00000000.00000002.2044682435.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: c24a2387e8465750c998e433e8a869357f731b576710b89a49909879919d4175
Instruction ID: 55371b15ec67bf4cc1541806478ffe2d7ef2cc591e52cf729c56ea2e1d3574d5
Opcode Fuzzy Hash: c24a2387e8465750c998e433e8a869357f731b576710b89a49909879919d4175
Instruction Fuzzy Hash: C4214CB5D002098FDB10DFAAC4857EEBBF5EF88314F14842AD519AB240C7789945CFA1

Function 0274B580 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0274D4E6,?,?,?,?,?), ref: 0274D5A7

Memory Dump Source

Source File: 00000000.00000002.2033087910.0000000002740000.00000040.00000800.00020000.00000000.sdmp, Offset: 02740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2740000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 194fa13e2b81f5f8deece94805c96416b79aa27e7fb7f07d3244b609296a76b9
Instruction ID: f760548999e09b752f3f75f41fb80e785ed8665bf15edd84b399ec2a5ca4e107
Opcode Fuzzy Hash: 194fa13e2b81f5f8deece94805c96416b79aa27e7fb7f07d3244b609296a76b9
Instruction Fuzzy Hash: EB21E6B59002589FDB10CF9AD584AEEFBF5FB48314F14801AE954B7310D778A944CFA5

Function 06D192C0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06D1933E

Memory Dump Source

Source File: 00000000.00000002.2044682435.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 645caa46cd4b114a4505dcfd33ecd0f8a2f071f0de78c83e5d1d368ecab84f30
Instruction ID: a82adae517c835b92c20907a601f44b7154759e838eec99c82274b5e6b53e984
Opcode Fuzzy Hash: 645caa46cd4b114a4505dcfd33ecd0f8a2f071f0de78c83e5d1d368ecab84f30
Instruction Fuzzy Hash: 9C2135B1D003099FDB10DFAAC4857EEBBF4EF48324F14842AD519AB240CB78A945CFA1

Function 06D19980 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06D19A00

Memory Dump Source

Source File: 00000000.00000002.2044682435.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: d354a93dc2d3d823a590e965d267127f0e172eac254fb0b93dbb9e8c4aad0054
Instruction ID: 62a41732d6f179ab2f6e91f9eee481e908072e17757dfef43584b9f6f87da672
Opcode Fuzzy Hash: d354a93dc2d3d823a590e965d267127f0e172eac254fb0b93dbb9e8c4aad0054
Instruction Fuzzy Hash: D52118B1C003499FCB10DFAAC885AEEFBF5FF48310F54842AE959A7250D7789944CBA1

Function 06D19390 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06D19406

Memory Dump Source

Source File: 00000000.00000002.2044682435.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 84af2c169b540a9907f06b54a28c1a0f165b6e9b1c33aab42494a7a992f4639f
Instruction ID: 8af72fa16ad208c51df3959576d7e3d4f4ee3a02e2a5cad58fef05c322dd8a98
Opcode Fuzzy Hash: 84af2c169b540a9907f06b54a28c1a0f165b6e9b1c33aab42494a7a992f4639f
Instruction Fuzzy Hash: CE116A768002499FCB20DFAAD845AEFBFF5EF48310F148419E519A7250C779A940CFA1

Function 06D19398 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06D19406

Memory Dump Source

Source File: 00000000.00000002.2044682435.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f2cdb52cf22c5237814dae4012dc6cfe53aac5a47ba93c6df20410862f53557b
Instruction ID: 03efb2657b360d926037ec2b10a7e6f64daffab00c17980d82945ae26b4882cf
Opcode Fuzzy Hash: f2cdb52cf22c5237814dae4012dc6cfe53aac5a47ba93c6df20410862f53557b
Instruction Fuzzy Hash: D21137758002499FCB10DFAAC845AEFBFF5EF48310F248419E519AB250C779A940CFA5

Function 06D19209 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06D19272

Memory Dump Source

Source File: 00000000.00000002.2044682435.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 9b2f48e256415bbc04617c3836c0c5065b140a162ca91ad742be60988ab26334
Instruction ID: 49a7612df0bc16b0144c265a50e89d79f6164fdcd785faaa8e41746df5741d6d
Opcode Fuzzy Hash: 9b2f48e256415bbc04617c3836c0c5065b140a162ca91ad742be60988ab26334
Instruction Fuzzy Hash: 7D1158B5D002488FDB20DFAAD4457EEFBF5EF88324F248419D01AAB250C7789944CFA1

Function 06D19210 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06D19272

Memory Dump Source

Source File: 00000000.00000002.2044682435.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2900e5ef04c8ea67188f82b930592b3ba1d499b49fff0324e0a0f58bc939f4f2
Instruction ID: fb6f62234815402cd243edd756c5c870ed57d1aeec0b06ee1401b06e5954e985
Opcode Fuzzy Hash: 2900e5ef04c8ea67188f82b930592b3ba1d499b49fff0324e0a0f58bc939f4f2
Instruction Fuzzy Hash: 35113AB1D003488FCB20DFAAD4457EEFBF5EF88314F248419D519A7250CB79A944CBA1

Function 0274B110 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0274B176

Memory Dump Source

Source File: 00000000.00000002.2033087910.0000000002740000.00000040.00000800.00020000.00000000.sdmp, Offset: 02740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2740000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d2202746137d0a42e92ad94a6a0699889f0838167589734598732b6c6fbb2fa7
Instruction ID: 0981a4b5a7a7adcafc8123a8fb08c64ec64de3e9860684734b4b5713eb17e59c
Opcode Fuzzy Hash: d2202746137d0a42e92ad94a6a0699889f0838167589734598732b6c6fbb2fa7
Instruction Fuzzy Hash: 1211DFB6C002498FCB10DF9AC844A9EFBF5EF89214F14846AD429A7210D379A945CFA1

Function 06D1C1D8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06D1C23D

Memory Dump Source

Source File: 00000000.00000002.2044682435.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 9eb45f81e293cba7ecbe3d10d2b8481545260b61eb123bb207fee7914cd3b9c4
Instruction ID: 17f11a790257129b4516b34919f6e90a9d2c79343b6a82adb69bf766e816c24f
Opcode Fuzzy Hash: 9eb45f81e293cba7ecbe3d10d2b8481545260b61eb123bb207fee7914cd3b9c4
Instruction Fuzzy Hash: 3F11D6B58003499FDB20DF99D845BDEBFF8EB48314F108459E558A7650C379A944CFA1

Function 06D12958 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06D1C23D

Memory Dump Source

Source File: 00000000.00000002.2044682435.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: aee88d3708d4e82da90944e7ffc1dd349de66fe78b5224490431f4caf8612295
Instruction ID: 76070f1d30fa8d88d99b8b11f5d4b3407c35ff7d01fc36e4aa09a3a656f7ff14
Opcode Fuzzy Hash: aee88d3708d4e82da90944e7ffc1dd349de66fe78b5224490431f4caf8612295
Instruction Fuzzy Hash: AF1103B58003489FDB20DF9AD845BDEBFF8EB48314F108459E958A7210D3B9A944CFE1

Function 054D7900 Relevance: 1.3, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,054D77B9,?,?), ref: 054D7960

Memory Dump Source

Source File: 00000000.00000002.2044494192.00000000054D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54d0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 463660675d86df92325d0223daac719beed06b3320940e5dfcad886212c8aad1
Instruction ID: aff7f0e2a5c7c384b96a731d434a7a2511c1607fc887a1dd86ffea84c14a7bf4
Opcode Fuzzy Hash: 463660675d86df92325d0223daac719beed06b3320940e5dfcad886212c8aad1
Instruction Fuzzy Hash: BD1116B68003499FDB20DF9AC445BDEFBF4EF48320F24845AD558A7241D378A584CBA5

Function 054D7004 Relevance: 1.3, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,054D77B9,?,?), ref: 054D7960

Memory Dump Source

Source File: 00000000.00000002.2044494192.00000000054D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54d0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ab772f3931501a970cbf7111f9e5c1a871e544622f142187db50326fc1fdcfed
Instruction ID: 107ae41ce4b536395a5097f2d951aae540b0e0337c6ada41150d472371cca961
Opcode Fuzzy Hash: ab772f3931501a970cbf7111f9e5c1a871e544622f142187db50326fc1fdcfed
Instruction Fuzzy Hash: BD1122B68003498FDB20DF9AC445BEEFBF4EB48320F20845AD958A7341D378A944CFA5

Function 054D708C Relevance: 1.3, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,054D77B9,?,?), ref: 054D7960

Memory Dump Source

Source File: 00000000.00000002.2044494192.00000000054D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54d0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: bdee06f6efafb71da25d112b424522f35a4ce1faf06ee2096cb54df8924303f3
Instruction ID: 8a98277b43192cec632c4976f1d4b7c3aa0197048d2cd6fbc62a45cf2671ce40
Opcode Fuzzy Hash: bdee06f6efafb71da25d112b424522f35a4ce1faf06ee2096cb54df8924303f3
Instruction Fuzzy Hash: 0C1122B68003498FDB20DF9AC445BEEFBF4EB48320F20845AD958A7340D378A944CFA5

Function 00F3D1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032913162.0000000000F3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f3d000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0009e6fe6c5220d5754fb7a8933bdf3ef84d937bd789fba36800ae855024fd20
Instruction ID: 6abd649f8fa3ce37f4ac855e98304bd01b9b8ba3fc67765acdbfeccbce9aab53
Opcode Fuzzy Hash: 0009e6fe6c5220d5754fb7a8933bdf3ef84d937bd789fba36800ae855024fd20
Instruction Fuzzy Hash: 6421C172504244DFDB05DF54E9C4B27BF65FB88324F24C569ED090A256C33AD816EBA2

Function 00F4D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032938344.0000000000F4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f4d000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52ff0f26a36c6f793e6ae9a78e6cb51975e4d4042e8fce8785d027c7f2287319
Instruction ID: c7363e959ea461e12d844a54a4047f5de738d83101ddb4962fcc693005b234c8
Opcode Fuzzy Hash: 52ff0f26a36c6f793e6ae9a78e6cb51975e4d4042e8fce8785d027c7f2287319
Instruction Fuzzy Hash: 8C21F571A04204DFDB05DF14D9C0B26BFA5FB84324F20C66DED094B356C3BAD906EA61

Function 00F4D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032938344.0000000000F4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f4d000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 172910da84919a1c919d8d611f0eaf5f2a7369983b6d5f4115b480316f42f625
Instruction ID: 1b39ad609888d8bc9653c5632ff2cc13bb4cff755089a5cdc254aadc7a93a7a5
Opcode Fuzzy Hash: 172910da84919a1c919d8d611f0eaf5f2a7369983b6d5f4115b480316f42f625
Instruction Fuzzy Hash: 7021F271604204DFCB14DF28D984B26BF65FB88324F20C56DDD0A4B39AC33AD847EA62

Function 00F4D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032938344.0000000000F4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f4d000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f625d9857efc939b1d311d165bc969eda4fd58296a23477ebb23d1995eb2d748
Instruction ID: ad4e0c8574fabc7c9b912607536a948c0248e0787056d9b71bb87811cd187549
Opcode Fuzzy Hash: f625d9857efc939b1d311d165bc969eda4fd58296a23477ebb23d1995eb2d748
Instruction Fuzzy Hash: 862192755093C08FCB02CF24D994715BF71EB46324F28C5EAD8498F2A7C33A980ADB62

Function 00F3D1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032913162.0000000000F3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f3d000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d06fae078f3ccc2112caf8552f6b645ede566e603d6c7b0d9faf10800b04cc1c
Instruction ID: 64cc02b6b32c0ce03aabb3255f7916ec7b2c217e6909e3fe487b241d34a20fc4
Opcode Fuzzy Hash: d06fae078f3ccc2112caf8552f6b645ede566e603d6c7b0d9faf10800b04cc1c
Instruction Fuzzy Hash: 3E21B176904240DFDB06CF50D9C4B16BF72FB88324F24C5A9DD490B656C33AD82ADBA2

Function 00F4D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032938344.0000000000F4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f4d000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 8c969707101c61e3787adab930b2f0c3d80831bc52722e1044afa3f6fb63c16e
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: BB11BB75904280DFCB06CF10C9C4B15BFA1FB84324F24C6A9DC494B296C37AD80ADB62

Function 00F3D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032913162.0000000000F3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f3d000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f8d4737c7a28fac7fcde408f17bb892f4df1a100bb2e554986df290762d1732
Instruction ID: acbc638aa6b1cab634dc449c19dcf984fdc58e2d430df18081dd3228733fc5a6
Opcode Fuzzy Hash: 0f8d4737c7a28fac7fcde408f17bb892f4df1a100bb2e554986df290762d1732
Instruction Fuzzy Hash: 03014E32404340DAE7208F25DD84B67FF9CEF45374F18C52AED080B286D2399C00DA71

Function 00F3D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032913162.0000000000F3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f3d000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16086110c06de2c5f470cea69895419e4c0a26f73166377c0601a35e10fc0b27
Instruction ID: 9ad41798b99f694c355a0c86d050a8f5fbbb2282e2dc4503a40a4ef24eb45bc2
Opcode Fuzzy Hash: 16086110c06de2c5f470cea69895419e4c0a26f73166377c0601a35e10fc0b27
Instruction Fuzzy Hash: DFF0F6714043449EE7108E16DC88B62FF9CEF95334F18C45AED480B386C2799C40CBB1

Non-executed Functions

Function 06D17300 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044682435.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d7dffb32acf2d387fd48b1b76944c1bf70f734c5cf5f40514eb12e9d82b2445
Instruction ID: 96f0fc02a784239e3cf054d202e8cf4cbd376f92b6e2cf047a184c40e63cfd74
Opcode Fuzzy Hash: 1d7dffb32acf2d387fd48b1b76944c1bf70f734c5cf5f40514eb12e9d82b2445
Instruction Fuzzy Hash: C2E13B74E041199FDB54DFA8D5809AEFBF2FF88305F24816AD415AB36AD730A941CFA0

Function 06D185B0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044682435.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 335b34c8059f911f2bf80fc25f02213310e6611847c4c5be6dc60c88cd5fda5a
Instruction ID: 07d0b9ae9aa09521075c689bbc9ecae4e6aeb414e92b1659c72dfbbe80cead04
Opcode Fuzzy Hash: 335b34c8059f911f2bf80fc25f02213310e6611847c4c5be6dc60c88cd5fda5a
Instruction Fuzzy Hash: D9E12C74E141199FCB14DFA8D5809AEFBF2FF89305F24816AE405AB35AD730A941CFA1

Function 06D19548 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044682435.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96d775868b02d9c97c48a1ea11e9a911e17c830f6cd955258e6e6ea7d7e3ff46
Instruction ID: 3a7540914586515369cd81583de7f989277ad69d789aba07c70fa662e1bf72ae
Opcode Fuzzy Hash: 96d775868b02d9c97c48a1ea11e9a911e17c830f6cd955258e6e6ea7d7e3ff46
Instruction Fuzzy Hash: 20E13B74E041199FCB14DFA8D5909AEFBF2FF89305F24816AE415AB35AC770A941CFA0

Function 06D16ED8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044682435.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78d4124e87f2e8e56ade74242dca4fa6201a20b9ad9a7858cefb59aca8916f7e
Instruction ID: e8d1d8bced727d0106156338bb098a22299253390c64f3e49ae2c0bc93548e22
Opcode Fuzzy Hash: 78d4124e87f2e8e56ade74242dca4fa6201a20b9ad9a7858cefb59aca8916f7e
Instruction Fuzzy Hash: AEE14D74E002199FCB14DFA9D5809AEFBF2FF89305F248169E414AB35AD771A941CFA0

Function 06D189E8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044682435.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cb454b5530dc725ac804844f166e0c135d40612ecbe9b479dd9cd92f1af39f6
Instruction ID: 21670ed8db497fc371a78bc3dda4bdb0477dc22ac8e3f4d1997e0e12b0dc2077
Opcode Fuzzy Hash: 9cb454b5530dc725ac804844f166e0c135d40612ecbe9b479dd9cd92f1af39f6
Instruction Fuzzy Hash: E5E11D74E041199FCB14DFA8D5809AEFBF2FF89305F24816AD405AB35AD770A941CFA1

Function 0274DBDC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033087910.0000000002740000.00000040.00000800.00020000.00000000.sdmp, Offset: 02740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2740000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f40158d21206930adec0b7a1441706052a278042582636adc40246a656b54243
Instruction ID: e7238931d4f0b907dcac1f2bea4ad104998382287bf5deffe3477f348e35e238
Opcode Fuzzy Hash: f40158d21206930adec0b7a1441706052a278042582636adc40246a656b54243
Instruction Fuzzy Hash: 82A17B32E002198FCF1ADFB5C9845AEB7B2FF84301B15856AE805AB265DF75EA15CF40

Function 06D10A28 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044682435.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 096dc3c55af08e87e93f7407e5bec56f0c6fcba9f722bfaa9f724f1893ff3cb0
Instruction ID: 674ee5623bad1bb467f9434138400db297fcaaaeb06d60d612d615fdd7caf6ac
Opcode Fuzzy Hash: 096dc3c55af08e87e93f7407e5bec56f0c6fcba9f722bfaa9f724f1893ff3cb0
Instruction Fuzzy Hash: 8F716E74E012199FDB44DFAAD98499EFBF2BF88310F14D16AD418AB315DB34A982CF50

Function 06D10798 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044682435.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aadb77fbf79aa66179fca514fa0a35ece5ea6b6e8d85487e855f24ee447368a5
Instruction ID: 7c57c08acd7dd352f1d2d4c661e076893067fc723a683a83be9e05bc5d859c61
Opcode Fuzzy Hash: aadb77fbf79aa66179fca514fa0a35ece5ea6b6e8d85487e855f24ee447368a5
Instruction Fuzzy Hash: AD519175D012199FDB08DFEAD8446EEBBB2FF88301F10802AE519AB254DB745946CF50

Function 06D19538 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044682435.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 082fb5d97777048e14627cdc59374d2d25bdd537ab0bf66fa7f9bb1ece5eb030
Instruction ID: 3a1c4079ec6c3249f105d64bc564fcb626f0ab800270b5a9036680e90c8af340
Opcode Fuzzy Hash: 082fb5d97777048e14627cdc59374d2d25bdd537ab0bf66fa7f9bb1ece5eb030
Instruction Fuzzy Hash: B2513874E042198FDB14CFA9D9905AEFBF2FF89305F24C16AD418AB256D7709A41CFA0

Function 06D1859F Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044682435.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad7f1bd786d1a53c4880733bf03ddd97d04d0f9b064436c417e0f4a2aa0b161a
Instruction ID: 1a28a9459f32b4317c4bdcab2e2aff5abf215f052d9b4ad05a7b096f94e76b4f
Opcode Fuzzy Hash: ad7f1bd786d1a53c4880733bf03ddd97d04d0f9b064436c417e0f4a2aa0b161a
Instruction Fuzzy Hash: 6A510C74E142198FDB14CFA9D9805AEFBF2FF89305F24C16AD408AB256D7319941CFA1

Function 06D10A17 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044682435.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3712e6125f909f99e0589ac88eaf78614ff45f28b20f849302f465506cdb5aa4
Instruction ID: 0a7bd12d349ffe702344503c80a2f7313dd2461f4142c2fd9a1f02d089daed55
Opcode Fuzzy Hash: 3712e6125f909f99e0589ac88eaf78614ff45f28b20f849302f465506cdb5aa4
Instruction Fuzzy Hash: 7F51B074E006198FDB48DFAAC98469EFBF2BF88300F14C06AE418AB355DB349946CB50

Function 06D10789 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044682435.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 687add2de3ba2b4d6970018f087689c22c1b9ff4fe521a354e361ab4faaf69c7
Instruction ID: 50afa3c881518f82c78521df4c562a1f9eb52d974c7a72cabe9c081a44f90b12
Opcode Fuzzy Hash: 687add2de3ba2b4d6970018f087689c22c1b9ff4fe521a354e361ab4faaf69c7
Instruction Fuzzy Hash: 4541B371E046599FDB08DFEAD8846AEFBF2AF89300F14C06AD418AB255DB745946CF40

Function 06D1B06B Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044682435.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89fe257eacadf7bd9766f73dee7b3b089ae8cf6d3bdfe4b005c0263088ac9108
Instruction ID: 35068420940b49822e28f1186a70dc2d01d8c3ede2803c8a9f6940681865767d
Opcode Fuzzy Hash: 89fe257eacadf7bd9766f73dee7b3b089ae8cf6d3bdfe4b005c0263088ac9108
Instruction Fuzzy Hash: 8DC04C36D8D109FA9B904D8478050F8F73CDEDF572F013057D28EAA5014690C65585C4

Analysis Process: Payslip_October_2024_pdf.exePID: 528, Parent PID: 2888COMMON

Execution Graph

Execution Coverage:	14.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	28
Total number of Limit Nodes:	6

Executed Functions

Function 06843578 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06843C83
$]q, xrefs: 06843C77
$]q, xrefs: 06843C4E
$]q, xrefs: 06843C9B
$]q, xrefs: 06843CA7
$]q, xrefs: 06843C5A

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 8c9bb3adc7947200240f4a71570c6a877c12d6885690c69ab21a75d1e28dc05b
Instruction ID: 94817f39d2a9965aaebc6822b89c6225ad1d103a717ac69b11f2f8e16790016b
Opcode Fuzzy Hash: 8c9bb3adc7947200240f4a71570c6a877c12d6885690c69ab21a75d1e28dc05b
Instruction Fuzzy Hash: 7B324131E1071A8FCB15EF79C89469DB7B6FFD9300F50C66AD449A7224EB30A985CB90

Function 06847E90 Relevance: 3.0, Strings: 2, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06848437
$]q, xrefs: 0684842B

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 66359b2de77dea25eb0d81206ee7667f7f5e3bc54d38c20b19e814c4c9d1b49f
Instruction ID: c053eea3740522911c36ae3976ca1405997a55c04c6452f0f477f5a34baba84c
Opcode Fuzzy Hash: 66359b2de77dea25eb0d81206ee7667f7f5e3bc54d38c20b19e814c4c9d1b49f
Instruction Fuzzy Hash: 9402A331B0020A8FDB58EF68D890AAEB7E6FF84314F148529D519DB354DB35ED46CB81

Function 068456A8 Relevance: 1.8, Strings: 1, Instructions: 590COMMON

Download Yara Rule

Strings

$, xrefs: 068459FB

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: e3c48ae65017009729203fb95e5f67d72e2221e1690e734368f5370f80cdf992
Instruction ID: 4aa78f93e2130174658425f301ac3e9be5ddf2d37b1680d884d1fca2525ea49c
Opcode Fuzzy Hash: e3c48ae65017009729203fb95e5f67d72e2221e1690e734368f5370f80cdf992
Instruction Fuzzy Hash: C222AF71E002198FDF64EFA4C4906AEBBB2FF84324F248469D559EB344DA35DD42CB92

