Windows Analysis Report
Statement JULY #U007e SEP 2024 USD 19,055.00.exe

Overview

General Information

Sample name: Statement JULY #U007e SEP 2024 USD 19,055.00.exe
renamed because original name is a hash value
Original sample name: Statement JULY ~ SEP 2024 USD 19,055.00.exe
Analysis ID: 1545102
MD5: a528109e5486419098353578bd5e662a
SHA1: 597c6324eb2796a81f13d91cd12124734790210c
SHA256: c5210dcae2936ca5424a1224ddc519bded76064115a95e58c722b69e96ac344c
Tags: exeuser-koluke
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected AgentTesla
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
AI detected suspicious sample
Connects to many ports of the same IP (likely port scanning)
Contains functionality to log keystrokes (.Net Source)
Contains functionality to register a low level keyboard hook
Drops executable to a common third party application directory
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Creates processes with suspicious names
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Uses 32bit PE files
Uses FTP
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Agent Tesla, AgentTesla A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
 https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

AV Detection
barindex
Found malware configuration
Source: 7.2.adobe.exe.400000.0.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://s4.serv00.com", "Username": "f2241_dol", "Password": "Doll900#@"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe ReversingLabs: Detection: 57%
Multi AV Scanner detection for submitted file
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe ReversingLabs: Detection: 57%
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe Virustotal: Detection: 65% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.4:49735 -> 213.189.52.181:63514
Source: Network traffic Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.4:49742 -> 213.189.52.181:64246
Source: Network traffic Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.4:49748 -> 213.189.52.181:21
Source: Network traffic Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.4:49733 -> 213.189.52.181:21
Source: Network traffic Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.4:49749 -> 213.189.52.181:64747
Source: Network traffic Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.4:49739 -> 213.189.52.181:21
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 213.189.52.181 ports 64246,63514,64747,1,2,63829,21
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:49735 -> 213.189.52.181:63514
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 213.189.52.181 213.189.52.181
Source: Joe Sandbox View IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View IP Address: 172.67.74.152 172.67.74.152
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: ECO-ATMAN-PLECO-ATMAN-PL ECO-ATMAN-PLECO-ATMAN-PL
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
May check the online IP address of the machine
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Uses FTP
Source: unknown FTP traffic detected: 213.189.52.181:21 -> 192.168.2.4:49733 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 150 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 150 allowed.220-Local time is now 06:28. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 150 allowed.220-Local time is now 06:28. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 150 allowed.220-Local time is now 06:28. Server port: 21.220-This is a private system - No anonymous login220 You will be disconnected after 15 minutes of inactivity.
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: api.ipify.org
Source: global traffic DNS traffic detected: DNS query: s4.serv00.com
Source: adobe.exe, 00000005.00000002.1799930314.00000000011A7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://en.wkH
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe, 00000003.00000002.4106544369.000000000302C000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 00000007.00000002.1890171254.000000000321C000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 0000000A.00000002.4105974724.000000000345C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://s4.serv00.com
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe, 00000003.00000002.4106544369.0000000002FB1000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 00000007.00000002.1890171254.00000000031A1000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 0000000A.00000002.4105974724.00000000033EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: adobe.exe, 00000005.00000002.1801839278.0000000007592000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe, 00000000.00000002.1658281450.0000000006C32000.00000004.00000800.00020000.00000000.sdmp, Statement JULY #U007e SEP 2024 USD 19,055.00.exe, 00000000.00000002.1654989039.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp, Statement JULY #U007e SEP 2024 USD 19,055.00.exe, 00000000.00000002.1658168989.0000000005B3B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe, 00000000.00000002.1654989039.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com~
Source: adobe.exe, 00000009.00000002.1892432130.0000000006F62000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 00000009.00000002.1889045993.0000000001357000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: adobe.exe, 00000009.00000002.1892432130.0000000006F62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe, 00000000.00000002.1655541150.00000000037C9000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 00000007.00000002.1886764234.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://account.dyn.com/
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe, 00000000.00000002.1655541150.00000000037C9000.00000004.00000800.00020000.00000000.sdmp, Statement JULY #U007e SEP 2024 USD 19,055.00.exe, 00000003.00000002.4106544369.0000000002FB1000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 00000007.00000002.1886764234.0000000000402000.00000040.00000400.00020000.00000000.sdmp, adobe.exe, 00000007.00000002.1890171254.00000000031A1000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 0000000A.00000002.4105974724.00000000033EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe, 00000003.00000002.4106544369.0000000002FB1000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 00000007.00000002.1890171254.00000000031A1000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 0000000A.00000002.4105974724.00000000033EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe, 00000003.00000002.4106544369.0000000002FB1000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 00000007.00000002.1890171254.00000000031A1000.00000004.00000800.00020000.00000000.sdmp, adobe.exe, 0000000A.00000002.4105974724.00000000033EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/t
Source: adobe.exe, 00000009.00000002.1892047750.0000000005E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.mic
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49747 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to log keystrokes (.Net Source)
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.3941c80.0.raw.unpack, JovGVW.cs .Net Code: _5PXjwm
Contains functionality to register a low level keyboard hook
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 10_2_06E29AE8 SetWindowsHookExA 0000000D,00000000,?,?,?,?,?,?,?,?,?,06E2A130,00000000,00000000 10_2_06E29AE8
Installs a global keyboard hook
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\adobe\adobe.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\adobe\adobe.exe Jump to behavior
Creates a window with clipboard capturing capabilities
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 7.2.adobe.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 7.2.adobe.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.3941c80.0.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.3941c80.0.unpack, type: UNPACKEDPE Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.384d5b0.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.384d5b0.2.raw.unpack, type: UNPACKEDPE Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.3941c80.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.3941c80.0.raw.unpack, type: UNPACKEDPE Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.380b580.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.380b580.1.raw.unpack, type: UNPACKEDPE Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Detected potential crypto function