Function 06842710 Relevance: 1.1, Instructions: 1066COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e60e17e287f2228a5ad6f920a5adf886a8b0291254ee320f8bcb4236d19dd58
Instruction ID: fdf640d6dc1b17d2751c1a71f09a0ab0c09aa37311272419e045a5c944500e2f
Opcode Fuzzy Hash: 5e60e17e287f2228a5ad6f920a5adf886a8b0291254ee320f8bcb4236d19dd58
Instruction Fuzzy Hash: 1AA23234A002088FDB64EB68C594B9DBBF2FB49314F5584A9E509EB366DB35ED81CF40

Function 06846700 Relevance: .8, Instructions: 815COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19eaccb1f837a38d6f997cf6366eaad9fa004c22f131a1ffc62f1f80bd4ecbce
Instruction ID: e3ef334b6991ab929b9c570e219efe67628885477ad702802d9cadc988d68150
Opcode Fuzzy Hash: 19eaccb1f837a38d6f997cf6366eaad9fa004c22f131a1ffc62f1f80bd4ecbce
Instruction Fuzzy Hash: B2628E34B002098FDB54EB68D590BADB7F6EF85314F248569E506EB354EB35EC86CB80

Function 0684B342 Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1adbc6f6ffa3debf183f69236a538bcef9e60499959c52e5ed369dc429b9cf5
Instruction ID: 080bb28a21ed54d75819cab26ca0eede4ba4fd9902e821e4b316e0c78f29c5e0
Opcode Fuzzy Hash: a1adbc6f6ffa3debf183f69236a538bcef9e60499959c52e5ed369dc429b9cf5
Instruction Fuzzy Hash: 2A226D30E1020D8FEF64EBA9D5907ADB7F6EB59310F248826E509EB395DA34DC81CB51

Function 0684ADE0 Relevance: 10.4, Strings: 8, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0684AF01
$]q, xrefs: 0684AFAC
$]q, xrefs: 0684AF0D
$]q, xrefs: 0684AF83
$]q, xrefs: 0684AF8F
$]q, xrefs: 0684AFB8
$]q, xrefs: 0684AF54
$]q, xrefs: 0684AF60

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 12c8c0273b9db7e45497d6d77e94f70212d198e6c264762bb1909df26a7d6c10
Instruction ID: a508f0ecc1bb6d1447981949e85fa2d57b70452e53f4a13f517973144c8accbb
Opcode Fuzzy Hash: 12c8c0273b9db7e45497d6d77e94f70212d198e6c264762bb1909df26a7d6c10
Instruction Fuzzy Hash: 2CE16C31E1020A8FCF69EFA9D5906AEB7B6FF84304F108529D519EB358DB74D846CB81

Function 0684B760 Relevance: 8.0, Strings: 6, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0684BD01
$]q, xrefs: 0684BCCD
$]q, xrefs: 0684BCF5
$]q, xrefs: 0684BD29
$]q, xrefs: 0684BD35
$]q, xrefs: 0684BCC1

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 723eb048ca356e70741ceb1b5503a5338bfc22ce594a5e57178da8cc2e99dfeb
Instruction ID: 09904757406f001d4c15a68ceb8a2e082dab812a49e9fa046523263e3856ca15
Opcode Fuzzy Hash: 723eb048ca356e70741ceb1b5503a5338bfc22ce594a5e57178da8cc2e99dfeb
Instruction Fuzzy Hash: 27027930E0020D8FDBA4EFA8D480AADBBB6FF45314F10896AE519EB255DB34DD45CB81

Function 06849260 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 068492DC
$]q, xrefs: 0684930B
$]q, xrefs: 068492D0
$]q, xrefs: 06849317

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 1ea3e1b92cd600c7a8c8d689e96b779aace952b97686daa96a8630bc62059396
Instruction ID: f6b1721936abdcd8a2e2715192751e4f004f5d092cce04290fbaf26764dc221e
Opcode Fuzzy Hash: 1ea3e1b92cd600c7a8c8d689e96b779aace952b97686daa96a8630bc62059396
Instruction Fuzzy Hash: C6915E30B0021A8BDF64EB69D860BAEB7F6BFD5214F108569C51DEB344EB309D468B91

Function 0684D068 Relevance: 4.5, Strings: 3, Instructions: 797
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0684D467
$]q, xrefs: 0684D473
$]q, xrefs: 0684D45F

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q
API String ID: 0-182748909
Opcode ID: 4ac60aaeb77ad259c85af5987a4f94bca4124c885c656c08e0cdaa9672d44b84
Instruction ID: 685d77cc59f516ad58c85241fde08dee365b25267527fa1ab25bc5ceadca1294
Opcode Fuzzy Hash: 4ac60aaeb77ad259c85af5987a4f94bca4124c885c656c08e0cdaa9672d44b84
Instruction Fuzzy Hash: 77625C30A0020A8FCB55EF68E590A5DB7E6FF84314B20CA69D409DF369DB75ED46CB80

Function 06844C78 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPbq, xrefs: 06844DC9
\Obq, xrefs: 06844E53
fbq, xrefs: 06844CA3

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: fbq$XPbq$\Obq
API String ID: 0-4057264190
Opcode ID: bcc31f2504bfadd8cbddd8fdefc90dc746916915e269c5b9ba11b62c2747545a
Instruction ID: d500e3876c803bfe8b84d198d13ff4ded354427ab7a6242fd623486790a0da0b
Opcode Fuzzy Hash: bcc31f2504bfadd8cbddd8fdefc90dc746916915e269c5b9ba11b62c2747545a
Instruction Fuzzy Hash: 6D615E30F002199FEB54EFA4C8547AEBBF6FB88710F208529E509EB394DB758C458B91

Function 0109EE90 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

c!, xrefs: 0109EF97

Memory Dump Source

Source File: 00000003.00000002.4492695280.0000000001090000.00000040.00000800.00020000.00000000.sdmp, Offset: 01090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1090000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: c!
API String ID: 0-2715345226
Opcode ID: 675143fb84a1a63de5beaa5147aa4ecfd8ec1d29b83983b25b8d14a084778270
Instruction ID: 515c419c21c303e202bafd7f9158028aa57b6522cfb7578d369c2e390721d28d
Opcode Fuzzy Hash: 675143fb84a1a63de5beaa5147aa4ecfd8ec1d29b83983b25b8d14a084778270
Instruction Fuzzy Hash: 9C41F272D0035A9FCB04DFA9D8147EEBBF5BF88310F1585AAE408A7241DB789885CBD1

Function 01098038 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(00000000), ref: 010980B0

Strings

c!, xrefs: 0109805F

Memory Dump Source

Source File: 00000003.00000002.4492695280.0000000001090000.00000040.00000800.00020000.00000000.sdmp, Offset: 01090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1090000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: DeleteFile
String ID: c!
API String ID: 4033686569-2715345226
Opcode ID: 96ec879ffb5ec30c334e6b14c30632ccc13e7e48a000c82ef862389fc5458b48
Instruction ID: f02b11bfd78b0c72886a4310f8346717c014cb5d917d9944be037d6196d236f4
Opcode Fuzzy Hash: 96ec879ffb5ec30c334e6b14c30632ccc13e7e48a000c82ef862389fc5458b48
Instruction Fuzzy Hash: 782124B5C006198BCB24CFAAD544B9EFBF0BF48720F14855AE858B7350D379AA44CFA1

Function 01098040 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(00000000), ref: 010980B0

Strings

c!, xrefs: 0109805F

Memory Dump Source

Source File: 00000003.00000002.4492695280.0000000001090000.00000040.00000800.00020000.00000000.sdmp, Offset: 01090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1090000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: DeleteFile
String ID: c!
API String ID: 4033686569-2715345226
Opcode ID: 427cb7a32c18d3c1961293bfb830ef23adfcc06b9725a02d1de1eed6ef22ed19
Instruction ID: 8009d916269e7aca438a7df274863f95c6bf00a65c179abc6e4c669577d576ea
Opcode Fuzzy Hash: 427cb7a32c18d3c1961293bfb830ef23adfcc06b9725a02d1de1eed6ef22ed19
Instruction Fuzzy Hash: CE1124B1C006199BCB14CF9AC54469EFBF4BF48320F10816AD958A7340D778A940CFE1

Function 0109EF78 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 0109EFDF

Strings

c!, xrefs: 0109EF97

Memory Dump Source

Source File: 00000003.00000002.4492695280.0000000001090000.00000040.00000800.00020000.00000000.sdmp, Offset: 01090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1090000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: c!
API String ID: 1890195054-2715345226
Opcode ID: b514fc1ad3a015d29afaecdc255362c6eb0deec7cbbec29a8f9743daafa1e4dc
Instruction ID: 4ef63f8e0e35469947d7912e34ab831b499b6071b9bac3df05343106e5de246b
Opcode Fuzzy Hash: b514fc1ad3a015d29afaecdc255362c6eb0deec7cbbec29a8f9743daafa1e4dc
Instruction Fuzzy Hash: 7E11EFB1C0065A9BCB10DF9AC944B9EFBF4AF48320F14856AE918A7240D778A944CFE5

Function 06849252 Relevance: 2.7, Strings: 2, Instructions: 169COMMON

Download Yara Rule

Strings

$]q, xrefs: 0684930B
$]q, xrefs: 068492D0

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: d96271443cfebfe76855bd0bc7bab2f4154239da3d774d8c846cddcbb12ce850
Instruction ID: f5fc6a33b2fdc844c2fe9969add0fe98e64bc880a1b203c906d296b5a5c7d478
Opcode Fuzzy Hash: d96271443cfebfe76855bd0bc7bab2f4154239da3d774d8c846cddcbb12ce850
Instruction Fuzzy Hash: C2516071B001099FDF64EB79D860BAEB7F6BBD9214F108569C419DB388EF309C068B91

Function 06844C69 Relevance: 2.6, Strings: 2, Instructions: 138COMMON

Download Yara Rule

Strings

XPbq, xrefs: 06844DC9
fbq, xrefs: 06844CA3

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: fbq$XPbq
API String ID: 0-2292610095
Opcode ID: 9ae0c97ad9bb3ee8da0adbf83fae5ecf7b6f98447a412afcc26c4b5f254b0bcb
Instruction ID: 15d82fa2d3c5138f00505c687b84d34351a230838c10edb0543f40a8da931116
Opcode Fuzzy Hash: 9ae0c97ad9bb3ee8da0adbf83fae5ecf7b6f98447a412afcc26c4b5f254b0bcb
Instruction Fuzzy Hash: 0E515E71F002099FDB54EFA4C4557AEBBF6FF88710F208529E105AB399DA758C018B91

Function 0684DBDD Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0684DD39

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 7e756e535c9e181e6beba00951e682accb50efe8066d67cce60fe94ac4eba49c
Instruction ID: b034c19a01bb98d5b48eb9dcc4bca8607303f537bcc306083c2652fa85612780
Opcode Fuzzy Hash: 7e756e535c9e181e6beba00951e682accb50efe8066d67cce60fe94ac4eba49c
Instruction Fuzzy Hash: 2441AF70E0020E9FDB65EFA5C4946AEBBB6AF85300F10852AE501EB344EB75D946CB91

Function 068421BD Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0684230B

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: afc5a3e84f86beb0292e1c8f617e1baf0431252fd54359f9acd0648f0ce7f151
Instruction ID: 3167984d5ba6ca07f3d465f6ea6c62ee10147eda4735cf8847a7f35e65320b0e
Opcode Fuzzy Hash: afc5a3e84f86beb0292e1c8f617e1baf0431252fd54359f9acd0648f0ce7f151
Instruction Fuzzy Hash: C7314230B142058FDB59AB74C5647AEBBE7AF89210F104578E406DB389DF39CE02CBA1

Function 068421D0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0684230B

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 84083353011fa92b7e11605005892e4575a2846f74c40703855c63e22924c419
Instruction ID: 4982ccb3f31e112f61c0bf50362c6f576c7a0065eaa8684838ef485cb5d43d0b
Opcode Fuzzy Hash: 84083353011fa92b7e11605005892e4575a2846f74c40703855c63e22924c419
Instruction Fuzzy Hash: AC312430B142098FDB58AB74C52066EBBE7AF89210F104538E406DB398DF39DE01CB91

Function 06843D92 Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

c!, xrefs: 06843DBA

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: c!
API String ID: 0-2715345226
Opcode ID: 1e7df2b8ee61e6ec94ba939d963733964cfe72289ee34286fa735d30f683219e
Instruction ID: 3f1b937a795b15687b46f1ae342f90c70f4fd0351b18959da30abcd59cdeef27
Opcode Fuzzy Hash: 1e7df2b8ee61e6ec94ba939d963733964cfe72289ee34286fa735d30f683219e
Instruction Fuzzy Hash: AA21C2B5D01219AFCB00DF9AD884ADEFBF4FB48310F10852AE918A7200C378A954CFE5

Function 06843D98 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

c!, xrefs: 06843DBA

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: c!
API String ID: 0-2715345226
Opcode ID: cc5ab886158a27d7e230029a536c295ac347ad307505bd4d95ecf54ea1fac336
Instruction ID: 4c72592f156974f2882329e6c72139d3b5451266ed5fe72a3be67344061f4324
Opcode Fuzzy Hash: cc5ab886158a27d7e230029a536c295ac347ad307505bd4d95ecf54ea1fac336
Instruction Fuzzy Hash: 6A11B3B5D012599FCB00DF9AD984ADEFBF4FB49310F10852AE918A7240C3786954CFE5

Function 068483E0 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

$]q, xrefs: 0684842B

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: c1808e497fcfa51c5ea1839c57130d4071ab60fc974bf962016262e88b67df14
Instruction ID: 10d8d403718eb99b4d7dbc65c438c322d3468f69dd5a6f9015f302881fab341e
Opcode Fuzzy Hash: c1808e497fcfa51c5ea1839c57130d4071ab60fc974bf962016262e88b67df14
Instruction Fuzzy Hash: 06F046B2B0011D8FDF78BE99E9806ACB7ACFB403A4F148425CA05CB204D735ED0AC781

Function 06844B61 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

\Obq, xrefs: 06844B6D

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: \Obq
API String ID: 0-2878401908
Opcode ID: 1d3a02a9ad5e4a3a335ee8f77f0c814f7b1830ef29f9df677abc119e3850264f
Instruction ID: 2b3487be1479b9ec4c9d19a832f8fabb400d94c125552e1d666ba4b43142c304
Opcode Fuzzy Hash: 1d3a02a9ad5e4a3a335ee8f77f0c814f7b1830ef29f9df677abc119e3850264f
Instruction Fuzzy Hash: 52F0DA30A5022DDBDB14DF94E899BAEBBB6FF88705F204519E402A7394CBB41C01CB80

Function 0684C2A8 Relevance: .6, Instructions: 636COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6271687f355766d756cfa0eb7fbf631833401521c2cf19e66d24e900571b7c3
Instruction ID: 1985c5c573c60e41b25d0925b12d9be8cda2434f0a54f02d206e5fe544272f41
Opcode Fuzzy Hash: a6271687f355766d756cfa0eb7fbf631833401521c2cf19e66d24e900571b7c3
Instruction Fuzzy Hash: 7932A030B112098FDB64EF68D990BADB7BAFB88314F108529D506EB355DB35EC42CB91

Function 06846300 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93078fd54e80e2a5b340e7df395c95dadf5d299466aaff7cc5a799f980e31fbc
Instruction ID: e6024b747f75b1ad237116a000b8ca0d09d00a175b8b8462e30529c82775710c
Opcode Fuzzy Hash: 93078fd54e80e2a5b340e7df395c95dadf5d299466aaff7cc5a799f980e31fbc
Instruction Fuzzy Hash: A361DE71F000114FDF24AA6EC88066FBADBAF95220F254479D90EDB364EF69ED4287D1

Function 068443B2 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d00c5d2ed9dc1133fad2dd1e4e4a5ae0580696fec01cb164cd60e290b3f0050
Instruction ID: 9c3144f80813a20fb8be2d2a841af5adfc7c77bc7b19ff62b7d3636269307aad
Opcode Fuzzy Hash: 9d00c5d2ed9dc1133fad2dd1e4e4a5ae0580696fec01cb164cd60e290b3f0050
Instruction Fuzzy Hash: 07814C31B0020A8BDF54EFA9D45479EB7F2EB99314F208429D50ADB394DF35DC468B92

Function 068446CC Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c1d084c6cb6e5df8f84bced136ef7aed5c85f88307de3f1f1a49f42589e6fc8
Instruction ID: 8614a2f2996af1c7a8ef36cbccc429eaa0d156811a3c58216c7e26c6b0ab4cf3
Opcode Fuzzy Hash: 4c1d084c6cb6e5df8f84bced136ef7aed5c85f88307de3f1f1a49f42589e6fc8
Instruction Fuzzy Hash: 4E915D30E1021A8BDF60DF64C890B9DB7B1FF89310F208599D549FB295DB74AA86CF51

Function 068446E0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f5adbc521507c596b024469daaed5d2e7a3b6399ba82df892ef7d7eeab9ba2a
Instruction ID: 0f8192c023332fe95b89c9aff1956312e8981a4b147b00be11677855d754c8ba
Opcode Fuzzy Hash: 1f5adbc521507c596b024469daaed5d2e7a3b6399ba82df892ef7d7eeab9ba2a
Instruction Fuzzy Hash: AC915C30E1021A8BDF60DF68C890B9DB7B1FF89310F208699D54DBB255DB71AA86CF51

Function 0684F040 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4afc9987a234db6274969efde4b66ace7d58bcbdf5f6888778725df143c4d17c
Instruction ID: 9ca7c72e9508896613102599e662d127a8cc7de53d79c37b09c819410ff7b48a
Opcode Fuzzy Hash: 4afc9987a234db6274969efde4b66ace7d58bcbdf5f6888778725df143c4d17c
Instruction Fuzzy Hash: 2B713A30A002099FDB54EFA9D990AADBBF6FF88300F148529D509EB259DB34ED46CB51

Function 0684F031 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b063d35549e0b5546b233ec20281533d05f353f440572bf62a156953b633a05
Instruction ID: 54884fa1774d4ee0283da35cda5db30658a9cd3a439aadac011b9751681f9040
Opcode Fuzzy Hash: 0b063d35549e0b5546b233ec20281533d05f353f440572bf62a156953b633a05
Instruction Fuzzy Hash: B9713C70A002099FDB54EFA9D990AADBBF6FF88300F148529D509EB358DB34ED46CB50

Function 0684FCC1 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2bb401e27459f4af6a8e2725d931a13f9f3a3b04d431b086d0386ff173f5589
Instruction ID: 9aaa7b588a71fb33e4dd74c4d2a6081bf8f9e8e477d0d384331ddc282ab9c1c0
Opcode Fuzzy Hash: f2bb401e27459f4af6a8e2725d931a13f9f3a3b04d431b086d0386ff173f5589
Instruction Fuzzy Hash: 8551D231E01109CFDF64FBB8E4946ADBBB2FF84316F108869E21ADB255DB358845CB81

Function 0684FA70 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da3a20fd327c29adddf6e21a43cc16ffbdc78800a43e8c2c08f1e185e38eb027
Instruction ID: e851e64ab5e94d4b9f2ee6a00bd32ed7dc8df411f1b1d2a5fd5c525f64c97234
Opcode Fuzzy Hash: da3a20fd327c29adddf6e21a43cc16ffbdc78800a43e8c2c08f1e185e38eb027
Instruction Fuzzy Hash: 2951A970B202199FEFA4A66CD95476F265EDBC9314F20482DE60AD73D9CA3CCC458792

Function 0684FA80 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed136014d922ef80281ff6b320d79a3f769cc41dba1964ef885f1bf263151a8d
Instruction ID: 158ebc1d73999d8bf1e3151b85f04dee947157b347562a0ea1303bd5a5bd662a
Opcode Fuzzy Hash: ed136014d922ef80281ff6b320d79a3f769cc41dba1964ef885f1bf263151a8d
Instruction Fuzzy Hash: 82519770B202189FEFA4B66CD95472F265EDBC9354F20482DEA0AD73D9CA3CCC458396

Function 06845522 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1179a8ec032bc03dabd4609b996fcb53c98e9016738614df8fbf84112540e22
Instruction ID: 182317f0d4bedee92cbc5979b5c6e573ebf2e652d61e724f233ebeaafcad1bcd
Opcode Fuzzy Hash: b1179a8ec032bc03dabd4609b996fcb53c98e9016738614df8fbf84112540e22
Instruction Fuzzy Hash: 6C416F71E002099FDF60DEA9D880ABFF7B2FB84310F10492AE256D7650D735E855CB92

Function 0684DA90 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46e1b388035cac970610e9ed9d31afd707ce9b390b749c922946bf2c2fab56d4
Instruction ID: c1484170b54fcce9847858667bb042d533e226f30489777669ac0bf837e7e307
Opcode Fuzzy Hash: 46e1b388035cac970610e9ed9d31afd707ce9b390b749c922946bf2c2fab56d4
Instruction Fuzzy Hash: 0E31C730E1020A8BCF14EFA5D980A9EBBB5FF85300F148929E505EB344EB74E946CB81

Function 06842081 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8f5d6b5ac5cb37eba1cfbe41e07f93603048f8995e557d1b497d56450614d89
Instruction ID: 3b30707370e6412bb300b54bbe0665484871c76c5979d8efaf131f39e2c23f60
Opcode Fuzzy Hash: e8f5d6b5ac5cb37eba1cfbe41e07f93603048f8995e557d1b497d56450614d89
Instruction Fuzzy Hash: DA319034E1424ADBDB05EFA4D8646AEBBF2BF89300F10C519E906EB350DB75AD46CB40

Function 06842090 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c177482ade0ceeaa94a3b36e99adcb4034ef0e33462660ddd9481418f3a162b
Instruction ID: ce49303de4ddac17a71a1845d815e76ba3a276e27236655aa96855d32a344c86
Opcode Fuzzy Hash: 3c177482ade0ceeaa94a3b36e99adcb4034ef0e33462660ddd9481418f3a162b
Instruction Fuzzy Hash: 30318030E142099BCB09EF65D86469EB7F6BF89310F108529F906EB350DB71AD42CB50

Function 06843FB9 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43f97077cda7198efdd549049b681e681f530731a568d2b083cffadc6868faf8
Instruction ID: c6af48b5d3739a315d6d0658d6d3c33dcd98672883bcfb3b6795464393411cab
Opcode Fuzzy Hash: 43f97077cda7198efdd549049b681e681f530731a568d2b083cffadc6868faf8
Instruction Fuzzy Hash: F521AE76F002099FDB50EFA9D891BAEBBF5EB58710F148025EA09E7390E735D811CB91

Function 06843FC8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81ee82bc86d3b0897d8bcba59c33c6df139aeffd7c517eab79104a7cf05623a1
Instruction ID: b3e162f8941c0407b018d93b8106ef3bee33aa41b15250a50b95a3fd78bbd07d
Opcode Fuzzy Hash: 81ee82bc86d3b0897d8bcba59c33c6df139aeffd7c517eab79104a7cf05623a1
Instruction Fuzzy Hash: D6217C75F002199FDB50EF69D881AAEBBF5EB58310F148025E905E7340E735D911CB91

Function 0684B030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 396e67beb5efa118865c411d8f8759001275595f3a8249d31a11af0ee9169bd5
Instruction ID: ac06de511555d7a01be50985082e59a1216fc9ed7376dbbaa1c454305c53ce2a
Opcode Fuzzy Hash: 396e67beb5efa118865c411d8f8759001275595f3a8249d31a11af0ee9169bd5
Instruction Fuzzy Hash: 82217F71D1071E8BCF64DFA9C44069EBBB5FF85310F10892AE905EB240DB70E945CB81

Function 0102D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4492351182.000000000102D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0102D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_102d000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cad6d0337c543d9b2ae305b9d390ae7f1bd8ad7a3db160b95961194c33bdab63
Instruction ID: aa1425feb38fb1add0eb5380bf69db521122bf3f29d360e5d07467c47edf97df
Opcode Fuzzy Hash: cad6d0337c543d9b2ae305b9d390ae7f1bd8ad7a3db160b95961194c33bdab63
Instruction Fuzzy Hash: 5821F271504204DFDB15DF98D9C0F26BBA5FB88314F24C5AEE9894B266C33ED846CB62

Function 0102D3A8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4492351182.000000000102D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0102D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_102d000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e22432d842d7e0c2668be4c570ea1e50caf36ab433832f0fc385a15406aa5acf
Instruction ID: 23e7f6a137153f5fefeca91857beb41f062ced9aeab6b567f75ede5d40d7a60a
Opcode Fuzzy Hash: e22432d842d7e0c2668be4c570ea1e50caf36ab433832f0fc385a15406aa5acf
Instruction Fuzzy Hash: EE2137B1500204DFDB05DF68D5C0B26BBA5FB84314F20C5ADD9894B256C73AE806CB61

Function 0102D1F8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4492351182.000000000102D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0102D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_102d000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9591fdde21002fd4bd5fd91ccd45b077d023886192e44dde0041524eb5f7fe2c
Instruction ID: 9a055a13a8725831b2531cb1dc1956494a7b2eb5fc9d0e3d4983781ac127a5fa
Opcode Fuzzy Hash: 9591fdde21002fd4bd5fd91ccd45b077d023886192e44dde0041524eb5f7fe2c
Instruction Fuzzy Hash: 51212971504204DFDB15DF98D584B2ABBA5FB95324F20C569D8890B246C37AD80ACBA1

Function 0102D118 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4492351182.000000000102D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0102D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_102d000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7672517989cd64fb362f62480d08f70092dd5d5d863f8ec8de510c9e235b9b8c
Instruction ID: 5f0731f156fa872876564d2c69280c9b44e8c8c4915cd1c52547212bc87165ee
Opcode Fuzzy Hash: 7672517989cd64fb362f62480d08f70092dd5d5d863f8ec8de510c9e235b9b8c
Instruction Fuzzy Hash: 3C21F271644244EFDB05DF58C9C0B26BFA5FB84318F30C5ADD9894B696C33AD846C761

Function 068440D8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04a41912e42464ac8236ee8b61a3604bfd1cf4ed9a48124c479ac657b41e0af7
Instruction ID: a4915127e6899f8fd242863142fa57aba5f928a3f2edc3a15beba92e3ff8c928
Opcode Fuzzy Hash: 04a41912e42464ac8236ee8b61a3604bfd1cf4ed9a48124c479ac657b41e0af7
Instruction Fuzzy Hash: FD11A132B101299BDF94E678CC546AE73EAEBD8315F048139D50AE7344DE75DC128BD1

Function 06844310 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 052d2fccabfded746723514ce05d600cab5d293aabad0ca8ac826200719c7202
Instruction ID: 3cafd6deb3c8e4ef1c4c853cfbb5943b1f0625adfca8f372ac39ca5f04a9ceed
Opcode Fuzzy Hash: 052d2fccabfded746723514ce05d600cab5d293aabad0ca8ac826200719c7202
Instruction Fuzzy Hash: 9E01D432B100150BDB54A5ADE410B5FB7DAEBC5B24F248439F20EC7351EE65DC034385

Function 0684F2B0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7394f3d16813079e45fe29a31e2d410aeb0692367dee8fa0b84774a49a1c92
Instruction ID: 07ffaa55e0ea62517df23efd8ddf9254ee5c25af6f1f91198bc0bd97b0bb4766
Opcode Fuzzy Hash: 7d7394f3d16813079e45fe29a31e2d410aeb0692367dee8fa0b84774a49a1c92
Instruction Fuzzy Hash: F801D431B105150FCB69E67D945476FB7D6EBCA221F24847EE20AC7340DA14DD438782

Function 0102D3A3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4492351182.000000000102D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0102D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_102d000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: a358d6653469a10bf5aee565f4246eee7a70c529575fe75b3feecbc41bbc3659
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 7911BB75504280CFDB02CF54D5C4B15BFA2FB84314F24C6AAD9894B2A6C33AE84ACB62

Function 0102D1F3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4492351182.000000000102D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0102D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_102d000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction ID: d434c0eb2c1d146574841899ef5fc603f35398e602a4dac93ce129322786cc23
Opcode Fuzzy Hash: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction Fuzzy Hash: 1811C176504280CFDB12CF54D5C4B19FFB1FB95324F24C6AAD8894B656C33AD80ACBA2

Function 0102D02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4492351182.000000000102D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0102D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_102d000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: d805432ba919086e31828c93343ee608e30e86d992f2a1e9377779e14a661368
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 9A11BE75504280DFDB12CF54D5C4B15BFA2FB84314F24C6AAE9894B666C33AD84ACB62

Function 0102D113 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4492351182.000000000102D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0102D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_102d000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 212b96ca827b798fa91ccd41c0eac3b093082415815754ec50078a914fdf967d
Instruction ID: 8a0162d9836d5e8a5028f25d443587f7b3e137fcd446254f24cd8fdadf14fb94
Opcode Fuzzy Hash: 212b96ca827b798fa91ccd41c0eac3b093082415815754ec50078a914fdf967d
Instruction Fuzzy Hash: 5711BB75504280DFDB06CF14C9C4B15BFA2FB84218F24C6AAD8894BA92C33AD84ACB52

Function 06844320 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6740f1b02c209fe2f40f96b7855df88c35ea1f620d68caf022d31632fa3fa968
Instruction ID: 2bddf3da35512085755d8bbe80051a0c862044e72b7cbb310a683e76edb11184
Opcode Fuzzy Hash: 6740f1b02c209fe2f40f96b7855df88c35ea1f620d68caf022d31632fa3fa968
Instruction Fuzzy Hash: 07018131B101150BDB65A9BDE454B6FB7DAEBC9B24F20843AF20ECB354DE66DC024391

Function 068440C9 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0711fa19850584a4e3869f2aedf177e8cb9f1103b3f5557450ed68c628584120
Instruction ID: 6eacd2d004387e49f75b21b8a7301f45d542cfdd765cd5715c81eadbd50cbed5
Opcode Fuzzy Hash: 0711fa19850584a4e3869f2aedf177e8cb9f1103b3f5557450ed68c628584120
Instruction Fuzzy Hash: B3018F36F100294BEBA5A568DC553EE72EADBD8215F048036D50AE7384EA65CC1647D1

Function 0684A418 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ab0ea94396250d9ecd6f0a9ea9a3c6e45eeef6537dbe2bb36aa012553e30d6
Instruction ID: 4d96aabb792a30aff163ba6d11850fa9e586f9f2cf645d3bc6ae52cb28b982f5
Opcode Fuzzy Hash: 55ab0ea94396250d9ecd6f0a9ea9a3c6e45eeef6537dbe2bb36aa012553e30d6
Instruction Fuzzy Hash: 5B012432B100084BDBA9E67DD46532E67C5EB89264F108424E20ECB398EF22DC028381

Function 0684F2C0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a743f3f956224923a74ce3ae2f0da61d9979f746354a829506384cac712e5f7e
Instruction ID: 5aea5af67e31086da42b2ce668db6a5f2b2859911c816b8b9abc983a1f1034fb
Opcode Fuzzy Hash: a743f3f956224923a74ce3ae2f0da61d9979f746354a829506384cac712e5f7e
Instruction Fuzzy Hash: A0018C35B004150BCB69A67ED494B2E76DAEBCA620F20883EE20AC7344EE25DD034786

Function 0684A428 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e83c92de76b4344bb85b4fe5aec2ef48fe6ecfd404092bcbfed8ba6af3b4575
Instruction ID: 0fb7ecdf7dabd3d3bd8f2e1baa0ecd4f2f4cb3ed01806c8a4bac240a585a6101
Opcode Fuzzy Hash: 4e83c92de76b4344bb85b4fe5aec2ef48fe6ecfd404092bcbfed8ba6af3b4575
Instruction Fuzzy Hash: 1601D131B100184BCB69EA7DE45472E77D9EBC9764F108438E20ECB398DE21EC028781

Function 0101D8C9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4492247130.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_101d000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f91a1a798165564b8c479b96628027843f2010fa66793a2e7fe5d6aa44004330
Instruction ID: eab35fe5d668cf3cb8b11e15760da5002a0ab11c4805ecef8a9cc5e6103925e4
Opcode Fuzzy Hash: f91a1a798165564b8c479b96628027843f2010fa66793a2e7fe5d6aa44004330
Instruction Fuzzy Hash: ED01DB71004354AAE7208F99DDC8B67BFDDEF45324F18C46AED991A28BC27D9840CB71

Function 0684C900 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70cad92373688308fe5d7decde5a25812968f3f30c24a2087d7efe02a722d2df
Instruction ID: b3dec3f6243a69fddd5d510790378da36dd9f2cbab163709ca4c30249343cfca
Opcode Fuzzy Hash: 70cad92373688308fe5d7decde5a25812968f3f30c24a2087d7efe02a722d2df
Instruction Fuzzy Hash: F301A931B212189BCB58AA6AE840A9D776DF785354F104539E505E7344DB32ED05C780

Function 0101D8C8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4492247130.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_101d000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46cf06eafa74880ad193934f9077ac208c79d29aac941c9f7c121bdadc636b42
Instruction ID: 55665e90269af73fcd4c8eab20ec7768edb031bf20a662f9a797e75cb6a4e67b
Opcode Fuzzy Hash: 46cf06eafa74880ad193934f9077ac208c79d29aac941c9f7c121bdadc636b42
Instruction Fuzzy Hash: 9AF06271404354AAEB218E1ADCC8B66FFE9EF45734F18C45AED885A287C2799844CBB1

Function 06846580 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c91b0e159b329f77459f976dc48d8cf6dff2453d9a792b0a946c0e7bbed36959
Instruction ID: 23b21e88c96bb8af24cb8ee5893126a195bf4cbdaebf59dcd8acb579852e65c4
Opcode Fuzzy Hash: c91b0e159b329f77459f976dc48d8cf6dff2453d9a792b0a946c0e7bbed36959
Instruction Fuzzy Hash: 3BE0D871D1520C5FDF90EFB08A1939F77A49B43208F2548E6D904CB146F136CE85CB41

Non-executed Functions

Function 068477B0 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$]q, xrefs: 06847C5D
$]q, xrefs: 068478AC
$]q, xrefs: 06847CFC
$]q, xrefs: 06847D12
$]q, xrefs: 06847C69
$]q, xrefs: 06847D1E
$]q, xrefs: 06847D08
$]q, xrefs: 068478DD
$]q, xrefs: 068478D1
$]q, xrefs: 068478A0

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2843079600
Opcode ID: 8238ac81f7ade55934acfc3bad27604aca89f9e18fa0575392520bec18efc12a
Instruction ID: f1bb89aa302bfd6202766d7d87a9f036be1d1c3bc0bad043633f1d5a8f74ecbd
Opcode Fuzzy Hash: 8238ac81f7ade55934acfc3bad27604aca89f9e18fa0575392520bec18efc12a
Instruction Fuzzy Hash: 42122C30A102198FDB68EF69C994AADB7F6BF84304F208969D509EB358DB349D45CF81

Function 0684AA48 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$]q, xrefs: 0684AB99
$]q, xrefs: 0684AB4A
$]q, xrefs: 0684ABFA
$]q, xrefs: 0684AB3E
$]q, xrefs: 0684ABA5
$]q, xrefs: 0684ABD0
$]q, xrefs: 0684ABC4
$]q, xrefs: 0684AC06

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: e20d1ca2d2f1f603d7c29f730eeb5d21174f4cfbf282922b3be126ce51d2d846
Instruction ID: a169e68c399d0cf975ac2963f0a25831327434f51f84f0f68edefac8be0c9ee9
Opcode Fuzzy Hash: e20d1ca2d2f1f603d7c29f730eeb5d21174f4cfbf282922b3be126ce51d2d846
Instruction Fuzzy Hash: F2915E30A5020D9FDB6CEF65D594BAEB7F6BF44304F108429E841DB298DB789D45CB90

Function 068471B0 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

.5uq, xrefs: 0684720B
$]q, xrefs: 068476B8
$]q, xrefs: 068476C4
$]q, xrefs: 0684764C
$]q, xrefs: 068474EC
$]q, xrefs: 06847492
$]q, xrefs: 068474F8

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: .5uq$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-981061697
Opcode ID: 8eb0578858ec20bc8486cc8e1eb3e4251642722a3baa3809b35f412daeb9fb0d
Instruction ID: 2edf82ce3584ee5f8b4bd8bf95811df4afbff77789052a2c8ed177173edf98f8
Opcode Fuzzy Hash: 8eb0578858ec20bc8486cc8e1eb3e4251642722a3baa3809b35f412daeb9fb0d
Instruction Fuzzy Hash: D9F12C30B01209CFDB58EF65D5A0AAEBBB6FF94300F648569D845DB368DB359C42CB90

Function 068484E8 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$]q, xrefs: 06848742
$]q, xrefs: 068487B3
$]q, xrefs: 0684874E
$]q, xrefs: 068487A7

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: cbe3c4ba24f10ec73fffbb859674dce92e4fbc7a84d4ca1c3c03ee58d45273cd
Instruction ID: d9fbab0f29c54ee7701d59ee2bdd56193242d453fbbca03a6476ca9851350b9f
Opcode Fuzzy Hash: cbe3c4ba24f10ec73fffbb859674dce92e4fbc7a84d4ca1c3c03ee58d45273cd
Instruction Fuzzy Hash: A4B14D70E012098FDB58EFA9D5906AEB7B6FF94314F248829D406DB359DB74DC82CB81

Function 06848900 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LR]q, xrefs: 06848A42
LR]q, xrefs: 068489F3
$]q, xrefs: 0684897F
$]q, xrefs: 0684898B

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q
API String ID: 0-3527005858
Opcode ID: ecfc73e07fb71b226f68bc53c2360fa1ed7f0a9f81b5aeec9414fd6db4095510
Instruction ID: 0582d5a35b70cc3680ba539cd534ad6e89f3bbdc199d6a6f840e8303b1bd9623
Opcode Fuzzy Hash: ecfc73e07fb71b226f68bc53c2360fa1ed7f0a9f81b5aeec9414fd6db4095510
Instruction Fuzzy Hash: F751E570B102098FDB58EF28D950A6E7BE6FF85314F148568E506DB398DB35EC41CB91

Function 0684ADD6 Relevance: 5.2, Strings: 4, Instructions: 158COMMON

Download Yara Rule

Strings

$]q, xrefs: 0684AF01
$]q, xrefs: 0684AFAC
$]q, xrefs: 0684AF83
$]q, xrefs: 0684AF54

Memory Dump Source

Source File: 00000003.00000002.4514513928.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 0a4ec11af1e8ee9d042be681404220b46d41be0c2ff32258f71d6c7a7a497967
Instruction ID: e79f98ef9e42e68ead7f98582df6936fec6fd45f26de9c30540727d2239196be
Opcode Fuzzy Hash: 0a4ec11af1e8ee9d042be681404220b46d41be0c2ff32258f71d6c7a7a497967
Instruction Fuzzy Hash: A351BF70E112098FCF68EB68E590AADB3B6FF94310F148529E916DB358DB31DC42CB81

Analysis Process: sgxIb.exePID: 432, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	247
Total number of Limit Nodes:	11

Executed Functions

Function 0B3C9B0C Relevance: 1.8, APIs: 1, Instructions: 252
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0B3C9D4E

Memory Dump Source

Source File: 00000004.00000002.2169905450.000000000B3C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b3c0000_sgxIb.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 2ff119e6d7858234d74a9cd2c810bba816f963f08b45a0364dc9faa6c3696d20
Instruction ID: 38c1fc662ab6ea436fdfcee736176823722a6c2b20b98692b056388d1ef0a00b
Opcode Fuzzy Hash: 2ff119e6d7858234d74a9cd2c810bba816f963f08b45a0364dc9faa6c3696d20
Instruction Fuzzy Hash: 57A16D71D00219DFDB25DFA8C8407EEBBB2BF48314F1586AAD809A7240DB759D85CF91

Function 0B3C9B18 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0B3C9D4E

Memory Dump Source

Source File: 00000004.00000002.2169905450.000000000B3C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b3c0000_sgxIb.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 3aa85da54685f50c9c51a6e93e204a846b1f0a1df632ab8e5e800933b123b30e
Instruction ID: 872a635145b6a03c55bfd94bac751e83ccaae107e16b47ccfb2f7daba4d9919d
Opcode Fuzzy Hash: 3aa85da54685f50c9c51a6e93e204a846b1f0a1df632ab8e5e800933b123b30e
Instruction Fuzzy Hash: 1A916C71D00219DFEB25DFA8C8407EEBBB2BF48314F1586AAD809A7240DB759D85CF91

Function 0167AF11 Relevance: 1.7, APIs: 1, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0167B176

Memory Dump Source

Source File: 00000004.00000002.2165773127.0000000001670000.00000040.00000800.00020000.00000000.sdmp, Offset: 01670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1670000_sgxIb.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: fa6648e5ae4e9ade36810f5c26caae9c2c320a004de8fa0a664f4d6b1e264dfd
Instruction ID: b2149f368d700129e88608a2773898dc2fd36f1e88191925d976c8f89433ed19
Opcode Fuzzy Hash: fa6648e5ae4e9ade36810f5c26caae9c2c320a004de8fa0a664f4d6b1e264dfd
Instruction Fuzzy Hash: 6C8122B0A00B058FD724DF6AD84475ABBF1BF88200F00892DD45AD7B50DB79E849CB94

Function 016744D4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 016759C9

Memory Dump Source

Source File: 00000004.00000002.2165773127.0000000001670000.00000040.00000800.00020000.00000000.sdmp, Offset: 01670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1670000_sgxIb.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: fd569357fcb320c22c8f2d73501b2e2b429cb5d39a28ffc5f65634ef233f75a7
Instruction ID: 1dd552a181bb559b9d741d38fc94b011467dfaa27e9377638261eb0307e99127
Opcode Fuzzy Hash: fd569357fcb320c22c8f2d73501b2e2b429cb5d39a28ffc5f65634ef233f75a7
Instruction Fuzzy Hash: BB41E0B0C0071DCBDB24DFA9C884B9EBBF5BF49704F20806AD409AB255DB75694ACF90

Function 0167590C Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 016759C9

Memory Dump Source

Source File: 00000004.00000002.2165773127.0000000001670000.00000040.00000800.00020000.00000000.sdmp, Offset: 01670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1670000_sgxIb.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e0b1008ca1672739594da216e9244e8fe45159296b0f9e6ade7a10807f3f2ed7
Instruction ID: c643d339fe53a590fda8cee485f3023ab2d818ef255959e48c92d98e36a5768b
Opcode Fuzzy Hash: e0b1008ca1672739594da216e9244e8fe45159296b0f9e6ade7a10807f3f2ed7
Instruction Fuzzy Hash: 0E41DFB0C00719CBDB24DFA9C884B9EBBB1BF49704F24806AD409AB255DB75594ACF90

Function 0B3C9450 Relevance: 1.6, APIs: 1, Instructions: 75
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0B3C94E8

Memory Dump Source

Source File: 00000004.00000002.2169905450.000000000B3C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b3c0000_sgxIb.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d0c0559f2c87b82237131067071c9429992b769d7f56c4a2c0c0e637ba914129
Instruction ID: 334ec38f1a3190d08b2453b6681b041535c1d4e9b1d3f7c14c3bb7234a2601c4
Opcode Fuzzy Hash: d0c0559f2c87b82237131067071c9429992b769d7f56c4a2c0c0e637ba914129
Instruction Fuzzy Hash: 0E212BB59003599FCB10DFA9D845BEEBBF5FF48320F10842AE519A7240D7789945CBA1

Function 0B3C9979 Relevance: 1.6, APIs: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0B3C9A00

Memory Dump Source

Source File: 00000004.00000002.2169905450.000000000B3C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b3c0000_sgxIb.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 8dbfd4dceb3777d3d338bf7a1d6fabc8cc958db3fe8e77507954435674921c9d
Instruction ID: be66cc4ac112e3cc1169baef03d46c1ca304c5ac42341090d3c6e4fdebb5705c
Opcode Fuzzy Hash: 8dbfd4dceb3777d3d338bf7a1d6fabc8cc958db3fe8e77507954435674921c9d
Instruction Fuzzy Hash: 782116B69003499FCB10DFAAD845AEEFBF5FF48320F10842AE519A7250D7399945CBA1

Function 0B3C9458 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0B3C94E8

Memory Dump Source

Source File: 00000004.00000002.2169905450.000000000B3C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b3c0000_sgxIb.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 2329b337f680ef091495ac1c9583a45d15af16b005f95e784217dffa4aa9c32e
Instruction ID: bcc578e741bec78adfb3cadd8385c06f0fefca02b81d5509a41e51ea447719db
Opcode Fuzzy Hash: 2329b337f680ef091495ac1c9583a45d15af16b005f95e784217dffa4aa9c32e
Instruction Fuzzy Hash: 82212AB59003499FCB10DFAAC985BEEBBF5FF48310F10842AE919A7250D7789945CBA0

Function 0B3C92B9 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0B3C933E

Memory Dump Source

Source File: 00000004.00000002.2169905450.000000000B3C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b3c0000_sgxIb.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 2833b6d10f02708df897e4c85e9652710db0c2889f1f131238189bc9172ff1a9
Instruction ID: c21e0a46883a02da8a77efef4923a8223f797eeaa6ae31a0f3ebae55b6037162
Opcode Fuzzy Hash: 2833b6d10f02708df897e4c85e9652710db0c2889f1f131238189bc9172ff1a9
Instruction Fuzzy Hash: 042138B1D002098FDB10DFAAC4847EFBBF5EF88324F24842AD519A7250C7789945CFA0

Function 0167D518 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0167D4E6,?,?,?,?,?), ref: 0167D5A7