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 0_2_0098DED4 0_2_0098DED4
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 0_2_04B90006 0_2_04B90006
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 0_2_04B90040 0_2_04B90040
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 3_2_015EB397 3_2_015EB397
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 3_2_015E4A90 3_2_015E4A90
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 3_2_015E3E78 3_2_015E3E78
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 3_2_015EEEA8 3_2_015EEEA8
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 3_2_015E41C0 3_2_015E41C0
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 3_2_06AE28A8 3_2_06AE28A8
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 3_2_06AE289A 3_2_06AE289A
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 3_2_06B4C0F8 3_2_06B4C0F8
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 3_2_06B43018 3_2_06B43018
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 3_2_06B46160 3_2_06B46160
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 3_2_06B45150 3_2_06B45150
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 3_2_06B4AD90 3_2_06B4AD90
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 3_2_06B478F8 3_2_06B478F8
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 3_2_06B47218 3_2_06B47218
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 3_2_06B4E328 3_2_06B4E328
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 3_2_06B42340 3_2_06B42340
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 3_2_06B40006 3_2_06B40006
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 3_2_06B40040 3_2_06B40040
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 3_2_06B4584F 3_2_06B4584F
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 5_2_0537DED4 5_2_0537DED4
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 5_2_05490040 5_2_05490040
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 5_2_05490006 5_2_05490006
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 7_2_02FF4A90 7_2_02FF4A90
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 7_2_02FF3E78 7_2_02FF3E78
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 7_2_02FFAE68 7_2_02FFAE68
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 7_2_02FF41C0 7_2_02FF41C0
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 7_2_06D62EA0 7_2_06D62EA0
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 7_2_06D66560 7_2_06D66560
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 7_2_06D6B1A8 7_2_06D6B1A8
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 7_2_06D67618 7_2_06D67618
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 7_2_06D65C60 7_2_06D65C60
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 7_2_06D60040 7_2_06D60040
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 7_2_06D6003F 7_2_06D6003F
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 9_2_02C0DED4 9_2_02C0DED4
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 10_2_031EA5D0 10_2_031EA5D0
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 10_2_031E4A90 10_2_031E4A90
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 10_2_031EE8A8 10_2_031EE8A8
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 10_2_031E3E78 10_2_031E3E78
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 10_2_031EADA8 10_2_031EADA8
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 10_2_031E41C0 10_2_031E41C0
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 10_2_06E21734 10_2_06E21734
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 10_2_06E22463 10_2_06E22463
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 10_2_06E22468 10_2_06E22468
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 10_2_06E2EF60 10_2_06E2EF60
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 10_2_06E2315E 10_2_06E2315E
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 10_2_06E32750 10_2_06E32750
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 10_2_06E36560 10_2_06E36560
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 10_2_06E35550 10_2_06E35550
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 10_2_06E3C0F8 10_2_06E3C0F8
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 10_2_06E3B1A8 10_2_06E3B1A8
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 10_2_06E37CF8 10_2_06E37CF8
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 10_2_06E37618 10_2_06E37618
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 10_2_06E3E328 10_2_06E3E328
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 10_2_06E30040 10_2_06E30040
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 10_2_06E35C60 10_2_06E35C60
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 10_2_06E3001F 10_2_06E3001F
Sample file is different than original file name gathered from version info
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe, 00000000.00000002.1655541150.00000000037C9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSoftwareGame.dll: vs Statement JULY #U007e SEP 2024 USD 19,055.00.exe
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe, 00000000.00000002.1655541150.00000000037C9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamea9d26a1c-7dc5-441c-98a8-6dd01f6d79df.exe4 vs Statement JULY #U007e SEP 2024 USD 19,055.00.exe
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe, 00000000.00000002.1655463889.00000000027C1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamea9d26a1c-7dc5-441c-98a8-6dd01f6d79df.exe4 vs Statement JULY #U007e SEP 2024 USD 19,055.00.exe
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe, 00000000.00000000.1650426459.0000000000316000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameJanioa.exe. vs Statement JULY #U007e SEP 2024 USD 19,055.00.exe
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe, 00000000.00000002.1654648982.00000000009BE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Statement JULY #U007e SEP 2024 USD 19,055.00.exe
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe, 00000003.00000002.4104071985.00000000010F9000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Statement JULY #U007e SEP 2024 USD 19,055.00.exe
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe Binary or memory string: OriginalFilenameJanioa.exe. vs Statement JULY #U007e SEP 2024 USD 19,055.00.exe
Uses 32bit PE files
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 7.2.adobe.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 7.2.adobe.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.3941c80.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.3941c80.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.384d5b0.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.384d5b0.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.3941c80.0.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.3941c80.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.380b580.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.380b580.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: adobe.exe.3.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.4da0000.3.raw.unpack, Form1.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.4da0000.3.raw.unpack, Form1.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.380b580.1.raw.unpack, Form1.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.380b580.1.raw.unpack, Form1.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.384d5b0.2.raw.unpack, Form1.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.384d5b0.2.raw.unpack, Form1.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.3941c80.0.raw.unpack, yNzg.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.3941c80.0.raw.unpack, yNzg.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.3941c80.0.raw.unpack, yNzg.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.3941c80.0.raw.unpack, yNzg.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.3941c80.0.raw.unpack, KNymkUU5gB.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.3941c80.0.raw.unpack, KNymkUU5gB.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@15/2@2/2
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe File created: C:\Users\user\AppData\Roaming\adobe\adobe.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Mutant created: NULL