Memory Dump Source

Source File: 00000004.00000002.2165773127.0000000001670000.00000040.00000800.00020000.00000000.sdmp, Offset: 01670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1670000_sgxIb.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c153b0b1086047babf83b456a09e3989f0364075808bef189b3608e526b1aa48
Instruction ID: 1cf2e0832c45b1f337427ad70c781f8c72e44b7124ce43ae0b1735bdc62cb22e
Opcode Fuzzy Hash: c153b0b1086047babf83b456a09e3989f0364075808bef189b3608e526b1aa48
Instruction Fuzzy Hash: 4A21E5B59002189FDB10CF9AD985ADEBFF8FB48314F14841AE914A3350D378A944CFA5

Function 0167B580 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0167D4E6,?,?,?,?,?), ref: 0167D5A7

Memory Dump Source

Source File: 00000004.00000002.2165773127.0000000001670000.00000040.00000800.00020000.00000000.sdmp, Offset: 01670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1670000_sgxIb.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 64042a16baa8e0e0c2884e764fb03360f40c8133a576839c9fc87d6633f46d56
Instruction ID: e47714b11f5de0949ceee338c91169baa747619a1af93ef27db6f453a2bb7b34
Opcode Fuzzy Hash: 64042a16baa8e0e0c2884e764fb03360f40c8133a576839c9fc87d6633f46d56
Instruction Fuzzy Hash: 0A21E5B59002589FDB10CF9AD984ADEBFF5FF48314F14841AE914A3350D378A944CFA5

Function 0B3C9980 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0B3C9A00

Memory Dump Source

Source File: 00000004.00000002.2169905450.000000000B3C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b3c0000_sgxIb.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: a573daefdeae1c4dee3c8388408c02a22df326c14fcfbbc17cde26098f59ff79
Instruction ID: 0deaa7238bc2607417858aba456ccb63805e387023d32eaf4e14c252d1ff2d6d
Opcode Fuzzy Hash: a573daefdeae1c4dee3c8388408c02a22df326c14fcfbbc17cde26098f59ff79
Instruction Fuzzy Hash: 7D21F5B5C003499FCB10DFAAC885AEEFBF5FF48310F50842AE919A7250D7799945CBA1

Function 0B3C92C0 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0B3C933E

Memory Dump Source

Source File: 00000004.00000002.2169905450.000000000B3C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b3c0000_sgxIb.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: c41f64d178f9c65a723e22d8ff5780957a112812c59e34945cc4f3d904f23e00
Instruction ID: d524a7fa04f8db4f3dd2d24738c7be2e7dd851fd1c15a7576c802e24d10a8f0a
Opcode Fuzzy Hash: c41f64d178f9c65a723e22d8ff5780957a112812c59e34945cc4f3d904f23e00
Instruction Fuzzy Hash: 472118B19002098FDB10DFAAC4857EEBBF4EF88314F14842AD519A7240DB789945CFA1

Function 0B3C9390 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0B3C9406

Memory Dump Source

Source File: 00000004.00000002.2169905450.000000000B3C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b3c0000_sgxIb.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1fbd6aec982361c73804281243d04aa1c5ea1a179ce3fd933311f2f0d3cdb3f3
Instruction ID: 8aa39bfa0d43020b02bf6579f8cb1cadc7cd10d742d2b1a087f0c2711c8ed6a9
Opcode Fuzzy Hash: 1fbd6aec982361c73804281243d04aa1c5ea1a179ce3fd933311f2f0d3cdb3f3
Instruction Fuzzy Hash: FF1159758002499FCB20DFAAD844BEFBFF5EF48320F24841AE519A7250CB799941CFA0

Function 0B3C9398 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0B3C9406

Memory Dump Source

Source File: 00000004.00000002.2169905450.000000000B3C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b3c0000_sgxIb.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9461ae7385bb8d6e124dc153b0832b24e44ae6d0144577f07f9b6cc76b8a3978
Instruction ID: 37a59b1dd69b2beb9659a39b002946983ddc65ab9914eff60d17f1c95909eda1
Opcode Fuzzy Hash: 9461ae7385bb8d6e124dc153b0832b24e44ae6d0144577f07f9b6cc76b8a3978
Instruction Fuzzy Hash: 101137758002499FCB10DFAAC844BEFBFF5EF48320F24841AE519A7250CB79A944CFA0

Function 0B3C9209 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0B3C9272

Memory Dump Source

Source File: 00000004.00000002.2169905450.000000000B3C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b3c0000_sgxIb.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 89eff6ef12c276a5a38dc5d7e51c7b39987d6f911a257907b5cd3ad47521dea2
Instruction ID: 7e4e6fe474520961a17d238d82c93b4f6a632d516afc2317985036692292b4e3
Opcode Fuzzy Hash: 89eff6ef12c276a5a38dc5d7e51c7b39987d6f911a257907b5cd3ad47521dea2
Instruction Fuzzy Hash: F71158B59002488FCB20DFAAD4447EEFFF5EF88324F24845AD119A7250C7789944CFA0

Function 0B3C9210 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0B3C9272

Memory Dump Source

Source File: 00000004.00000002.2169905450.000000000B3C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b3c0000_sgxIb.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 23f8f76b09105b41ea8e1d8dabad6eba2acd8ed298faf8eacf6ffc216be00bdc
Instruction ID: 82c06f49d0d65acedf0777ee9c49e60a42c9eec25c464955f1023e3fc21f8b5c
Opcode Fuzzy Hash: 23f8f76b09105b41ea8e1d8dabad6eba2acd8ed298faf8eacf6ffc216be00bdc
Instruction Fuzzy Hash: 0A1136B1D002498FCB20DFAAC4457EFFBF5EF88324F24845AD519A7250CB79A944CBA4

Function 0B3C2958 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0B3CC23D

Memory Dump Source

Source File: 00000004.00000002.2169905450.000000000B3C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b3c0000_sgxIb.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 6db2f751ed0a83ea6006920141eb64de6cd10fd3b942d36342b98d9e8d708345
Instruction ID: e06e19689794f92e1d280593ae9f03ef17eaeffb4c9b67bedf7ba5ad113c9df2
Opcode Fuzzy Hash: 6db2f751ed0a83ea6006920141eb64de6cd10fd3b942d36342b98d9e8d708345
Instruction Fuzzy Hash: 2911E3B58002499FCB10DF9AD449BDFBBF8EB48310F20845AE518A7200D375A944CFA1

Function 0B3CC1D8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0B3CC23D

Memory Dump Source

Source File: 00000004.00000002.2169905450.000000000B3C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b3c0000_sgxIb.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: e0b6db7e3abe972220ec4e17b95d9ba9fd7c5407e7b9a6e2f9a37054a5948c83
Instruction ID: 0ce0a18b13da0e9ec12cacf090ab9113486874da7def405af5b8ca54e5764f32
Opcode Fuzzy Hash: e0b6db7e3abe972220ec4e17b95d9ba9fd7c5407e7b9a6e2f9a37054a5948c83
Instruction Fuzzy Hash: 1411F5B58002499FCB10DF99D845BDEBFF8EB48324F10845AE518A7600C379A984CFA1

Function 0167B110 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0167B176

Memory Dump Source

Source File: 00000004.00000002.2165773127.0000000001670000.00000040.00000800.00020000.00000000.sdmp, Offset: 01670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1670000_sgxIb.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: eb56e8eec71a74f56046d167b4211cfd5d7192530c5cd80b06a706651b2c3352
Instruction ID: 54ea56a6c3423d327b8484454c5d702707e542740f9dc14d2e5c5b213cf68f54
Opcode Fuzzy Hash: eb56e8eec71a74f56046d167b4211cfd5d7192530c5cd80b06a706651b2c3352
Instruction Fuzzy Hash: 7D110FB5C002498FDB10DF9AD848A9EFBF4EF89220F10841AD528A7610C379A545CFA1

Function 015DD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2165510160.00000000015DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_15dd000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c3a356834ad09ec48a6a2bf826bc19e753968c32d228172cd179b2bf8e56e1d
Instruction ID: 15efcdbc500f0fd8a252c31b2335f97737ea770cc4b3dd11ee4ef7816ef5cdac
Opcode Fuzzy Hash: 9c3a356834ad09ec48a6a2bf826bc19e753968c32d228172cd179b2bf8e56e1d
Instruction Fuzzy Hash: 2F21F471500204DFDB25DF98D9C0B6ABFB5FB98324F20C569D9090F296C37AE456C7A2

Function 015ED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2165556348.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_15ed000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a8bcc0087f6c7d3b841ac30bf9130555293e82d713972688a03a6ed311ef93a
Instruction ID: 9a2d74957c761628659781f076ceb19499310a31590e1f24736e4fb7dc0243df
Opcode Fuzzy Hash: 6a8bcc0087f6c7d3b841ac30bf9130555293e82d713972688a03a6ed311ef93a
Instruction Fuzzy Hash: 9A210071A04204DFCB19DF68D988B26BFF5FB88314F28C969D90A0F256D33AD406CA61

Function 015ED1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2165556348.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_15ed000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5bba7037e635fd7875e89c1c6d78e7ccb11775886c0062459c3b756efff61f2
Instruction ID: b2e3e94ff4e53a860adca8b1ecd16734c3ffb92c9bade9fa545c5a7d44a15f85
Opcode Fuzzy Hash: f5bba7037e635fd7875e89c1c6d78e7ccb11775886c0062459c3b756efff61f2
Instruction Fuzzy Hash: 1221F575904204DFDB09DFA8D5C8B2ABBF5FB84324F20C9ADD9494F296C33AD406CA61

Function 015ED006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2165556348.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_15ed000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b3cc5269bec8a96fccac150a2e4a9ff70860651b73e2ed129a47ba98cfe5d01
Instruction ID: 254dfb741344112e61d0293b62c98a75742c827e83a9347fc92e8032bd78b848
Opcode Fuzzy Hash: 6b3cc5269bec8a96fccac150a2e4a9ff70860651b73e2ed129a47ba98cfe5d01
Instruction Fuzzy Hash: 4B219F755093808FDB07CF24D994715BFB1FB46214F28C5EAD8498F2A7C33A980ACB62

Function 015DD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2165510160.00000000015DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_15dd000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 2faebf6734f86c35b78dc3e2b129717a42b75b673c013950b8719bd63df373f1
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: B711CD72404240DFDB12CF48D5C4B5ABF71FB84224F24C6A9D9090A256C33AE45ACBA2

Function 015ED1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2165556348.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_15ed000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: ec03755c698f5b3f5cf45dc61c9b821d85aa85167cf91281ecf00b551ca79186
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: E811BB75904280DFDB06CF54C5C8B19BFB1FB84224F24C6A9D8494F296C33AD40ACB62

Function 015DD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2165510160.00000000015DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_15dd000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45e1d1ab08d7eeafad06d057ba9b9e48e91ca010567cc19a2609a4c900aed037
Instruction ID: 57c02ba5bd5425be4ff872a384abd5c6a31ff7d4c94eaec10a29554e558c7fcd
Opcode Fuzzy Hash: 45e1d1ab08d7eeafad06d057ba9b9e48e91ca010567cc19a2609a4c900aed037
Instruction Fuzzy Hash: 7E01887110438499E7309A5DC984B56BFACFF45324F19C96AED090E2C6D2799841C7B1

Function 015DD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2165510160.00000000015DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_15dd000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9e8c5f3332ab2c4418b5122b1ffa116427ea28b5803918b70039c51c65e04ba
Instruction ID: cf64ffed43059b80372064b2158678d2085321e92b35a9ae5f72c9b526703ff4
Opcode Fuzzy Hash: b9e8c5f3332ab2c4418b5122b1ffa116427ea28b5803918b70039c51c65e04ba
Instruction Fuzzy Hash: 02F062724043849AE7218E1EC888B66FFA8EF55735F18C45BED4C4E286C2799844CBB1

Analysis Process: sgxIb.exePID: 6552, Parent PID: 432COMMON

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	17
Total number of Limit Nodes:	4

Executed Functions

Function 06BD3580 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06BD3CAF
$]q, xrefs: 06BD3C7F
$]q, xrefs: 06BD3CA3
$]q, xrefs: 06BD3C56
$]q, xrefs: 06BD3C62
$]q, xrefs: 06BD3C8B

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 4f268cb1f3cd0c09e5a2ebe435053012aae5d23353685927d1b05d62d4b4cf29
Instruction ID: 2e16ee688afcd21a078cb2ef4aee5926e2105f3c3d346c0b1dfc16171de8ac32
Opcode Fuzzy Hash: 4f268cb1f3cd0c09e5a2ebe435053012aae5d23353685927d1b05d62d4b4cf29
Instruction Fuzzy Hash: 91325030E1071A8FCB14EF74D89459DB7F6FFC9300F1486AAD449AB265EB70A985CB81

Function 06BD7E98 Relevance: 3.0, Strings: 2, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06BD8433
$]q, xrefs: 06BD843F

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 023515e55247cc95fedd739f473bad67516c0b45104c58e899d43a9f80873421
Instruction ID: d4aca8f73faeb2e9117756ee479605a167cdb5662882b5e6298852ff3a884c29
Opcode Fuzzy Hash: 023515e55247cc95fedd739f473bad67516c0b45104c58e899d43a9f80873421
Instruction Fuzzy Hash: 9B02BD70B0021A8FDB54DF69D890AAEB7F6FF84314F108569D4199B394EB74EC46CB81

Function 06BD56B0 Relevance: 1.8, Strings: 1, Instructions: 594
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06BD5A03

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: bfb65aa1a6cd36bcae1739a41c78832618c1c621402f1012ff2cf0e498d1f254
Instruction ID: 85ac74856756d7d32043f0cd52ad500a89034db674b01e41528835defe2d440e
Opcode Fuzzy Hash: bfb65aa1a6cd36bcae1739a41c78832618c1c621402f1012ff2cf0e498d1f254
Instruction Fuzzy Hash: 9322B1B6E002159FDF64DFA4C4906AEB7B2FB84310F2484A9D45AAF354EA35DC42CB91

Function 06BD6708 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5370e1446ba5c7818f42de55a0ec2315bbb5b9d5854e5d9a2eff5bdb2cb38530
Instruction ID: dd4d71e99d32f37f139a08ba9c00972bd2094a9010ea5e07fc3dd4b1f6238261
Opcode Fuzzy Hash: 5370e1446ba5c7818f42de55a0ec2315bbb5b9d5854e5d9a2eff5bdb2cb38530
Instruction Fuzzy Hash: F662AD74A002058FDB54DB68D594AADB7F2FF89314F1484A9E40ADF394EB75EC42CB81

Function 06BDADE8 Relevance: 10.4, Strings: 8, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06BDAF97
$]q, xrefs: 06BDAFC0
$]q, xrefs: 06BDAF5C
$]q, xrefs: 06BDAF15
$]q, xrefs: 06BDAF8B
$]q, xrefs: 06BDAF09
$]q, xrefs: 06BDAFB4
$]q, xrefs: 06BDAF68

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 982bb2fb3a6d167b927a7a375338598aea004243bef432bdc0f460f0b11fe745
Instruction ID: 3dff0d5c33a76dd0c7ec84ad29680d4ff17883184f6dea63c3802bad847028db
Opcode Fuzzy Hash: 982bb2fb3a6d167b927a7a375338598aea004243bef432bdc0f460f0b11fe745
Instruction Fuzzy Hash: 6DE18DB0E102098FCF68DF68D5906AEB7B6FF85304F208569D419EB354EB74D846CB81

Function 06BD9268 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06BD92E4
$]q, xrefs: 06BD9313
$]q, xrefs: 06BD92D8
$]q, xrefs: 06BD931F

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 9c45d4b942f5c3abb73b934aced6c0bab505b1074ba122fa9148adc8385e7268
Instruction ID: 75c71a19f0e3f958842ec4b1a02177d6f53d0b5c77c047d07f59e51b159aec05
Opcode Fuzzy Hash: 9c45d4b942f5c3abb73b934aced6c0bab505b1074ba122fa9148adc8385e7268
Instruction Fuzzy Hash: A2914170B0020A9FDB54EF69D8607AE73F6FF85204F108569C81DEB398EB709D468B91

Function 06BDD070 Relevance: 4.5, Strings: 3, Instructions: 798
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06BDD46F
$]q, xrefs: 06BDD47B
$]q, xrefs: 06BDD467

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q
API String ID: 0-182748909
Opcode ID: 02fad14c164c8e81d5aa0d74ea15dbc7fdb1849cd388ad621d5476d232b508c8
Instruction ID: a83d4f88efbfc86c860507e6b6b23721da727758e82be6d6773ec9f082fac7cf
Opcode Fuzzy Hash: 02fad14c164c8e81d5aa0d74ea15dbc7fdb1849cd388ad621d5476d232b508c8
Instruction Fuzzy Hash: 6762427060020A8FCB59EFA9D590A5EB7F6FF84304B10CA69D0459F369EB75EC46CB81

Function 06BD4C80 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Obq, xrefs: 06BD4E5B
XPbq, xrefs: 06BD4DD1
fbq, xrefs: 06BD4CAB

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID: fbq$XPbq$\Obq
API String ID: 0-4057264190
Opcode ID: f54ab57ce35df8e0e70b5eea1d9426c4f0ea637332730083d0a6d8e047db6f03
Instruction ID: eec8867b94b17b177f707362f1198ebe00d39cd8a5680a795d169c9cb3a6092b
Opcode Fuzzy Hash: f54ab57ce35df8e0e70b5eea1d9426c4f0ea637332730083d0a6d8e047db6f03
Instruction Fuzzy Hash: E36182B1F102199FEF54DFA5C8547AEBBF6FB88700F20842AD10AAB394DB758C458B51

Function 06BD925A Relevance: 2.7, Strings: 2, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06BD9313
$]q, xrefs: 06BD92D8

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: cf9d33f5e2da8813f8ac3cf71148676538cd1877a252f50978a656bb47ef348a
Instruction ID: 56121cc9ab29da4920a09875b4b110962950704abbc9739de08985d2a3abcdc5
Opcode Fuzzy Hash: cf9d33f5e2da8813f8ac3cf71148676538cd1877a252f50978a656bb47ef348a
Instruction Fuzzy Hash: 9D513F70B001099FDB95EB78D9A0BAE73F6EB88604F108569C41DDB399EB719C068B91

Function 06BD4C71 Relevance: 2.6, Strings: 2, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPbq, xrefs: 06BD4DD1
fbq, xrefs: 06BD4CAB

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID: fbq$XPbq
API String ID: 0-2292610095
Opcode ID: d85a790bb50bf71fd21556606f85c5d9f52ed48d7094d5384471af30ca5be00c
Instruction ID: a64347baf577fc01f38f232743a6febcd9b3353cab9a4661fca0ffbe39329271
Opcode Fuzzy Hash: d85a790bb50bf71fd21556606f85c5d9f52ed48d7094d5384471af30ca5be00c
Instruction Fuzzy Hash: 49518275F002199FDB54DFA5C854BAEBBF6FF88700F20852AE106AB395DA758C01CB91

Function 02CEED70 Relevance: 1.6, APIs: 1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2252684836.0000000002CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2ce0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cfb60e5e0a71e814d0ab07a4f8172ad84e759971da34d8f6f8329b1ef23d56e
Instruction ID: 245330bc731451692ddedc58c86728925ec76cfe221eb7fc5c1d067085d6b517
Opcode Fuzzy Hash: 6cfb60e5e0a71e814d0ab07a4f8172ad84e759971da34d8f6f8329b1ef23d56e
Instruction Fuzzy Hash: B4410472D0075A8BCB14EF79D8443DEBBF5EF89310F148A6AD416A7280DB789841CBE0

Function 02CEEE58 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 02CEEEBF

Memory Dump Source

Source File: 00000005.00000002.2252684836.0000000002CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2ce0000_sgxIb.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: b51d842147ca9131b3edb92630f95250ff96b1e71ae59bdbd5634dfc695f9aaa
Instruction ID: 5bde4f5d82b45e706fc6f4f575854bc97bb2efd8d189202546463b892e265112
Opcode Fuzzy Hash: b51d842147ca9131b3edb92630f95250ff96b1e71ae59bdbd5634dfc695f9aaa
Instruction Fuzzy Hash: 9811EFB1C0065A9BCB10DFAAC544A9EFBF4AF48320F15856AD918A7240D778A944CFA5

Function 06BDDBE5 Relevance: 1.4, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH]q, xrefs: 06BDDD41

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: fb05d33c712de952fad5b16d9d051255eec5a0fb247a1b34ec408d2ac17a544c
Instruction ID: b2bf8f69cf39b17771f4946b177e6b1d05ffc4fad901db3fefafbd7e202d6ab6
Opcode Fuzzy Hash: fb05d33c712de952fad5b16d9d051255eec5a0fb247a1b34ec408d2ac17a544c
Instruction Fuzzy Hash: 2B41BEB0E0060A9FDF64DFA9D85469EBBB2FF85300F144569E845EB354EBB0D806CB81

Function 06BD21D0 Relevance: 1.4, Strings: 1, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH]q, xrefs: 06BD230B

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: e2f5a5e598f689cb2ef8dcb2a0cb89b52d6a884e863109da8322b6babd670bc7
Instruction ID: b3a57fddbf28755e3c381c145d305847f9d27dfe450cd5764e29e7b2742af97f
Opcode Fuzzy Hash: e2f5a5e598f689cb2ef8dcb2a0cb89b52d6a884e863109da8322b6babd670bc7
Instruction Fuzzy Hash: A331FEB0B102458FDB59AB74D52066E3AA7EFC9204F104478E506DB399EE35DE02CB95

Function 06BD83E8 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

$]q, xrefs: 06BD8433

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: fe8bd4d400ca2ab063c5d7608c4787b775a76bdbe94190f05903cf92c33ebd63
Instruction ID: 4621c2229d40a221d314a9004af507897cd92ec84c4beca5818258da74560aea
Opcode Fuzzy Hash: fe8bd4d400ca2ab063c5d7608c4787b775a76bdbe94190f05903cf92c33ebd63
Instruction Fuzzy Hash: 7EF0C2B1B041158FDF689E98F9A027977ADFB40216F1444F6C908CF264E7B1D905CF91

Function 06BD4B69 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

\Obq, xrefs: 06BD4B75

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID: \Obq
API String ID: 0-2878401908
Opcode ID: 718c7d1ffb2cd611b959a3013c28fbf7fcb9de89ec2b40365156b2dc31717d0f
Instruction ID: 3a703f4976200f1447928d8f879117a64ba92070e4542528c0d6512813048d25
Opcode Fuzzy Hash: 718c7d1ffb2cd611b959a3013c28fbf7fcb9de89ec2b40365156b2dc31717d0f
Instruction Fuzzy Hash: CCF0DAB4E50129DFDB14DF95E958BAEBBF2FF88600F200559E002A7294CBB01C01CF80

Function 06BDC2B0 Relevance: .6, Instructions: 642COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6bfad4a9cf25d787b1cac3d10734945075d409e742ed8d4a80192b7aa3bb354
Instruction ID: cc5e01894908a640d1539ae204e8fcfca49909b7726450d6b51d62e99e746b12
Opcode Fuzzy Hash: d6bfad4a9cf25d787b1cac3d10734945075d409e742ed8d4a80192b7aa3bb354
Instruction Fuzzy Hash: E832B174B001099FDF54DFA8D990AADBBBAFB84314F108465D405EB395EB35DC42CB91

Function 06BDB3E7 Relevance: .6, Instructions: 558COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2c88df7a713290f73cb6bec121de9db7065bc969adb2764a99d4a34d860fb93
Instruction ID: c8882bf97e3e6ce7057e529d5df55948a610a59cbb730c7465d8b32610198869
Opcode Fuzzy Hash: b2c88df7a713290f73cb6bec121de9db7065bc969adb2764a99d4a34d860fb93
Instruction Fuzzy Hash: 0C225EF0E002099FDF64DB68D4907ADB7B6EB45310F2598AAE409EF395EA34DC81CB51

Function 06BD6308 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6451a14efbb17088353222cc55c0fb7ef10f90a61e467cf2d1617cc3fe4bfa2
Instruction ID: f46c9289d861e1807fe9c069a1a3843c99f0e2a694ca2cf7c1c8ac69fc33a030
Opcode Fuzzy Hash: a6451a14efbb17088353222cc55c0fb7ef10f90a61e467cf2d1617cc3fe4bfa2
Instruction Fuzzy Hash: FA61A1B1F001214FDB64AA6EC88065FBADBEF94224F154479D80EDB364EE75ED0287D1

Function 06BD43B9 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 307e2e4deff22d04e042924e4116632a5b3fcc2dd64b1ec6728c2c01fae96413
Instruction ID: e602c44213467ec7d0e6c243e77aac890e68636584e44b9e04c39a4109b400a4
Opcode Fuzzy Hash: 307e2e4deff22d04e042924e4116632a5b3fcc2dd64b1ec6728c2c01fae96413
Instruction Fuzzy Hash: 5C815D74B0020A8FDF44DFA9D45469EB7F2EF85304F108469D50AEB395EB74DC468B92

Function 06BD46D4 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e15aec22bc1dc4392bc699c39e6fcac3e0a8e44ccf2cb4d195e302d3864769b
Instruction ID: 8e582f7a2424bf962e3998df1aeb5a0bd3e3fdb5f3956d7f6e68a7e5041d61d3
Opcode Fuzzy Hash: 3e15aec22bc1dc4392bc699c39e6fcac3e0a8e44ccf2cb4d195e302d3864769b
Instruction Fuzzy Hash: 7A915E70E002198FDF60DF68C890B9DB7B1FF89300F208599D54DAB255EB70AA86CF91

Function 06BD46E8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95d7641f45415972667f20ab3e180c860e7bad57ff31cf47933ab3023f971a39
Instruction ID: 13589ce2a3819fd36624d5ef649c32c14436287bdb4772923bd58f8bc533bae6
Opcode Fuzzy Hash: 95d7641f45415972667f20ab3e180c860e7bad57ff31cf47933ab3023f971a39
Instruction Fuzzy Hash: 7D913E74E1021A8BDF60DF64C890B9DB7B1FF89300F208599D54DAB255EB70AA85CF91

Function 06BDF039 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21bccd4eac69a73c38ba36dc29f5af12e64fcc0d4d872ad111d567dd6fe52a9f
Instruction ID: bfa9153f5e226ce8113e8f9f5d5d6b973409805bf8ceb95ac4b592ac9cb21681
Opcode Fuzzy Hash: 21bccd4eac69a73c38ba36dc29f5af12e64fcc0d4d872ad111d567dd6fe52a9f
Instruction Fuzzy Hash: F3713274A001099FCB54DFA9D990AADB7FAFF84304F148469D40AEB355EB30ED46CB51

Function 06BDF048 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d685d0206a7dfd7b58c3560533c47edcf5679dd6a95d1897ffbeed661327a927
Instruction ID: 5183d564b13f738aca553e02766a34c23c312f999b2c0470c359622765200899
Opcode Fuzzy Hash: d685d0206a7dfd7b58c3560533c47edcf5679dd6a95d1897ffbeed661327a927
Instruction Fuzzy Hash: 7D714070A001099FCB54DFA9D990AADBBFAFF84304F148469D40AEB365EB30EC46CB51

Function 06BDFCC9 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea80275af6084ccc4d97019ba9c0eeef62dd9be10d9dd5d2df2a76d9e3b62aaa
Instruction ID: 712c26b9e59e21e96601f1c670afa25c8007c1eeb56b49e5310381c95ad498f5
Opcode Fuzzy Hash: ea80275af6084ccc4d97019ba9c0eeef62dd9be10d9dd5d2df2a76d9e3b62aaa
Instruction Fuzzy Hash: 935100B0E14105DFCF64AF78E4542ADBBBAFB84214F1088A9E11ADB251EB318855CB81

Function 06BDFA78 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cbef2a4a4b0deb6ec4a83d24e2ac1ed0c3ce3e66b9536a14074a71d178becc7
Instruction ID: f2103bd660670475765a61cfd4d34b67c02259caf43d060505f58cd197ccad1e
Opcode Fuzzy Hash: 9cbef2a4a4b0deb6ec4a83d24e2ac1ed0c3ce3e66b9536a14074a71d178becc7
Instruction Fuzzy Hash: 7551ECB0F102059FEF64567CD96473F365EEB89314F204866E40BCB3EAEA68CC458792

Function 06BDFA88 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1f4cf664f0527b9827d311af93ab3fb05af10d66df3d4b6d640a502c4286ffb
Instruction ID: 8a384951837bf16a0202525637eff489ce4c41cb125651566c96445c4c4d4643
Opcode Fuzzy Hash: d1f4cf664f0527b9827d311af93ab3fb05af10d66df3d4b6d640a502c4286ffb
Instruction Fuzzy Hash: CD51CBB0F102055FEF64666CD96473F365FEB89314F204865E40BCB3EAEA68CC458792

Function 06BD5529 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b31e175463f048f5dce83d8c89df1ec2e40f3e8fbf6887ec35a5b71bb3fe021b
Instruction ID: e049d807a84330a870d0b0ca13ba52364e263aff05fa1952e7ba8f3629090f87
Opcode Fuzzy Hash: b31e175463f048f5dce83d8c89df1ec2e40f3e8fbf6887ec35a5b71bb3fe021b
Instruction Fuzzy Hash: 1C415FB2E006098FDF74CEA9D8C0AAFFBB6FB44310F10496AD255DB650E731E8458B91

Function 06BD2080 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 271064c491614f792dcfd1b24a3ff6575b4439b4e3306343506706df67f975da
Instruction ID: e018e5c195452727e752f99e61c6198e7f993125a20492169ac3595b1ceb49ac
Opcode Fuzzy Hash: 271064c491614f792dcfd1b24a3ff6575b4439b4e3306343506706df67f975da
Instruction Fuzzy Hash: 8C31DE70E002169FCB59DF64D89469EB7F2FF89300F10C569EA0AEB350EB31A906CB50

Function 06BDDA98 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efb6a1e6c1658c85cb14ed7183583e111061025db4667793bbe17eb37020cca7
Instruction ID: 60d8b71d86c8adae43cd2ab2dcd4d1ee5bc3ec5ca82688a30cb7c909157fce21
Opcode Fuzzy Hash: efb6a1e6c1658c85cb14ed7183583e111061025db4667793bbe17eb37020cca7
Instruction Fuzzy Hash: 4F31E370E1070A8FCF65DFA8D49069EBBF6FF85304F108969D445AB254EBB0E846CB81

Function 06BD2090 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c5384a67ebbe4d6c0864765254b17b76040e7921d199228dc6fdf9416491932
Instruction ID: 6c852e82a4c375b099ba6d9cc086b4b5becf017938251347fea061ca656ea501
Opcode Fuzzy Hash: 7c5384a67ebbe4d6c0864765254b17b76040e7921d199228dc6fdf9416491932
Instruction Fuzzy Hash: 9B31AB74E0021A9FCB19DF65D85469EB7F2FF89300F10C529EA0AEB350EB71A946CB50

Function 06BD3508 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d370ec12509d53581b3477937089e9d964d4b82bd487b7291e9178642b088ee4
Instruction ID: 20acc93b0ee35c9808ab53a0f59849f1ffdedc9d2ba128305d1ad167e0a84d93
Opcode Fuzzy Hash: d370ec12509d53581b3477937089e9d964d4b82bd487b7291e9178642b088ee4
Instruction Fuzzy Hash: 5921B0B1E052A45FCB55DB38C8605CEBBF5AF8A314F0840E7D042EF252EA34C945CBA2

Function 06BD3FC1 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 804b05f4edea9a6908d623493a2b1ffb9eb60dd4340e1ce3f860503cd4c3bee0
Instruction ID: a6090ee3a4d0e0c90e904af3b9779c8fee1ab5fb76e31141ccad16ef0a419c7a
Opcode Fuzzy Hash: 804b05f4edea9a6908d623493a2b1ffb9eb60dd4340e1ce3f860503cd4c3bee0
Instruction Fuzzy Hash: D72190B5F002199FDB54EF68D950AAFB7F5EB48310F008065E915EB380E775DD018BA1

Function 06BD3FD0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2637955563d37947d28a8c6dd64a04e41b8c732938956e30ae5c81ce61712a62
Instruction ID: 08c991d775f43e3a886a96c59cefcc719efea16cf53a79f40bf6702b0a0f1552
Opcode Fuzzy Hash: 2637955563d37947d28a8c6dd64a04e41b8c732938956e30ae5c81ce61712a62
Instruction Fuzzy Hash: 9B218CB5F002199FDB50DF69D990AAEBBF5EB48310F108066E905EB384E775D9018BA1

Function 06BDB038 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74e051beb0ab4c5cb1e563185e296c659c7ea5bf478c4bdf7578d9964a230117
Instruction ID: f158865e62758412abf0b3048c96b820269d8257e9e97ec8a57cefa7c11e313b
Opcode Fuzzy Hash: 74e051beb0ab4c5cb1e563185e296c659c7ea5bf478c4bdf7578d9964a230117
Instruction Fuzzy Hash: 1B216FB1D1071E8BDF64CFA9C84069EBBB5FF85354F11896AD809EF250EBB09845CB81

Function 06BDA420 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cd1bfb75401896c8254bda8503cc6ceddea0d43f194aa751a5bfe95580476dd
Instruction ID: 2e99c52ec33d033c0f8069602a7f52af762c6026678d56c8cea294fb2253952c
Opcode Fuzzy Hash: 4cd1bfb75401896c8254bda8503cc6ceddea0d43f194aa751a5bfe95580476dd
Instruction Fuzzy Hash: BE2138B1F001114FCBA5DA7CE85476E77E5EB86718F1044BAE50ECB395EE24CD068781

Function 06BD6E30 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6e159d1ef3f30bb1b40dd4f86359c1cf03e8fd40e28a6da3d9faffd4d7a8d35
Instruction ID: a022b19c711b0900848cfbd9b8eecf00e5e5e0aba10411e7bb29229937c8a269
Opcode Fuzzy Hash: f6e159d1ef3f30bb1b40dd4f86359c1cf03e8fd40e28a6da3d9faffd4d7a8d35
Instruction Fuzzy Hash: 1A21DC70B200199BCF84EA69E8646AEB7B6EB84314F108579D409EB344EB30ED428B81

Function 06BD4318 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52db7d40affb63273d24fa2f32a41d67991bb1ff4088b55be810e5d297cdb867
Instruction ID: 8d9e330d739d173cd86f225da2e21a7b88ee39a8336e86f107dfa640a60b3bb9
Opcode Fuzzy Hash: 52db7d40affb63273d24fa2f32a41d67991bb1ff4088b55be810e5d297cdb867
Instruction Fuzzy Hash: D00122B5B101110BCB659A3CD81472EB7EADBC6620F10847AE14ECB3A5E960CC024391

Function 06BD40E0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8681db92fd4840887cdc86895d5daad9ae7e41200049c243f962894b5d333b6a
Instruction ID: bd0ac6ae940eeef7cf473812dbe3dc050f4df1f389797c6354a1774b5f3669d5
Opcode Fuzzy Hash: 8681db92fd4840887cdc86895d5daad9ae7e41200049c243f962894b5d333b6a
Instruction Fuzzy Hash: 8C118E36B001284BDB54E668DC146AE77FAEBC8210F058579C50AEB340EE75DC068BE1

Function 06BD40D1 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adc108c0fac19fee6e5a019e2d32e36deef034fb5c6fccba319dd876adc4f50f
Instruction ID: 4b9a9afa9e843ffa196f2566267e037b209359c5ed37621c1c95283d1ad4fb96
Opcode Fuzzy Hash: adc108c0fac19fee6e5a019e2d32e36deef034fb5c6fccba319dd876adc4f50f
Instruction Fuzzy Hash: 5201DF32F000295BDF94A668DC10AEF77FAEBC8210F014035D50AEB244EE759C074BE1

Function 06BD3D99 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f925b2247bdbffbf8b725692d1ccd64c64d759750d1c165b434080f1357d0cd
Instruction ID: e76b6e5dda9ea2ee816aa7b598509f350a5f739b9500f55af01f2fcbe738c5ce
Opcode Fuzzy Hash: 0f925b2247bdbffbf8b725692d1ccd64c64d759750d1c165b434080f1357d0cd
Instruction Fuzzy Hash: 3421C0B5D01219AFCB10DF9AD984ADEFFB8FB49310F10812AE918A7241D374A954CBA5

Function 06BD3DA0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7388ec9749eaf6cb4fe56c52e02ea103c9df8effd85cddc3cbaf2a2d35d3241
Instruction ID: ba966cf4871e5c99ce69245c7f8f24d944d7538b9f0eabcb8814d5823c62b6e7
Opcode Fuzzy Hash: c7388ec9749eaf6cb4fe56c52e02ea103c9df8effd85cddc3cbaf2a2d35d3241
Instruction Fuzzy Hash: 8011C2B5D01219AFCB00DF9AD884ADEFBB4FB49310F10812AE518A7241D374A954CBA5

Function 06BDF2B8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75801e4f5fa491c01f9e533720e19370bb6b8f6cff41f1210c6e24b0639b8928
Instruction ID: 11076715cbba1c2a99af53d83b35a1f6c754edaa873f04e6d8a278368354419a
Opcode Fuzzy Hash: 75801e4f5fa491c01f9e533720e19370bb6b8f6cff41f1210c6e24b0639b8928
Instruction Fuzzy Hash: E501B1B6F181500BCB66D67C945477E67DADB85618F148869E04FCF380EA95DD028382

Function 06BD4328 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3093abeec23e7c52629ad51be5fb6c15e8ac9611a6e2b8e52deb0e94700a997d
Instruction ID: d37b401a0d22fac9ab86175a07cad2d48fb0a98c5c21e687e22029ee455432d2
Opcode Fuzzy Hash: 3093abeec23e7c52629ad51be5fb6c15e8ac9611a6e2b8e52deb0e94700a997d
Instruction Fuzzy Hash: 0B01D1B5B100140BDB64996DD41472FA3EBDBCA724F10843EE10ECB354ED71DC024381

Function 06BDF2C8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5a0a9e1105f50f426246a5738d4e81844f3ab2f5c6763c2f5e757937f805336
Instruction ID: 2510001ec07bc14fba6633f586e147ff955eccd96aae9c939ca8182b69036813
Opcode Fuzzy Hash: b5a0a9e1105f50f426246a5738d4e81844f3ab2f5c6763c2f5e757937f805336
Instruction Fuzzy Hash: F5018175B140150BCB65997DE45473E67DEDBC9628F208479E50FCF390EE65DD024382

Function 06BDA430 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f69af5f065f7dc45574bca35c05d263b904d17112e3553b6db25f50fa87bd81
Instruction ID: 429d217041260fefcb3650eaa19f8e4e75736b2ff4d2c8f401f7527e1df516c4
Opcode Fuzzy Hash: 4f69af5f065f7dc45574bca35c05d263b904d17112e3553b6db25f50fa87bd81
Instruction Fuzzy Hash: 0101A471B000154BCB65EA7DE858B2B73DAEBCA718F108478E10ECB354EE21DC028BC1

Function 06BD6588 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c74d842d1124f311312f55bb5c2ff4d068571675dfddb4ac14adc26c5ccb1128
Instruction ID: 5f9713d5c7b9a27e6e5d44d88ef040ee74a73478e16995bb5d7829fa486212b4
Opcode Fuzzy Hash: c74d842d1124f311312f55bb5c2ff4d068571675dfddb4ac14adc26c5ccb1128
Instruction Fuzzy Hash: 22E022F0D0420C6FDF20DA74890578A3BE9D702208F1040E6D804DF206F231C9818382

Non-executed Functions

Function 06BD77B8 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$]q, xrefs: 06BD7D26
$]q, xrefs: 06BD7C71
$]q, xrefs: 06BD7D1A
$]q, xrefs: 06BD78D9
$]q, xrefs: 06BD7D04
$]q, xrefs: 06BD78B4
$]q, xrefs: 06BD7D10
$]q, xrefs: 06BD78E5
$]q, xrefs: 06BD78A8
$]q, xrefs: 06BD7C65

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2843079600
Opcode ID: 3cd7ad0da1c6dd7d8082a227e9a8fdd59a867a98403349458e571f60a02d4d65
Instruction ID: b71632885184fdd812314886e123071023b3ca63839f0e116cd3e78d070d08b8
Opcode Fuzzy Hash: 3cd7ad0da1c6dd7d8082a227e9a8fdd59a867a98403349458e571f60a02d4d65
Instruction Fuzzy Hash: 38123D70E002198FDB68DF69C994A9DB7F6FF88304F2089A9D409AB254EF749D41CF91

Function 06BDAA50 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$]q, xrefs: 06BDABCC
$]q, xrefs: 06BDAB46
$]q, xrefs: 06BDABD8
$]q, xrefs: 06BDABAD
$]q, xrefs: 06BDAB52
$]q, xrefs: 06BDABA1
$]q, xrefs: 06BDAC02
$]q, xrefs: 06BDAC0E

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 52491979305d4f98981a12dc2f3ce20006ac12eb2a2d3eba6370d9038557ad6c
Instruction ID: a11b703c2d4db3117b4773ad751fb3af30bc876d54218e84061728c6e4baa2ef
Opcode Fuzzy Hash: 52491979305d4f98981a12dc2f3ce20006ac12eb2a2d3eba6370d9038557ad6c
Instruction Fuzzy Hash: 7F9192B0A00209DFDF68DF68D994B6E77F6FF44301F148569D806AB2A4EB749C45CB90

Function 06BD71B8 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$]q, xrefs: 06BD749A
$]q, xrefs: 06BD7654
$]q, xrefs: 06BD74F4
$]q, xrefs: 06BD76C0
.5uq, xrefs: 06BD7213
$]q, xrefs: 06BD76CC
$]q, xrefs: 06BD7500

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID: .5uq$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-981061697
Opcode ID: 1f85bc777d361940e0e75b7550eec94cc3416bd6c88e42504468c20fd99d7c1d
Instruction ID: 7f89150c4d5aac25309604c88bb509c387c37324db4f8fce3c1ba25b5124b605
Opcode Fuzzy Hash: 1f85bc777d361940e0e75b7550eec94cc3416bd6c88e42504468c20fd99d7c1d
Instruction Fuzzy Hash: 82F16074B00209CFDB59EFA8D550AAEB7B7FF84300F248569D4169B368DBB49C42CB90

Function 06BDBB30 Relevance: 7.7, Strings: 6, Instructions: 197COMMON

Download Yara Rule

Strings

$]q, xrefs: 06BDBCD5
$]q, xrefs: 06BDBD09
$]q, xrefs: 06BDBCFD
$]q, xrefs: 06BDBCC9
$]q, xrefs: 06BDBD3D
$]q, xrefs: 06BDBD31

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: df4f234eca30ef5f1634b9d0ce4267e129ca82a31179a29db47e8af4cd8f9913
Instruction ID: 238399404493c6080d0a2872b6060b1aeeef2fecb6809239438a601dbc8153db
Opcode Fuzzy Hash: df4f234eca30ef5f1634b9d0ce4267e129ca82a31179a29db47e8af4cd8f9913
Instruction Fuzzy Hash: 1B71AFF1A402098FDBA8DF68D450AAEB7F6FF85304B1184A9D40ADF254EB71DD45CB81

Function 06BD84F0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$]q, xrefs: 06BD87BB
$]q, xrefs: 06BD874A
$]q, xrefs: 06BD87AF
$]q, xrefs: 06BD8756

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 9f712363e54a43bf3f6526dc25bf2469633889bd279350491cd8a3e874f23c58
Instruction ID: 034cd4cb39d4d1acb457979332e3aa5fcfc9a775badc8380115185dcbe776a91
Opcode Fuzzy Hash: 9f712363e54a43bf3f6526dc25bf2469633889bd279350491cd8a3e874f23c58
Instruction Fuzzy Hash: B3B15D70F002098FDB58EFA9D590A6EB7B6FF84305F248469D406AB354EB75DC82CB81

Function 06BDADD8 Relevance: 5.2, Strings: 4, Instructions: 178COMMON

Download Yara Rule

Strings

$]q, xrefs: 06BDAF5C
$]q, xrefs: 06BDAF8B
$]q, xrefs: 06BDAF09
$]q, xrefs: 06BDAFB4

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 103279f62f20060a6d2b0a3f4e35fc0be5df8cc2eef311d3d147e90dbf3a3c6c
Instruction ID: 628225a4b00562125127c5920da5536a2124b296ca9d9377f4991844b77ab7d4
Opcode Fuzzy Hash: 103279f62f20060a6d2b0a3f4e35fc0be5df8cc2eef311d3d147e90dbf3a3c6c
Instruction Fuzzy Hash: B451A2B4E102089FCFA5DB68D990AADB7B6FF84300F2459A9D416EB254EB31DC41CB91

Function 06BD8908 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LR]q, xrefs: 06BD89FB
$]q, xrefs: 06BD8993
$]q, xrefs: 06BD8987
LR]q, xrefs: 06BD8A4A

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q
API String ID: 0-3527005858
Opcode ID: d5dcc4dc7dfa9ce224b5a7db3f9de37bb37406ea9251a265a0119fe548a3fff2
Instruction ID: 3a404b4b894b544d9391b131b6bae9fb851cc1bb75db066ee6df3177c0d38853
Opcode Fuzzy Hash: d5dcc4dc7dfa9ce224b5a7db3f9de37bb37406ea9251a265a0119fe548a3fff2
Instruction Fuzzy Hash: 9F51D170B002059FDB58EF28D990A6E77E6FF84704F1495A9D4069F3A9EB74EC01CB91