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe ReversingLabs: Detection: 57%
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe Virustotal: Detection: 65%
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe File read: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe "C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe"
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process created: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe "C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe"
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process created: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe "C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe"
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process created: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe "C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\Adobe\adobe.exe "C:\Users\user\AppData\Roaming\adobe\adobe.exe"
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process created: C:\Users\user\AppData\Roaming\Adobe\adobe.exe "C:\Users\user\AppData\Roaming\adobe\adobe.exe"
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process created: C:\Users\user\AppData\Roaming\Adobe\adobe.exe "C:\Users\user\AppData\Roaming\adobe\adobe.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\Adobe\adobe.exe "C:\Users\user\AppData\Roaming\adobe\adobe.exe"
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process created: C:\Users\user\AppData\Roaming\Adobe\adobe.exe "C:\Users\user\AppData\Roaming\adobe\adobe.exe"
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process created: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe "C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe" Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process created: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe "C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe" Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process created: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe "C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process created: C:\Users\user\AppData\Roaming\Adobe\adobe.exe "C:\Users\user\AppData\Roaming\adobe\adobe.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process created: C:\Users\user\AppData\Roaming\Adobe\adobe.exe "C:\Users\user\AppData\Roaming\adobe\adobe.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process created: C:\Users\user\AppData\Roaming\Adobe\adobe.exe "C:\Users\user\AppData\Roaming\adobe\adobe.exe" Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles Jump to behavior
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe, EvenMoreWhimsicalFunctions.cs .Net Code: Polan System.AppDomain.Load(byte[])
Source: adobe.exe.3.dr, EvenMoreWhimsicalFunctions.cs .Net Code: Polan System.AppDomain.Load(byte[])
Binary contains a suspicious time stamp
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe Static PE information: 0xEBF8C820 [Wed Jun 15 04:18:40 2095 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 0_2_0098E72A push esp; retf 0_2_0098E731
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 0_2_0098EEDA push eax; iretd 0_2_0098EEE1
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 0_2_04B96CD0 push eax; ret 0_2_04B96CF9
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 3_2_06AE9F31 pushfd ; iretd 3_2_06AE9F32
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 3_2_06AEBAB0 push es; ret 3_2_06AEBAC0
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Code function: 3_2_06AE7952 push es; ret 3_2_06AE7960
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 5_2_0537E72A push esp; retf 5_2_0537E731
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 5_2_0537EEDA push eax; iretd 5_2_0537EEE1
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 5_2_05496CD0 push eax; ret 5_2_05496CF9
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 7_2_06D67FE3 push ebp; ret 7_2_06D67FEA
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 7_2_06D65741 push 1405C32Fh; ret 7_2_06D65855
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 7_2_06D67CF8 push esi; ret 7_2_06D67FE2
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 7_2_06D67CE9 push edx; ret 7_2_06D67CEA
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 7_2_06D6E312 push ss; iretd 7_2_06D6E31A
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 7_2_06D641B3 push ss; ret 7_2_06D641BA
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 7_2_06D641B1 push ss; ret 7_2_06D641B2
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 9_2_02C047B1 push ebp; ret 9_2_02C04815
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 9_2_02C0E72A push esp; retf 9_2_02C0E731
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 9_2_02C0EEDA push eax; iretd 9_2_02C0EEE1
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Code function: 10_2_031E0C55 push edi; retf 10_2_031E0C7A
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe Static PE information: section name: .text entropy: 7.447223065937859
Source: adobe.exe.3.dr Static PE information: section name: .text entropy: 7.447223065937859
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.4da0000.3.raw.unpack, Form1.cs High entropy of concatenated method names: 'oxycobaltammine', 'fringier', 'unchorded', 'wAhRr7CKv', 'Dispose', 'lVOGV1721', 'ULHqFVpPeqZbNsBNpV', 'TchE2TMnA4CKf52ZUf', 'f0mq9hQrUpsqOwSyGd', 'nTd0Zl0tx6BYOWEqZW'
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.4da0000.3.raw.unpack, QJDLGErGwGLnDsDTGnUfx.cs High entropy of concatenated method names: 'pwiMsJJwOLAUrsrsiLrJk', 'vkJkyBAyMrJJZpZnJUUsB', 'pBDTEixOwwhDhOiywipLh', 'wZnEyxixGJZZTGvwQsrMDAvGiTwBJLT', 'erhT', 'aerhTteS46w', 'LvfQyBLvviAnvZJBUkfipTGCDTvQDxU', 'F6WFViyxW', 'TE3wDwuNS', 'MyGetProcAddressWrapper'
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.380b580.1.raw.unpack, Form1.cs High entropy of concatenated method names: 'oxycobaltammine', 'fringier', 'unchorded', 'wAhRr7CKv', 'Dispose', 'lVOGV1721', 'ULHqFVpPeqZbNsBNpV', 'TchE2TMnA4CKf52ZUf', 'f0mq9hQrUpsqOwSyGd', 'nTd0Zl0tx6BYOWEqZW'
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.380b580.1.raw.unpack, QJDLGErGwGLnDsDTGnUfx.cs High entropy of concatenated method names: 'pwiMsJJwOLAUrsrsiLrJk', 'vkJkyBAyMrJJZpZnJUUsB', 'pBDTEixOwwhDhOiywipLh', 'wZnEyxixGJZZTGvwQsrMDAvGiTwBJLT', 'erhT', 'aerhTteS46w', 'LvfQyBLvviAnvZJBUkfipTGCDTvQDxU', 'F6WFViyxW', 'TE3wDwuNS', 'MyGetProcAddressWrapper'
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.384d5b0.2.raw.unpack, Form1.cs High entropy of concatenated method names: 'oxycobaltammine', 'fringier', 'unchorded', 'wAhRr7CKv', 'Dispose', 'lVOGV1721', 'ULHqFVpPeqZbNsBNpV', 'TchE2TMnA4CKf52ZUf', 'f0mq9hQrUpsqOwSyGd', 'nTd0Zl0tx6BYOWEqZW'
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.384d5b0.2.raw.unpack, QJDLGErGwGLnDsDTGnUfx.cs High entropy of concatenated method names: 'pwiMsJJwOLAUrsrsiLrJk', 'vkJkyBAyMrJJZpZnJUUsB', 'pBDTEixOwwhDhOiywipLh', 'wZnEyxixGJZZTGvwQsrMDAvGiTwBJLT', 'erhT', 'aerhTteS46w', 'LvfQyBLvviAnvZJBUkfipTGCDTvQDxU', 'F6WFViyxW', 'TE3wDwuNS', 'MyGetProcAddressWrapper'

Persistence and Installation Behavior
barindex
Drops executable to a common third party application directory
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe File written: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Jump to behavior
Creates processes with suspicious names
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe File created: \statement july #u007e sep 2024 usd 19,055.00.exe
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe File created: \statement july #u007e sep 2024 usd 19,055.00.exe
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe File created: \statement july #u007e sep 2024 usd 19,055.00.exe
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe File created: \statement july #u007e sep 2024 usd 19,055.00.exe Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe File created: \statement july #u007e sep 2024 usd 19,055.00.exe Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe File created: \statement july #u007e sep 2024 usd 19,055.00.exe Jump to behavior
Drops PE files
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe File created: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Jump to dropped file
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run adobe Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run adobe Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe File opened: C:\Users\user\AppData\Roaming\adobe\adobe.exe:Zone.Identifier read attributes | delete Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Memory allocated: 980000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Memory allocated: 27C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Memory allocated: CB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Memory allocated: 15E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Memory allocated: 2FB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Memory allocated: 4FB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Memory allocated: 2C10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Memory allocated: 2E70000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Memory allocated: 4E70000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Memory allocated: 1600000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Memory allocated: 31A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Memory allocated: 3030000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Memory allocated: 1260000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Memory allocated: 2CC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Memory allocated: 12B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Memory allocated: 31A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Memory allocated: 33E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Memory allocated: 3210000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 599890 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 599781 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 599671 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 599562 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 599453 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 599343 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 599234 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 599125 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 599015 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 598900 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 598796 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 598687 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 598582 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 598453 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 598343 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 598233 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 598125 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 598015 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 597906 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 597797 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 597687 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 597577 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 597468 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 597359 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 597250 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 597140 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 597031 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 596922 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 596812 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 596703 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 596588 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 596480 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 596373 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 596248 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 596134 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 596031 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 595922 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 595812 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 595703 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 595593 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 595484 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 595375 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 595265 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 595149 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 595047 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 594922 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 594812 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 594703 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 594592 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599890 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599764 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599650 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599546 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599433 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599309 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599168 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599061 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598952 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598842 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598734 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598624 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598515 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598406 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598296 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598187 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598075 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597968 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597859 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597749 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597640 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597531 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597421 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597309 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597202 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597093 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596983 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596874 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596201 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596093 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595984 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595862 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595749 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595634 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595530 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595421 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595312 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595202 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595093 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594984 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594874 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594765 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594656 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594546 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594437 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594328 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594218 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594109 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 593999 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 593852 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599890 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599781 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599671 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599562 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599453 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599343 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599234 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599124 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599015 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598906 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598796 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598687 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598578 