Function 06BDAE64 Relevance: 5.1, Strings: 4, Instructions: 117COMMON

Download Yara Rule

Strings

$]q, xrefs: 06BDAF5C
$]q, xrefs: 06BDAF8B
$]q, xrefs: 06BDAF09
$]q, xrefs: 06BDAFB4

Memory Dump Source

Source File: 00000005.00000002.2261541830.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6bd0000_sgxIb.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 60d49ca3f8539189fae91b85778311dd5204b90d5f8104f6d537acd2301eb5ef
Instruction ID: 9548be705fbdf846622189ee3e0e3d76b2b38b5a724c898bfa71917f46623129
Opcode Fuzzy Hash: 60d49ca3f8539189fae91b85778311dd5204b90d5f8104f6d537acd2301eb5ef
Instruction Fuzzy Hash: 98415FB4A102058FCFA5DB64D59096DB3B6FF84300B2495A9D415EB254EB30EC41CB91

Analysis Process: sgxIb.exePID: 6192, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	159
Total number of Limit Nodes:	6

Executed Functions

Function 0302AF11 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0302B176

Memory Dump Source

Source File: 00000007.00000002.2252430413.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_sgxIb.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: cd0125f703d80c3d7789e746ac8d99b7880ef39917efe390c74ecc446f4ae916
Instruction ID: 0e7ead4e164035abd9ed4cb0637eaf72b14aeeeec3929e0cc81ecd14a347e57a
Opcode Fuzzy Hash: cd0125f703d80c3d7789e746ac8d99b7880ef39917efe390c74ecc446f4ae916
Instruction Fuzzy Hash: 4E8187B0A01B158FDB64DF69D08075ABBF1FF88300F048A6DD05ADBA50DB39E809CB90

Function 030244D4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 030259C9

Memory Dump Source

Source File: 00000007.00000002.2252430413.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_sgxIb.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 205ab72fbb76c028d7dfd4ce5ff1e68c316465bce352f54f535ee107511603d6
Instruction ID: ca070b1ea2c125465a277bcd330a84d7ebdde454c676f8cb4a6edd48c2d92aa3
Opcode Fuzzy Hash: 205ab72fbb76c028d7dfd4ce5ff1e68c316465bce352f54f535ee107511603d6
Instruction Fuzzy Hash: 1541F1B0C01719CBDB24CFA9C885B9DFBF5BF49314F64806AD408AB251DB756945CF90

Function 0302590C Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 030259C9

Memory Dump Source

Source File: 00000007.00000002.2252430413.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_sgxIb.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 498ca542bb3b588556669007b3f7bb4aff2f1cc0dc19fc46107d50aeca90c5a8
Instruction ID: 8c06df69f5cf8698d66a49846d0c328e0f9d5a65297c526d503dcc5e355212ca
Opcode Fuzzy Hash: 498ca542bb3b588556669007b3f7bb4aff2f1cc0dc19fc46107d50aeca90c5a8
Instruction Fuzzy Hash: 2941FFB0C01729CADB24CFA9C885B9DFBF1BF49304F24806AD408AB255DB755946CF90

Function 056D4120 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 056D41E1

Memory Dump Source

Source File: 00000007.00000002.2267447094.00000000056D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_56d0000_sgxIb.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: ecd1eaee089639b4b13fa7ab1d2e4f0794046a174337c7dd23111cf9ae1f47d4
Instruction ID: 94db51273f15fb4d7a0d61c479bd167630501091a758d603a69d332d8d2c475c
Opcode Fuzzy Hash: ecd1eaee089639b4b13fa7ab1d2e4f0794046a174337c7dd23111cf9ae1f47d4
Instruction Fuzzy Hash: 73411AB5900309CFDB14CF99C888AAAFBF5FF98314F248859D519AB321D775A841CFA0

Function 0302B580 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0302D4E6,?,?,?,?,?), ref: 0302D5A7

Memory Dump Source

Source File: 00000007.00000002.2252430413.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_sgxIb.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0ee6de388ef7226967a9d70e1d1a5f754009922010014981b67d5f31d85b593a
Instruction ID: a1391a3354a3504a6a0907eb2cdff029c412429cc2cb30239522a73feffac5bb
Opcode Fuzzy Hash: 0ee6de388ef7226967a9d70e1d1a5f754009922010014981b67d5f31d85b593a
Instruction Fuzzy Hash: 6B2116B59012589FDB10CF9AD484ADEFFF4FB48310F14841AE914A7310D378A944CFA4

Function 0302D518 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0302D4E6,?,?,?,?,?), ref: 0302D5A7

Memory Dump Source

Source File: 00000007.00000002.2252430413.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_sgxIb.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a418af8df8fed80533539ed8f4d5aa832fd64be8ee60b3f032f04d00015a78d0
Instruction ID: 057f05696e993c1350f7585bdf507d67aa1743d6c5130ea96569c6e8d5eeec14
Opcode Fuzzy Hash: a418af8df8fed80533539ed8f4d5aa832fd64be8ee60b3f032f04d00015a78d0
Instruction Fuzzy Hash: F921E4B59002589FDB10CF9AD985ADEFFF8FB48314F14841AE918A3310D379A940CFA5

Function 0302B110 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0302B176

Memory Dump Source

Source File: 00000007.00000002.2252430413.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_sgxIb.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 84042579178d1535c4c3c3bca0db3f4040afd48684eed8b94c12512dc362daa8
Instruction ID: 7ca5c8826843df229728ea83c99086c24636bd36d251351b2c1867a0318aface
Opcode Fuzzy Hash: 84042579178d1535c4c3c3bca0db3f4040afd48684eed8b94c12512dc362daa8
Instruction Fuzzy Hash: 3B11DFB5C012598FDB10DF9AD844A9EFBF4AB89210F14841AD429B7610C379A545CFA5

Function 0152D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2251778198.000000000152D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0152D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_152d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc8e5d91432a92ddb8cff695020c8284bc2d0f865c8e9936291f9c3ae985ad7e
Instruction ID: 428e9ed7b0ef481bb17fef9c0e03a04e39c60e9ead2a1c443351452fc4c192f7
Opcode Fuzzy Hash: dc8e5d91432a92ddb8cff695020c8284bc2d0f865c8e9936291f9c3ae985ad7e
Instruction Fuzzy Hash: 08213672504204DFDB05DF58C9C0B5ABFB5FB99314F20C569D9090F296C37AE446C6E1

Function 0152D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2251778198.000000000152D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0152D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_152d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 265ab1eb6d5e80f9ce1c439333875df2b9b3f400d74450483e98165be2a20ea0
Instruction ID: 5f381f8c4ad8564b262fc87e3325ea75a1124f70298964a200eb28c83251983f
Opcode Fuzzy Hash: 265ab1eb6d5e80f9ce1c439333875df2b9b3f400d74450483e98165be2a20ea0
Instruction Fuzzy Hash: 8A210372604240DFDB05DF58D9C0F2ABFB5FB89318F20C569E9090F296C37AD456CAA2

Function 018DD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2251990967.00000000018DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_18dd000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90d724e2c52473f87a4febfb8043ef17d90c75d57b30e4338e6362a9572fdc8b
Instruction ID: 43bc4bd4603ac5b2d86918be82787638b594fd60bd026f40b41317c7ec5a3b70
Opcode Fuzzy Hash: 90d724e2c52473f87a4febfb8043ef17d90c75d57b30e4338e6362a9572fdc8b
Instruction Fuzzy Hash: 52210071604304DFCB15DF68D980B26BF65EB88314F20C669D90A8B296C33AD907CAA1

Function 018DD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2251990967.00000000018DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_18dd000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9e617bc8591214e1939def13f71f57cd66e431d5fc4e4fb5d9166c6a44be134
Instruction ID: b3b2f22e91fc2e1f9f65a80e5c84bd940487ad1c68270ce53905c1bbeba493c8
Opcode Fuzzy Hash: c9e617bc8591214e1939def13f71f57cd66e431d5fc4e4fb5d9166c6a44be134
Instruction Fuzzy Hash: 2B21F571544304EFDB05DFA8D9C0F26BB65FB84324F20C66DD9498B296C33AE506CA61

Function 018DD005 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2251990967.00000000018DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_18dd000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9782ce7225c9b07b2ecf72b53d826cf28ca06afb2116f24b7cab96769f66908a
Instruction ID: 4d46b0f7f5d7a903aed7fe8bbb7d856a5783fda58e0f973b7bff2ad5a6900ba7
Opcode Fuzzy Hash: 9782ce7225c9b07b2ecf72b53d826cf28ca06afb2116f24b7cab96769f66908a
Instruction Fuzzy Hash: 852192755093808FDB13CF24D994715BF71EB86314F28C6EAD8498B697C33A990ACB62

Function 0152D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2251778198.000000000152D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0152D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_152d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 538a559834a934c5bb17b323b53a39b72e00cc3493ca1f1d13152e584d72ad9d
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 0511CD72404280CFDB02CF44D9C4B5ABF71FB85224F24C6A9D9090E256C33AE45ACBA2

Function 0152D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2251778198.000000000152D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0152D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_152d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 5e7c947b789f4abf4bb0875ece9c5569367ed5d9d5f04f124d811fdd439567c3
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 0E11DF72504280CFDB02CF54D5C4B1ABF71FB88314F24C6A9D9490F256C33AD45ACBA2

Function 018DD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2251990967.00000000018DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_18dd000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: f855903380dc9efda51c3d48d48727fd75ef4b0f37fb1f9550f79d102a57d17b
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: E511BB75504380DFDB02CF54C5C4B15BFB2FB84324F24C6A9D8498B696C33AE40ACB62

Function 0152D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2251778198.000000000152D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0152D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_152d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddc6cde7cee5787b4751237f87533eae5780a80bfb8d641300ea79123db4781c
Instruction ID: b46c19e20ae32b588096f4589993f32c5459183f91b6f25d7551cba48a0b4da4
Opcode Fuzzy Hash: ddc6cde7cee5787b4751237f87533eae5780a80bfb8d641300ea79123db4781c
Instruction Fuzzy Hash: B701AC7200439499E7105E59CD84B56BFECFF47324F1CC929ED194E2C6D27D9841C6B1

Function 0152D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2251778198.000000000152D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0152D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_152d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dddb18738c0cbb547aab9a045b1a32fe0cbe960340754c419dc0bbc09e1ae350
Instruction ID: e6cb633ea7c2be30c3367376557319a69f242c1de5d2e906049bf21c127296a0
Opcode Fuzzy Hash: dddb18738c0cbb547aab9a045b1a32fe0cbe960340754c419dc0bbc09e1ae350
Instruction Fuzzy Hash: 9AF062724043949EE7118E1ADC88B66FFA8EF86734F18C45AED485E287C27D9844CAB1

Analysis Process: sgxIb.exePID: 2800, Parent PID: 6192COMMON

Execution Graph

Execution Coverage:	13.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	20
Total number of Limit Nodes:	5

Executed Functions

Function 06DB3580 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06DB3C56
$]q, xrefs: 06DB3C62
$]q, xrefs: 06DB3CA3
$]q, xrefs: 06DB3CAF
$]q, xrefs: 06DB3C8B
$]q, xrefs: 06DB3C7F

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 0f9051b27e9fe6f5cf747e168241653c85d0d1741c2f659c2069e0fae6a0690f
Instruction ID: a0cb42778cab96ea663eb3140c54dbed0df14f694576a64e0a9f6e3ebb2bcef8
Opcode Fuzzy Hash: 0f9051b27e9fe6f5cf747e168241653c85d0d1741c2f659c2069e0fae6a0690f
Instruction Fuzzy Hash: 7C324D30E1061ACFCB15DF79D89459DB7B2FFC9300F21966AD40AA7264EB34AD85CB90

Function 06DB7E98 Relevance: 3.0, Strings: 2, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06DB8433
$]q, xrefs: 06DB843F

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 75c1fbac4f4055dfe40295882213cf7e89c4bd09ec948b66617754cf7db21007
Instruction ID: 2b2da2eabd9b0f2d15dae1f3cfc3cfe798cda55421bf6df6feab3cc52dd0eff7
Opcode Fuzzy Hash: 75c1fbac4f4055dfe40295882213cf7e89c4bd09ec948b66617754cf7db21007
Instruction Fuzzy Hash: 59027C30B002169FDB54DF69D990AAEB7B6FF84314F148529D406EB399DB39EC42CB81

Function 06DB56B0 Relevance: 1.8, Strings: 1, Instructions: 588
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06DB5A03

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: b7be07db9fc3f4d9a2fb1c55df0b2097e00472b6d22e9a4da36f13fe986b5ac2
Instruction ID: 8b1b7dcce9d837c2fa0f27ccd1f2c94f4c6c5c54485a9dd257ea4c21b7ac9b30
Opcode Fuzzy Hash: b7be07db9fc3f4d9a2fb1c55df0b2097e00472b6d22e9a4da36f13fe986b5ac2
Instruction Fuzzy Hash: 7122A275F00215CFDF64DFA8E4806EEBBB2EB84314F208569D54AAB358DA35DC42CB91

Function 06DB6708 Relevance: .8, Instructions: 815COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bf3108f10e9b2a518478fe5a86796050b1820af59cc57d7e5ae1656b77781af
Instruction ID: 7804c73d834224600d0e9cc67592e8823a8d55ce4980aeb32816150ca94a06c1
Opcode Fuzzy Hash: 7bf3108f10e9b2a518478fe5a86796050b1820af59cc57d7e5ae1656b77781af
Instruction Fuzzy Hash: F5629B34B00205CFDB54DB68D594AADB7F2EF88314F249569E406EB398DB39EC46CB90

Function 06DBADE8 Relevance: 10.4, Strings: 8, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06DBAF15
$]q, xrefs: 06DBAF09
$]q, xrefs: 06DBAF68
$]q, xrefs: 06DBAFB4
$]q, xrefs: 06DBAF97
$]q, xrefs: 06DBAF5C
$]q, xrefs: 06DBAF8B
$]q, xrefs: 06DBAFC0

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 4d43e8d65736ede97ef34cf73f8c311e233264e20945f5af14dff7552af68702
Instruction ID: 5e798bbebb7284d34191cea361dfa3babff912d9057154f5f324c81c8c9d3e5a
Opcode Fuzzy Hash: 4d43e8d65736ede97ef34cf73f8c311e233264e20945f5af14dff7552af68702
Instruction Fuzzy Hash: BEE14A30E10209CFDB69DF69D5806AEB7B6EF89304F14952AE406AB358DB34DC46CB91

Function 06DB9268 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06DB931F
$]q, xrefs: 06DB92E4
$]q, xrefs: 06DB9313
$]q, xrefs: 06DB92D8

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 08a67ba72c7f47c2887ea286151a314a7e48c04b0b6e3d4f0644eb7733baea33
Instruction ID: 7529c67c4964d54fc14326fc7afc0b5c5eb66d9aff8882f9393057a92a0864ab
Opcode Fuzzy Hash: 08a67ba72c7f47c2887ea286151a314a7e48c04b0b6e3d4f0644eb7733baea33
Instruction Fuzzy Hash: 01915030F0061A9FDB54DF69D9A07AE73F6FF85204F108569D50AEB388EA349C46CB91

Function 06DBD070 Relevance: 4.5, Strings: 3, Instructions: 799
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06DBD467
$]q, xrefs: 06DBD46F
$]q, xrefs: 06DBD47B

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q
API String ID: 0-182748909
Opcode ID: 689ebf02370d0ce47ffe8f492c3de1aa88f0fe6b14551a0db7c7b0f2c18ffad1
Instruction ID: 0313f41ebdda6c83d8e8b8fb68846b38e574ef4158e0135d3d697ba2aaff20a1
Opcode Fuzzy Hash: 689ebf02370d0ce47ffe8f492c3de1aa88f0fe6b14551a0db7c7b0f2c18ffad1
Instruction Fuzzy Hash: 63622F746006068FCB55EF68D680A9EB7F6FF84304B208A79D0069F359DB79ED46CB81

Function 07492148 Relevance: 4.1, Strings: 3, Instructions: 348
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(aq, xrefs: 074922C2
(aq, xrefs: 0749247F
(aq, xrefs: 074922ED

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID: (aq$(aq$(aq
API String ID: 0-2593664646
Opcode ID: f5d9d1ce10c79236d7ed5a08a41c9d133e10e95a80eae8a8f39f0997761a0d80
Instruction ID: 9e73e50ca59f22e1a8bf16cf460304d1c2c40b49f2fd636f944f4259e902dbc2
Opcode Fuzzy Hash: f5d9d1ce10c79236d7ed5a08a41c9d133e10e95a80eae8a8f39f0997761a0d80
Instruction Fuzzy Hash: 0CD17AB0E0021A9FCF14DFA9C8546EEBFF2BF89310F14856AD405AB391DB74A941CB91

Function 06DB4C80 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Obq, xrefs: 06DB4E5B
fbq, xrefs: 06DB4CAB
XPbq, xrefs: 06DB4DD1

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID: fbq$XPbq$\Obq
API String ID: 0-4057264190
Opcode ID: d41a5abe63b63fffe522f26bb7e0c596fb2f555bdf49d4b5f30ade2835423c91
Instruction ID: e18135eed4a39f04c61e8683eb81ccbda789e00609326db699ba188d879df3fa
Opcode Fuzzy Hash: d41a5abe63b63fffe522f26bb7e0c596fb2f555bdf49d4b5f30ade2835423c91
Instruction Fuzzy Hash: 6561A030F00219DFEB54DFA9C8547AEBBF6FB88704F208429E106AB395DB759C018B91

Function 06DB925A Relevance: 2.7, Strings: 2, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06DB9313
$]q, xrefs: 06DB92D8

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: d05b506c47107a1655a2d87c4ce6922e547fc00e42e81454a5eb7df87076e1a6
Instruction ID: 55d7cd3b0bf44a3ea26fdf2bcfd36e1645edfdc27939a2a2c3c85055f441ef98
Opcode Fuzzy Hash: d05b506c47107a1655a2d87c4ce6922e547fc00e42e81454a5eb7df87076e1a6
Instruction Fuzzy Hash: D0514131F006059FDB54DB68D9A0BAE77F6FB89204F108529D51AEB398DA34DC06CB91

Function 06DB4C71 Relevance: 2.6, Strings: 2, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fbq, xrefs: 06DB4CAB
XPbq, xrefs: 06DB4DD1

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID: fbq$XPbq
API String ID: 0-2292610095
Opcode ID: 31cf2cf762915c71265535374229ea74e6b90b4cbf6fffb0aba95144800d1fd7
Instruction ID: 1ff7be1c4ebc6f8b628b5dee40b8e708a7b1aeae041db0cf1dd16d31dc068fd0
Opcode Fuzzy Hash: 31cf2cf762915c71265535374229ea74e6b90b4cbf6fffb0aba95144800d1fd7
Instruction Fuzzy Hash: 05519130F002199FEB54DFA9C8557AEBBF6FF88704F208529D106AB395DA759C01CB91

Function 013CED80 Relevance: 1.6, APIs: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.4491320890.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_13c0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c0460011847ce53ebb9f03ae14bf3b496c36a1864dba0be97d16d7fe006b2b8
Instruction ID: 73b78a91cd3094c7c28813aeaa240dcea337e319bb1b58382da6d631f7e20b72
Opcode Fuzzy Hash: 0c0460011847ce53ebb9f03ae14bf3b496c36a1864dba0be97d16d7fe006b2b8
Instruction Fuzzy Hash: D3412372D043598FCB04DFB9D8042DEBFF1EF89210F15866AD408A7641DB74A845CBE1

Function 013CEE58 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 013CEEBF

Memory Dump Source

Source File: 00000008.00000002.4491320890.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_13c0000_sgxIb.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: df97b97f56a1947a45b6d447cf888032eca11de0e74e85b0734a92bc664a51e7
Instruction ID: a8162e2e88d7eefd5c3ba279c4959e0c2cf493649e21f990b6f629e7ce5f7a12
Opcode Fuzzy Hash: df97b97f56a1947a45b6d447cf888032eca11de0e74e85b0734a92bc664a51e7
Instruction Fuzzy Hash: F9111FB1C006599BCB10DFAAC444B9EFBF8AF48320F10812AD818A7240D778A944CFA5

Function 013CEE50 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 013CEEBF

Memory Dump Source

Source File: 00000008.00000002.4491320890.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_13c0000_sgxIb.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 358bc4fa9d155d462431bd24e47bc1baeedc44821cee0eed79191dfe7bbda8b7
Instruction ID: e9333308a1460261bad71f01548edc6bd7d8b6899823fc16cac7b9eb686112f4
Opcode Fuzzy Hash: 358bc4fa9d155d462431bd24e47bc1baeedc44821cee0eed79191dfe7bbda8b7
Instruction Fuzzy Hash: 3B1120B5C0065A9BCB10DFAAC4447AEFBF5BF08724F10852AD818B7241D378A944CFE5

Function 06DBDBF8 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06DBDD41

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 97509d9bfd1070bfe4d1dc7776f0775943302baa0bfea3147d8ba5fa659cdc9c
Instruction ID: 17ea9a83d7cab74ffe7ebc9f9160951bddcd40ade492e5cd750c6344fe1a225d
Opcode Fuzzy Hash: 97509d9bfd1070bfe4d1dc7776f0775943302baa0bfea3147d8ba5fa659cdc9c
Instruction Fuzzy Hash: C1418070E0060ADFDB64DF65D45469EBBB6FF85304F208529E406E7248DBB4E94ACB81

Function 06DBDBE5 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06DBDD41

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 48c8697ed61733b4c4d8fd22aca222fcd75ea8c3ae4da15dfbe3e2d1a389c979
Instruction ID: 249daf428554d229caf8453660793e7d52e8c2c95c8dbd9e45636a89d083f4bc
Opcode Fuzzy Hash: 48c8697ed61733b4c4d8fd22aca222fcd75ea8c3ae4da15dfbe3e2d1a389c979
Instruction Fuzzy Hash: 8541A130E00705DFDB649F65D45469EBBB6FF89300F109529E446EB248DBB4E80ACB41

Function 06DB21BD Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06DB230B

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 9dc50d901749e3acf2521e71d1489dc74b1c8d9418c5e52e2b1d73f79f3c6e0a
Instruction ID: d3662fe09c4c2c1690f6960ed44d9bced6c7eb10340d1f9807e7e4692edb6a13
Opcode Fuzzy Hash: 9dc50d901749e3acf2521e71d1489dc74b1c8d9418c5e52e2b1d73f79f3c6e0a
Instruction Fuzzy Hash: 7D31FE31B10202DFDB699B74D554AAE3BE6AF89304F108538D007DB399DE39DE06CBA1

Function 06DB21D0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06DB230B

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 3b01559a21e341abafcd8c5f8bb5e1d6c33df746af51b02bf0d2aba5422b8647
Instruction ID: 9b63a73dad13351b8abef26036368773a886934f57a994c622544dceeabc0522
Opcode Fuzzy Hash: 3b01559a21e341abafcd8c5f8bb5e1d6c33df746af51b02bf0d2aba5422b8647
Instruction Fuzzy Hash: DA31DE31B10201DFDB689B74D5546AE3BE6AFC9304F108438D406DB398DE39DE06CBA5