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598468 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598359 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598249 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598139 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598031 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597921 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597801 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597672 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597555 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597445 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597336 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597199 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597093 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596984 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596875 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596765 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596656 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596546 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596437 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596328 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596218 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596109 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595890 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595781 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595671 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595562 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595453 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595343 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595234 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595119 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594858 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594727 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594591 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594436 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594322 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594203 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594093 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 593984 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Window / User API: threadDelayed 1999 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Window / User API: threadDelayed 7849 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Window / User API: threadDelayed 6119 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Window / User API: threadDelayed 3721 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Window / User API: threadDelayed 3458 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Window / User API: threadDelayed 6382 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep count: 34 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -31359464925306218s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7772 Thread sleep count: 1999 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -599890s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7772 Thread sleep count: 7849 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -599781s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -599671s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -599562s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -599453s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -599343s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -599234s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -599125s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -599015s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -598900s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -598796s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -598687s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -598582s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -598453s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -598343s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -598233s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -598125s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -598015s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -597906s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -597797s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -597687s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -597577s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -597468s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -597359s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -597250s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -597140s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -597031s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -596922s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -596812s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -596703s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -596588s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -596480s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -596373s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -596248s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -596134s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -596031s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -595922s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -595812s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -595703s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -595593s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -595484s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -595375s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -595265s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -595149s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -595047s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -594922s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -594812s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -594703s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe TID: 7764 Thread sleep time: -594592s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep count: 41 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -37815825351104557s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8088 Thread sleep count: 6119 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -599890s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -599764s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -599650s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8088 Thread sleep count: 3721 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -599546s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -599433s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -599309s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -599168s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -599061s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -598952s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -598842s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -598734s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -598624s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -598515s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -598406s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -598296s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -598187s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -598075s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -597968s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -597859s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -597749s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -597640s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -597531s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -597421s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -597309s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -597202s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -597093s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -596983s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -596874s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -596201s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -596093s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -595984s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -595862s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -595749s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -595634s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -595530s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -595421s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -595312s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -595202s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -595093s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -594984s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -594874s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -594765s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -594656s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -594546s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -594437s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -594328s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -594218s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -594109s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -593999s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 8084 Thread sleep time: -593852s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep count: 35 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -32281802128991695s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 2568 Thread sleep count: 3458 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -599890s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -599781s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 2568 Thread sleep count: 6382 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -599671s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -599562s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -599453s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -599343s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -599234s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -599124s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -599015s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -598906s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -598796s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -598687s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -598578s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -598468s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -598359s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -598249s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -598139s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -598031s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -597921s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -597801s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -597672s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -597555s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -597445s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -597336s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -597199s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -597093s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -596984s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -596875s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -596765s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -596656s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -596546s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -596437s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -596328s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -596218s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -596109s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -596000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -595890s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -595781s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -595671s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -595562s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -595453s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -595343s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -595234s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -595119s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -595000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -594858s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -594727s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -594591s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -594436s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -594322s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -594203s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -594093s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe TID: 1904 Thread sleep time: -593984s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 599890 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 599781 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 599671 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 599562 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 599453 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 599343 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 599234 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 599125 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 599015 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 598900 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 598796 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 598687 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 598582 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 598453 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 598343 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 598233 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 598125 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 598015 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 597906 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 597797 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 597687 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 597577 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 597468 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 597359 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 597250 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 597140 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 597031 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 596922 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 596812 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 596703 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 596588 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 596480 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 596373 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 596248 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 596134 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 596031 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 595922 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 595812 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 595703 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 595593 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 595484 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 595375 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 595265 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 595149 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 595047 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 594922 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 594812 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 594703 Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Thread delayed: delay time: 594592 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599890 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599764 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599650 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599546 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599433 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599309 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599168 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599061 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598952 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598842 