Function 06DB83E8 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

$]q, xrefs: 06DB8433

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: 832e0f9f8250fd6e58696968b108f9ceb5aa152f8bbdfc98e3dbf83c5bcf850c
Instruction ID: 22381482dc8a90d0101543fdaf4a12992909f838f71a6ba91741ccb4e2a5f566
Opcode Fuzzy Hash: 832e0f9f8250fd6e58696968b108f9ceb5aa152f8bbdfc98e3dbf83c5bcf850c
Instruction Fuzzy Hash: A9F0DC31B00105CFDF688F58EA806E877AEEB88204F045576C906DB258CB2AD906EB91

Function 06DB4B69 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

\Obq, xrefs: 06DB4B75

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID: \Obq
API String ID: 0-2878401908
Opcode ID: 78b42e9a0c582b4f3cfc1dd8df0dfc775710c4104086915f2ab3fa541886f6ba
Instruction ID: 20a9aaecdd5d81ea54902cb4ebf29865fed0b0213716b9def3547250f716dc08
Opcode Fuzzy Hash: 78b42e9a0c582b4f3cfc1dd8df0dfc775710c4104086915f2ab3fa541886f6ba
Instruction Fuzzy Hash: D0F0DA31A60129DBDB24DF95E959BAEBBF2FF88705F204519E102A7298CBB05C01CF80

Function 06DBC2B0 Relevance: .6, Instructions: 634COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc3f07024db1114611d8b9169478f55b9a3ec46ef4cdc43ffa6708579ec59a1d
Instruction ID: 97b496c56d3c76c2e49ddda2ec595b2ffcc80a395525d95e2c3db744e5cbdf63
Opcode Fuzzy Hash: fc3f07024db1114611d8b9169478f55b9a3ec46ef4cdc43ffa6708579ec59a1d
Instruction Fuzzy Hash: 62326D34B10209CFDB54DF68D990AAEB7B6FB88314F109529E406E7359DB39EC42CB91

Function 06DBB3E7 Relevance: .6, Instructions: 558COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8e8dc2c75fc1bbfb85c078c010c78601ec0494e978825832ac9bf2d09dfc6bf
Instruction ID: 75112894dde0f2cfb38710bc64f880420eab3fd9002f3213b65a75c8cfade283
Opcode Fuzzy Hash: f8e8dc2c75fc1bbfb85c078c010c78601ec0494e978825832ac9bf2d09dfc6bf
Instruction Fuzzy Hash: FF224D34E10209CFDF64CF68D584BADB7B5EB89314F209426E406EB399DA38DC81CB51

Function 06DB6308 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff7488a813515bed176d23f1c50e854dd0f432cef7603ac4a3106d4c0ff4cf3b
Instruction ID: 75c6c19d7c39f10d9c17489ad501ff55d67d4b0d61c0bb1735fca09d6c57773e
Opcode Fuzzy Hash: ff7488a813515bed176d23f1c50e854dd0f432cef7603ac4a3106d4c0ff4cf3b
Instruction Fuzzy Hash: F861C171F001118FDB149B6EC8806AFBADBAFD4224B284479D80FDB364DE69ED0287D1

Function 06DB43B9 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bcf3fdcb349692a866fff205201dcee29c420d8143b6dd6e859f5a4b5bbc5b9
Instruction ID: 460b9e00960b3a277041e096ebfaca2e805008684047912d68d9be0fe668c2c1
Opcode Fuzzy Hash: 2bcf3fdcb349692a866fff205201dcee29c420d8143b6dd6e859f5a4b5bbc5b9
Instruction Fuzzy Hash: E5813E30B0060A9FDF44DFA9D5546AEB7F2EB89304F108528D40AEB399DF75DC468B91

Function 06DB43C8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17b353d87fd263b09d57c23ab310b99507208dae8b8992b00760a9f21196e4d7
Instruction ID: 5b73aa6435084f2d4d0d303a8178c2839b68f4944b5c2f163d31485fbd06b148
Opcode Fuzzy Hash: 17b353d87fd263b09d57c23ab310b99507208dae8b8992b00760a9f21196e4d7
Instruction Fuzzy Hash: F9813D30B0060A9BDB44DFA9D5546AEB7F2EF89304F108528D40AEB399DF75DC468B92

Function 06DB46D4 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd1ae63de5455d227015eb26e37a41775b8e7f1d2957d0de610b943175bd22de
Instruction ID: 9f72a895981b5b43d047545f4dea60450e6e9182ac489c8f4be2fedfd5daf652
Opcode Fuzzy Hash: bd1ae63de5455d227015eb26e37a41775b8e7f1d2957d0de610b943175bd22de
Instruction Fuzzy Hash: 17915D34E10219CBDF60CF68C890BDDB7B1FF89304F208599D549AB259DB70AA86CF91

Function 06DB46E8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98192ebbda21603dc3063a9f91e3ec6827f0ff6f1eb6cccdf315a7e6d80a6c4e
Instruction ID: fb0ccc81e635db3415225e51bbe886ad1efd4a6c4a5b483d9f42948af3d900ff
Opcode Fuzzy Hash: 98192ebbda21603dc3063a9f91e3ec6827f0ff6f1eb6cccdf315a7e6d80a6c4e
Instruction Fuzzy Hash: A2915E30E1021ACBDF60DF68C890BDDB7B1FF89304F208599D549AB255DB70AA86CF91

Function 06DBF048 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 271ad4f8127fdbbf711a0c0a01137631295779b557f439a536711ac404031bd6
Instruction ID: d35f69b93fe9436180ef8a705930ddcbeb97daf5385243c0f083fcc5d4e34a02
Opcode Fuzzy Hash: 271ad4f8127fdbbf711a0c0a01137631295779b557f439a536711ac404031bd6
Instruction Fuzzy Hash: E2711874A00209DFDB54DFA9D980A9DBBF6FF88304F249429D406EB269DB34EC46CB50

Function 06DBF039 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18f028dd0ce1458c6886e1f10fb64daa167b2b9dafd82e0893829eb4d2018535
Instruction ID: c7256d8f2d572d5db76c741f06e73e83053906851f763cb2052e44b6b6ea7c0f
Opcode Fuzzy Hash: 18f028dd0ce1458c6886e1f10fb64daa167b2b9dafd82e0893829eb4d2018535
Instruction Fuzzy Hash: F1712874A00209DFDB58DFA9D980A9DB7F6FF84304F249529D406EB268DB34EC46CB50

Function 06DBFA78 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27b198abe6bd9536545a60f97e6dd59cb0fdda81009c5df8eb705faebedc4a1e
Instruction ID: c7d0c8fad63b7a6f130f32531ab448954360631262c52c6e48f7e8d56a066ea4
Opcode Fuzzy Hash: 27b198abe6bd9536545a60f97e6dd59cb0fdda81009c5df8eb705faebedc4a1e
Instruction Fuzzy Hash: 4F51B6B4B102049BEFA45B7DDD947AF2A5ED7C9710F20583AE80BD3399C92CCC4587A6

Function 06DBFCD8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 920bd2310c437cef543db6096feca85a9c135cb8247e7aa42a699b0a39f3658a
Instruction ID: c5eaeb7b5cbe977ba1eb85c844ff385bbd2d7d23fcfaee61bd21a309c53f0d5d
Opcode Fuzzy Hash: 920bd2310c437cef543db6096feca85a9c135cb8247e7aa42a699b0a39f3658a
Instruction Fuzzy Hash: 3651EE31E00105DFDF64AB78E8456EEBBB2FF88315F108879E10AE7259DB358845CB81

Function 06DBFA88 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5070db5653d7a7b66d3311ff87db68d908795d9936db297f51105d1687baed00
Instruction ID: fc1928c1ed49eed70ababdbce2ffb6a2fee8b7c6a8af300613771e4ad7b2c42e
Opcode Fuzzy Hash: 5070db5653d7a7b66d3311ff87db68d908795d9936db297f51105d1687baed00
Instruction Fuzzy Hash: 2C51B4B4B102058BEFA45B7DED9476F265EDBC9710F20583AE80BD3399C92CCC458796

Function 06DB5538 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e256384ef79bc3699122cf7a290cfeb14ab17116a8699fe91466fe1109f3f52f
Instruction ID: a5e3197401b1bc3487b131faada2869b6c0e28f907ad4be8eaba20dfdc80b8dd
Opcode Fuzzy Hash: e256384ef79bc3699122cf7a290cfeb14ab17116a8699fe91466fe1109f3f52f
Instruction Fuzzy Hash: B9413A71E00609CFDF60CFA9E8C0AAFFBF6EB84210F10592AD256D7644D731E8458B91

Function 07492139 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1a02b91633fadd9693577be5dae99860be928d774f192ee0d7baf0381b42868
Instruction ID: c6eefdffe07c03612e1079b975e5bce2b632250c7a7936cb8662baa3ab0d34cb
Opcode Fuzzy Hash: f1a02b91633fadd9693577be5dae99860be928d774f192ee0d7baf0381b42868
Instruction Fuzzy Hash: C64151B191070ADFCF14DFA5C8446DDBBB1FF89310F14C66AD4456B264EB70A981CB91

Function 06DBDA98 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d67cd684877dc0fa357458d3b3c2deba6a1b0983295afcb34737a2f2fa9f79c4
Instruction ID: 61ac9a6b9b3f1689d911198e2a98d7e08363693bdc47cb5b6cc0fab4949fab4d
Opcode Fuzzy Hash: d67cd684877dc0fa357458d3b3c2deba6a1b0983295afcb34737a2f2fa9f79c4
Instruction Fuzzy Hash: C931C430E1060ADFDB64DF68D580ADEBBB6FF85304F148539D406AB218DB74E946CB81

Function 06DB2080 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56421abcada6f8c4ed9b9308e357549bc4c7254268428d41702514d8c7e06e37
Instruction ID: 5400dfc4f9d7dbcedd0ecf8dec5a06c380d4daedbed960b2c8b5287f8d64fbb0
Opcode Fuzzy Hash: 56421abcada6f8c4ed9b9308e357549bc4c7254268428d41702514d8c7e06e37
Instruction Fuzzy Hash: 5A31CD31E10206DBCB09CF68D8946EEB7B2EF89300F108929E946EB344DB70A902CB50

Function 06DB2090 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b64b536768ca272579adc68848b29565537a1ee7c05805cdd33741c32e9bab0c
Instruction ID: ecce24a5fb0b867373e67cdeda452f61a7a2e482df065a8e5891af4c536d5674
Opcode Fuzzy Hash: b64b536768ca272579adc68848b29565537a1ee7c05805cdd33741c32e9bab0c
Instruction Fuzzy Hash: 34319C31E1020ADBDB49CF65D8956AEB7B2FF89300F108929E906EB354DB71AD46CB50

Function 07490C30 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef0023cb3dead59ff3aa2f4b66bb7b39d621fc3f4caf451e065385c5158599b6
Instruction ID: 8a0effa570b64996e42dc6db804d9add20b6cabd2b0cab464494cb881a4b6ece
Opcode Fuzzy Hash: ef0023cb3dead59ff3aa2f4b66bb7b39d621fc3f4caf451e065385c5158599b6
Instruction Fuzzy Hash: B2315EB0A016079FCB14DF6AC584AABBBF6FF88710B14C56AD419DB714E734E841CB90

Function 07491B3A Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01dd6cb3cef7cc6d9a7ce342274bd665a9225bc23b7239cb27ffbcd30a26cccd
Instruction ID: 8fb53d94e5ddd0be69317e04c150c25dd1b27849e8d45f1cae3e5f7cbd0623a0
Opcode Fuzzy Hash: 01dd6cb3cef7cc6d9a7ce342274bd665a9225bc23b7239cb27ffbcd30a26cccd
Instruction Fuzzy Hash: 6E3164B0A016079FCB14DF6AC584AABBBF6FF88710B14C56DD4199B714E734E842CB90

Function 07492990 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7f027419a1b47a4caa3952cc6a8b5399cdcd6ebbfe0db3fded488fd11bba952
Instruction ID: 56439371397de3352af0440b1b6271ba4fe46fb2e1553e01e0deda8c225da596
Opcode Fuzzy Hash: e7f027419a1b47a4caa3952cc6a8b5399cdcd6ebbfe0db3fded488fd11bba952
Instruction Fuzzy Hash: 3021A0B47002068FCB05DB78E954A6E7BBAEFC9304F204479E509E3396DA389C06C792

Function 07491998 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd72f67f2477188cc192774b3a012ec25d101619bff74b7ced41cbf827d7285a
Instruction ID: 9873f21949b44cc49c338721536f6e0a8f9394b3b4e94d9d3a1c1502aed94263
Opcode Fuzzy Hash: cd72f67f2477188cc192774b3a012ec25d101619bff74b7ced41cbf827d7285a
Instruction Fuzzy Hash: 04315AB4A0024ADFCF05CFA9D844ADEBFF2FF89300F1484AAE414AB261D7359950CB50

Function 06DB3FC1 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab146aaa76e083ea106e3ae4fc9f2314f762da0a578aa918a1089fe760c55715
Instruction ID: 08f3b7fb6c41b0943f88c3101571e98c744bf0fb043680f5be241f79aac042e2
Opcode Fuzzy Hash: ab146aaa76e083ea106e3ae4fc9f2314f762da0a578aa918a1089fe760c55715
Instruction Fuzzy Hash: 22216B75F002159FDB50CFA9E981AEEBBF5EB88710F108025E945E7385E639DD01CB91

Function 06DB3FD0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f46db2fde322493b0d00fa5e6370dd72c7c5080aeae3cf5f256a4b8db73ee0bc
Instruction ID: 289ad011edfebdb1604d28fa8a18e66f60f01767c88ae830bb2f9a36651aabfe
Opcode Fuzzy Hash: f46db2fde322493b0d00fa5e6370dd72c7c5080aeae3cf5f256a4b8db73ee0bc
Instruction Fuzzy Hash: AE212A75F006159FDB50CF69E980AEEB7F5EB88710F10802AE905E7385E639DD01CB91

Function 074929A0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f17ff806b1b4dc9f26435aeddf14098c65e79111b73335ef2117c21992138e5
Instruction ID: 1ec49e57444fa14156f899b022df7ce5c8918ad8008f1494d4f3cd742e845e72
Opcode Fuzzy Hash: 0f17ff806b1b4dc9f26435aeddf14098c65e79111b73335ef2117c21992138e5
Instruction Fuzzy Hash: 4F21AFB47002069FCB04DB78E944A6F7BAAEBC8350F204439E509E3355DA399C02C792

Function 074924BC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba5c0a1a4cecfc9452a920c626159bc41bca0e4022c4e70343fc6ee006c6435b
Instruction ID: aa9ad96d8c55b85121b1de8c07c5a63dfc567ab6443d6f2f79d520efb5660d7e
Opcode Fuzzy Hash: ba5c0a1a4cecfc9452a920c626159bc41bca0e4022c4e70343fc6ee006c6435b
Instruction Fuzzy Hash: 6F31E2B0D01259EFDB10DFA9C958BDEBFB5BB49310F24802AE404AB340C7B59845CFA0

Function 0135D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490962178.000000000135D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0135D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_135d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 719f43bce3025c986150eca1db5c694e0cfcceb2a873a2f93702fe998db5cc96
Instruction ID: b53ca17aa857f660ddf573431a7867472259ad3a78558cf7f41827b2137b5170
Opcode Fuzzy Hash: 719f43bce3025c986150eca1db5c694e0cfcceb2a873a2f93702fe998db5cc96
Instruction Fuzzy Hash: 512122B1504204DFDB55DF98D980F26BBA9FB84718F20C56DDD0A4B356C33AD447CA62

Function 0135D1F8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490962178.000000000135D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0135D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_135d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46fb1211fb7cc12384baa73bb8406411574c40d426a456e93b011c5ee8a26273
Instruction ID: 074d4a9321f17f0bcbb3dde0915b29ccbeb8e6461db707b80007c9fbb024af56
Opcode Fuzzy Hash: 46fb1211fb7cc12384baa73bb8406411574c40d426a456e93b011c5ee8a26273
Instruction Fuzzy Hash: 98214671504204DFDB51CF98D980F26BB69FB84728F20C569EC090B346C37AD446CAA2

Function 0135D3A8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490962178.000000000135D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0135D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_135d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37bf46bb157bedee1f4d02c8f658c19d94989c36f12ce3632e02d9cb5d95149e
Instruction ID: fa683561f4747c6bcdece4f7be1e5a70f762417df84c8a73b5f33bf7fa43987d
Opcode Fuzzy Hash: 37bf46bb157bedee1f4d02c8f658c19d94989c36f12ce3632e02d9cb5d95149e
Instruction Fuzzy Hash: 802100B1600244DFCB45DFA8D580F26BF69EB88718F20C56DDD094B256C73AE846CA62

Function 06DBB038 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 979c5bb4ed51d19bd46f37ca040383cc9dcee1d385c289e30fd9e9ae653f2df3
Instruction ID: 126ce6db9c2be996c5b48e025fc3aaaf1ab5ffe2f581daa1d91f4ccacb2f0505
Opcode Fuzzy Hash: 979c5bb4ed51d19bd46f37ca040383cc9dcee1d385c289e30fd9e9ae653f2df3
Instruction Fuzzy Hash: 10216071D10719CBDF64CFAAC8406DEBBB5FF85300F10452AD446EB244DB709845CB81

Function 07491E44 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fd4c4ce569642d07fb9d5540f767c397ba7082d1c71a02418187e95c6f60010
Instruction ID: 9ac40c8c1926a6026aff726821cdd98ba06bde3ec8965db7d66547ee1ab8d6a3
Opcode Fuzzy Hash: 0fd4c4ce569642d07fb9d5540f767c397ba7082d1c71a02418187e95c6f60010
Instruction Fuzzy Hash: ED31C1B0C11218EFDB24DF99C598BDEBFB5BB48710F24842AE408AB350C7B59845CBA5

Function 07490770 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3245f441559c44c5794f1c0c3e1e62f9bc5957b06df08823bb8ee1e608bc0dc
Instruction ID: f64e569178e9942a212637aa9ee2e6a4c0b6478a2caefd9769e2998d5dfde7f4
Opcode Fuzzy Hash: a3245f441559c44c5794f1c0c3e1e62f9bc5957b06df08823bb8ee1e608bc0dc
Instruction Fuzzy Hash: 0A1103712013128FC718AF78D48456ABBF6FF863547208A7EC00A8B754DB36ED46CB90

Function 0135D006 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490962178.000000000135D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0135D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_135d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45f3dca8d9064f2bffede2b27c9342308f1f898f7885b803cc9512b578fb54b5
Instruction ID: 62e0d62d6da3c157da70380c02bc18ba7a6fbf6deb20298bae24f5925516cd25
Opcode Fuzzy Hash: 45f3dca8d9064f2bffede2b27c9342308f1f898f7885b803cc9512b578fb54b5
Instruction Fuzzy Hash: AD217F755093C08FD707CB64D990B11BF71AB46214F29C5EBD8898F2A7C23A984ACB62

Function 06DB3518 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bf3408c1c4d0c17df796ab427a3f397f3c4c809e1b64a873bc37911da882721
Instruction ID: 98a1db9b3b8610ddd865945eb69a7d178a864a4fc91da929191687b081bee70e
Opcode Fuzzy Hash: 0bf3408c1c4d0c17df796ab427a3f397f3c4c809e1b64a873bc37911da882721
Instruction Fuzzy Hash: 1A11BFB1E00224CACB94DBA8DC411EEF7B5EB88310F0595AAD406E7308EA30D941CBE5

Function 06DB40E0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d309a3745960909407e6eba938de858a354c0fa9faff3c0dd2479bd19832e0f
Instruction ID: fe461d17ac08512ece9befa815a872814c2fd58063c4fe4d3ea59735a40e9248
Opcode Fuzzy Hash: 6d309a3745960909407e6eba938de858a354c0fa9faff3c0dd2479bd19832e0f
Instruction Fuzzy Hash: F7117C32F101259BDB54DA68D8146EF73FAEBC8255B058539D40AE7348EE29DC028BD1

Function 07490780 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 820c431aa2483563c79a33fad390242fe8cbfada10673689de32679d648d13ad
Instruction ID: 1e6ef9f6c8ee64a32c5d64831cf93cf5d5670452f285c76ff65a27bd6c95bee7
Opcode Fuzzy Hash: 820c431aa2483563c79a33fad390242fe8cbfada10673689de32679d648d13ad
Instruction Fuzzy Hash: BB116D702013168FD728AF69D49465AB7EAFF85354B20893DC11A8B754DB36AC05CB90

Function 06DBF2B8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f5c6c3ff5d8082d435705352ff6b96f9a144e5debfc356f2f33eec78f7f3c86
Instruction ID: a6cae6def8229d085afba0890c55a24db311e864793426c40f0a2e02e5dfc4df
Opcode Fuzzy Hash: 9f5c6c3ff5d8082d435705352ff6b96f9a144e5debfc356f2f33eec78f7f3c86
Instruction Fuzzy Hash: 0C01B139B041504FCB66977DA8547AE7BE6DBC6624B10847AE00BCB354EA15DD034392

Function 06DB4318 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1082a3e5acf4bd6f9e483a41c31eadbde1612e0db4f68d2f4dfaa8772b6083d6
Instruction ID: 9d5849b27ac2c94e392e58aebd662a6c7ab5db38ee1a0d4df7b5f665451a16f9
Opcode Fuzzy Hash: 1082a3e5acf4bd6f9e483a41c31eadbde1612e0db4f68d2f4dfaa8772b6083d6
Instruction Fuzzy Hash: 3B01F135B100100BDB68D66DD811B6FA7DADBC6224F288539E04FC339ADA25DC028391

Function 06DB3570 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67c7ce5c69b99f229858f80acf96a1df93456fbccbd8e0c6d948e9e061ef04f3
Instruction ID: 86e5a29a425606a6f5f57bc29e86ecae2996339a23e6664d78dd463805158e24
Opcode Fuzzy Hash: 67c7ce5c69b99f229858f80acf96a1df93456fbccbd8e0c6d948e9e061ef04f3
Instruction Fuzzy Hash: D911C2B1E00224CFCB54DBB8D8411DEF7F5EB88310F15956AD446E7304EA30DA41DBA1

Function 06DB316C Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d95a0fce006a5c1c329bec52fcf4c5e5d0f4d622bc0775b77bcac52650175487
Instruction ID: 83d9474e8cc65b888362ec16a310f7c282f9f7362b44c3c84719173284e82248
Opcode Fuzzy Hash: d95a0fce006a5c1c329bec52fcf4c5e5d0f4d622bc0775b77bcac52650175487
Instruction Fuzzy Hash: 6021C0B1D01259AFCB40DF9AD884ADEFBB8FB49310F50812AE918B7201C374A954CBE5