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598734 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598624 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598515 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598406 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598296 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598187 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598075 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597968 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597859 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597749 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597640 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597531 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597421 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597309 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597202 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597093 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596983 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596874 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596201 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596093 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595984 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595862 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595749 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595634 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595530 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595421 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595312 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595202 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595093 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594984 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594874 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594765 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594656 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594546 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594437 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594328 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594218 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594109 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 593999 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 593852 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599890 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599781 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599671 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599562 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599453 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599343 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599234 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599124 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 599015 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598906 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598796 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598687 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598578 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598468 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598359 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598249 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598139 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 598031 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597921 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597801 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597672 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597555 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597445 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597336 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597199 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 597093 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596984 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596875 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596765 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596656 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596546 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596437 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596328 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596218 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596109 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 596000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595890 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595781 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595671 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595562 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595453 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595343 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595234 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595119 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 595000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594858 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594727 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594591 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594436 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594322 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594203 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 594093 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Thread delayed: delay time: 593984 Jump to behavior
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe, 00000003.00000002.4104320850.0000000001404000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllW
Source: adobe.exe, 00000007.00000002.1888089380.000000000138D000.00000004.00000020.00020000.00000000.sdmp, adobe.exe, 0000000A.00000002.4104072984.000000000143F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe, ProcessorArchitecture.cs Reference to suspicious API methods: Microsoft.Build.Shared.NativeMethods.LoadLibrary("kernel32.dll")
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe, ProcessorArchitecture.cs Reference to suspicious API methods: Microsoft.Build.Shared.NativeMethods.GetProcAddress(intPtr, "IsWow64Process")
Source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.3941c80.0.raw.unpack, WzE.cs Reference to suspicious API methods: GXmc.OpenProcess(jHxuhfTis5.DuplicateHandle, bInheritHandle: true, (uint)bTRx6NbOE.ProcessID)
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Memory written: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Memory written: C:\Users\user\AppData\Roaming\Adobe\adobe.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process created: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe "C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe" Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process created: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe "C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe" Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Process created: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe "C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process created: C:\Users\user\AppData\Roaming\Adobe\adobe.exe "C:\Users\user\AppData\Roaming\adobe\adobe.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process created: C:\Users\user\AppData\Roaming\Adobe\adobe.exe "C:\Users\user\AppData\Roaming\adobe\adobe.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Process created: C:\Users\user\AppData\Roaming\Adobe\adobe.exe "C:\Users\user\AppData\Roaming\adobe\adobe.exe" Jump to behavior
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe, 00000003.00000002.4106544369.0000000003032000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: $^q9<b>[ Program Manager]</b> (30/10/2024 05:48:01)<br>{Win}rTHcqX
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe, 00000003.00000002.4106544369.0000000003032000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Manager
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe, 00000003.00000002.4106544369.0000000003032000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: $^q8<b>[ Program Manager]</b> (30/10/2024 05:48:01)<br>{Win}THcqX
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe, 00000003.00000002.4106544369.0000000003032000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program ManagerLR^q
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe, 00000003.00000002.4106544369.0000000003032000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: $^q><b>[ Program Manager]</b> (30/10/2024 05:48:01)<br>{Win}r{Win}THcqX
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe, 00000003.00000002.4106544369.0000000003032000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: $^q3<b>[ Program Manager]</b> (30/10/2024 05:48:01)<br>
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe, 00000003.00000002.4106544369.0000000003046000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: <html>Time: 11/12/2024 22:03:39<br>User Name: user<br>Computer Name: 675052<br>OSFullName: Microsoft Windows 10 Pro<br>CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz<br>RAM: 8191.25 MB<br>IP Address: 173.254.250.78<br><hr><b>[ Program Manager]</b> (30/10/2024 05:48:01)<br>{Win}r{Win}r</html>
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe, 00000003.00000002.4106544369.0000000003032000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program ManagerLR^qT
Source: Statement JULY #U007e SEP 2024 USD 19,055.00.exe, 00000003.00000002.4106544369.0000000003032000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: $^q?<b>[ Program Manager]</b> (30/10/2024 05:48:01)<br>{Win}r{Win}rTHcqX
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Queries volume information: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Queries volume information: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Users\user\AppData\Roaming\Adobe\adobe.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Users\user\AppData\Roaming\Adobe\adobe.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Users\user\AppData\Roaming\Adobe\adobe.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Users\user\AppData\Roaming\Adobe\adobe.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 7.2.adobe.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.3941c80.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.384d5b0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.3941c80.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.380b580.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.4106544369.000000000302C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1890171254.000000000321C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.4105974724.000000000345C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1886764234.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1890171254.00000000031F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.4106544369.0000000003001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.4105974724.0000000003431000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1655541150.00000000037C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Statement JULY #U007e SEP 2024 USD 19,055.00.exe PID: 7524, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Statement JULY #U007e SEP 2024 USD 19,055.00.exe PID: 7568, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: adobe.exe PID: 7968, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: adobe.exe PID: 7320, type: MEMORYSTR
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe File opened: C:\FTP Navigator\Ftplist.txt Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Users\user\Desktop\Statement JULY #U007e SEP 2024 USD 19,055.00.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\adobe.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 7.2.adobe.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.3941c80.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.384d5b0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.3941c80.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.380b580.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.1886764234.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1890171254.00000000031F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.4106544369.0000000003001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.4105974724.0000000003431000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1655541150.00000000037C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Statement JULY #U007e SEP 2024 USD 19,055.00.exe PID: 7524, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Statement JULY #U007e SEP 2024 USD 19,055.00.exe PID: 7568, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: adobe.exe PID: 7968, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: adobe.exe PID: 7320, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 7.2.adobe.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.3941c80.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.384d5b0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.3941c80.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Statement JULY #U007e SEP 2024 USD 19,055.00.exe.380b580.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.4106544369.000000000302C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1890171254.000000000321C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.4105974724.000000000345C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1886764234.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1890171254.00000000031F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.4106544369.0000000003001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.4105974724.0000000003431000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1655541150.00000000037C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Statement JULY #U007e SEP 2024 USD 19,055.00.exe PID: 7524, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Statement JULY #U007e SEP 2024 USD 19,055.00.exe PID: 7568, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: adobe.exe PID: 7968, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: adobe.exe PID: 7320, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1545102 Sample: Statement JULY #U007e SEP 2... Startdate: 30/10/2024 Architecture: WINDOWS Score: 100 33 s4.serv00.com 2->33 35 api.ipify.org 2->35 55 Suricata IDS alerts for network traffic 2->55 57 Found malware configuration 2->57 59 Malicious sample detected (through community Yara rule) 2->59 61 9 other signatures 2->61 7 Statement JULY #U007e SEP 2024 USD 19,055.00.exe 2 2->7         started        10 adobe.exe 2 2->10         started        12 adobe.exe 2 2->12         started        signatures3 process4 signatures5 63 Injects a PE file into a foreign processes 7->63 14 Statement JULY #U007e SEP 2024 USD 19,055.00.exe 16 4 7->14         started        19 Statement JULY #U007e SEP 2024 USD 19,055.00.exe 7->19         started        21 Statement JULY #U007e SEP 2024 USD 19,055.00.exe 7->21         started        65 Multi AV Scanner detection for dropped file 10->65 67 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 10->67 69 Machine Learning detection for dropped file 10->69 71 Contains functionality to register a low level keyboard hook 10->71 23 adobe.exe 14 2 10->23         started        25 adobe.exe 10->25         started        27 adobe.exe 2 12->27         started        process6 dnsIp7 37 s4.serv00.com 213.189.52.181, 21, 49733, 49735 ECO-ATMAN-PLECO-ATMAN-PL Poland 14->37 39 api.ipify.org 172.67.74.152, 443, 49730, 49738 CLOUDFLARENETUS United States 14->39 29 C:\Users\user\AppData\Roaming\...\adobe.exe, PE32 14->29 dropped 31 C:\Users\user\...\adobe.exe:Zone.Identifier, ASCII 14->31 dropped 41 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->41 43 Tries to steal Mail credentials (via file / registry access) 14->43 45 Drops executable to a common third party application directory 14->45 47 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->47 49 Tries to harvest and steal ftp login credentials 27->49 51 Tries to harvest and steal browser information (history, passwords, etc) 27->51 53 Installs a global keyboard hook 27->53 file8 signatures9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
213.189.52.181
 s4.serv00.com Poland
57367 ECO-ATMAN-PLECO-ATMAN-PL true
172.67.74.152
 api.ipify.org United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
api.ipify.org 172.67.74.152 true
s4.serv00.com 213.189.52.181 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://api.ipify.org/ false
  • URL Reputation: safe
 unknown