Function 074916F1 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 140f25836be53384f622ec9f839e5ba3d3a5f82a2a8db818e7bb694fdfebfb7d
Instruction ID: 284b897c0b2f2c02b5148f26dcfd4fbed8dc725eff0de7ee273e004987d48cfb
Opcode Fuzzy Hash: 140f25836be53384f622ec9f839e5ba3d3a5f82a2a8db818e7bb694fdfebfb7d
Instruction Fuzzy Hash: 7411E0B46143079FC7649B2895885A3BFA6BB96640B0888AFD04287681D736EC42CB91

Function 06DB3D99 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 275fb9b9698828210728b244f0323af4c85ceacec6b5fd3eebbfc96d99daac5c
Instruction ID: 7682c11fa966eea49c1689570a7317f00424df4dd67e7564b36bc2b29475d5a2
Opcode Fuzzy Hash: 275fb9b9698828210728b244f0323af4c85ceacec6b5fd3eebbfc96d99daac5c
Instruction Fuzzy Hash: 7821C2B5D01219AFCB00DF9AD885ADEFBB8FB49310F10812AE918B7300C374A954CBE5

Function 0135D1F3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490962178.000000000135D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0135D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_135d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction ID: 4ff25465de78b893c903169f038edc189c3b660e61ea0b9ef0f2f41c133ef6a9
Opcode Fuzzy Hash: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction Fuzzy Hash: FE119D76504280DFDB12CF54D5C4B15BF71FB84728F24C6AADC494B656C33AD44ACBA2

Function 0135D3A3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490962178.000000000135D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0135D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_135d000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 7e2d213832322dca597b102073d4413ddf99194e919d88458ae50adbbe39d0c1
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 5311BBB5504280CFDB02CF54D5C4B15BFA2FB84718F24C6AADD494B266C33AE44ACB62

Function 06DB4328 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddab542f7ae07d4a9fc9c7d568e3aab8f25cbe714c8240cfba2890ab936e55df
Instruction ID: 1c9f48c51c0be97707269e704237c734496509ee502174767461b8aee49ca8a8
Opcode Fuzzy Hash: ddab542f7ae07d4a9fc9c7d568e3aab8f25cbe714c8240cfba2890ab936e55df
Instruction Fuzzy Hash: 0B01AD31B100204BDB68D66D9414B6FA7DADBCA724F14883AE10FC7359DD65DC024391

Function 06DBF2C8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1188b7f70882272cf0c26b9772f4d2460a214cada41f457e4e57c28b416b1d27
Instruction ID: 1a629a62fd74d61cc6c0dfe925f3e6bd0139d690065836238e5c99a46d484bd2
Opcode Fuzzy Hash: 1188b7f70882272cf0c26b9772f4d2460a214cada41f457e4e57c28b416b1d27
Instruction Fuzzy Hash: 77018C35B000148BDB659B7DE854B6EA2DADBCA628F108839E50FC7358EE65DD034392

Function 06DB40D0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eb1f3d1f0b0fd89488b5e926d26eba43a2b1f5e107119ec42cc26cff5e927e5
Instruction ID: 7d2f132c981171ff869381b0df947927d9337f25dba479a4c7d78fc235bb4cd6
Opcode Fuzzy Hash: 0eb1f3d1f0b0fd89488b5e926d26eba43a2b1f5e107119ec42cc26cff5e927e5
Instruction Fuzzy Hash: 53018F36F140158BDB95DAA8D8142EF72F6ABC8258F06443AD44AE3258EE69CC1647C2

Function 06DBA422 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d807504506ed592b68303c9f3501cd20bea4ca3eb7742a71cb653516be5f8fa8
Instruction ID: d88fe388c71d2095902c750255614b5337755ab978146068878a07dd235503c2
Opcode Fuzzy Hash: d807504506ed592b68303c9f3501cd20bea4ca3eb7742a71cb653516be5f8fa8
Instruction Fuzzy Hash: 6A01FD32B100108FDBA4CA6CE9987AB77D2EB89319F148439E00FD7758DE29DC028780

Function 07490C04 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e735631471320a0284897ccffeedc00754cb01b95390e19fd70e3f98101eaeb
Instruction ID: 7863650da6f13ffdbf36b680cef89bec7dd45e2aff679463ece797aa74aa95a3
Opcode Fuzzy Hash: 1e735631471320a0284897ccffeedc00754cb01b95390e19fd70e3f98101eaeb
Instruction Fuzzy Hash: CB0192F8220707DBC7249B2995845637FE5FB85750F448DAEE41686640CB76EC028B41

Function 06DBA430 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1ce148a6c74b54acd7e8c1f79b17a2b317b42284accd67100e6ef1d5ca5a3bc
Instruction ID: a71699b1bc94411f1301ae2e013c73eea2a599427e049a6b0ede717e8148a878
Opcode Fuzzy Hash: b1ce148a6c74b54acd7e8c1f79b17a2b317b42284accd67100e6ef1d5ca5a3bc
Instruction Fuzzy Hash: D601D131B100108FDB64DA7CE454B5A73D6EBCA719F108439E10FD7354DE29DC028780

Function 06DBC908 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d79e4ea68501a3f888c81b0ceec1f4ef5a4528a946c3be3d861abb084487e454
Instruction ID: 6fdcc91fa9b0a937a5ee4371ed09edff95b3e2858cfd3c6e958adc3d0b1f008a
Opcode Fuzzy Hash: d79e4ea68501a3f888c81b0ceec1f4ef5a4528a946c3be3d861abb084487e454
Instruction Fuzzy Hash: EF01F471B201289BDF289F79E840A9EB77AFB85354F004539E902EB344DB36AC05CBC0

Function 07490934 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81163c829f4c000df6c8bdb3b8220e689d72e4a28ef71176ea57ad415376a6ce
Instruction ID: 401ac5b66f4893e060be8636a65b3e0bcea2c2454d3e19aaab0206d4976d8e01
Opcode Fuzzy Hash: 81163c829f4c000df6c8bdb3b8220e689d72e4a28ef71176ea57ad415376a6ce
Instruction Fuzzy Hash: 33F028B110A3929FCF329B7898006E17FE8EE0720070805AFD084C7B62C7149805C792

Function 07491988 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9d2197f83e74467f18751033bae4bade79b6e9f1d8420b2e98e431ef44ba6f0
Instruction ID: 68fb7a799a014a6f6e530e4131fb57e5abf6c6349db5e56615fdaff9321e6d84
Opcode Fuzzy Hash: c9d2197f83e74467f18751033bae4bade79b6e9f1d8420b2e98e431ef44ba6f0
Instruction Fuzzy Hash: 7701373210528BEFCB02CF28D988C85BFB2EF4630032984E7E0448B526D336E925DB11

Function 0749193A Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fbc750ffb9c3ac402438c06884c23e514f2d261fffd853e3166f677a11e8c18
Instruction ID: 51bca16f9046015ff2f7b6ed90aabb02d183232dfd8f56553495b259c13c4e71
Opcode Fuzzy Hash: 4fbc750ffb9c3ac402438c06884c23e514f2d261fffd853e3166f677a11e8c18
Instruction Fuzzy Hash: 29F06D70D04346AFCB21CFB9D80449AFFF5EF4A20070485ABE495D3201D731A928CB91

Function 07491948 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d78a1af5a778504aaadac72ea18678366abb3981076afa830cb487d50b42934
Instruction ID: 6ffe3efb9499bf1f4461a9c3c1cbc088abadedac5f8d02eda886525954feacf8
Opcode Fuzzy Hash: 0d78a1af5a778504aaadac72ea18678366abb3981076afa830cb487d50b42934
Instruction Fuzzy Hash: 34F030B5E00718AF8F34DFA9D80449AFBF9EF49610B00856AE456D3600D731E914CF90

Function 07490848 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b93c670a321b8d607115172dceead8824e9acab48b605c759d27685f223315e
Instruction ID: e2176ba83b7e516ce934760f59cd80e02c12c4ab8332f4d8f388b6341ee4fd32
Opcode Fuzzy Hash: 9b93c670a321b8d607115172dceead8824e9acab48b605c759d27685f223315e
Instruction Fuzzy Hash: C6E04F727101119B8754EA5FA48496ABB9FFFC95643A580BEE10DC7321DE62EC024690

Function 07490E52 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6205394b8e2021e7c4bdfd18f5552091863044e245a05ec1bf8dc7130a5a0d35
Instruction ID: d1198e740bd0ef0c4f03a8356750f76842a9b4cc652e34055f1def9b8d999038
Opcode Fuzzy Hash: 6205394b8e2021e7c4bdfd18f5552091863044e245a05ec1bf8dc7130a5a0d35
Instruction Fuzzy Hash: E5F01CB824A2428FE301DF70EA5AA513FB2EB86300F104176DA118B395EA7E4C05CF12

Function 074908F8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 600eef07756c42ab5b5749dbe279aa5587b074545b4a1225daeb05747d2ab407
Instruction ID: 354fb8316ad1420f40ae96a938e2fffbcc6b37d16f571dd765bc5fad7fb4d4bf
Opcode Fuzzy Hash: 600eef07756c42ab5b5749dbe279aa5587b074545b4a1225daeb05747d2ab407
Instruction Fuzzy Hash: 3BE0DF756067628FCB329F38A4016DA7FF8AB07610304096FE895C3B52C724EC04CBA2

Function 06DB6588 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d758217144de6c4620f6d7cfbf3a82959bbe8d27d77a003df2dc867954d5f576
Instruction ID: bf263de08ef20ffdbe627dcd9943d646b8ebbb60914aa9816533e28d7ce28264
Opcode Fuzzy Hash: d758217144de6c4620f6d7cfbf3a82959bbe8d27d77a003df2dc867954d5f576
Instruction Fuzzy Hash: 3EE0D8B1D15188DFDF60CB70CA057EA3BA5DB02204F2588E6C849DB24EE135CE128785

Function 07490D38 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d48690a29c381405c3422cd6fa6cd07922790a9f8f87679ad57b66b5dc9592a
Instruction ID: 154bbc399eac417193ea83d6b8ac859c30a2bcfe59af94b589f077e0b67ce937
Opcode Fuzzy Hash: 7d48690a29c381405c3422cd6fa6cd07922790a9f8f87679ad57b66b5dc9592a
Instruction Fuzzy Hash: 92E046B1208742DFC332CF38E4888A37FF4BF1A2203054A8BE481C7A16C720E844CBA1

Function 06DB6598 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fa225661ddbad690980ca199bd9c8a91c65082e2f7e24f673e5af566a448d84
Instruction ID: 70731d577c74114c942558eea89efe43d50da3c88218663e8e40869d84a1c09d
Opcode Fuzzy Hash: 1fa225661ddbad690980ca199bd9c8a91c65082e2f7e24f673e5af566a448d84
Instruction Fuzzy Hash: A0E0C2B1E10248EBDF60CFB0C9057AE73ECD702208F2084A4D40ACB30AE272DA118780

Function 07490E60 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad2633923639b1b0e4bea280515ce1ec3e3f0dbfb93e7a419bf6957d05cec701
Instruction ID: c1e88f9f9a028bbf21e30c06777580f5aec1e869ebeb9c5b959acae1db572718
Opcode Fuzzy Hash: ad2633923639b1b0e4bea280515ce1ec3e3f0dbfb93e7a419bf6957d05cec701
Instruction Fuzzy Hash: 73E09AB86462059FE7049F60FA4AF623BA7E385701F1081369E154B7C0EA7E5902CF12

Function 07490908 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7a01b5a16b8cd1da9349cbb8d1a2f1ea773c4335194607852a57762b4a9a1db
Instruction ID: 9b00c1e4ed8f75a15e228ccaebf824684748f0c5305ef77d0d37a255ab295857
Opcode Fuzzy Hash: e7a01b5a16b8cd1da9349cbb8d1a2f1ea773c4335194607852a57762b4a9a1db
Instruction Fuzzy Hash: 85D012706017228B8E34DE29A00059AB7FCAB46610300092FE456C3750D761E9048785

Function 074916C0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69e137b82c7187caf211a5928eb0c753be98897284e086fd7751c75e81aaa3ff
Instruction ID: 129a3a0bea3172a9b06bc429b67c7a0d92a13b47588f1ccad3dec573a7f327b6
Opcode Fuzzy Hash: 69e137b82c7187caf211a5928eb0c753be98897284e086fd7751c75e81aaa3ff
Instruction Fuzzy Hash: 2CD02272208126A7DB09B2F9E0107EE3B9A8F85210F000477D20CC728ACE8DCC4243E7

Function 07491C70 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0471456ba3f1421663e4b28ed88d0266a2bb94d23c7778e9bf1d4fe7c8c0503a
Instruction ID: 56b4f90ecbced108458949e487340cdaa277c2f071cf170eef73110f2383420b
Opcode Fuzzy Hash: 0471456ba3f1421663e4b28ed88d0266a2bb94d23c7778e9bf1d4fe7c8c0503a
Instruction Fuzzy Hash: 98D0123314410D9E5F80EA95E840C927BDDAB546007408473E504C6220E721E564E751

Function 07491B12 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8130c6055c375fb3687a75e6aa6a9cbbb8e049f0db4f31331f89e7bd260ca1d
Instruction ID: 495e49077759a481a2d183e3f7d70039e6fa40a43dc55536167fd78d22fdfcdb
Opcode Fuzzy Hash: e8130c6055c375fb3687a75e6aa6a9cbbb8e049f0db4f31331f89e7bd260ca1d
Instruction Fuzzy Hash: 6DC08C3333042642EA08629CE2207FE7B8B4B88220F64002BD01CD3684CE94CD9302CA

Function 07491B18 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7874d6b9c41f95d9d4f1170b0ad2f4870eec92a827f07a6bf1dc7ed97d9503a4
Instruction ID: dacbeb9bc56dafa653c28b17ec85ca8675b706e06d99e454461c81dde7cb8849
Opcode Fuzzy Hash: 7874d6b9c41f95d9d4f1170b0ad2f4870eec92a827f07a6bf1dc7ed97d9503a4
Instruction Fuzzy Hash: 08B09B2232423913DA1C319D64206FE768E47C5564F50007B951D877415DC59C4202DB

Function 074916D0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f518ab3c50e1fba40e3b9f94d97ced496102f196fc9e19d8d87bcb391ea9246
Instruction ID: 8c1fb1b6ef8fae388e490a52fb25fd64745d5d39c7b7736a912a57652f48aa77
Opcode Fuzzy Hash: 1f518ab3c50e1fba40e3b9f94d97ced496102f196fc9e19d8d87bcb391ea9246
Instruction Fuzzy Hash: 48B09B6131413513DE0C719D64106FE768E4BC5564F00007BD51D877419DD59C4142DB

Function 07490253 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b6d240e0d3f034cb142f2d9c912a1a43cc73d48384aa960d61b79e86f34d872
Instruction ID: 052bf9d781b1c69a85f7172291e211ffdb9426f3b6217af1636c21ca6009cc7b
Opcode Fuzzy Hash: 8b6d240e0d3f034cb142f2d9c912a1a43cc73d48384aa960d61b79e86f34d872
Instruction Fuzzy Hash: 16D0C9B084421BCFEF758F80C8197EEBF70BB05315F10442AD401A61A4CBBD0946CF50

Function 074908E0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02ca1b08d05391dd0723763f29aa1bbcc4413b0d7a8da007dfd57cf5687ec529
Instruction ID: 514972420231231c63ece3e2f8a11e1c2fe494130def0f4e8450e891be6aa4de
Opcode Fuzzy Hash: 02ca1b08d05391dd0723763f29aa1bbcc4413b0d7a8da007dfd57cf5687ec529
Instruction Fuzzy Hash: 1FB09283C1F28116EB4222328C0B6581FA1AEA224171ED0A342558155BEA18854A8A06

Function 0749034F Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4514673446.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7490000_sgxIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22b0f6b022cbc63e95422638e0f47f42afcb3c444b0bbe9de5bde40beaf47cd4
Instruction ID: 79295edd70c7a308a25c8aa01b14ad64f90c2aa7830af9489360cb8633f15d40
Opcode Fuzzy Hash: 22b0f6b022cbc63e95422638e0f47f42afcb3c444b0bbe9de5bde40beaf47cd4
Instruction Fuzzy Hash: 06C048B04016008ACF18AF28A1482903AA0AB98329B30428DD0288A2D2C376CA83DAD2

Non-executed Functions

Function 06DB77B8 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$]q, xrefs: 06DB7D04
$]q, xrefs: 06DB7C71
$]q, xrefs: 06DB78E5
$]q, xrefs: 06DB7C65
$]q, xrefs: 06DB7D10
$]q, xrefs: 06DB7D1A
$]q, xrefs: 06DB78B4
$]q, xrefs: 06DB78A8
$]q, xrefs: 06DB7D26
$]q, xrefs: 06DB78D9

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2843079600
Opcode ID: 1fc54fb9074a4693a3bb8ca0032c8f8e7d410bacbdf5abaa978cf66d4a20c898
Instruction ID: fea57ce30df1ad08aeaca025886cf63a3cdfc5473496b023b070576a53bc073c
Opcode Fuzzy Hash: 1fc54fb9074a4693a3bb8ca0032c8f8e7d410bacbdf5abaa978cf66d4a20c898
Instruction Fuzzy Hash: DC123C30E00219CFDB68DF69D994A9DB7B2FFC8304F209969D40AAB258DB349D41CF90

Function 06DBAA50 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$]q, xrefs: 06DBABD8
$]q, xrefs: 06DBABAD
$]q, xrefs: 06DBAB52
$]q, xrefs: 06DBAC0E
$]q, xrefs: 06DBABA1
$]q, xrefs: 06DBABCC
$]q, xrefs: 06DBAC02
$]q, xrefs: 06DBAB46

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 9ce5847375b2e7894a7dc300d80faeecd52b5bd914113d1a3c0fc74193606d60
Instruction ID: bb4ea79ad770dd87dba0a57047ba0970d86880bebb628155c81ea0ed49492881
Opcode Fuzzy Hash: 9ce5847375b2e7894a7dc300d80faeecd52b5bd914113d1a3c0fc74193606d60
Instruction Fuzzy Hash: 9B919234A00209DFDB68DF69D594BAE77F6FF84304F189529E842A7298DB38DC45CB90

Function 06DB71B8 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$]q, xrefs: 06DB749A
$]q, xrefs: 06DB7654
$]q, xrefs: 06DB74F4
$]q, xrefs: 06DB76CC
.5uq, xrefs: 06DB7213
$]q, xrefs: 06DB7500
$]q, xrefs: 06DB76C0

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID: .5uq$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-981061697
Opcode ID: 9bbe58de30192ba85e411eea81e4d954de0a0412169a00f7cf8c47eda6288d35
Instruction ID: 3ce3738892fb8cb04604a8bcd12a505dd216804f4a37d22405104873d77d97ad
Opcode Fuzzy Hash: 9bbe58de30192ba85e411eea81e4d954de0a0412169a00f7cf8c47eda6288d35
Instruction Fuzzy Hash: 29F11B34B00209CFDB59DF68D554AAEB7B6FFC4704F248568D406AB3A8DB799C42CB81

Function 06DBBB30 Relevance: 7.7, Strings: 6, Instructions: 197COMMON

Download Yara Rule

Strings

$]q, xrefs: 06DBBCC9
$]q, xrefs: 06DBBD3D
$]q, xrefs: 06DBBD31
$]q, xrefs: 06DBBCFD
$]q, xrefs: 06DBBD09
$]q, xrefs: 06DBBCD5

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 72a8fc31b9234b8593d62006ea0adb048514c65e171d0241ede69be59e041e87
Instruction ID: 71f02976deb2c3fa24d91e9f8690657991e844d72abadadeca4dd26f6246fdf3
Opcode Fuzzy Hash: 72a8fc31b9234b8593d62006ea0adb048514c65e171d0241ede69be59e041e87
Instruction Fuzzy Hash: A9719C30A00219CFDB68CF69E9506AEB7F6FF84304B10952AD4479B258DF79ED46CB81

Function 06DB84F0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$]q, xrefs: 06DB87BB
$]q, xrefs: 06DB8756
$]q, xrefs: 06DB874A
$]q, xrefs: 06DB87AF

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: d0533016afa0c30cd639ae6a737b8a9aaa9abefa8d5cae296b74b4716e497a31
Instruction ID: 12ee4a86d5a7a26fe688c384befa4b7c7c4a74051710804ae3814c974ca152b9
Opcode Fuzzy Hash: d0533016afa0c30cd639ae6a737b8a9aaa9abefa8d5cae296b74b4716e497a31
Instruction Fuzzy Hash: 89B10934E00209CFDB58DFA9D5906AEB7B6FF84704F249929D406AB358DB75DC86CB80

Function 06DB8908 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LR]q, xrefs: 06DB89FB
$]q, xrefs: 06DB8993
$]q, xrefs: 06DB8987
LR]q, xrefs: 06DB8A4A

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q
API String ID: 0-3527005858
Opcode ID: 3133b935259a274542deafd60eee47f7d0ea0a67e25588149061182214a02897
Instruction ID: b021d6d4211dcd2e736c135414fd58f84d07bb089da3e27a01196c3be0917a8b
Opcode Fuzzy Hash: 3133b935259a274542deafd60eee47f7d0ea0a67e25588149061182214a02897
Instruction Fuzzy Hash: E6518130B00205DFDF58DF28D940AAAB7FAFF85704B149568E4079B3A9DA38EC41CB91

Function 06DBADD8 Relevance: 5.2, Strings: 4, Instructions: 159COMMON

Download Yara Rule

Strings

$]q, xrefs: 06DBAF09
$]q, xrefs: 06DBAFB4
$]q, xrefs: 06DBAF5C
$]q, xrefs: 06DBAF8B

Memory Dump Source

Source File: 00000008.00000002.4513106351.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6db0000_sgxIb.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 5f65bdb2f8c5b485c56d2e91255dddc347892108faa48160da650bef895b8623
Instruction ID: 2e8f00680634578a13f13024c46cbba086fae6dcef5fbb83fa82989192a043ed
Opcode Fuzzy Hash: 5f65bdb2f8c5b485c56d2e91255dddc347892108faa48160da650bef895b8623
Instruction Fuzzy Hash: 99517D34F10205CFDBA9DF68D5806EDB7B2EB89314F18952AE416EB258DB35DC42CB90

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Payslip_October_2024_pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Payslip_October_2024_pdf.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\sgxIb.exe.log

C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
Payslip_October_2024_pdf.exe

Function 06D19B0C Relevance: 1.8, APIs: 1, Instructions: 252
processCOMMON

Function 06D19B18 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 0274AF11 Relevance: 1.7, APIs: 1, Instructions: 214
COMMON

Function 0274590C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 027444D4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 06D19450 Relevance: 1.6, APIs: 1, Instructions: 75
injectionCOMMON

Function 0274D518 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Function 06D19458 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 06D19979 Relevance: 1.6, APIs: 1, Instructions: 69
COMMON

Function 06D192B9 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Function 0274B580 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre